chore(release): v0.6.0

Co-authored-by: Jacob MacDonald <jakemac@google.com>

.github/CODEOWNERS

@@ -4,10 +4,10 @@
 # Require reviews from the release approvers for critical files.
 # These patterns override the rule above.
 /package.json @google-gemini/gemini-cli-askmode-approvers
-/npm-shrinkwrap.json @google-gemini/gemini-cli-askmode-approvers
+/package-lock.json @google-gemini/gemini-cli-askmode-approvers
 /GEMINI.md @google-gemini/gemini-cli-askmode-approvers
 /SECURITY.md @google-gemini/gemini-cli-askmode-approvers
 /LICENSE @google-gemini/gemini-cli-askmode-approvers
 /.github/workflows/ @google-gemini/gemini-cli-askmode-approvers
 /packages/cli/package.json @google-gemini/gemini-cli-askmode-approvers
-/packages/core/package.json @google-gemini/gemini-cli-askmode-approvers
+/packages/core/package.json @google-gemini/gemini-cli-askmode-approvers

.github/actions/create-pull-request/action.yml

@@ -0,0 +1,55 @@
+name: 'Create and Merge Pull Request'
+description: 'Creates a pull request and merges it automatically.'
+
+inputs:
+  branch-name:
+    description: 'The name of the branch to create the PR from.'
+    required: true
+  pr-title:
+    description: 'The title of the pull request.'
+    required: true
+  pr-body:
+    description: 'The body of the pull request.'
+    required: true
+  base-branch:
+    description: 'The branch to merge into.'
+    required: true
+    default: 'main'
+  app-id:
+    description: 'The ID of the GitHub App.'
+    required: true
+  private-key:
+    description: 'The private key of the GitHub App.'
+    required: true
+  dry-run:
+    description: 'Whether to run in dry-run mode.'
+    required: false
+    default: 'false'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Generate GitHub App Token'
+      id: 'generate_token'
+      if: "inputs.dry-run == 'false'"
+      uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b'
+      with:
+        app-id: '${{ inputs.app-id }}'
+        private-key: '${{ inputs.private-key }}'
+        permission-pull-requests: 'write'
+        permission-contents: 'write'
+
+    - name: 'Create and Approve Pull Request'
+      if: "inputs.dry-run == 'false'"
+      env:
+        GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
+      shell: 'bash'
+      run: |
+        set -e
+        PR_URL=$(gh pr create \
+          --title "${{ inputs.pr-title }}" \
+          --body "${{ inputs.pr-body }}" \
+          --base "${{ inputs.base-branch }}" \
+          --head "${{ inputs.branch-name }}" \
+          --fill)
+        gh pr merge "$PR_URL" --auto --squash

.github/actions/publish-release/action.yml

@@ -27,10 +27,19 @@ inputs:
   previous-tag:
     description: 'The previous tag to use for generating release notes.'
     required: true
+  skip-github-release:
+    description: 'Whether to skip creating a GitHub release.'
+    type: 'boolean'
+    required: false
+    default: false
   working-directory:
     description: 'The working directory to run the steps in.'
     required: false
     default: '.'
+  force-skip-tests:
+    description: 'Skip tests and validation'
+    required: false
+    default: false
 
 runs:
   using: 'composite'
@@ -69,14 +78,8 @@ runs:
         BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
         DRY_RUN: '${{ inputs.dry-run }}'
         RELEASE_TAG: '${{ inputs.release-tag }}'
-      run: |
-        git add package.json packages/*/package.json
-        if [ -f npm-shrinkwrap.json ]; then
-          git add npm-shrinkwrap.json
-        fi
-        if [ -f package-lock.json ]; then
-          git add package-lock.json
-        fi
+      run: |-
+        git add package.json package-lock.json packages/*/package.json
         git commit -m "chore(release): ${RELEASE_TAG}"
         if [[ "${DRY_RUN}" == "false" ]]; then
           echo "Pushing release branch to remote..."
@@ -108,7 +111,7 @@ runs:
         npm publish \
           --dry-run="${{ inputs.dry-run }}" \
           --workspace="@google/gemini-cli-core" \
-          --tag="${{ inputs.npm-tag }}"
+          --no-tag
 
     - name: '🔗 Install latest core package'
       working-directory: '${{ inputs.working-directory }}'
@@ -128,7 +131,31 @@ runs:
         npm publish \
           --dry-run="${{ inputs.dry-run }}" \
           --workspace="@google/gemini-cli" \
-          --tag="${{ inputs.npm-tag }}"
+          --no-tag
+
+    - name: '🔬 Verify NPM release by version'
+      uses: './.github/actions/verify-release'
+      if: "${{ inputs.dry-run == 'false' && inputs.force-skip-tests == 'false' }}"
+      with:
+        npm-package: '@google/gemini-cli@${{ inputs.release-version }}'
+        expected-version: '${{ inputs.release-version }}'
+        ref: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
+
+    - name: '🏷️ Tag release'
+      uses: './.github/actions/tag-npm-release'
+      if: "${{ inputs.dry-run == 'false' }}"
+      with:
+        channel: '${{ inputs.npm-tag }}'
+        version: '${{ inputs.release-version }}'
+        dry-run: '${{ inputs.dry-run }}'
+        wombat-token-core: '${{ inputs.wombat-token-core }}'
+        wombat-token-cli: '${{ inputs.wombat-token-cli }}'
+
+    - name: 'Install deps'
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      run: |
+        npm install
 
     - name: '🎁 Bundle'
       working-directory: '${{ inputs.working-directory }}'
@@ -138,7 +165,7 @@ runs:
 
     - name: '🎉 Create GitHub Release'
       working-directory: '${{ inputs.working-directory }}'
-      if: "${{ inputs.dry-run == 'false' }}"
+      if: "${{ inputs.dry-run == 'false' && inputs.skip-github-release == 'false' && inputs.npm-tag != 'dev' }}"
       env:
         GITHUB_TOKEN: '${{ inputs.github-token }}'
       shell: 'bash'
@@ -149,3 +176,12 @@ runs:
           --title "Release ${{ inputs.release-tag }}" \
           --notes-start-tag "${{ inputs.previous-tag }}" \
           --generate-notes
+
+    - name: '🧹 Clean up release branch'
+      working-directory: '${{ inputs.working-directory }}'
+      if: "${{ inputs.dry-run == 'false' }}"
+      continue-on-error: true
+      shell: 'bash'
+      run: |
+        echo "Cleaning up release branch ${{ steps.release_branch.outputs.BRANCH_NAME }}..."
+        git push origin --delete "${{ steps.release_branch.outputs.BRANCH_NAME }}"

.github/actions/push-docker/action.yml

@@ -0,0 +1,73 @@
+name: 'Push to docker'
+description: 'Builds packages and pushes a docker image to GHCR'
+
+inputs:
+  github-actor:
+    description: 'Github actor'
+    required: true
+  github-secret:
+    description: 'Github secret'
+    required: true
+  ref-name:
+    description: 'Github ref name'
+    required: true
+  github-sha:
+    description: 'Github Commit SHA Hash'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Checkout'
+      uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
+      with:
+        ref: '${{ inputs.github-sha }}'
+        fetch-depth: 0
+    - name: 'Install Dependencies'
+      shell: 'bash'
+      run: 'npm install'
+    - name: 'Set up Docker Buildx'
+      uses: 'docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435' # ratchet:docker/setup-buildx-action@v3
+    - name: 'build'
+      shell: 'bash'
+      run: 'npm run build'
+    - name: 'pack @google/gemini-cli'
+      shell: 'bash'
+      run: 'npm pack -w @google/gemini-cli --pack-destination ./packages/cli/dist'
+    - name: 'pack @google/gemini-cli-core'
+      shell: 'bash'
+      run: 'npm pack -w @google/gemini-cli-core --pack-destination ./packages/core/dist'
+    - name: 'Log in to GitHub Container Registry'
+      uses: 'docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1' # ratchet:docker/login-action@v3
+      with:
+        registry: 'ghcr.io'
+        username: '${{ inputs.github-actor }}'
+        password: '${{ inputs.github-secret }}'
+    - name: 'Get branch name'
+      id: 'branch_name'
+      shell: 'bash'
+      run: |
+        REF_NAME="${{ inputs.ref-name }}"
+        echo "name=${REF_NAME%/merge}" >> $GITHUB_OUTPUT
+    - name: 'Build and Push the Docker Image'
+      uses: 'docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83' # ratchet:docker/build-push-action@v6
+      with:
+        context: '.'
+        file: './Dockerfile'
+        push: true
+        provenance: false # avoid pushing 3 images to Aritfact Registry
+        tags: |
+          ghcr.io/${{ github.repository }}/cli:${{ steps.branch_name.outputs.name }}
+          ghcr.io/${{ github.repository }}/cli:${{ inputs.github-sha }}
+    - name: 'Create issue on failure'
+      if: |-
+        ${{ failure() }}
+      shell: 'bash'
+      env:
+        GITHUB_TOKEN: '${{ inputs.github-secret }}'
+        DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+      run: |-
+        gh issue create \
+          --title "Docker build failed" \
+          --body "The docker build failed. See the full run for details: ${DETAILS_URL}" \
+          --label "kind/bug,release-failure"

.github/actions/push-sandbox/action.yaml

@@ -0,0 +1,85 @@
+name: 'Build and push sandbox docker'
+description: 'Pushes sandbox docker image to container registry'
+
+inputs:
+  github-actor:
+    description: 'Github actor'
+    required: true
+  github-secret:
+    description: 'Github secret'
+    required: true
+  github-sha:
+    description: 'Github Commit SHA Hash'
+    required: true
+  github-ref-name:
+    description: 'Github ref name'
+    required: true
+  dry-run:
+    description: 'Whether this is a dry run.'
+    required: true
+    type: 'boolean'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Checkout'
+      uses: 'actions/checkout@v4'
+      with:
+        ref: '${{ inputs.github-sha }}'
+        fetch-depth: 0
+    - name: 'Install Dependencies'
+      shell: 'bash'
+      run: 'npm install'
+    - name: 'npm build'
+      shell: 'bash'
+      run: 'npm run build'
+    - name: 'Set up Docker Buildx'
+      uses: 'docker/setup-buildx-action@v3'
+    - name: 'Log in to GitHub Container Registry'
+      uses: 'docker/login-action@v3'
+      with:
+        registry: 'ghcr.io'
+        username: '${{ inputs.github-actor }}'
+        password: '${{ inputs.github-secret }}'
+    - name: 'determine image tag'
+      id: 'image_tag'
+      shell: 'bash'
+      run: |-
+        SHELL_TAG_NAME="${{ inputs.github-ref-name }}"
+        FINAL_TAG="${{ inputs.github-sha }}"
+        if [[ "$SHELL_TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
+          echo "Release detected."
+          FINAL_TAG="${SHELL_TAG_NAME#v}"
+        else
+          echo "Development release detected. Using commit SHA as tag."
+        fi
+        echo "Determined image tag: $FINAL_TAG"
+        echo "FINAL_TAG=$FINAL_TAG" >> $GITHUB_OUTPUT
+    - name: 'build'
+      id: 'docker_build'
+      shell: 'bash'
+      env:
+        GEMINI_SANDBOX_IMAGE_TAG: '${{ steps.image_tag.outputs.FINAL_TAG }}'
+        GEMINI_SANDBOX: 'docker'
+      run: |-
+        npm run build:sandbox -- \
+          --image ghcr.io/${{ github.repository}}/sandbox:${{ steps.image_tag.outputs.FINAL_TAG }} \
+          --output-file final_image_uri.txt
+        echo "uri=$(cat final_image_uri.txt)" >> $GITHUB_OUTPUT
+    - name: 'publish'
+      shell: 'bash'
+      if: "${{ inputs.dry-run == 'false' }}"
+      run: |-
+        docker push "${{ steps.docker_build.outputs.uri }}"
+    - name: 'Create issue on failure'
+      if: |-
+        ${{ failure() }}
+      shell: 'bash'
+      env:
+        GITHUB_TOKEN: '${{ inputs.github-secret }}'
+        DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+      run: |-
+        gh issue create \
+          --title "Docker build failed" \
+          --body "The docker build failed. See the full run for details: ${DETAILS_URL}" \
+          --label "kind/bug,release-failure"

.github/actions/tag-npm-release/action.yml

@@ -0,0 +1,53 @@
+name: 'Tag an NPM release'
+description: 'Tags a specific npm version to a specific channel.'
+
+inputs:
+  channel:
+    description: 'NPM Channel tag'
+    required: true
+  version:
+    description: 'version'
+    required: true
+  dry-run:
+    description: 'Whether to run in dry-run mode.'
+    required: true
+  wombat-token-core:
+    description: 'The npm token for the wombat @google/gemini-cli-core'
+    required: true
+  wombat-token-cli:
+    description: 'The npm token for wombat @google/gemini-cli'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Setup Node.js'
+      uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+      with:
+        node-version-file: '.nvmrc'
+        registry-url: 'https://wombat-dressing-room.appspot.com'
+        scope: '@google'
+
+    - name: 'Change tag for @google/gemini-cli-core'
+      if: |-
+        ${{ inputs.dry-run == 'false' }}
+      env:
+        NODE_AUTH_TOKEN: '${{ inputs.wombat-token-core }}'
+      shell: 'bash'
+      run: |
+        npm dist-tag add @google/gemini-cli-core@${{ inputs.version }} ${{ inputs.channel }}
+
+    - name: 'Change tag for @google/gemini-cli'
+      if: |-
+        ${{ inputs.dry-run == 'false' }}
+      env:
+        NODE_AUTH_TOKEN: '${{ inputs.wombat-token-cli }}'
+      shell: 'bash'
+      run: |
+        npm dist-tag add @google/gemini-cli@${{ inputs.version }} ${{ inputs.channel }}
+
+    - name: 'Log dry run'
+      if: |-
+        ${{ inputs.dry-run == 'true' }}
+      shell: 'bash'
+      run: |
+        echo "Dry run: Would have added tag '${{ inputs.channel }}' to version '${{ inputs.version }}' for @google/gemini-cli and @google/gemini-cli-core."

.github/actions/verify-release/action.yml

@@ -0,0 +1,55 @@
+name: 'Verify an NPM release'
+description: 'Fetches a package from NPM and does some basic smoke tests'
+
+inputs:
+  npm-package:
+    description: 'NPM Package'
+    required: true
+    default: '@google/gemini-cli@latest'
+  expected-version:
+    description: 'Expected version'
+    required: true
+  ref:
+    description: 'The branch, tag, or SHA to release from.'
+    required: false
+    type: 'string'
+    default: 'main'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: '📝 Print Inputs'
+      shell: 'bash'
+      run: |
+        echo "${{ toJSON(inputs) }}"
+    - name: 'Checkout'
+      uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
+      with:
+        ref: '${{ github.event.inputs.ref }}'
+        fetch-depth: 0
+
+    - name: 'Install from NPM'
+      uses: 'nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08' # ratchet:nick-fields/retry@v3
+      with:
+        timeout_seconds: 900
+        retry_wait_seconds: 30
+        max_attempts: 10
+        command: |-
+          npm install --prefer-online --no-cache -g ${{ inputs.npm-package }}
+
+    # This provides a very basic smoke test for Gemini CLI
+    - name: 'Run Gemini CLI'
+      id: 'gemini_cli'
+      shell: 'bash'
+      run: |-
+        echo "gemini_version=$(gemini --version)" >> $GITHUB_OUTPUT
+
+    # Force a failure if it doesn't match
+    - name: 'Fail workflow if version does not match'
+      if: '${{ steps.gemini_cli.outputs.gemini_version != inputs.expected-version }}'
+      shell: 'bash'
+      run: |-
+        echo '❌ Got ${{ steps.gemini_cli.outputs.gemini_version }} from ${{ inputs.npm-package }}'
+        echo '❌ Expected Version ${{ inputs.expected-version }}'
+
+        exit 1

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: 'Gemini CLI CI'
+name: 'Testing: CI'
 
 on:
   push:
@@ -10,6 +10,7 @@ on:
       - 'main'
       - 'release/**'
   merge_group:
+  workflow_dispatch:
 
 concurrency:
   group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
@@ -25,63 +26,10 @@ defaults:
   run:
     shell: 'bash'
 
-env:
-  ACTIONLINT_VERSION: '1.7.7'
-  SHELLCHECK_VERSION: '0.11.0'
-  YAMLLINT_VERSION: '1.35.1'
-
 jobs:
-  #
-  # Lint: GitHub Actions
-  #
-  lint_github_actions:
-    name: 'Lint (GitHub Actions)'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          fetch-depth: 1
-
-      - name: 'Install shellcheck' # Actionlint uses shellcheck
-        run: |-
-          mkdir -p "${RUNNER_TEMP}/shellcheck"
-          curl -sSLo "${RUNNER_TEMP}/.shellcheck.txz" "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
-          tar -xf "${RUNNER_TEMP}/.shellcheck.txz" -C "${RUNNER_TEMP}/shellcheck" --strip-components=1
-          echo "${RUNNER_TEMP}/shellcheck" >> "${GITHUB_PATH}"
-
-      - name: 'Install actionlint'
-        run: |-
-          mkdir -p "${RUNNER_TEMP}/actionlint"
-          curl -sSLo "${RUNNER_TEMP}/.actionlint.tgz" "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
-          tar -xzf "${RUNNER_TEMP}/.actionlint.tgz" -C "${RUNNER_TEMP}/actionlint"
-          echo "${RUNNER_TEMP}/actionlint" >> "${GITHUB_PATH}"
-
-      # For actionlint, we specifically ignore shellcheck rules that are
-      # annoying or unhelpful. See the shellcheck action for a description.
-      - name: 'Run actionlint'
-        run: |-
-          actionlint \
-            -color \
-            -format '{{range $err := .}}::error file={{$err.Filepath}},line={{$err.Line}},col={{$err.Column}}::{{$err.Filepath}}@{{$err.Line}} {{$err.Message}}%0A```%0A{{replace $err.Snippet "\\n" "%0A"}}%0A```\n{{end}}' \
-            -ignore 'SC2002:' \
-            -ignore 'SC2016:' \
-            -ignore 'SC2129:' \
-            -ignore 'label ".+" is unknown'
-
-      - name: 'Run ratchet'
-        uses: 'sethvargo/ratchet@8b4ca256dbed184350608a3023620f267f0a5253' # ratchet:sethvargo/ratchet@v0.11.4
-        with:
-          files: |-
-            .github/workflows/*.yml
-            .github/actions/**/*.yml
-
-  #
-  # Lint: Javascript
-  #
-  lint_javascript:
-    name: 'Lint (Javascript)'
-    runs-on: 'ubuntu-latest'
+  lint:
+    name: 'Lint'
+    runs-on: 'gemini-cli-ubuntu-16-core'
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
@@ -94,161 +42,33 @@ jobs:
           node-version-file: '.nvmrc'
           cache: 'npm'
 
-      - name: 'Run lockfile check'
-        run: |-
-          npm run check:lockfile
-
       - name: 'Install dependencies'
-        run: |-
-          npm ci
+        run: 'npm ci'
 
-      - name: 'Run formatter check'
-        run: |-
-          npm run format
-          git diff --exit-code
+      - name: 'Check lockfile'
+        run: 'npm run check:lockfile'
 
-      - name: 'Run linter'
-        run: |-
-          npm run lint:ci
+      - name: 'Install linters'
+        run: 'node scripts/lint.js --setup'
 
-      - name: 'Run linter on integration tests'
-        run: |-
-          npx eslint integration-tests --max-warnings 0
+      - name: 'Run ESLint'
+        run: 'node scripts/lint.js --eslint'
 
-      - name: 'Run formatter on integration tests'
-        run: |-
-          npx prettier --check integration-tests
-          git diff --exit-code
+      - name: 'Run actionlint'
+        run: 'node scripts/lint.js --actionlint'
 
-      - name: 'Build project'
-        run: |-
-          npm run build
-
-      - name: 'Run type check'
-        run: |-
-          npm run typecheck
-
-  #
-  # Lint: Shell
-  #
-  lint_shell:
-    name: 'Lint (Shell)'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          fetch-depth: 1
-
-      - name: 'Install shellcheck'
-        run: |-
-          mkdir -p "${RUNNER_TEMP}/shellcheck"
-          curl -sSLo "${RUNNER_TEMP}/.shellcheck.txz" "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
-          tar -xf "${RUNNER_TEMP}/.shellcheck.txz" -C "${RUNNER_TEMP}/shellcheck" --strip-components=1
-          echo "${RUNNER_TEMP}/shellcheck" >> "${GITHUB_PATH}"
-
-      - name: 'Install shellcheck problem matcher'
-        run: |-
-          cat > "${RUNNER_TEMP}/shellcheck/problem-matcher-lint-shell.json" <<"EOF"
-          {
-            "problemMatcher": [
-              {
-                "owner": "lint_shell",
-                "pattern": [
-                  {
-                    "regexp": "^(.*):(\\\\d+):(\\\\d+):\\\\s+(?:fatal\\\\s+)?(warning|error):\\\\s+(.*)$",
-                    "file": 1,
-                    "line": 2,
-                    "column": 3,
-                    "severity": 4,
-                    "message": 5
-                  }
-                ]
-              }
-            ]
-          }
-          EOF
-          echo "::add-matcher::${RUNNER_TEMP}/shellcheck/problem-matcher-lint-shell.json"
-
-      # Note that only warning and error severity show up in the github files
-      # page. So we replace 'style' and 'note' with 'warning' to make it show
-      # up.
-      #
-      # We also try and find all bash scripts even if they don't have an
-      # explicit extension.
-      #
-      # We explicitly ignore the following rules:
-      #
-      # - SC2002: This rule suggests using "cmd < file" instead of "cat | cmd".
-      #   While < is more efficient, pipes are much more readable and expected.
-      #
-      # - SC2129: This rule suggests grouping multiple writes to a file in
-      #   braces like "{ cmd1; cmd2; } >> file". This is unexpected and less
-      #   readable.
-      #
-      # - SC2310: This is an optional warning that only appears with "set -e"
-      #   and when a command is used as a conditional.
       - name: 'Run shellcheck'
-        run: |-
-          git ls-files | grep -E '^([^.]+|.*\.(sh|zsh|bash))$' | xargs file --mime-type \
-            | grep "text/x-shellscript" | awk '{ print substr($1, 1, length($1)-1) }' \
-            | xargs shellcheck \
-              --check-sourced \
-              --enable=all \
-              --exclude=SC2002,SC2129,SC2310 \
-              --severity=style \
-              --format=gcc \
-              --color=never | sed -e 's/note:/warning:/g' -e 's/style:/warning:/g'
-
-  #
-  # Lint: YAML
-  #
-  lint_yaml:
-    name: 'Lint (YAML)'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          fetch-depth: 1
-
-      - name: 'Setup Python'
-        uses: 'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065' # ratchet:actions/setup-python@v5
-        with:
-          python-version: '3'
-
-      - name: 'Install yamllint'
-        run: |-
-          pip install --user "yamllint==${YAMLLINT_VERSION}"
+        run: 'node scripts/lint.js --shellcheck'
 
       - name: 'Run yamllint'
-        run: |-
-          git ls-files | grep -E '\.(yaml|yml)' | xargs yamllint --format github
+        run: 'node scripts/lint.js --yamllint'
 
-  #
-  # Lint: All
-  #
-  # This is a virtual job that other jobs depend on to wait for all linters to
-  # finish. It's also used to ensure linting happens on CI via required
-  # workflows.
-  lint:
-    name: 'Lint'
-    needs:
-      - 'lint_github_actions'
-      - 'lint_javascript'
-      - 'lint_shell'
-      - 'lint_yaml'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - run: |-
-          echo 'All linters finished!'
+      - name: 'Run Prettier'
+        run: 'node scripts/lint.js --prettier'
 
-  #
-  # Test: Node
-  #
-  test:
-    name: 'Test'
-    runs-on: '${{ matrix.os }}'
+  test_linux:
+    name: 'Test (Linux)'
+    runs-on: 'gemini-cli-ubuntu-16-core'
     needs:
       - 'lint'
     permissions:
@@ -256,12 +76,7 @@ jobs:
       checks: 'write'
       pull-requests: 'write'
     strategy:
-      fail-fast: false # So we can see all test failures
       matrix:
-        os:
-          - 'macos-latest'
-          - 'ubuntu-latest'
-          - 'windows-latest'
         node-version:
           - '20.x'
           - '22.x'
@@ -277,18 +92,19 @@ jobs:
           cache: 'npm'
 
       - name: 'Build project'
-        run: |-
-          npm run build
+        run: 'npm run build'
 
       - name: 'Install dependencies for testing'
-        run: |-
-          npm ci
+        run: 'npm ci'
 
       - name: 'Run tests and generate reports'
         env:
           NO_COLOR: true
         run: 'npm run test:ci'
 
+      - name: 'Wait for file system sync'
+        run: 'sleep 2'
+
       - name: 'Publish Test Report (for non-forks)'
         if: |-
           ${{ always() && (github.event.pull_request.head.repo.full_name == github.repository) }}
@@ -304,7 +120,67 @@ jobs:
           ${{ always() && (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
         uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
         with:
-          name: 'test-results-fork-${{ matrix.node-version }}-${{ matrix.os }}'
+          name: 'test-results-fork-${{ matrix.node-version }}-${{ runner.os }}'
+          path: 'packages/*/junit.xml'
+
+  test_slow_platforms:
+    name: 'Slow Test - Mac'
+    runs-on: '${{ matrix.os }}'
+    needs:
+      - 'lint'
+    permissions:
+      contents: 'read'
+      checks: 'write'
+      pull-requests: 'write'
+    continue-on-error: true
+    strategy:
+      matrix:
+        os:
+          - 'macos-latest'
+        node-version:
+          - '20.x'
+          - '22.x'
+          - '24.x'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+
+      - name: 'Set up Node.js ${{ matrix.node-version }}'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '${{ matrix.node-version }}'
+          cache: 'npm'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Install dependencies for testing'
+        run: 'npm ci'
+
+      - name: 'Run tests and generate reports'
+        env:
+          NO_COLOR: true
+        run: 'npm run test:ci -- --coverage.enabled=false'
+
+      - name: 'Wait for file system sync'
+        run: 'sleep 2'
+
+      - name: 'Publish Test Report (for non-forks)'
+        if: |-
+          ${{ always() && (github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: 'dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3' # ratchet:dorny/test-reporter@v2
+        with:
+          name: 'Test Results (Node ${{ matrix.node-version }})'
+          path: 'packages/*/junit.xml'
+          reporter: 'java-junit'
+          fail-on-error: 'false'
+
+      - name: 'Upload Test Results Artifact (for forks)'
+        if: |-
+          ${{ always() && (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'test-results-fork-${{ matrix.node-version }}-${{ runner.os }}'
           path: 'packages/*/junit.xml'
 
       - name: 'Upload coverage reports'
@@ -315,47 +191,9 @@ jobs:
           name: 'coverage-reports-${{ matrix.node-version }}-${{ matrix.os }}'
           path: 'packages/*/coverage'
 
-  post_coverage_comment:
-    name: 'Post Coverage Comment'
-    runs-on: 'ubuntu-latest'
-    needs: 'test'
-    if: |-
-      ${{ always() && github.event_name == 'pull_request' && (github.event.pull_request.head.repo.full_name == github.repository) }}
-    continue-on-error: true
-    permissions:
-      contents: 'read' # For checkout
-      pull-requests: 'write' # For commenting
-    strategy:
-      matrix:
-        # Reduce noise by only posting the comment once
-        os:
-          - 'ubuntu-latest'
-        node-version:
-          - '22.x'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-
-      - name: 'Download coverage reports artifact'
-        uses: 'actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0' # ratchet:actions/download-artifact@v5
-        with:
-          name: 'coverage-reports-${{ matrix.node-version }}-${{ matrix.os }}'
-          path: 'coverage_artifact' # Download to a specific directory
-
-      - name: 'Post Coverage Comment using Composite Action'
-        uses: './.github/actions/post-coverage-comment' # Path to the composite action directory
-        with:
-          cli_json_file: 'coverage_artifact/cli/coverage/coverage-summary.json'
-          core_json_file: 'coverage_artifact/core/coverage/coverage-summary.json'
-          cli_full_text_summary_file: 'coverage_artifact/cli/coverage/full-text-summary.txt'
-          core_full_text_summary_file: 'coverage_artifact/core/coverage/full-text-summary.txt'
-          node_version: '${{ matrix.node-version }}'
-          os: '${{ matrix.os }}'
-          github_token: '${{ secrets.GITHUB_TOKEN }}'
-
   codeql:
     name: 'CodeQL'
-    runs-on: 'ubuntu-latest'
+    runs-on: 'gemini-cli-ubuntu-16-core'
     permissions:
       actions: 'read'
       contents: 'read'
@@ -375,9 +213,8 @@ jobs:
   # Check for changes in bundle size.
   bundle_size:
     name: 'Check Bundle Size'
-    if: |-
-      ${{ github.event_name != 'merge_group' }}
-    runs-on: 'ubuntu-latest'
+    if: "github.event_name == 'pull_request'"
+    runs-on: 'gemini-cli-ubuntu-16-core'
     permissions:
       contents: 'read' # For checkout
       pull-requests: 'write' # For commenting
@@ -395,3 +232,79 @@ jobs:
           minimum-change-threshold: '1000'
           compression: 'none'
           clean-script: 'clean'
+
+  test_windows:
+    name: 'Slow Test - Win'
+    runs-on: 'gemini-cli-windows-16-core'
+    continue-on-error: true
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+
+      - name: 'Set up Node.js 20.x'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+
+      - name: 'Configure Windows Defender exclusions'
+        run: |
+          Add-MpPreference -ExclusionPath $env:GITHUB_WORKSPACE -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\node_modules" -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\packages" -Force
+          Add-MpPreference -ExclusionPath "$env:TEMP" -Force
+        shell: 'pwsh'
+
+      - name: 'Configure npm for Windows performance'
+        run: |
+          npm config set progress false
+          npm config set audit false
+          npm config set fund false
+          npm config set loglevel error
+          npm config set maxsockets 32
+          npm config set registry https://registry.npmjs.org/
+        shell: 'pwsh'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+        shell: 'pwsh'
+
+      - name: 'Build project'
+        run: 'npm run build'
+        shell: 'pwsh'
+        env:
+          NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
+          UV_THREADPOOL_SIZE: '32'
+          NODE_ENV: 'production'
+
+      - name: 'Run tests and generate reports'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          NO_COLOR: true
+          NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
+          UV_THREADPOOL_SIZE: '32'
+          NODE_ENV: 'test'
+        run: 'npm run test:ci -- --coverage.enabled=false'
+        shell: 'pwsh'
+
+  ci:
+    name: 'CI'
+    if: 'always()'
+    needs:
+      - 'lint'
+      - 'test_linux'
+      - 'codeql'
+      - 'bundle_size'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    steps:
+      - name: 'Check all job results'
+        run: |
+          if [[ (${{ needs.lint.result }} != 'success' && ${{ needs.lint.result }} != 'skipped') || \
+               (${{ needs.test_linux.result }} != 'success' && ${{ needs.test_linux.result }} != 'skipped') || \
+               (${{ needs.codeql.result }} != 'success' && ${{ needs.codeql.result }} != 'skipped') || \
+               (${{ needs.bundle_size.result }} != 'success' && ${{ needs.bundle_size.result }} != 'skipped') ]]; then
+            echo "One or more CI jobs failed."
+            exit 1
+          fi
+          echo "All CI jobs passed!"

.github/workflows/create-patch-pr.yml

@@ -1,58 +0,0 @@
-name: 'Create Patch PR'
-
-on:
-  workflow_dispatch:
-    inputs:
-      commit:
-        description: 'The commit SHA to cherry-pick for the patch.'
-        required: true
-        type: 'string'
-      channel:
-        description: 'The release channel to patch.'
-        required: true
-        type: 'choice'
-        options:
-          - 'stable'
-          - 'preview'
-      dry_run:
-        description: 'Whether to run in dry-run mode.'
-        required: false
-        type: 'boolean'
-        default: false
-
-jobs:
-  create-patch:
-    runs-on: 'ubuntu-latest'
-    permissions:
-      contents: 'write'
-      pull-requests: 'write'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: 'Setup Node.js'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
-        with:
-          node-version-file: '.nvmrc'
-          cache: 'npm'
-
-      - name: 'Install Dependencies'
-        run: 'npm ci'
-
-      - name: 'Configure Git User'
-        run: |-
-          git config user.name "gemini-cli-robot"
-          git config user.email "gemini-cli-robot@google.com"
-
-      - name: 'Create Patch for Stable'
-        if: "github.event.inputs.channel == 'stable'"
-        env:
-          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-        run: 'node scripts/create-patch-pr.js --commit=${{ github.event.inputs.commit }} --channel=stable --dry-run=${{ github.event.inputs.dry_run }}'
-
-      - name: 'Create Patch for Preview'
-        env:
-          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-        run: 'node scripts/create-patch-pr.js --commit=${{ github.event.inputs.commit }} --channel=${{ github.event.inputs.channel }} --dry-run=${{ github.event.inputs.dry_run }}'

.github/workflows/e2e.yml

@@ -1,4 +1,4 @@
-name: 'E2E Tests'
+name: 'Testing: E2E'
 
 on:
   push:
@@ -14,35 +14,63 @@ on:
     types: ['labeled']
   merge_group:
 
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: |-
+    ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/heads/release/') }}
+
 jobs:
-  e2e-test:
-    name: 'E2E Test (${{ matrix.os }}) - ${{ matrix.sandbox }}'
-    # This condition ensures the job runs for pushes to main, merge groups,
-    # PRs from the base repo, OR PRs from forks with the correct label.
+  build:
+    name: 'Build Project'
+    runs-on: 'gemini-cli-ubuntu-16-core'
     if: |
       github.event_name == 'push' ||
       github.event_name == 'merge_group' ||
       (github.event.pull_request.head.repo.full_name == github.repository) ||
       (github.event.label.name == 'maintainer:e2e:ok')
-    runs-on: '${{ matrix.os }}'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Archive build artifacts'
+        run: 'tar -cvf build-artifacts.tar bundle/ node_modules/ packages/ package.json'
+
+      - name: 'Upload build artifacts'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
+        with:
+          name: 'build-artifacts-${{ github.run_id }}'
+          path: 'build-artifacts.tar'
+
+  e2e_linux:
+    name: 'E2E Test (Linux) - ${{ matrix.sandbox }}'
+    needs:
+      - 'build'
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'merge_group' ||
+      (github.event.pull_request.head.repo.full_name == github.repository) ||
+      (github.event.label.name == 'maintainer:e2e:ok')
+    runs-on: 'gemini-cli-ubuntu-16-core'
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - 'ubuntu-latest'
-          - 'macos-latest'
-          - 'gemini-cli-windows-16-core'
         sandbox:
           - 'sandbox:none'
           - 'sandbox:docker'
         node-version:
           - '20.x'
-        exclude:
-          # Docker tests are not supported on macOS or Windows
-          - os: 'macos-latest'
-            sandbox: 'sandbox:docker'
-          - os: 'gemini-cli-windows-16-core'
-            sandbox: 'sandbox:docker'
 
     steps:
       - name: 'Checkout (fork)'
@@ -56,22 +84,22 @@ jobs:
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         if: "github.event_name != 'pull_request_target'"
 
+      - name: 'Download build artifacts'
+        uses: 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        with:
+          name: 'build-artifacts-${{ github.run_id }}'
+          path: '.'
+
+      - name: 'Extract build artifacts'
+        run: 'tar -xvf build-artifacts.tar'
+
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
         with:
           node-version: '${{ matrix.node-version }}'
 
-      - name: 'Install dependencies'
-        run: |-
-          npm ci
-
-      - name: 'Build project'
-        run: |-
-          npm run build
-
       - name: 'Set up Docker'
-        if: |-
-          matrix.os == 'ubuntu-latest' && matrix.sandbox == 'sandbox:docker'
+        if: "matrix.sandbox == 'sandbox:docker'"
         uses: 'docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435' # ratchet:docker/setup-buildx-action@v3
 
       - name: 'Run E2E tests'
@@ -80,6 +108,153 @@ jobs:
           KEEP_OUTPUT: 'true'
           SANDBOX: '${{ matrix.sandbox }}'
           VERBOSE: 'true'
+          GEMINI_SANDBOX: 'docker'
         shell: 'bash'
-        run: |-
-          npm run "test:integration:${SANDBOX}"
+        run: |
+          if [[ "${{ matrix.sandbox }}" == "sandbox:docker" ]]; then
+            npm run build:sandbox
+          fi
+          npx vitest run --root ./integration-tests
+
+  e2e_slow_platforms:
+    name: 'Slow E2E - Mac'
+    needs:
+      - 'build'
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'merge_group' ||
+      (github.event.pull_request.head.repo.full_name == github.repository) ||
+      (github.event.label.name == 'maintainer:e2e:ok')
+    runs-on: '${{ matrix.os }}'
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - 'macos-latest'
+        node-version:
+          - '20.x'
+
+    steps:
+      - name: 'Checkout (fork)'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        if: "github.event_name == 'pull_request_target'"
+        with:
+          ref: '${{ github.event.pull_request.head.sha }}'
+          repository: '${{ github.event.pull_request.head.repo.full_name }}'
+
+      - name: 'Checkout (internal)'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        if: "github.event_name != 'pull_request_target'"
+
+      - name: 'Download build artifacts'
+        uses: 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        with:
+          name: 'build-artifacts-${{ github.run_id }}'
+          path: '.'
+
+      - name: 'Extract build artifacts'
+        run: 'tar -xvf build-artifacts.tar'
+
+      - name: 'Set up Node.js ${{ matrix.node-version }}'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version: '${{ matrix.node-version }}'
+
+      - name: 'Fix rollup optional dependencies on macOS'
+        if: "runner.os == 'macOS'"
+        run: |
+          npm cache clean --force
+          npm install --no-save @rollup/rollup-darwin-arm64 || true
+
+      - name: 'Run E2E tests (non-Windows)'
+        if: "runner.os != 'Windows'"
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          KEEP_OUTPUT: 'true'
+          SANDBOX: 'sandbox:none'
+          VERBOSE: 'true'
+        run: 'npx vitest run --root ./integration-tests'
+
+  e2e_windows:
+    name: 'Slow E2E - Win'
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'merge_group' ||
+      (github.event.pull_request.head.repo.full_name == github.repository) ||
+      (github.event.label.name == 'maintainer:e2e:ok')
+    runs-on: 'gemini-cli-windows-16-core'
+    continue-on-error: true
+
+    steps:
+      - name: 'Checkout (fork)'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        if: "github.event_name == 'pull_request_target'"
+        with:
+          ref: '${{ github.event.pull_request.head.sha }}'
+          repository: '${{ github.event.pull_request.head.repo.full_name }}'
+
+      - name: 'Checkout (internal)'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        if: "github.event_name != 'pull_request_target'"
+
+      - name: 'Set up Node.js 20.x'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+
+      - name: 'Configure Windows Defender exclusions'
+        run: |
+          Add-MpPreference -ExclusionPath $env:GITHUB_WORKSPACE -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\node_modules" -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\packages" -Force
+          Add-MpPreference -ExclusionPath "$env:TEMP" -Force
+        shell: 'pwsh'
+
+      - name: 'Configure npm for Windows performance'
+        run: |
+          npm config set progress false
+          npm config set audit false
+          npm config set fund false
+          npm config set loglevel error
+          npm config set maxsockets 32
+          npm config set registry https://registry.npmjs.org/
+        shell: 'pwsh'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+        shell: 'pwsh'
+
+      - name: 'Run E2E tests'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          KEEP_OUTPUT: 'true'
+          SANDBOX: 'sandbox:none'
+          VERBOSE: 'true'
+          NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
+          UV_THREADPOOL_SIZE: '32'
+          NODE_ENV: 'test'
+        shell: 'pwsh'
+        run: 'npx vitest run --root ./integration-tests'
+
+  e2e:
+    name: 'E2E'
+    if: |
+      always() && (
+        github.event_name == 'push' ||
+        github.event_name == 'merge_group' ||
+        (github.event.pull_request.head.repo.full_name == github.repository) ||
+        (github.event.label.name == 'maintainer:e2e:ok')
+      )
+    needs:
+      - 'e2e_linux'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    steps:
+      - name: 'Check E2E test results'
+        run: |
+          if [[ ${{ needs.e2e_linux.result }} != 'success' ]]; then
+            echo "The required E2E test job failed."
+            exit 1
+          fi
+          echo "All required E2E test jobs passed!"

.github/workflows/patch-from-comment.yml

@@ -1,56 +0,0 @@
-name: 'Patch from Comment'
-
-on:
-  issue_comment:
-    types: ['created']
-
-jobs:
-  slash-command:
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Slash Command Dispatch'
-        id: 'slash_command'
-        uses: 'peter-evans/slash-command-dispatch@40877f718dce0101edfc7aea2b3800cc192f9ed5'
-        with:
-          token: '${{ secrets.GITHUB_TOKEN }}'
-          commands: 'patch'
-          permission: 'write'
-          issue-type: 'pull-request'
-          static-args: |
-            dry_run=false
-
-      - name: 'Get PR Status'
-        id: 'pr_status'
-        if: "steps.slash_command.outputs.dispatched == 'true'"
-        env:
-          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-        run: |
-          gh pr view "${{ github.event.issue.number }}" --json mergeCommit,state > pr_status.json
-          echo "MERGE_COMMIT_SHA=$(jq -r .mergeCommit.oid pr_status.json)" >> "$GITHUB_OUTPUT"
-          echo "STATE=$(jq -r .state pr_status.json)" >> "$GITHUB_OUTPUT"
-
-      - name: 'Dispatch if Merged'
-        if: "steps.pr_status.outputs.STATE == 'MERGED'"
-        uses: 'actions/github-script@00f12e3e20659f42342b1c0226afda7f7c042325'
-        with:
-          script: |
-            const args = JSON.parse('${{ steps.slash_command.outputs.command-arguments }}');
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'create-patch-pr.yml',
-              ref: 'main',
-              inputs: {
-                commit: '${{ steps.pr_status.outputs.MERGE_COMMIT_SHA }}',
-                channel: args.channel,
-                dry_run: args.dry_run
-              }
-            })
-
-      - name: 'Comment on Failure'
-        if: "steps.pr_status.outputs.STATE != 'MERGED'"
-        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
-        with:
-          issue-number: '${{ github.event.issue.number }}'
-          body: |
-            :x: The `/patch` command failed. This pull request must be merged before a patch can be created.

.github/workflows/patch-release.yml

@@ -1,94 +0,0 @@
-name: 'Patch Release'
-
-on:
-  workflow_dispatch:
-    inputs:
-      type:
-        description: 'The type of release to patch from.'
-        required: true
-        type: 'choice'
-        options:
-          - 'stable'
-          - 'preview'
-      ref:
-        description: 'The branch or ref (full git sha) to release from.'
-        required: true
-        type: 'string'
-        default: 'main'
-      dry_run:
-        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
-        required: true
-        type: 'boolean'
-        default: true
-      force_skip_tests:
-        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
-        required: false
-        type: 'boolean'
-        default: false
-
-jobs:
-  release:
-    runs-on: 'ubuntu-latest'
-    environment:
-      name: 'production-release'
-      url: '${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ steps.version.outputs.RELEASE_TAG }}'
-    if: |-
-      ${{ github.repository == 'google-gemini/gemini-cli' }}
-    permissions:
-      contents: 'write'
-      packages: 'write'
-      id-token: 'write'
-      issues: 'write' # For creating issues on failure
-    outputs:
-      RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          ref: '${{ github.event.inputs.ref || github.sha }}'
-          fetch-depth: 0
-
-      - name: 'Setup Node.js'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
-        with:
-          node-version-file: '.nvmrc'
-          cache: 'npm'
-
-      - name: 'Install Dependencies'
-        run: |-
-          npm ci
-
-      - name: 'Get the version'
-        id: 'version'
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-        run: |-
-          VERSION_JSON="$(node scripts/get-release-version.js --type=patch --patch-from=${{ github.event.inputs.type }})"
-          echo "${VERSION_JSON}"
-          echo "RELEASE_TAG=$(echo "${VERSION_JSON}" | jq -r .releaseTag)" >> "${GITHUB_OUTPUT}"
-          echo "RELEASE_VERSION=$(echo "${VERSION_JSON}" | jq -r .releaseVersion)" >> "${GITHUB_OUTPUT}"
-          echo "NPM_TAG=$(echo "${VERSION_JSON}" | jq -r .npmTag)" >> "${GITHUB_OUTPUT}"
-          echo "PREVIOUS_TAG=$(echo "${VERSION_JSON}" | jq -r .previousReleaseTag)" >> "${GITHUB_OUTPUT}"
-
-      - name: 'Print Calculated Version'
-        run: |-
-          echo "Calculated version: ${{ steps.version.outputs.RELEASE_VERSION }}"
-
-      - name: 'Run Tests'
-        uses: './.github/actions/run-tests'
-        with:
-          force_skip_tests: '${{ github.event.inputs.force_skip_tests }}'
-          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
-
-      - name: 'Publish Release'
-        uses: './.github/actions/publish-release'
-        with:
-          release-version: '${{ steps.version.outputs.RELEASE_VERSION }}'
-          release-tag: '${{ steps.version.outputs.RELEASE_TAG }}'
-          npm-tag: '${{ steps.version.outputs.NPM_TAG }}'
-          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
-          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
-          github-token: '${{ secrets.GITHUB_TOKEN }}'
-          dry-run: '${{ github.event.inputs.dry_run }}'
-          previous-tag: '${{ steps.version.outputs.PREVIOUS_TAG }}'

.github/workflows/release-change-tags.yml

@@ -0,0 +1,56 @@
+name: 'Release: Change Tags'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The package version to tag (e.g., 0.5.0-preview-2). This version must already exist on the npm registry.'
+        required: true
+        type: 'string'
+      channel:
+        description: 'The npm dist-tag to apply (e.g., latest, preview, nightly).'
+        required: true
+        type: 'choice'
+        options:
+          - 'latest'
+          - 'preview'
+          - 'nightly'
+      ref:
+        description: 'The branch, tag, or SHA to run from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      dry-run:
+        description: 'Whether to run in dry-run mode.'
+        required: false
+        type: 'boolean'
+        default: true
+
+jobs:
+  change-tags:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@v4'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          registry-url: 'https://wombat-dressing-room.appspot.com'
+          scope: '@google'
+
+      - name: 'Change tag'
+        uses: './.github/actions/tag-npm-release'
+        with:
+          channel: '${{ github.event.inputs.channel }}'
+          version: '${{ github.event.inputs.version }}'
+          dry-run: '${{ github.event.inputs.dry-run }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'

.github/workflows/release-manual.yml

@@ -0,0 +1,89 @@
+name: 'Release: Manual'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The version to release (e.g., v0.1.11). Must be a valid semver string with a "v" prefix.'
+        required: true
+        type: 'string'
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: true
+        type: 'string'
+      npm_channel:
+        description: 'The npm channel to publish to.'
+        required: true
+        type: 'choice'
+        options:
+          - 'preview'
+          - 'nightly'
+          - 'latest'
+          - 'dev'
+        default: 'dev'
+      dry_run:
+        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
+        required: true
+        type: 'boolean'
+        default: true
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+      skip_github_release:
+        description: 'Select to skip creating a GitHub release and create a npm release only.'
+        required: false
+        type: 'boolean'
+        default: false
+
+jobs:
+  release:
+    runs-on: 'self-hosted'
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Prepare Release Info'
+        id: 'release_info'
+        run: |
+          RELEASE_VERSION="${{ github.event.inputs.version }}"
+          echo "RELEASE_VERSION=${RELEASE_VERSION#v}" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_TAG=$(git describe --tags --abbrev=0)" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Run Tests'
+        if: |-
+          ${{ github.event.inputs.force_skip_tests != true }}
+        uses: './.github/actions/run-tests'
+        with:
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          force-skip-tests: '${{ github.event.inputs.force_skip_tests }}'
+          release-version: '${{ steps.release_info.outputs.RELEASE_VERSION }}'
+          release-tag: '${{ github.event.inputs.version }}'
+          npm-tag: '${{ github.event.inputs.npm_channel }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ steps.release_info.outputs.PREVIOUS_TAG }}'
+          skip-github-release: '${{ github.event.inputs.skip_github_release }}'

.github/workflows/release-nightly.yml

@@ -1,4 +1,4 @@
-name: 'Nightly Release'
+name: 'Release: Nightly'
 
 on:
   schedule:
@@ -25,7 +25,10 @@ jobs:
   release:
     runs-on: 'ubuntu-latest'
     permissions:
+      contents: 'write'
+      packages: 'write'
       issues: 'write'
+      pull-requests: 'write'
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
@@ -71,6 +74,16 @@ jobs:
           dry-run: '${{ github.event.inputs.dry_run }}'
           previous-tag: '${{ steps.nightly_version.outputs.PREVIOUS_TAG }}'
 
+      - name: 'Create and Merge Pull Request'
+        uses: './.github/actions/create-pull-request'
+        with:
+          branch-name: 'release/${{ steps.nightly_version.outputs.RELEASE_TAG }}'
+          pr-title: 'chore(release): bump version to ${{ steps.nightly_version.outputs.RELEASE_VERSION }}'
+          pr-body: 'Automated version bump for nightly release.'
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+
       - name: 'Create Issue on Failure'
         if: '${{ failure() && github.event.inputs.dry_run == false }}'
         env:

.github/workflows/release-patch-1-create-pr.yml

@@ -0,0 +1,109 @@
+name: 'Release: Patch (1) Create PR'
+
+on:
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: 'The commit SHA to cherry-pick for the patch.'
+        required: true
+        type: 'string'
+      channel:
+        description: 'The release channel to patch.'
+        required: true
+        type: 'choice'
+        options:
+          - 'stable'
+          - 'preview'
+      dry_run:
+        description: 'Whether to run in dry-run mode.'
+        required: false
+        type: 'boolean'
+        default: false
+      ref:
+        description: 'The branch, tag, or SHA to test from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      original_pr:
+        description: 'The original PR number to comment back on.'
+        required: false
+        type: 'string'
+
+jobs:
+  create-patch:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+      actions: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Script Dependencies'
+        run: 'npm install yargs'
+
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b'
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+          permission-pull-requests: 'write'
+          permission-contents: 'write'
+
+      - name: 'Configure Git User'
+        run: |-
+          git config user.name "gemini-cli-robot"
+          git config user.email "gemini-cli-robot@google.com"
+          # Configure git to use GITHUB_TOKEN for remote operations (has actions:write for workflow files)
+          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git"
+
+      - name: 'Create Patch'
+        id: 'create_patch'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
+        continue-on-error: true
+        run: |
+          # Capture output and display it in logs using tee
+          {
+            node scripts/releasing/create-patch-pr.js --commit=${{ github.event.inputs.commit }} --channel=${{ github.event.inputs.channel }} --dry-run=${{ github.event.inputs.dry_run }}
+            echo "EXIT_CODE=$?" >> "$GITHUB_OUTPUT"
+          } 2>&1 | tee >(
+            echo "LOG_CONTENT<<EOF" >> "$GITHUB_ENV"
+            cat >> "$GITHUB_ENV"
+            echo "EOF" >> "$GITHUB_ENV"
+          )
+
+      - name: 'Comment on Original PR'
+        if: 'always() && inputs.original_pr'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ORIGINAL_PR: '${{ github.event.inputs.original_pr }}'
+          EXIT_CODE: '${{ steps.create_patch.outputs.EXIT_CODE }}'
+          COMMIT: '${{ github.event.inputs.commit }}'
+          CHANNEL: '${{ github.event.inputs.channel }}'
+          REPOSITORY: '${{ github.repository }}'
+          GITHUB_RUN_ID: '${{ github.run_id }}'
+          LOG_CONTENT: '${{ env.LOG_CONTENT }}'
+        continue-on-error: true
+        run: |
+          git checkout '${{ github.event.inputs.ref }}'
+          node scripts/releasing/patch-create-comment.js
+
+      - name: 'Fail Workflow if Main Task Failed'
+        if: 'always() && steps.create_patch.outputs.EXIT_CODE != 0'
+        run: |
+          echo "Patch creation failed with exit code: ${{ steps.create_patch.outputs.EXIT_CODE }}"
+          echo "Check the logs above and the comment posted to the original PR for details."
+          exit 1

.github/workflows/release-patch-2-trigger.yml

@@ -0,0 +1,72 @@
+name: 'Release: Patch (2) Trigger'
+
+on:
+  pull_request:
+    types:
+      - 'closed'
+    branches:
+      - 'release/**'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'The head ref of the merged hotfix PR to trigger the release for (e.g. hotfix/v1.2.3/cherry-pick-abc).'
+        required: true
+        type: 'string'
+      workflow_ref:
+        description: 'The ref to checkout the workflow code from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      workflow_id:
+        description: 'The workflow to trigger. Defaults to patch-release.yml'
+        required: false
+        type: 'string'
+        default: 'release-patch-3-release.yml'
+      dry_run:
+        description: 'Whether this is a dry run.'
+        required: false
+        type: 'boolean'
+        default: false
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+
+jobs:
+  trigger-patch-release:
+    if: "(github.event_name == 'pull_request' && github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'hotfix/')) || github.event_name == 'workflow_dispatch'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      actions: 'write'
+      contents: 'write'
+      pull-requests: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: "${{ github.event.inputs.workflow_ref || 'main' }}"
+          fetch-depth: 1
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Trigger Patch Release'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          HEAD_REF: "${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.event.inputs.ref }}"
+          PR_BODY: "${{ github.event_name == 'pull_request' && github.event.pull_request.body || '' }}"
+          WORKFLOW_ID: '${{ github.event.inputs.workflow_id }}'
+          GITHUB_REPOSITORY_OWNER: '${{ github.repository_owner }}'
+          GITHUB_REPOSITORY_NAME: '${{ github.event.repository.name }}'
+          GITHUB_EVENT_NAME: '${{ github.event_name }}'
+          GITHUB_EVENT_PAYLOAD: '${{ toJSON(github.event) }}'
+          FORCE_SKIP_TESTS: '${{ github.event.inputs.force_skip_tests }}'
+        run: |
+          node scripts/releasing/patch-trigger.js

.github/workflows/release-patch-3-release.yml

@@ -0,0 +1,219 @@
+name: 'Release: Patch (3) Release'
+
+on:
+  workflow_dispatch:
+    inputs:
+      type:
+        description: 'The type of release to perform.'
+        required: true
+        type: 'choice'
+        options:
+          - 'stable'
+          - 'preview'
+      dry_run:
+        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
+        required: true
+        type: 'boolean'
+        default: true
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+      release_ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: true
+        type: 'string'
+      original_pr:
+        description: 'The original PR number to comment back on.'
+        required: false
+        type: 'string'
+
+jobs:
+  release:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: 'Checkout Release Code'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.release_ref }}'
+          path: 'release'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        working-directory: './release'
+        run: |-
+          npm ci
+
+      - name: 'Print Inputs'
+        shell: 'bash'
+        run: |-
+          echo "${{ toJSON(inputs) }}"
+
+      - name: 'Get Patch Version'
+        id: 'patch_version'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          # Use the existing get-release-version.js script to calculate patch version
+          # Run from main checkout which has full git history and access to npm
+          PATCH_JSON=$(node scripts/get-release-version.js --type=patch --patch-from=${{ github.event.inputs.type }})
+          echo "Patch version calculation result: ${PATCH_JSON}"
+
+          RELEASE_VERSION=$(echo "${PATCH_JSON}" | jq -r .releaseVersion)
+          RELEASE_TAG=$(echo "${PATCH_JSON}" | jq -r .releaseTag)
+          NPM_TAG=$(echo "${PATCH_JSON}" | jq -r .npmTag)
+          PREVIOUS_TAG=$(echo "${PATCH_JSON}" | jq -r .previousReleaseTag)
+
+          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> "${GITHUB_OUTPUT}"
+          echo "RELEASE_TAG=${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "NPM_TAG=${NPM_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_TAG=${PREVIOUS_TAG}" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Verify Version Consistency'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          CHANNEL: '${{ github.event.inputs.type }}'
+        run: |
+          echo "🔍 Verifying no concurrent patch releases have occurred..."
+
+          # Store original calculation for comparison
+          ORIGINAL_RELEASE_VERSION="${{ steps.patch_version.outputs.RELEASE_VERSION }}"
+          ORIGINAL_RELEASE_TAG="${{ steps.patch_version.outputs.RELEASE_TAG }}"
+          ORIGINAL_PREVIOUS_TAG="${{ steps.patch_version.outputs.PREVIOUS_TAG }}"
+
+          echo "Original calculation:"
+          echo "  Release version: ${ORIGINAL_RELEASE_VERSION}"
+          echo "  Release tag: ${ORIGINAL_RELEASE_TAG}"
+          echo "  Previous tag: ${ORIGINAL_PREVIOUS_TAG}"
+
+          # Re-run the same version calculation script
+          echo "Re-calculating version to check for changes..."
+          CURRENT_PATCH_JSON=$(node scripts/get-release-version.js --type=patch --patch-from="${CHANNEL}")
+          CURRENT_RELEASE_VERSION=$(echo "${CURRENT_PATCH_JSON}" | jq -r .releaseVersion)
+          CURRENT_RELEASE_TAG=$(echo "${CURRENT_PATCH_JSON}" | jq -r .releaseTag)
+          CURRENT_PREVIOUS_TAG=$(echo "${CURRENT_PATCH_JSON}" | jq -r .previousReleaseTag)
+
+          echo "Current calculation:"
+          echo "  Release version: ${CURRENT_RELEASE_VERSION}"
+          echo "  Release tag: ${CURRENT_RELEASE_TAG}"
+          echo "  Previous tag: ${CURRENT_PREVIOUS_TAG}"
+
+          # Compare calculations
+          if [[ "${ORIGINAL_RELEASE_VERSION}" != "${CURRENT_RELEASE_VERSION}" ]] || \
+             [[ "${ORIGINAL_RELEASE_TAG}" != "${CURRENT_RELEASE_TAG}" ]] || \
+             [[ "${ORIGINAL_PREVIOUS_TAG}" != "${CURRENT_PREVIOUS_TAG}" ]]; then
+            echo "❌ RACE CONDITION DETECTED: Version calculations have changed!"
+            echo "This indicates another patch release completed while this one was in progress."
+            echo ""
+            echo "Originally planned:  ${ORIGINAL_RELEASE_VERSION} (from ${ORIGINAL_PREVIOUS_TAG})"
+            echo "Should now build:    ${CURRENT_RELEASE_VERSION} (from ${CURRENT_PREVIOUS_TAG})"
+            echo ""
+            echo "# Setting outputs for failure comment"
+            echo "CURRENT_RELEASE_VERSION=${CURRENT_RELEASE_VERSION}" >> "${GITHUB_ENV}"
+            echo "CURRENT_RELEASE_TAG=${CURRENT_RELEASE_TAG}" >> "${GITHUB_ENV}"
+            echo "CURRENT_PREVIOUS_TAG=${CURRENT_PREVIOUS_TAG}" >> "${GITHUB_ENV}"
+            echo "The patch release must be restarted to use the correct version numbers."
+            exit 1
+          fi
+
+          echo "✅ Version calculations unchanged - proceeding with release"
+
+      - name: 'Print Calculated Version'
+        run: |-
+          echo "Patch Release Summary:"
+          echo "  Release Version: ${{ steps.patch_version.outputs.RELEASE_VERSION }}"
+          echo "  Release Tag: ${{ steps.patch_version.outputs.RELEASE_TAG }}"
+          echo "  NPM Tag: ${{ steps.patch_version.outputs.NPM_TAG }}"
+          echo "  Previous Tag: ${{ steps.patch_version.outputs.PREVIOUS_TAG }}"
+
+      - name: 'Run Tests'
+        uses: './.github/actions/run-tests'
+        with:
+          force_skip_tests: '${{ github.event.inputs.force_skip_tests }}'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          working-directory: './release'
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          release-version: '${{ steps.patch_version.outputs.RELEASE_VERSION }}'
+          release-tag: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          npm-tag: '${{ steps.patch_version.outputs.NPM_TAG }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ steps.patch_version.outputs.PREVIOUS_TAG }}'
+          working-directory: './release'
+
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry_run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Patch Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')' \
+            --body 'The patch-release workflow failed. See the full run for details: ${DETAILS_URL}' \
+            --label 'kind/bug,release-failure,priority/p0'
+
+      - name: 'Comment Success on Original PR'
+        if: '${{ success() && github.event.inputs.original_pr }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ORIGINAL_PR: '${{ github.event.inputs.original_pr }}'
+          SUCCESS: 'true'
+          RELEASE_VERSION: '${{ steps.patch_version.outputs.RELEASE_VERSION }}'
+          RELEASE_TAG: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          NPM_TAG: '${{ steps.patch_version.outputs.NPM_TAG }}'
+          CHANNEL: '${{ github.event.inputs.type }}'
+          DRY_RUN: '${{ github.event.inputs.dry_run }}'
+          GITHUB_RUN_ID: '${{ github.run_id }}'
+          GITHUB_REPOSITORY_OWNER: '${{ github.repository_owner }}'
+          GITHUB_REPOSITORY_NAME: '${{ github.event.repository.name }}'
+        run: |
+          node scripts/releasing/patch-comment.js
+
+      - name: 'Comment Failure on Original PR'
+        if: '${{ failure() && github.event.inputs.original_pr }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ORIGINAL_PR: '${{ github.event.inputs.original_pr }}'
+          SUCCESS: 'false'
+          RELEASE_VERSION: '${{ steps.patch_version.outputs.RELEASE_VERSION }}'
+          RELEASE_TAG: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          NPM_TAG: '${{ steps.patch_version.outputs.NPM_TAG }}'
+          CHANNEL: '${{ github.event.inputs.type }}'
+          DRY_RUN: '${{ github.event.inputs.dry_run }}'
+          GITHUB_RUN_ID: '${{ github.run_id }}'
+          GITHUB_REPOSITORY_OWNER: '${{ github.repository_owner }}'
+          GITHUB_REPOSITORY_NAME: '${{ github.event.repository.name }}'
+          # Pass current version info for race condition failures
+          CURRENT_RELEASE_VERSION: '${{ env.CURRENT_RELEASE_VERSION }}'
+          CURRENT_RELEASE_TAG: '${{ env.CURRENT_RELEASE_TAG }}'
+          CURRENT_PREVIOUS_TAG: '${{ env.CURRENT_PREVIOUS_TAG }}'
+        run: |
+          # Check if this was a version consistency failure
+          if [[ -n "${CURRENT_RELEASE_VERSION}" ]]; then
+            echo "Detected version race condition failure - posting specific comment with current version info"
+            export RACE_CONDITION_FAILURE=true
+          fi
+          node scripts/releasing/patch-comment.js

.github/workflows/release-patch-from-comment.yml

@@ -0,0 +1,187 @@
+name: 'Release: Patch from Comment'
+
+on:
+  issue_comment:
+    types: ['created']
+
+jobs:
+  slash-command:
+    runs-on: 'ubuntu-latest'
+    # Only run if the comment is from a human user (not automated)
+    if: "github.event.comment.user.type == 'User' && github.event.comment.user.login != 'github-actions[bot]'"
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+      actions: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          fetch-depth: 1
+
+      - name: 'Slash Command Dispatch'
+        id: 'slash_command'
+        uses: 'peter-evans/slash-command-dispatch@40877f718dce0101edfc7aea2b3800cc192f9ed5'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          commands: 'patch'
+          permission: 'write'
+          issue-type: 'pull-request'
+
+      - name: 'Get PR Status'
+        id: 'pr_status'
+        if: "startsWith(github.event.comment.body, '/patch')"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          gh pr view "${{ github.event.issue.number }}" --json mergeCommit,state > pr_status.json
+          echo "MERGE_COMMIT_SHA=$(jq -r .mergeCommit.oid pr_status.json)" >> "$GITHUB_OUTPUT"
+          echo "STATE=$(jq -r .state pr_status.json)" >> "$GITHUB_OUTPUT"
+
+      - name: 'Dispatch if Merged'
+        if: "steps.pr_status.outputs.STATE == 'MERGED'"
+        id: 'dispatch_patch'
+        uses: 'actions/github-script@00f12e3e20659f42342b1c0226afda7f7c042325'
+        env:
+          COMMENT_BODY: '${{ github.event.comment.body }}'
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          script: |
+            // Parse the comment body directly to extract channel(s)
+            const commentBody = process.env.COMMENT_BODY;
+            console.log('Comment body:', commentBody);
+
+            let channels = ['stable', 'preview'];  // default to both
+
+            // Parse different formats:
+            // /patch (defaults to both)
+            // /patch both
+            // /patch stable
+            // /patch preview
+            if (commentBody.trim() === '/patch' || commentBody.trim() === '/patch both') {
+              channels = ['stable', 'preview'];
+            } else if (commentBody.trim() === '/patch stable') {
+              channels = ['stable'];
+            } else if (commentBody.trim() === '/patch preview') {
+              channels = ['preview'];
+            } else {
+              // Fallback parsing for legacy formats
+              if (commentBody.includes('channel=preview')) {
+                channels = ['preview'];
+              } else if (commentBody.includes('--channel preview')) {
+                channels = ['preview'];
+              }
+            }
+
+            console.log('Detected channels:', channels);
+
+            const dispatchedRuns = [];
+
+            // Dispatch workflow for each channel
+            for (const channel of channels) {
+              console.log(`Dispatching workflow for channel: ${channel}`);
+
+              const response = await github.rest.actions.createWorkflowDispatch({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'release-patch-1-create-pr.yml',
+                ref: 'main',
+                inputs: {
+                  commit: '${{ steps.pr_status.outputs.MERGE_COMMIT_SHA }}',
+                  channel: channel,
+                  original_pr: '${{ github.event.issue.number }}'
+                }
+              });
+
+              dispatchedRuns.push({ channel, response });
+            }
+
+            // Wait a moment for the workflows to be created
+            await new Promise(resolve => setTimeout(resolve, 3000));
+
+            const runs = await github.rest.actions.listWorkflowRuns({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release-patch-1-create-pr.yml',
+              per_page: 20  // Increased to handle multiple runs
+            });
+
+            // Find the recent runs that match our trigger
+            const recentRuns = runs.data.workflow_runs.filter(run =>
+              run.event === 'workflow_dispatch' &&
+              new Date(run.created_at) > new Date(Date.now() - 15000) // Within last 15 seconds
+            ).slice(0, channels.length); // Limit to the number of channels we dispatched
+
+            // Set outputs
+            core.setOutput('dispatched_channels', channels.join(','));
+            core.setOutput('dispatched_run_count', channels.length.toString());
+
+            if (recentRuns.length > 0) {
+              core.setOutput('dispatched_run_urls', recentRuns.map(r => r.html_url).join(','));
+              core.setOutput('dispatched_run_ids', recentRuns.map(r => r.id).join(','));
+            }
+
+      - name: 'Comment on Failure'
+        if: "startsWith(github.event.comment.body, '/patch') && steps.pr_status.outputs.STATE != 'MERGED'"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            :x: The `/patch` command failed. This pull request must be merged before a patch can be created.
+
+      - name: 'Final Status Comment - Success'
+        if: "always() && startsWith(github.event.comment.body, '/patch') && steps.dispatch_patch.outcome == 'success' && steps.dispatch_patch.outputs.dispatched_run_urls"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            ✅ **Patch workflow(s) dispatched successfully!**
+
+            **📋 Details:**
+            - **Channels**: `${{ steps.dispatch_patch.outputs.dispatched_channels }}`
+            - **Commit**: `${{ steps.pr_status.outputs.MERGE_COMMIT_SHA }}`
+            - **Workflows Created**: ${{ steps.dispatch_patch.outputs.dispatched_run_count }}
+
+            **🔗 Track Progress:**
+            - [View patch workflows](https://github.com/${{ github.repository }}/actions/workflows/release-patch-1-create-pr.yml)
+            - [This workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+
+      - name: 'Final Status Comment - Dispatch Success (No URL)'
+        if: "always() && startsWith(github.event.comment.body, '/patch') && steps.dispatch_patch.outcome == 'success' && !steps.dispatch_patch.outputs.dispatched_run_urls"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            ✅ **Patch workflow(s) dispatched successfully!**
+
+            **📋 Details:**
+            - **Channels**: `${{ steps.dispatch_patch.outputs.dispatched_channels }}`
+            - **Commit**: `${{ steps.pr_status.outputs.MERGE_COMMIT_SHA }}`
+            - **Workflows Created**: ${{ steps.dispatch_patch.outputs.dispatched_run_count }}
+
+            **🔗 Track Progress:**
+            - [View patch workflows](https://github.com/${{ github.repository }}/actions/workflows/release-patch-1-create-pr.yml)
+            - [This workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+
+      - name: 'Final Status Comment - Failure'
+        if: "always() && startsWith(github.event.comment.body, '/patch') && (steps.dispatch_patch.outcome == 'failure' || steps.dispatch_patch.outcome == 'cancelled')"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            ❌ **Patch workflow dispatch failed!**
+
+            There was an error dispatching the patch creation workflow.
+
+            **🔍 Troubleshooting:**
+            - Check that the PR is properly merged
+            - Verify workflow permissions
+            - Review error logs in the workflow run
+
+            **🔗 Debug Links:**
+            - [This workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+            - [Patch workflow history](https://github.com/${{ github.repository }}/actions/workflows/release-patch-1-create-pr.yml)

.github/workflows/release-promote.yml

@@ -1,4 +1,4 @@
-name: 'Promote Release'
+name: 'Release: Promote'
 
 on:
   workflow_dispatch:
@@ -303,9 +303,6 @@ jobs:
           DRY_RUN: '${{ github.event.inputs.dry_run }}'
         run: |-
           git add package.json packages/*/package.json
-          if [ -f npm-shrinkwrap.json ]; then
-            git add npm-shrinkwrap.json
-          fi
           if [ -f package-lock.json ]; then
             git add package-lock.json
           fi
@@ -317,20 +314,15 @@ jobs:
             echo "Dry run enabled. Skipping push."
           fi
 
-      - name: 'Create and Approve Pull Request'
-        if: |-
-          ${{ github.event.inputs.dry_run == 'false' }}
-        env:
-          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
-        run: |
-          gh pr create \
-            --title "chore(release): bump version to ${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}" \
-            --body "Automated version bump to prepare for the next nightly release." \
-            --base "main" \
-            --head "${BRANCH_NAME}" \
-            --fill
-          gh pr merge --auto --squash
+      - name: 'Create and Merge Pull Request'
+        uses: './.github/actions/create-pull-request'
+        with:
+          branch-name: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
+          pr-title: 'chore(release): bump version to ${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
+          pr-body: 'Automated version bump to prepare for the next nightly release.'
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
 
       - name: 'Create Issue on Failure'
         if: '${{ failure() && github.event.inputs.dry_run == false }}'

.github/workflows/release-sandbox.yml

@@ -0,0 +1,33 @@
+name: 'Release Sandbox'
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      dry-run:
+        description: 'Whether this is a dry run.'
+        required: false
+        type: 'boolean'
+        default: true
+
+jobs:
+  build:
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref || github.sha }}'
+          fetch-depth: 0
+      - name: 'Push'
+        uses: './.github/actions/push-sandbox'
+        with:
+          github-actor: '${{ github.actor }}'
+          github-secret: '${{ secrets.GITHUB_TOKEN }}'
+          github-sha: '${{ github.event.inputs.ref || github.sha }}'
+          github-ref-name: '${{github.event.inputs.ref}}'
+          dry-run: '${{ github.event.inputs.dry-run }}'

.github/workflows/release.yml

@@ -1,202 +0,0 @@
-name: 'Release'
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'The version to release (e.g., v0.1.11).'
-        required: true
-        type: 'string'
-      ref:
-        description: 'The branch or ref (full git sha) to release from.'
-        required: true
-        type: 'string'
-        default: 'main'
-      dry_run:
-        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
-        required: true
-        type: 'boolean'
-        default: true
-      force_skip_tests:
-        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
-        required: false
-        type: 'boolean'
-        default: false
-
-jobs:
-  release:
-    runs-on: 'ubuntu-latest'
-    environment:
-      name: 'production-release'
-      url: '${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ steps.version.outputs.RELEASE_TAG }}'
-    if: |-
-      ${{ github.repository == 'google-gemini/gemini-cli' }}
-    permissions:
-      contents: 'write'
-      packages: 'write'
-      id-token: 'write'
-      issues: 'write' # For creating issues on failure
-    outputs:
-      RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          ref: '${{ github.event.inputs.ref || github.sha }}'
-          fetch-depth: 0
-
-      - name: 'Set booleans for simplified logic'
-        env:
-          DRY_RUN_INPUT: '${{ github.event.inputs.dry_run }}'
-        id: 'vars'
-        run: |-
-          is_dry_run="false"
-          if [[ "${DRY_RUN_INPUT}" == "true" ]]; then
-            is_dry_run="true"
-          fi
-          echo "is_dry_run=${is_dry_run}" >> "${GITHUB_OUTPUT}"
-
-      - name: 'Setup Node.js'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
-        with:
-          node-version-file: '.nvmrc'
-          cache: 'npm'
-
-      - name: 'Install Dependencies'
-        run: |-
-          npm ci
-
-      - name: 'Get the version'
-        id: 'version'
-        run: |-
-          RELEASE_TAG="${{ inputs.version }}"
-          # The version for npm should not have the 'v' prefix.
-          RELEASE_VERSION="${RELEASE_TAG#v}"
-          NPM_TAG="latest"
-          if [[ "${RELEASE_TAG}" == *"preview"* ]]; then
-            NPM_TAG="preview"
-          fi
-          PREVIOUS_TAG=$(git describe --tags --abbrev=0)
-          echo "RELEASE_TAG=${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
-          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> "${GITHUB_OUTPUT}"
-          echo "NPM_TAG=${NPM_TAG}" >> "${GITHUB_OUTPUT}"
-          echo "PREVIOUS_TAG=${PREVIOUS_TAG}" >> "${GITHUB_OUTPUT}"
-
-      - name: 'Run Tests'
-        if: |-
-          ${{ github.event.inputs.force_skip_tests != 'true' }}
-        env:
-          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-        run: |-
-          npm run preflight
-          npm run test:integration:sandbox:none
-          npm run test:integration:sandbox:docker
-
-      - name: 'Configure Git User'
-        run: |-
-          git config user.name "gemini-cli-robot"
-          git config user.email "gemini-cli-robot@google.com"
-
-      - name: 'Create and switch to a release branch'
-        id: 'release_branch'
-        env:
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-        run: |-
-          BRANCH_NAME="release/${RELEASE_TAG}"
-          git switch -c "${BRANCH_NAME}"
-          echo "BRANCH_NAME=${BRANCH_NAME}" >> "${GITHUB_OUTPUT}"
-
-      - name: 'Update package versions'
-        env:
-          RELEASE_VERSION: '${{ steps.version.outputs.RELEASE_VERSION }}'
-        run: |-
-          npm run release:version "${RELEASE_VERSION}"
-
-      - name: 'Commit and Conditionally Push package versions'
-        env:
-          BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
-          IS_DRY_RUN: '${{ steps.vars.outputs.is_dry_run }}'
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-        run: |-
-          git add package.json npm-shrinkwrap.json packages/*/package.json
-          git commit -m "chore(release): ${RELEASE_TAG}"
-          if [[ "${IS_DRY_RUN}" == "false" ]]; then
-            echo "Pushing release branch to remote..."
-            git push --set-upstream origin "${BRANCH_NAME}" --follow-tags
-          else
-            echo "Dry run enabled. Skipping push."
-          fi
-
-      - name: 'Build and Prepare Packages'
-        run: |-
-          npm run build:packages
-          npm run prepare:package
-
-      - name: 'Configure npm for publishing'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
-        with:
-          node-version-file: '.nvmrc'
-          registry-url: 'https://wombat-dressing-room.appspot.com'
-          scope: '@google'
-
-      - name: 'Publish @google/gemini-cli-core'
-        env:
-          IS_DRY_RUN: '${{ steps.vars.outputs.is_dry_run }}'
-          NODE_AUTH_TOKEN: '${{ secrets.WOMBAT_TOKEN_CORE }}'
-          NPM_TAG: '${{ steps.version.outputs.NPM_TAG }}'
-        run: |-
-          npm publish \
-            --dry-run="${IS_DRY_RUN}" \
-            --workspace="@google/gemini-cli-core" \
-            --tag="${NPM_TAG}"
-
-      - name: 'Install latest core package'
-        if: |-
-          ${{ steps.vars.outputs.is_dry_run == 'false' }}
-        env:
-          RELEASE_VERSION: '${{ steps.version.outputs.RELEASE_VERSION }}'
-        run: |-
-          npm install "@google/gemini-cli-core@${RELEASE_VERSION}" \
-          --workspace="@google/gemini-cli" \
-          --save-exact
-
-      - name: 'Publish @google/gemini-cli'
-        env:
-          IS_DRY_RUN: '${{ steps.vars.outputs.is_dry_run }}'
-          NODE_AUTH_TOKEN: '${{ secrets.WOMBAT_TOKEN_CLI }}'
-          NPM_TAG: '${{ steps.version.outputs.NPM_TAG }}'
-        run: |-
-          npm publish \
-            --dry-run="${IS_DRY_RUN}" \
-            --workspace="@google/gemini-cli" \
-            --tag="${NPM_TAG}"
-
-      - name: 'Create GitHub Release and Tag'
-        if: |-
-          ${{ steps.vars.outputs.is_dry_run == 'false' }}
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          RELEASE_BRANCH: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-          PREVIOUS_TAG: '${{ steps.version.outputs.PREVIOUS_TAG }}'
-        run: |-
-          gh release create "${RELEASE_TAG}" \
-            bundle/gemini.js \
-            --target "$RELEASE_BRANCH" \
-            --title "Release ${RELEASE_TAG}" \
-            --notes-start-tag "$PREVIOUS_TAG" \
-            --generate-notes
-
-      - name: 'Create Issue on Failure'
-        if: |-
-          ${{ failure() }}
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }} || "N/A"'
-          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
-        run: |-
-          gh issue create \
-            --title "Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')" \
-            --body "The release workflow failed. See the full run for details: ${DETAILS_URL}" \
-            --label "kind/bug,release-failure,priority/p0"

.github/workflows/trigger-patch-release.yml

@@ -1,30 +0,0 @@
-name: 'Trigger Patch Release'
-
-on:
-  pull_request:
-    types:
-      - 'closed'
-
-jobs:
-  trigger-patch-release:
-    if: "github.event.pull_request.merged == true && startsWith(github.head_ref, 'hotfix/')"
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Trigger Patch Release'
-        uses: 'actions/github-script@00f12e3e20659f42342b1c0226afda7f7c042325'
-        with:
-          script: |
-            const body = context.payload.pull_request.body;
-            const isDryRun = body.includes('[DRY RUN]');
-            const ref = context.payload.pull_request.base.ref;
-            const channel = ref.includes('preview') ? 'preview' : 'stable';
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'patch-release.yml',
-              ref: ref,
-              inputs: {
-                type: channel,
-                dry_run: isDryRun.toString()
-              }
-            })

.github/workflows/verify-release.yml

@@ -0,0 +1,31 @@
+name: 'Verify NPM release tag'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The expected Gemini binary version that should be released (e.g., 0.5.0-preview-2).'
+        required: true
+        type: 'string'
+      npm-package:
+        description: 'NPM package to verify'
+        required: true
+        type: 'string'
+        default: '@google/gemini-cli@latest'
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: false
+        type: 'string'
+        default: 'main'
+
+jobs:
+  build:
+    runs-on: 'ubuntu-latest'
+    steps:
+      - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+      - name: 'Verify release'
+        uses: './.github/actions/verify-release'
+        with:
+          npm-package: '${github.event.inputs.npm-package}'
+          expected-version: '${github.event.inputs.version}'
+          ref: '${github.event.inputs.ref}'

.prettierignore

@@ -17,5 +17,4 @@ eslint.config.js
 **/generated
 gha-creds-*.json
 junit.xml
-npm-shrinkwrap.json
 Thumbs.db

docs/cli/configuration.md

@@ -203,9 +203,9 @@ Settings are organized into categories. All settings should be placed within the
   - **Description:** Sandbox execution environment (can be a boolean or a path string).
   - **Default:** `undefined`
 
-- **`tools.usePty`** (boolean):
-  - **Description:** Use node-pty for shell command execution. Fallback to child_process still applies.
-  - **Default:** `false`
+- **`tools.shell.enableInteractiveShell`** (boolean):
+
+  Use `node-pty` for an interactive shell experience. Fallback to `child_process` still applies. Defaults to `false`.
 
 - **`tools.core`** (array of strings):
   - **Description:** This can be used to restrict the set of built-in tools [with an allowlist](./enterprise.md#restricting-tool-access). See [Built-in Tools](../core/tools-api.md#built-in-tools) for a list of core tools. The match semantics are the same as `tools.allowed`.

docs/extension-releasing.md

@@ -0,0 +1,121 @@
+# Extension Releasing
+
+There are two primary ways of releasing extensions to users:
+
+- [Git repository](#releasing-through-a-git-repository)
+- [Github Releases](#releasing-through-github-releases)
+
+Git repository releases tend to be the simplest and most flexible approach, while GitHub releases can be more efficient on initial install as they are shipped as single archives instead of requiring a git clone which downloads each file individually. Github releases may also contain platform specific archives if you need to ship platform specific binary files.
+
+## Releasing through a git repository
+
+This is the most flexible and simple option. All you need to do us create a publicly accessible git repo (such as a public github repository) and then users can install your extension using `gemini extensions install <your-repo-uri>`, or for a GitHub repository they can use the simplified `gemini extensions install <org>/<repo>` format. They can optionally depend on a specific ref (branch/tag/commit) using the `--ref=<some-ref>` argument, this defaults to the default branch.
+
+Whenever commits are pushed to the ref that a user depends on, they will be prompted to update the extension. Note that this also allows for easy rollbacks, the HEAD commit is always treated as the latest version regardless of the actual version in the `gemini-extension.json` file.
+
+### Managing release channels using a git repository
+
+Users can depend on any ref from your git repo, such as a branch or tag, which allows you to manage multiple release channels.
+
+For instance, you can maintain a `stable` branch, which users can install this way `gemini extensions install <your-repo-uri> --ref=stable`. Or, you could make this the default by treating your default branch as your stable release branch, and doing development in a different branch (for instance called `dev`). You can maintain as many branches or tags as you like, providing maximum flexibility for you and your users.
+
+Note that these `ref` arguments can be tags, branches, or even specific commits, which allows users to depend on a specific version of your extension. It is up to you how you want to manage your tags and branches.
+
+### Example releasing flow using a git repo
+
+While there are many options for how you want to manage releases using a git flow, we recommend treating your default branch as your "stable" release branch. This means that the default behavior for `gemini extensions install <your-repo-uri>` is to be on the stable release branch.
+
+Lets say you want to maintain three standard release channels, `stable`, `preview`, and `dev`. You would do all your standard development in the `dev` branch. When you are ready to do a preview release, you merge that branch into your `preview` branch. When you are ready to promote your preview branch to stable, you merge `preview` into your stable branch (which might be your default branch or a different branch).
+
+You can also cherry pick changes from one branch into another using `git cherry-pick`, but do note that this will result in your branches having a slightly divergent history from each other, unless you force push changes to your branches on each release to restore the history to a clean slate (which may not be possible for the default branch depending on your repository settings). If you plan on doing cherry picks, you may want to avoid having your default branch be the stable branch to avoid force-pushing to the default branch which should generally be avoided.
+
+## Releasing through Github releases
+
+Gemini CLI extensions can be distributed through [GitHub Releases](https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases). This provides a faster and more reliable initial installation experience for users, as it avoids the need to clone the repository.
+
+Each release includes at least one archive file, which contains the full contents of the repo at the tag that it was linked to. Releases may also include [pre-built archives](#custom-pre-built-archives) if your extension requires some build step or has platform specific binaries attached to it.
+
+When checking for updates, gemini will just look for the latest release on github (you must mark it as such when creating the release), unless the user installed a specific release by passing `--ref=<some-release-tag>`. We do not at this time support opting in to pre-release releases or semver.
+
+### Custom pre-built archives
+
+Custom archives must be attached directly to the github release as assets and must be fully self-contained. This means they should include the entire extension, see [archive structure](#archive-structure).
+
+If your extension is platform-independent, you can provide a single generic asset. In this case, there should be only one asset attached to the release.
+
+Custom archives may also be used if you want to develop your extension within a larger repository, you can build an archive which has a different layout from the repo itself (for instance it might just be an archive of a subdirectory containing the extension).
+
+#### Platform specific archives
+
+To ensure Gemini CLI can automatically find the correct release asset for each platform, you must follow this naming convention. The CLI will search for assets in the following order:
+
+1.  **Platform and Architecture-Specific:** `{platform}.{arch}.{name}.{extension}`
+2.  **Platform-Specific:** `{platform}.{name}.{extension}`
+3.  **Generic:** If only one asset is provided, it will be used as a generic fallback.
+
+- `{name}`: The name of your extension.
+- `{platform}`: The operating system. Supported values are:
+  - `darwin` (macOS)
+  - `linux`
+  - `win32` (Windows)
+- `{arch}`: The architecture. Supported values are:
+  - `x64`
+  - `arm64`
+- `{extension}`: The file extension of the archive (e.g., `.tar.gz` or `.zip`).
+
+**Examples:**
+
+- `darwin.arm64.my-tool.tar.gz` (specific to Apple Silicon Macs)
+- `darwin.my-tool.tar.gz` (for all Macs)
+- `linux.x64.my-tool.tar.gz`
+- `win32.my-tool.zip`
+
+#### Archive structure
+
+Archives must be fully contained extensions and have all the standard requirements - specifically the `gemini-extension.json` file must be at the root of the archive.
+
+The rest of the layout should look exactly the same as a typical extension, see [extensions.md](extension.md).
+
+#### Example GitHub Actions workflow
+
+Here is an example of a GitHub Actions workflow that builds and releases a Gemini CLI extension for multiple platforms:
+
+```yaml
+name: Release Extension
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build extension
+        run: npm run build
+
+      - name: Create release assets
+        run: |
+          npm run package -- --platform=darwin --arch=arm64
+          npm run package -- --platform=linux --arch=x64
+          npm run package -- --platform=win32 --arch=x64
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            release/darwin.arm64.my-tool.tar.gz
+            release/linux.arm64.my-tool.tar.gz
+            release/win32.arm64.my-tool.zip
+```

docs/extension.md

@@ -36,11 +36,13 @@ gemini extensions uninstall gemini-cli-security
 
 Extensions are, by default, enabled across all workspaces. You can disable an extension entirely or for specific workspace.
 
-For example, `gemini extensions disable extension-name` will disable the extension at the user level, so it will be disabled everywhere. `gemini extensions disable extension-name --scope=Workspace` will only disable the extension in the current workspace.
+For example, `gemini extensions disable extension-name` will disable the extension at the user level, so it will be disabled everywhere. `gemini extensions disable extension-name --scope=workspace` will only disable the extension in the current workspace.
 
 ### Enabling an extension
 
-You can re-enable extensions using `gemini extensions enable extension-name`. Note that if an extension is disabled at the user-level, enabling it at the workspace level will not do anything.
+You can enable extensions using `gemini extensions enable extension-name`. You can also enable an extension for a specific workspace using `gemini extensions enable extension-name --scope=workspace` from within that workspace.
+
+This is useful if you have an extension disabled at the top-level and only enabled in specific places.
 
 ### Updating an extension
 
@@ -105,8 +107,9 @@ The `gemini-extension.json` file contains the configuration for the extension. T
 - `name`: The name of the extension. This is used to uniquely identify the extension and for conflict resolution when extension commands have the same name as user or project commands. The name should be lowercase and use dashes instead of underscores or spaces. This is how users will refer to your extension in the CLI. Note that we expect this name to match the extension directory name.
 - `version`: The version of the extension.
 - `mcpServers`: A map of MCP servers to configure. The key is the name of the server, and the value is the server configuration. These servers will be loaded on startup just like MCP servers configured in a [`settings.json` file](./cli/configuration.md). If both an extension and a `settings.json` file configure an MCP server with the same name, the server defined in the `settings.json` file takes precedence.
+  - Note that all MCP server configuration options are supported except for `trust`.
 - `contextFileName`: The name of the file that contains the context for the extension. This will be used to load the context from the extension directory. If this property is not used but a `GEMINI.md` file is present in your extension directory, then that file will be loaded.
-- `excludeTools`: An array of tool names to exclude from the model. You can also specify command-specific restrictions for tools that support it, like the `run_shell_command` tool. For example, `"excludeTools": ["run_shell_command(rm -rf)"]` will block the `rm -rf` command.
+- `excludeTools`: An array of tool names to exclude from the model. You can also specify command-specific restrictions for tools that support it, like the `run_shell_command` tool. For example, `"excludeTools": ["run_shell_command(rm -rf)"]` will block the `rm -rf` command. Note that this differs from the MCP server `excludeTools` functionality, which can be listed in the MCP server config.
 
 When Gemini CLI starts, it loads all the extensions and merges their configurations. If there are any conflicts, the workspace configuration takes precedence.
 

docs/telemetry.md

@@ -307,6 +307,15 @@ for Gemini CLI:
     - `command` (string)
     - `subcommand` (string, if applicable)
 
+- `gemini_cli.extension_enable`: This event occurs when an extension is enabled
+- `gemini_cli.extension_install`: This event occurs when an extension is installed
+  - **Attributes**:
+    - `extension_name` (string)
+    - `extension_version` (string)
+    - `extension_source` (string)
+    - `status` (string)
+- `gemini_cli.extension_uninstall`: This event occurs when an extension is uninstalled
+
 ### Metrics
 
 Metrics are numerical measurements of behavior over time. The following metrics are collected for Gemini CLI:

docs/tools/shell.md

@@ -4,7 +4,7 @@ This document describes the `run_shell_command` tool for the Gemini CLI.
 
 ## Description
 
-Use `run_shell_command` to interact with the underlying system, run scripts, or perform command-line operations. `run_shell_command` executes a given shell command, including interactive commands that require user input (e.g., `vim`, `git rebase -i`) if the `tools.usePty` setting is set to `true`.
+Use `run_shell_command` to interact with the underlying system, run scripts, or perform command-line operations. `run_shell_command` executes a given shell command, including interactive commands that require user input (e.g., `vim`, `git rebase -i`) if the `tools.shell.enableInteractiveShell` setting is set to `true`.
 
 On Windows, commands are executed with `cmd.exe /c`. On other platforms, they are executed with `bash -c`.
 
@@ -61,21 +61,23 @@ You can configure the behavior of the `run_shell_command` tool by modifying your
 
 ### Enabling Interactive Commands
 
-To enable interactive commands, you need to set the `tools.usePty` setting to `true`. This will use `node-pty` for shell command execution, which allows for interactive sessions. If `node-pty` is not available, it will fall back to the `child_process` implementation, which does not support interactive commands.
+To enable interactive commands, you need to set the `tools.shell.enableInteractiveShell` setting to `true`. This will use `node-pty` for shell command execution, which allows for interactive sessions. If `node-pty` is not available, it will fall back to the `child_process` implementation, which does not support interactive commands.
 
 **Example `settings.json`:**
 
 ```json
 {
   "tools": {
-    "usePty": true
+    "shell": {
+      "enableInteractiveShell": true
+    }
   }
 }
 ```
 
 ### Showing Color in Output
 
-To show color in the shell output, you need to set the `tools.shell.showColor` setting to `true`. **Note: This setting only applies when `tools.usePty` is enabled.**
+To show color in the shell output, you need to set the `tools.shell.showColor` setting to `true`. **Note: This setting only applies when `tools.shell.enableInteractiveShell` is enabled.**
 
 **Example `settings.json`:**
 
@@ -91,7 +93,7 @@ To show color in the shell output, you need to set the `tools.shell.showColor` s
 
 ### Setting the Pager
 
-You can set a custom pager for the shell output by setting the `tools.shell.pager` setting. The default pager is `cat`. **Note: This setting only applies when `tools.usePty` is enabled.**
+You can set a custom pager for the shell output by setting the `tools.shell.pager` setting. The default pager is `cat`. **Note: This setting only applies when `tools.shell.enableInteractiveShell` is enabled.**
 
 **Example `settings.json`:**
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.6.0-nightly",
+  "version": "0.6.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@google/gemini-cli",
-      "version": "0.6.0-nightly",
+      "version": "0.6.0",
       "workspaces": [
         "packages/*"
       ],
@@ -1655,51 +1655,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@inquirer/core/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@inquirer/core/node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@inquirer/core/node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@inquirer/core/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/@inquirer/core/node_modules/type-fest": {
       "version": "0.21.3",
       "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
@@ -1713,21 +1668,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@inquirer/core/node_modules/wrap-ansi": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
-      "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/@inquirer/figures": {
       "version": "1.0.13",
       "resolved": "https://registry.npmjs.org/@inquirer/figures/-/figures-1.0.13.tgz",
@@ -9764,23 +9704,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/ink/node_modules/wrap-ansi": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.0.tgz",
-      "integrity": "sha512-G8ura3S+3Z2G+mkgNRq8dqaFZAuxfsxpBB8OCTGRTCtp+l/v9nbFNmCUP1BZMts3G1142MsZfn6eeUKrr4PD1Q==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^6.2.1",
-        "string-width": "^7.0.0",
-        "strip-ansi": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
     "node_modules/internal-slot": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.1.0.tgz",
@@ -15263,18 +15186,6 @@
         "url": "https://github.com/yeoman/update-notifier?sponsor=1"
       }
     },
-    "node_modules/update-notifier/node_modules/ansi-styles": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.1.tgz",
-      "integrity": "sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
     "node_modules/update-notifier/node_modules/boxen": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/boxen/-/boxen-8.0.1.tgz",
@@ -15371,23 +15282,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/update-notifier/node_modules/wrap-ansi": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.0.tgz",
-      "integrity": "sha512-G8ura3S+3Z2G+mkgNRq8dqaFZAuxfsxpBB8OCTGRTCtp+l/v9nbFNmCUP1BZMts3G1142MsZfn6eeUKrr4PD1Q==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^6.2.1",
-        "string-width": "^7.0.0",
-        "strip-ansi": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
     "node_modules/uri-js": {
       "version": "4.4.1",
       "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
@@ -15943,17 +15837,17 @@
       }
     },
     "node_modules/wrap-ansi": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
-      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+      "version": "9.0.2",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.2.tgz",
+      "integrity": "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==",
       "license": "MIT",
       "dependencies": {
-        "ansi-styles": "^6.1.0",
-        "string-width": "^5.0.1",
-        "strip-ansi": "^7.0.1"
+        "ansi-styles": "^6.2.1",
+        "string-width": "^7.0.0",
+        "strip-ansi": "^7.1.0"
       },
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       },
       "funding": {
         "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
@@ -16030,6 +15924,29 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/wrap-ansi/node_modules/emoji-regex": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.5.0.tgz",
+      "integrity": "sha512-lb49vf1Xzfx080OKA0o6l8DQQpV+6Vg95zyCJX9VB/BqKYlhG7N4wgROUUHRA+ZPUefLnteQOad7z1kT2bV7bg==",
+      "license": "MIT"
+    },
+    "node_modules/wrap-ansi/node_modules/string-width": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz",
+      "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==",
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^10.3.0",
+        "get-east-asian-width": "^1.0.0",
+        "strip-ansi": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
@@ -16279,7 +16196,7 @@
     },
     "packages/a2a-server": {
       "name": "@google/gemini-cli-a2a-server",
-      "version": "0.6.0-nightly",
+      "version": "0.6.0",
       "dependencies": {
         "@a2a-js/sdk": "^0.3.2",
         "@google-cloud/storage": "^7.16.0",
@@ -16550,7 +16467,7 @@
     },
     "packages/cli": {
       "name": "@google/gemini-cli",
-      "version": "0.6.0-nightly",
+      "version": "0.6.0",
       "dependencies": {
         "@google/gemini-cli-core": "file:../core",
         "@google/genai": "1.16.0",
@@ -16578,6 +16495,7 @@
         "strip-json-comments": "^3.1.1",
         "undici": "^7.10.0",
         "update-notifier": "^7.3.1",
+        "wrap-ansi": "9.0.2",
         "yargs": "^17.7.2",
         "zod": "^3.23.8"
       },
@@ -16742,7 +16660,7 @@
     },
     "packages/core": {
       "name": "@google/gemini-cli-core",
-      "version": "0.6.0-nightly",
+      "version": "0.6.0",
       "dependencies": {
         "@google-cloud/logging": "^11.2.1",
         "@google-cloud/opentelemetry-cloud-monitoring-exporter": "^0.21.0",
@@ -16887,7 +16805,7 @@
     },
     "packages/test-utils": {
       "name": "@google/gemini-cli-test-utils",
-      "version": "0.6.0-nightly",
+      "version": "0.6.0",
       "license": "Apache-2.0",
       "devDependencies": {
         "typescript": "^5.3.3"
@@ -16898,7 +16816,7 @@
     },
     "packages/vscode-ide-companion": {
       "name": "gemini-cli-vscode-ide-companion",
-      "version": "0.6.0-nightly",
+      "version": "0.6.0",
       "license": "LICENSE",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.15.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.6.0-nightly",
+  "version": "0.6.0",
   "engines": {
     "node": ">=20.0.0"
   },
@@ -14,7 +14,7 @@
     "url": "git+https://github.com/google-gemini/gemini-cli.git"
   },
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.6.0-nightly"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.6.0"
   },
   "scripts": {
     "start": "node scripts/start.js",
@@ -59,8 +59,7 @@
   "files": [
     "bundle/",
     "README.md",
-    "LICENSE",
-    "npm-shrinkwrap.json"
+    "LICENSE"
   ],
   "devDependencies": {
     "@types/marked": "^5.0.2",
@@ -103,5 +102,11 @@
     "@lydell/node-pty-win32-arm64": "1.1.0",
     "@lydell/node-pty-win32-x64": "1.1.0",
     "node-pty": "^1.0.0"
+  },
+  "overrides": {
+    "wrap-ansi": "9.0.2",
+    "cliui": {
+      "wrap-ansi": "7.0.0"
+    }
   }
 }

packages/a2a-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-a2a-server",
-  "version": "0.6.0-nightly",
+  "version": "0.6.0",
   "private": true,
   "description": "Gemini CLI A2A Server",
   "repository": {

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.6.0-nightly",
+  "version": "0.6.0",
   "description": "Gemini CLI",
   "repository": {
     "type": "git",
@@ -25,7 +25,7 @@
     "dist"
   ],
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.6.0-nightly"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.6.0"
   },
   "dependencies": {
     "@google/gemini-cli-core": "file:../core",
@@ -54,6 +54,7 @@
     "strip-json-comments": "^3.1.1",
     "undici": "^7.10.0",
     "update-notifier": "^7.3.1",
+    "wrap-ansi": "9.0.2",
     "yargs": "^17.7.2",
     "zod": "^3.23.8"
   },

packages/cli/src/commands/extensions/disable.ts

@@ -11,12 +11,16 @@ import { getErrorMessage } from '../../utils/errors.js';
 
 interface DisableArgs {
   name: string;
-  scope: SettingScope;
+  scope?: string;
 }
 
 export function handleDisable(args: DisableArgs) {
   try {
-    disableExtension(args.name, args.scope);
+    if (args.scope?.toLowerCase() === 'workspace') {
+      disableExtension(args.name, SettingScope.Workspace);
+    } else {
+      disableExtension(args.name, SettingScope.User);
+    }
     console.log(
       `Extension "${args.name}" successfully disabled for scope "${args.scope}".`,
     );
@@ -39,13 +43,28 @@ export const disableCommand: CommandModule = {
         describe: 'The scope to disable the extenison in.',
         type: 'string',
         default: SettingScope.User,
-        choices: [SettingScope.User, SettingScope.Workspace],
       })
-      .check((_argv) => true),
+      .check((argv) => {
+        if (
+          argv.scope &&
+          !Object.values(SettingScope)
+            .map((s) => s.toLowerCase())
+            .includes((argv.scope as string).toLowerCase())
+        ) {
+          throw new Error(
+            `Invalid scope: ${argv.scope}. Please use one of ${Object.values(
+              SettingScope,
+            )
+              .map((s) => s.toLowerCase())
+              .join(', ')}.`,
+          );
+        }
+        return true;
+      }),
   handler: (argv) => {
     handleDisable({
       name: argv['name'] as string,
-      scope: argv['scope'] as SettingScope,
+      scope: argv['scope'] as string,
     });
   },
 };

packages/cli/src/commands/extensions/enable.ts

@@ -11,13 +11,16 @@ import { SettingScope } from '../../config/settings.js';
 
 interface EnableArgs {
   name: string;
-  scope?: SettingScope;
+  scope?: string;
 }
 
 export function handleEnable(args: EnableArgs) {
   try {
-    const scope = args.scope ? args.scope : SettingScope.User;
-    enableExtension(args.name, scope);
+    if (args.scope?.toLowerCase() === 'workspace') {
+      enableExtension(args.name, SettingScope.Workspace);
+    } else {
+      enableExtension(args.name, SettingScope.User);
+    }
     if (args.scope) {
       console.log(
         `Extension "${args.name}" successfully enabled for scope "${args.scope}".`,
@@ -45,13 +48,28 @@ export const enableCommand: CommandModule = {
         describe:
           'The scope to enable the extenison in. If not set, will be enabled in all scopes.',
         type: 'string',
-        choices: [SettingScope.User, SettingScope.Workspace],
       })
-      .check((_argv) => true),
+      .check((argv) => {
+        if (
+          argv.scope &&
+          !Object.values(SettingScope)
+            .map((s) => s.toLowerCase())
+            .includes((argv.scope as string).toLowerCase())
+        ) {
+          throw new Error(
+            `Invalid scope: ${argv.scope}. Please use one of ${Object.values(
+              SettingScope,
+            )
+              .map((s) => s.toLowerCase())
+              .join(', ')}.`,
+          );
+        }
+        return true;
+      }),
   handler: (argv) => {
     handleEnable({
       name: argv['name'] as string,
-      scope: argv['scope'] as SettingScope,
+      scope: argv['scope'] as string,
     });
   },
 };

packages/cli/src/commands/extensions/install.test.ts

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { describe, it, expect, type MockInstance } from 'vitest';
+import { describe, it, expect, vi, type MockInstance } from 'vitest';
 import { handleInstall, installCommand } from './install.js';
 import yargs from 'yargs';
 
@@ -32,6 +32,15 @@ describe('extensions install command', () => {
       validationParser.parse('install some-url --path /some/path'),
     ).toThrow('Arguments source and path are mutually exclusive');
   });
+
+  it('should fail if both auto update and local path are provided', () => {
+    const validationParser = yargs([]).command(installCommand).fail(false);
+    expect(() =>
+      validationParser.parse(
+        'install some-url --path /some/path --auto-update',
+      ),
+    ).toThrow('Arguments path and auto-update are mutually exclusive');
+  });
 });
 
 describe('handleInstall', () => {

packages/cli/src/commands/extensions/install.ts

@@ -5,10 +5,8 @@
  */
 
 import type { CommandModule } from 'yargs';
-import {
-  installExtension,
-  type ExtensionInstallMetadata,
-} from '../../config/extension.js';
+import { installExtension } from '../../config/extension.js';
+import type { ExtensionInstallMetadata } from '@google/gemini-cli-core';
 
 import { getErrorMessage } from '../../utils/errors.js';
 
@@ -16,12 +14,12 @@ interface InstallArgs {
   source?: string;
   path?: string;
   ref?: string;
+  autoUpdate?: boolean;
 }
 
 export async function handleInstall(args: InstallArgs) {
   try {
     let installMetadata: ExtensionInstallMetadata;
-
     if (args.source) {
       const { source } = args;
       if (
@@ -34,6 +32,7 @@ export async function handleInstall(args: InstallArgs) {
           source,
           type: 'git',
           ref: args.ref,
+          autoUpdate: args.autoUpdate,
         };
       } else {
         throw new Error(`The source "${source}" is not a valid URL format.`);
@@ -42,6 +41,7 @@ export async function handleInstall(args: InstallArgs) {
       installMetadata = {
         source: args.path,
         type: 'local',
+        autoUpdate: args.autoUpdate,
       };
     } else {
       // This should not be reached due to the yargs check.
@@ -57,7 +57,7 @@ export async function handleInstall(args: InstallArgs) {
 }
 
 export const installCommand: CommandModule = {
-  command: 'install [source]',
+  command: 'install [<source>] [--path] [--ref] [--auto-update]',
   describe: 'Installs an extension from a git repository URL or a local path.',
   builder: (yargs) =>
     yargs
@@ -73,8 +73,13 @@ export const installCommand: CommandModule = {
         describe: 'The git ref to install from.',
         type: 'string',
       })
+      .option('auto-update', {
+        describe: 'Enable auto-update for this extension.',
+        type: 'boolean',
+      })
       .conflicts('source', 'path')
       .conflicts('path', 'ref')
+      .conflicts('path', 'auto-update')
       .check((argv) => {
         if (!argv.source && !argv.path) {
           throw new Error('Either source or --path must be provided.');
@@ -86,6 +91,7 @@ export const installCommand: CommandModule = {
       source: argv['source'] as string | undefined,
       path: argv['path'] as string | undefined,
       ref: argv['ref'] as string | undefined,
+      autoUpdate: argv['auto-update'] as boolean | undefined,
     });
   },
 };

packages/cli/src/commands/extensions/link.ts

@@ -5,10 +5,8 @@
  */
 
 import type { CommandModule } from 'yargs';
-import {
-  installExtension,
-  type ExtensionInstallMetadata,
-} from '../../config/extension.js';
+import { installExtension } from '../../config/extension.js';
+import type { ExtensionInstallMetadata } from '@google/gemini-cli-core';
 
 import { getErrorMessage } from '../../utils/errors.js';
 

packages/cli/src/commands/extensions/uninstall.ts

@@ -9,7 +9,7 @@ import { uninstallExtension } from '../../config/extension.js';
 import { getErrorMessage } from '../../utils/errors.js';
 
 interface UninstallArgs {
-  name: string;
+  name: string; // can be extension name or source URL.
 }
 
 export async function handleUninstall(args: UninstallArgs) {
@@ -28,7 +28,7 @@ export const uninstallCommand: CommandModule = {
   builder: (yargs) =>
     yargs
       .positional('name', {
-        describe: 'The name of the extension to uninstall.',
+        describe: 'The name or source path of the extension to uninstall.',
         type: 'string',
       })
       .check((argv) => {

packages/cli/src/commands/extensions/update.ts

@@ -6,14 +6,18 @@
 
 import type { CommandModule } from 'yargs';
 import {
-  updateExtensionByName,
-  updateAllUpdatableExtensions,
-  type ExtensionUpdateInfo,
   loadExtensions,
   annotateActiveExtensions,
-  checkForAllExtensionUpdates,
 } from '../../config/extension.js';
+import {
+  updateAllUpdatableExtensions,
+  type ExtensionUpdateInfo,
+  checkForAllExtensionUpdates,
+  updateExtension,
+} from '../../config/extensions/update.js';
+import { checkForExtensionUpdate } from '../../config/extensions/github.js';
 import { getErrorMessage } from '../../utils/errors.js';
+import { ExtensionUpdateState } from '../../ui/state/extensions.js';
 
 interface UpdateArgs {
   name?: string;
@@ -31,13 +35,56 @@ export async function handleUpdate(args: UpdateArgs) {
     allExtensions.map((e) => e.config.name),
     workingDir,
   );
-
+  if (args.name) {
+    try {
+      const extension = extensions.find(
+        (extension) => extension.name === args.name,
+      );
+      if (!extension) {
+        console.log(`Extension "${args.name}" not found.`);
+        return;
+      }
+      let updateState: ExtensionUpdateState | undefined;
+      if (!extension.installMetadata) {
+        console.log(
+          `Unable to install extension "${args.name}" due to missing install metadata`,
+        );
+        return;
+      }
+      await checkForExtensionUpdate(extension, (newState) => {
+        updateState = newState;
+      });
+      if (updateState !== ExtensionUpdateState.UPDATE_AVAILABLE) {
+        console.log(`Extension "${args.name}" is already up to date.`);
+        return;
+      }
+      // TODO(chrstnb): we should list extensions if the requested extension is not installed.
+      const updatedExtensionInfo = (await updateExtension(
+        extension,
+        workingDir,
+        updateState,
+        () => {},
+      ))!;
+      if (
+        updatedExtensionInfo.originalVersion !==
+        updatedExtensionInfo.updatedVersion
+      ) {
+        console.log(
+          `Extension "${args.name}" successfully updated: ${updatedExtensionInfo.originalVersion} → ${updatedExtensionInfo.updatedVersion}.`,
+        );
+      } else {
+        console.log(`Extension "${args.name}" is already up to date.`);
+      }
+    } catch (error) {
+      console.error(getErrorMessage(error));
+    }
+  }
   if (args.all) {
     try {
       let updateInfos = await updateAllUpdatableExtensions(
         workingDir,
         extensions,
-        await checkForAllExtensionUpdates(extensions, (_) => {}),
+        await checkForAllExtensionUpdates(extensions, new Map(), (_) => {}),
         () => {},
       );
       updateInfos = updateInfos.filter(
@@ -52,32 +99,10 @@ export async function handleUpdate(args: UpdateArgs) {
       console.error(getErrorMessage(error));
     }
   }
-  if (args.name)
-    try {
-      // TODO(chrstnb): we should list extensions if the requested extension is not installed.
-      const updatedExtensionInfo = await updateExtensionByName(
-        args.name,
-        workingDir,
-        extensions,
-        () => {},
-      );
-      if (
-        updatedExtensionInfo.originalVersion !==
-        updatedExtensionInfo.updatedVersion
-      ) {
-        console.log(
-          `Extension "${args.name}" successfully updated: ${updatedExtensionInfo.originalVersion} → ${updatedExtensionInfo.updatedVersion}.`,
-        );
-      } else {
-        console.log(`Extension "${args.name}" already up to date.`);
-      }
-    } catch (error) {
-      console.error(getErrorMessage(error));
-    }
 }
 
 export const updateCommand: CommandModule = {
-  command: 'update [--all] [name]',
+  command: 'update [<name>] [--all]',
   describe:
     'Updates all extensions or a named extension to the latest version.',
   builder: (yargs) =>

packages/cli/src/config/config.ts

@@ -633,7 +633,7 @@ export async function loadCliConfig(
     interactive,
     trustedFolder,
     useRipgrep: settings.tools?.useRipgrep,
-    shouldUseNodePtyShell: settings.tools?.usePty,
+    shouldUseNodePtyShell: settings.tools?.shell?.enableInteractiveShell,
     skipNextSpeakerCheck: settings.model?.skipNextSpeakerCheck,
     enablePromptCompletion: settings.general?.enablePromptCompletion ?? false,
     truncateToolOutputThreshold: settings.tools?.truncateToolOutputThreshold,

packages/cli/src/config/extension.test.ts

@@ -12,8 +12,6 @@ import {
   EXTENSIONS_CONFIG_FILENAME,
   INSTALL_METADATA_FILENAME,
   annotateActiveExtensions,
-  checkForAllExtensionUpdates,
-  checkForExtensionUpdate,
   disableExtension,
   enableExtension,
   installExtension,
@@ -21,22 +19,18 @@ import {
   loadExtensions,
   performWorkspaceExtensionMigration,
   uninstallExtension,
-  updateExtension,
   type Extension,
-  type ExtensionInstallMetadata,
 } from './extension.js';
 import {
   GEMINI_DIR,
   type GeminiCLIExtension,
-  type MCPServerConfig,
-  ClearcutLogger,
-  type Config,
   ExtensionUninstallEvent,
+  ExtensionEnableEvent,
 } from '@google/gemini-cli-core';
 import { execSync } from 'node:child_process';
 import { SettingScope } from './settings.js';
 import { isWorkspaceTrusted } from './trustedFolders.js';
-import { ExtensionUpdateState } from '../ui/state/extensions.js';
+import { createExtension } from '../test-utils/createExtension.js';
 import { ExtensionEnablementManager } from './extensions/extensionEnablement.js';
 
 const mockGit = {
@@ -59,9 +53,9 @@ vi.mock('simple-git', () => ({
 }));
 
 vi.mock('os', async (importOriginal) => {
-  const os = await importOriginal<typeof os>();
+  const mockedOs = await importOriginal<typeof os>();
   return {
-    ...os,
+    ...mockedOs,
     homedir: vi.fn(),
   };
 });
@@ -74,20 +68,18 @@ vi.mock('./trustedFolders.js', async (importOriginal) => {
   };
 });
 
+const mockLogExtensionEnable = vi.hoisted(() => vi.fn());
+const mockLogExtensionInstallEvent = vi.hoisted(() => vi.fn());
+const mockLogExtensionUninstall = vi.hoisted(() => vi.fn());
 vi.mock('@google/gemini-cli-core', async (importOriginal) => {
   const actual =
     await importOriginal<typeof import('@google/gemini-cli-core')>();
-  const mockLogExtensionInstallEvent = vi.fn();
-  const mockLogExtensionUninstallEvent = vi.fn();
   return {
     ...actual,
-    ClearcutLogger: {
-      getInstance: vi.fn(() => ({
-        logExtensionInstallEvent: mockLogExtensionInstallEvent,
-        logExtensionUninstallEvent: mockLogExtensionUninstallEvent,
-      })),
-    },
-    Config: vi.fn(),
+    logExtensionEnable: mockLogExtensionEnable,
+    logExtensionInstallEvent: mockLogExtensionInstallEvent,
+    logExtensionUninstall: mockLogExtensionUninstall,
+    ExtensionEnableEvent: vi.fn(),
     ExtensionInstallEvent: vi.fn(),
     ExtensionUninstallEvent: vi.fn(),
   };
@@ -377,6 +369,90 @@ describe('extension tests', () => {
       expect(serverConfig.env!.MISSING_VAR).toBe('$UNDEFINED_ENV_VAR');
       expect(serverConfig.env!.MISSING_VAR_BRACES).toBe('${ALSO_UNDEFINED}');
     });
+
+    it('should skip extensions with invalid JSON and log a warning', () => {
+      const consoleSpy = vi
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      // Good extension
+      createExtension({
+        extensionsDir: userExtensionsDir,
+        name: 'good-ext',
+        version: '1.0.0',
+      });
+
+      // Bad extension
+      const badExtDir = path.join(userExtensionsDir, 'bad-ext');
+      fs.mkdirSync(badExtDir);
+      const badConfigPath = path.join(badExtDir, EXTENSIONS_CONFIG_FILENAME);
+      fs.writeFileSync(badConfigPath, '{ "name": "bad-ext"'); // Malformed
+
+      const extensions = loadExtensions();
+
+      expect(extensions).toHaveLength(1);
+      expect(extensions[0].config.name).toBe('good-ext');
+      expect(consoleSpy).toHaveBeenCalledOnce();
+      expect(consoleSpy).toHaveBeenCalledWith(
+        expect.stringContaining(
+          `Warning: Skipping extension in ${badExtDir}: Failed to load extension config from ${badConfigPath}`,
+        ),
+      );
+
+      consoleSpy.mockRestore();
+    });
+
+    it('should skip extensions with missing name and log a warning', () => {
+      const consoleSpy = vi
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      // Good extension
+      createExtension({
+        extensionsDir: userExtensionsDir,
+        name: 'good-ext',
+        version: '1.0.0',
+      });
+
+      // Bad extension
+      const badExtDir = path.join(userExtensionsDir, 'bad-ext-no-name');
+      fs.mkdirSync(badExtDir);
+      const badConfigPath = path.join(badExtDir, EXTENSIONS_CONFIG_FILENAME);
+      fs.writeFileSync(badConfigPath, JSON.stringify({ version: '1.0.0' }));
+
+      const extensions = loadExtensions();
+
+      expect(extensions).toHaveLength(1);
+      expect(extensions[0].config.name).toBe('good-ext');
+      expect(consoleSpy).toHaveBeenCalledOnce();
+      expect(consoleSpy).toHaveBeenCalledWith(
+        expect.stringContaining(
+          `Warning: Skipping extension in ${badExtDir}: Failed to load extension config from ${badConfigPath}: Invalid configuration in ${badConfigPath}: missing "name"`,
+        ),
+      );
+
+      consoleSpy.mockRestore();
+    });
+
+    it('should filter trust out of mcp servers', () => {
+      createExtension({
+        extensionsDir: userExtensionsDir,
+        name: 'test-extension',
+        version: '1.0.0',
+        mcpServers: {
+          'test-server': {
+            command: 'node',
+            args: ['server.js'],
+            trust: true,
+          },
+        },
+      });
+
+      const extensions = loadExtensions();
+      expect(extensions).toHaveLength(1);
+      const loadedConfig = extensions[0].config;
+      expect(loadedConfig.mcpServers?.['test-server'].trust).toBeUndefined();
+    });
   });
 
   describe('annotateActiveExtensions', () => {
@@ -455,6 +531,86 @@ describe('extension tests', () => {
       expect(consoleSpy).toHaveBeenCalledWith('Extension not found: ext4');
       consoleSpy.mockRestore();
     });
+
+    describe('autoUpdate', () => {
+      it('should be false if autoUpdate is not set in install metadata', () => {
+        const activeExtensions = annotateActiveExtensions(
+          extensions,
+          [],
+          tempHomeDir,
+        );
+        expect(
+          activeExtensions.every(
+            (e) => e.installMetadata?.autoUpdate === false,
+          ),
+        ).toBe(false);
+      });
+
+      it('should be true if autoUpdate is true in install metadata', () => {
+        const extensionsWithAutoUpdate: Extension[] = extensions.map((e) => ({
+          ...e,
+          installMetadata: {
+            ...e.installMetadata!,
+            autoUpdate: true,
+          },
+        }));
+        const activeExtensions = annotateActiveExtensions(
+          extensionsWithAutoUpdate,
+          [],
+          tempHomeDir,
+        );
+        expect(
+          activeExtensions.every((e) => e.installMetadata?.autoUpdate === true),
+        ).toBe(true);
+      });
+
+      it('should respect the per-extension settings from install metadata', () => {
+        const extensionsWithAutoUpdate: Extension[] = [
+          {
+            path: '/path/to/ext1',
+            config: { name: 'ext1', version: '1.0.0' },
+            contextFiles: [],
+            installMetadata: {
+              source: 'test',
+              type: 'local',
+              autoUpdate: true,
+            },
+          },
+          {
+            path: '/path/to/ext2',
+            config: { name: 'ext2', version: '1.0.0' },
+            contextFiles: [],
+            installMetadata: {
+              source: 'test',
+              type: 'local',
+              autoUpdate: false,
+            },
+          },
+          {
+            path: '/path/to/ext3',
+            config: { name: 'ext3', version: '1.0.0' },
+            contextFiles: [],
+          },
+        ];
+        const activeExtensions = annotateActiveExtensions(
+          extensionsWithAutoUpdate,
+          [],
+          tempHomeDir,
+        );
+        expect(
+          activeExtensions.find((e) => e.name === 'ext1')?.installMetadata
+            ?.autoUpdate,
+        ).toBe(true);
+        expect(
+          activeExtensions.find((e) => e.name === 'ext2')?.installMetadata
+            ?.autoUpdate,
+        ).toBe(false);
+        expect(
+          activeExtensions.find((e) => e.name === 'ext3')?.installMetadata
+            ?.autoUpdate,
+        ).toBe(undefined);
+      });
+    });
   });
 
   describe('installExtension', () => {
@@ -496,15 +652,49 @@ describe('extension tests', () => {
     it('should throw an error and cleanup if gemini-extension.json is missing', async () => {
       const sourceExtDir = path.join(tempHomeDir, 'bad-extension');
       fs.mkdirSync(sourceExtDir, { recursive: true });
+      const configPath = path.join(sourceExtDir, EXTENSIONS_CONFIG_FILENAME);
+
+      await expect(
+        installExtension({ source: sourceExtDir, type: 'local' }),
+      ).rejects.toThrow(`Configuration file not found at ${configPath}`);
+
+      const targetExtDir = path.join(userExtensionsDir, 'bad-extension');
+      expect(fs.existsSync(targetExtDir)).toBe(false);
+    });
+
+    it('should throw an error for invalid JSON in gemini-extension.json', async () => {
+      const sourceExtDir = path.join(tempHomeDir, 'bad-json-ext');
+      fs.mkdirSync(sourceExtDir, { recursive: true });
+      const configPath = path.join(sourceExtDir, EXTENSIONS_CONFIG_FILENAME);
+      fs.writeFileSync(configPath, '{ "name": "bad-json", "version": "1.0.0"'); // Malformed JSON
 
       await expect(
         installExtension({ source: sourceExtDir, type: 'local' }),
       ).rejects.toThrow(
-        `Invalid extension at ${sourceExtDir}. Please make sure it has a valid gemini-extension.json file.`,
+        new RegExp(
+          `^Failed to load extension config from ${configPath.replace(
+            /\\/g,
+            '\\\\',
+          )}`,
+        ),
       );
+    });
 
-      const targetExtDir = path.join(userExtensionsDir, 'bad-extension');
-      expect(fs.existsSync(targetExtDir)).toBe(false);
+    it('should throw an error for missing name in gemini-extension.json', async () => {
+      const sourceExtDir = createExtension({
+        extensionsDir: tempHomeDir,
+        name: 'missing-name-ext',
+        version: '1.0.0',
+      });
+      const configPath = path.join(sourceExtDir, EXTENSIONS_CONFIG_FILENAME);
+      // Overwrite with invalid config
+      fs.writeFileSync(configPath, JSON.stringify({ version: '1.0.0' }));
+
+      await expect(
+        installExtension({ source: sourceExtDir, type: 'local' }),
+      ).rejects.toThrow(
+        `Invalid configuration in ${configPath}: missing "name"`,
+      );
     });
 
     it('should install an extension from a git URL', async () => {
@@ -570,8 +760,7 @@ describe('extension tests', () => {
 
       await installExtension({ source: sourceExtDir, type: 'local' });
 
-      const logger = ClearcutLogger.getInstance({} as Config);
-      expect(logger?.logExtensionInstallEvent).toHaveBeenCalled();
+      expect(mockLogExtensionInstallEvent).toHaveBeenCalled();
     });
 
     it('should show users information on their mcp server when installing', async () => {
@@ -600,16 +789,11 @@ describe('extension tests', () => {
       ).resolves.toBe('my-local-extension');
 
       expect(consoleInfoSpy).toHaveBeenCalledWith(
-        'This extension will run the following MCP servers: ',
-      );
-      expect(consoleInfoSpy).toHaveBeenCalledWith(
-        '  * test-server (local): a local mcp server',
-      );
-      expect(consoleInfoSpy).toHaveBeenCalledWith(
-        '  * test-server-2 (remote): a remote mcp server',
-      );
-      expect(consoleInfoSpy).toHaveBeenCalledWith(
-        'The extension will append info to your gemini.md context',
+        `Extensions may introduce unexpected behavior.
+Ensure you have investigated the extension source and trust the author.
+This extension will run the following MCP servers:
+  * test-server (local): node server.js
+  * test-server-2 (remote): https://google.com`,
       );
     });
 
@@ -633,7 +817,7 @@ describe('extension tests', () => {
       ).resolves.toBe('my-local-extension');
 
       expect(mockQuestion).toHaveBeenCalledWith(
-        expect.stringContaining('Do you want to continue? (y/n)'),
+        expect.stringContaining('Do you want to continue? [Y/n]: '),
         expect.any(Function),
       );
     });
@@ -658,11 +842,37 @@ describe('extension tests', () => {
       ).rejects.toThrow('Installation cancelled by user.');
 
       expect(mockQuestion).toHaveBeenCalledWith(
-        expect.stringContaining('Do you want to continue? (y/n)'),
+        expect.stringContaining('Do you want to continue? [Y/n]: '),
         expect.any(Function),
       );
     });
 
+    it('should save the autoUpdate flag to the install metadata', async () => {
+      const sourceExtDir = createExtension({
+        extensionsDir: tempHomeDir,
+        name: 'my-local-extension',
+        version: '1.0.0',
+      });
+      const targetExtDir = path.join(userExtensionsDir, 'my-local-extension');
+      const metadataPath = path.join(targetExtDir, INSTALL_METADATA_FILENAME);
+
+      await installExtension({
+        source: sourceExtDir,
+        type: 'local',
+        autoUpdate: true,
+      });
+
+      expect(fs.existsSync(targetExtDir)).toBe(true);
+      expect(fs.existsSync(metadataPath)).toBe(true);
+      const metadata = JSON.parse(fs.readFileSync(metadataPath, 'utf-8'));
+      expect(metadata).toEqual({
+        source: sourceExtDir,
+        type: 'local',
+        autoUpdate: true,
+      });
+      fs.rmSync(targetExtDir, { recursive: true, force: true });
+    });
+
     it('should ignore consent flow if not required', async () => {
       const sourceExtDir = createExtension({
         extensionsDir: tempHomeDir,
@@ -716,7 +926,7 @@ describe('extension tests', () => {
 
     it('should throw an error if the extension does not exist', async () => {
       await expect(uninstallExtension('nonexistent-extension')).rejects.toThrow(
-        'Extension "nonexistent-extension" not found.',
+        'Extension not found.',
       );
     });
 
@@ -729,11 +939,47 @@ describe('extension tests', () => {
 
       await uninstallExtension('my-local-extension');
 
-      const logger = ClearcutLogger.getInstance({} as Config);
-      expect(logger?.logExtensionUninstallEvent).toHaveBeenCalledWith(
-        new ExtensionUninstallEvent('my-local-extension', 'success'),
+      expect(mockLogExtensionUninstall).toHaveBeenCalled();
+      expect(ExtensionUninstallEvent).toHaveBeenCalledWith(
+        'my-local-extension',
+        'success',
       );
     });
+
+    it('should uninstall an extension by its source URL', async () => {
+      const gitUrl = 'https://github.com/google/gemini-sql-extension.git';
+      const sourceExtDir = createExtension({
+        extensionsDir: userExtensionsDir,
+        name: 'gemini-sql-extension',
+        version: '1.0.0',
+        installMetadata: {
+          source: gitUrl,
+          type: 'git',
+        },
+      });
+
+      await uninstallExtension(gitUrl);
+
+      expect(fs.existsSync(sourceExtDir)).toBe(false);
+      expect(mockLogExtensionUninstall).toHaveBeenCalled();
+      expect(ExtensionUninstallEvent).toHaveBeenCalledWith(
+        'gemini-sql-extension',
+        'success',
+      );
+    });
+
+    it('should fail to uninstall by URL if an extension has no install metadata', async () => {
+      createExtension({
+        extensionsDir: userExtensionsDir,
+        name: 'no-metadata-extension',
+        version: '1.0.0',
+        // No installMetadata provided
+      });
+
+      await expect(
+        uninstallExtension('https://github.com/google/no-metadata-extension'),
+      ).rejects.toThrow('Extension not found.');
+    });
   });
 
   describe('performWorkspaceExtensionMigration', () => {
@@ -881,377 +1127,6 @@ describe('extension tests', () => {
     });
   });
 
-  describe('updateExtension', () => {
-    it('should update a git-installed extension', async () => {
-      const gitUrl = 'https://github.com/google/gemini-extensions.git';
-      const extensionName = 'gemini-extensions';
-      const targetExtDir = path.join(userExtensionsDir, extensionName);
-      const metadataPath = path.join(targetExtDir, INSTALL_METADATA_FILENAME);
-
-      fs.mkdirSync(targetExtDir, { recursive: true });
-      fs.writeFileSync(
-        path.join(targetExtDir, EXTENSIONS_CONFIG_FILENAME),
-        JSON.stringify({ name: extensionName, version: '1.0.0' }),
-      );
-      fs.writeFileSync(
-        metadataPath,
-        JSON.stringify({ source: gitUrl, type: 'git' }),
-      );
-
-      mockGit.clone.mockImplementation(async (_, destination) => {
-        fs.mkdirSync(path.join(mockGit.path(), destination), {
-          recursive: true,
-        });
-        fs.writeFileSync(
-          path.join(mockGit.path(), destination, EXTENSIONS_CONFIG_FILENAME),
-          JSON.stringify({ name: extensionName, version: '1.1.0' }),
-        );
-      });
-      mockGit.getRemotes.mockResolvedValue([{ name: 'origin' }]);
-      const extension = annotateActiveExtensions(
-        [
-          loadExtension({
-            extensionDir: targetExtDir,
-            workspaceDir: tempWorkspaceDir,
-          })!,
-        ],
-        [],
-        process.cwd(),
-      )[0];
-      const updateInfo = await updateExtension(
-        extension,
-        tempHomeDir,
-        () => {},
-      );
-
-      expect(updateInfo).toEqual({
-        name: 'gemini-extensions',
-        originalVersion: '1.0.0',
-        updatedVersion: '1.1.0',
-      });
-
-      const updatedConfig = JSON.parse(
-        fs.readFileSync(
-          path.join(targetExtDir, EXTENSIONS_CONFIG_FILENAME),
-          'utf-8',
-        ),
-      );
-      expect(updatedConfig.version).toBe('1.1.0');
-    });
-
-    it('should call setExtensionUpdateState with UPDATING and then UPDATED_NEEDS_RESTART on success', async () => {
-      const extensionName = 'test-extension';
-      const extensionDir = createExtension({
-        extensionsDir: userExtensionsDir,
-        name: extensionName,
-        version: '1.0.0',
-        installMetadata: {
-          source: 'https://some.git/repo',
-          type: 'git',
-        },
-      });
-
-      mockGit.clone.mockImplementation(async (_, destination) => {
-        fs.mkdirSync(path.join(mockGit.path(), destination), {
-          recursive: true,
-        });
-        fs.writeFileSync(
-          path.join(mockGit.path(), destination, EXTENSIONS_CONFIG_FILENAME),
-          JSON.stringify({ name: extensionName, version: '1.1.0' }),
-        );
-      });
-      mockGit.getRemotes.mockResolvedValue([{ name: 'origin' }]);
-
-      const setExtensionUpdateState = vi.fn();
-
-      const extension = annotateActiveExtensions(
-        [
-          loadExtension({
-            extensionDir,
-            workspaceDir: tempWorkspaceDir,
-          })!,
-        ],
-        [],
-        process.cwd(),
-      )[0];
-      await updateExtension(extension, tempHomeDir, setExtensionUpdateState);
-
-      expect(setExtensionUpdateState).toHaveBeenCalledWith(
-        ExtensionUpdateState.UPDATING,
-      );
-      expect(setExtensionUpdateState).toHaveBeenCalledWith(
-        ExtensionUpdateState.UPDATED_NEEDS_RESTART,
-      );
-    });
-
-    it('should call setExtensionUpdateState with ERROR on failure', async () => {
-      const extensionName = 'test-extension';
-      const extensionDir = createExtension({
-        extensionsDir: userExtensionsDir,
-        name: extensionName,
-        version: '1.0.0',
-        installMetadata: {
-          source: 'https://some.git/repo',
-          type: 'git',
-        },
-      });
-
-      mockGit.clone.mockRejectedValue(new Error('Git clone failed'));
-      mockGit.getRemotes.mockResolvedValue([{ name: 'origin' }]);
-
-      const setExtensionUpdateState = vi.fn();
-      const extension = annotateActiveExtensions(
-        [
-          loadExtension({
-            extensionDir,
-            workspaceDir: tempWorkspaceDir,
-          })!,
-        ],
-        [],
-        process.cwd(),
-      )[0];
-      await expect(
-        updateExtension(extension, tempHomeDir, setExtensionUpdateState),
-      ).rejects.toThrow();
-
-      expect(setExtensionUpdateState).toHaveBeenCalledWith(
-        ExtensionUpdateState.UPDATING,
-      );
-      expect(setExtensionUpdateState).toHaveBeenCalledWith(
-        ExtensionUpdateState.ERROR,
-      );
-    });
-  });
-
-  describe('checkForAllExtensionUpdates', () => {
-    it('should return UpdateAvailable for a git extension with updates', async () => {
-      const extensionDir = createExtension({
-        extensionsDir: userExtensionsDir,
-        name: 'test-extension',
-        version: '1.0.0',
-        installMetadata: {
-          source: 'https://some.git/repo',
-          type: 'git',
-        },
-      });
-      const extension = annotateActiveExtensions(
-        [
-          loadExtension({
-            extensionDir,
-            workspaceDir: tempWorkspaceDir,
-          })!,
-        ],
-        [],
-        process.cwd(),
-      )[0];
-
-      mockGit.getRemotes.mockResolvedValue([
-        { name: 'origin', refs: { fetch: 'https://some.git/repo' } },
-      ]);
-      mockGit.listRemote.mockResolvedValue('remoteHash	HEAD');
-      mockGit.revparse.mockResolvedValue('localHash');
-
-      const results = await checkForAllExtensionUpdates([extension], () => {});
-      const result = results.get('test-extension');
-      expect(result).toBe(ExtensionUpdateState.UPDATE_AVAILABLE);
-    });
-
-    it('should return UpToDate for a git extension with no updates', async () => {
-      const extensionDir = createExtension({
-        extensionsDir: userExtensionsDir,
-        name: 'test-extension',
-        version: '1.0.0',
-        installMetadata: {
-          source: 'https://some.git/repo',
-          type: 'git',
-        },
-      });
-      const extension = annotateActiveExtensions(
-        [
-          loadExtension({
-            extensionDir,
-            workspaceDir: tempWorkspaceDir,
-          })!,
-        ],
-        [],
-        process.cwd(),
-      )[0];
-
-      mockGit.getRemotes.mockResolvedValue([
-        { name: 'origin', refs: { fetch: 'https://some.git/repo' } },
-      ]);
-      mockGit.listRemote.mockResolvedValue('sameHash	HEAD');
-      mockGit.revparse.mockResolvedValue('sameHash');
-
-      const results = await checkForAllExtensionUpdates([extension], () => {});
-      const result = results.get('test-extension');
-      expect(result).toBe(ExtensionUpdateState.UP_TO_DATE);
-    });
-
-    it('should return NotUpdatable for a non-git extension', async () => {
-      const extensionDir = createExtension({
-        extensionsDir: userExtensionsDir,
-        name: 'local-extension',
-        version: '1.0.0',
-        installMetadata: { source: '/local/path', type: 'local' },
-      });
-      const extension = annotateActiveExtensions(
-        [
-          loadExtension({
-            extensionDir,
-            workspaceDir: tempWorkspaceDir,
-          })!,
-        ],
-        [],
-        process.cwd(),
-      )[0];
-
-      const results = await checkForAllExtensionUpdates([extension], () => {});
-      const result = results.get('local-extension');
-      expect(result).toBe(ExtensionUpdateState.NOT_UPDATABLE);
-    });
-
-    it('should return Error when git check fails', async () => {
-      const extensionDir = createExtension({
-        extensionsDir: userExtensionsDir,
-        name: 'error-extension',
-        version: '1.0.0',
-        installMetadata: {
-          source: 'https://some.git/repo',
-          type: 'git',
-        },
-      });
-      const extension = annotateActiveExtensions(
-        [
-          loadExtension({
-            extensionDir,
-            workspaceDir: tempWorkspaceDir,
-          })!,
-        ],
-        [],
-        process.cwd(),
-      )[0];
-
-      mockGit.getRemotes.mockRejectedValue(new Error('Git error'));
-
-      const results = await checkForAllExtensionUpdates([extension], () => {});
-      const result = results.get('error-extension');
-      expect(result).toBe(ExtensionUpdateState.ERROR);
-    });
-  });
-
-  describe('checkForExtensionUpdate', () => {
-    it('should return UpdateAvailable for a git extension with updates', async () => {
-      const extensionDir = createExtension({
-        extensionsDir: userExtensionsDir,
-        name: 'test-extension',
-        version: '1.0.0',
-        installMetadata: {
-          source: 'https://some.git/repo',
-          type: 'git',
-        },
-      });
-      const extension = annotateActiveExtensions(
-        [
-          loadExtension({
-            extensionDir,
-            workspaceDir: tempWorkspaceDir,
-          })!,
-        ],
-        [],
-        process.cwd(),
-      )[0];
-
-      mockGit.getRemotes.mockResolvedValue([
-        { name: 'origin', refs: { fetch: 'https://some.git/repo' } },
-      ]);
-      mockGit.listRemote.mockResolvedValue('remoteHash	HEAD');
-      mockGit.revparse.mockResolvedValue('localHash');
-
-      const result = await checkForExtensionUpdate(extension);
-      expect(result).toBe(ExtensionUpdateState.UPDATE_AVAILABLE);
-    });
-
-    it('should return UpToDate for a git extension with no updates', async () => {
-      const extensionDir = createExtension({
-        extensionsDir: userExtensionsDir,
-        name: 'test-extension',
-        version: '1.0.0',
-        installMetadata: {
-          source: 'https://some.git/repo',
-          type: 'git',
-        },
-      });
-      const extension = annotateActiveExtensions(
-        [
-          loadExtension({
-            extensionDir,
-            workspaceDir: tempWorkspaceDir,
-          })!,
-        ],
-        [],
-        process.cwd(),
-      )[0];
-
-      mockGit.getRemotes.mockResolvedValue([
-        { name: 'origin', refs: { fetch: 'https://some.git/repo' } },
-      ]);
-      mockGit.listRemote.mockResolvedValue('sameHash	HEAD');
-      mockGit.revparse.mockResolvedValue('sameHash');
-
-      const result = await checkForExtensionUpdate(extension);
-      expect(result).toBe(ExtensionUpdateState.UP_TO_DATE);
-    });
-
-    it('should return NotUpdatable for a non-git extension', async () => {
-      const extensionDir = createExtension({
-        extensionsDir: userExtensionsDir,
-        name: 'local-extension',
-        version: '1.0.0',
-      });
-      const extension = annotateActiveExtensions(
-        [
-          loadExtension({
-            extensionDir,
-            workspaceDir: tempWorkspaceDir,
-          })!,
-        ],
-        [],
-        process.cwd(),
-      )[0];
-
-      const result = await checkForExtensionUpdate(extension);
-      expect(result).toBe(ExtensionUpdateState.NOT_UPDATABLE);
-    });
-
-    it('should return Error when git check fails', async () => {
-      const extensionDir = createExtension({
-        extensionsDir: userExtensionsDir,
-        name: 'error-extension',
-        version: '1.0.0',
-        installMetadata: {
-          source: 'https://some.git/repo',
-          type: 'git',
-        },
-      });
-      const extension = annotateActiveExtensions(
-        [
-          loadExtension({
-            extensionDir,
-            workspaceDir: tempWorkspaceDir,
-          })!,
-        ],
-        [],
-        process.cwd(),
-      )[0];
-
-      mockGit.getRemotes.mockRejectedValue(new Error('Git error'));
-
-      const result = await checkForExtensionUpdate(extension);
-      expect(result).toBe(ExtensionUpdateState.ERROR);
-    });
-  });
-
   describe('disableExtension', () => {
     it('should disable an extension at the user scope', () => {
       disableExtension('my-extension', SettingScope.User);
@@ -1351,42 +1226,25 @@ describe('extension tests', () => {
       expect(activeExtensions).toHaveLength(1);
       expect(activeExtensions[0].name).toBe('ext1');
     });
+
+    it('should log an enable event', () => {
+      createExtension({
+        extensionsDir: userExtensionsDir,
+        name: 'ext1',
+        version: '1.0.0',
+      });
+      disableExtension('ext1', SettingScope.Workspace);
+      enableExtension('ext1', SettingScope.Workspace);
+
+      expect(mockLogExtensionEnable).toHaveBeenCalled();
+      expect(ExtensionEnableEvent).toHaveBeenCalledWith(
+        'ext1',
+        SettingScope.Workspace,
+      );
+    });
   });
 });
 
-function createExtension({
-  extensionsDir = 'extensions-dir',
-  name = 'my-extension',
-  version = '1.0.0',
-  addContextFile = false,
-  contextFileName = undefined as string | undefined,
-  mcpServers = {} as Record<string, MCPServerConfig>,
-  installMetadata = undefined as ExtensionInstallMetadata | undefined,
-} = {}): string {
-  const extDir = path.join(extensionsDir, name);
-  fs.mkdirSync(extDir, { recursive: true });
-  fs.writeFileSync(
-    path.join(extDir, EXTENSIONS_CONFIG_FILENAME),
-    JSON.stringify({ name, version, contextFileName, mcpServers }),
-  );
-
-  if (addContextFile) {
-    fs.writeFileSync(path.join(extDir, 'GEMINI.md'), 'context');
-  }
-
-  if (contextFileName) {
-    fs.writeFileSync(path.join(extDir, contextFileName), 'context');
-  }
-
-  if (installMetadata) {
-    fs.writeFileSync(
-      path.join(extDir, INSTALL_METADATA_FILENAME),
-      JSON.stringify(installMetadata),
-    );
-  }
-  return extDir;
-}
-
 function isEnabled(options: {
   name: string;
   configDir: string;

packages/cli/src/config/extension.ts

@@ -7,26 +7,32 @@
 import type {
   MCPServerConfig,
   GeminiCLIExtension,
+  ExtensionInstallMetadata,
 } from '@google/gemini-cli-core';
 import {
   GEMINI_DIR,
   Storage,
-  ClearcutLogger,
   Config,
   ExtensionInstallEvent,
   ExtensionUninstallEvent,
+  ExtensionEnableEvent,
+  logExtensionEnable,
+  logExtensionInstallEvent,
+  logExtensionUninstall,
 } from '@google/gemini-cli-core';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
-import { simpleGit } from 'simple-git';
 import { SettingScope, loadSettings } from '../config/settings.js';
 import { getErrorMessage } from '../utils/errors.js';
 import { recursivelyHydrateStrings } from './extensions/variables.js';
 import { isWorkspaceTrusted } from './trustedFolders.js';
 import { resolveEnvVarsInObject } from '../utils/envVarResolver.js';
 import { randomUUID } from 'node:crypto';
-import { ExtensionUpdateState } from '../ui/state/extensions.js';
+import {
+  cloneFromGit,
+  downloadFromGitHubRelease,
+} from './extensions/github.js';
 import type { LoadExtensionContext } from './extensions/variableSchema.js';
 import { ExtensionEnablementManager } from './extensions/extensionEnablement.js';
 
@@ -50,12 +56,6 @@ export interface ExtensionConfig {
   excludeTools?: string[];
 }
 
-export interface ExtensionInstallMetadata {
-  source: string;
-  type: 'git' | 'local' | 'link';
-  ref?: string;
-}
-
 export interface ExtensionUpdateInfo {
   name: string;
   originalVersion: string;
@@ -100,7 +100,7 @@ export function getWorkspaceExtensions(workspaceDir: string): Extension[] {
   return loadExtensionsFromDir(workspaceDir);
 }
 
-async function copyExtension(
+export async function copyExtension(
   source: string,
   destination: string,
 ): Promise<void> {
@@ -126,16 +126,18 @@ export async function performWorkspaceExtensionMigration(
   return failedInstallNames;
 }
 
-function getClearcutLogger(cwd: string) {
+function getTelemetryConfig(cwd: string) {
+  const settings = loadSettings(cwd);
   const config = new Config({
+    telemetry: settings.merged.telemetry,
+    interactive: false,
     sessionId: randomUUID(),
     targetDir: cwd,
     cwd,
     model: '',
     debugMode: false,
   });
-  const logger = ClearcutLogger.getInstance(config);
-  return logger;
+  return config;
 }
 
 export function loadExtensions(
@@ -214,34 +216,23 @@ export function loadExtension(context: LoadExtensionContext): Extension | null {
     effectiveExtensionPath = installMetadata.source;
   }
 
-  const configFilePath = path.join(
-    effectiveExtensionPath,
-    EXTENSIONS_CONFIG_FILENAME,
-  );
-  if (!fs.existsSync(configFilePath)) {
-    console.error(
-      `Warning: extension directory ${effectiveExtensionPath} does not contain a config file ${configFilePath}.`,
-    );
-    return null;
-  }
-
   try {
-    const configContent = fs.readFileSync(configFilePath, 'utf-8');
-    let config = recursivelyHydrateStrings(JSON.parse(configContent), {
-      extensionPath: extensionDir,
-      workspacePath: workspaceDir,
-      '/': path.sep,
-      pathSeparator: path.sep,
-    }) as unknown as ExtensionConfig;
-    if (!config.name || !config.version) {
-      console.error(
-        `Invalid extension config in ${configFilePath}: missing name or version.`,
-      );
-      return null;
-    }
+    let config = loadExtensionConfig({
+      extensionDir: effectiveExtensionPath,
+      workspaceDir,
+    });
 
     config = resolveEnvVarsInObject(config);
 
+    if (config.mcpServers) {
+      config.mcpServers = Object.fromEntries(
+        Object.entries(config.mcpServers).map(([key, value]) => [
+          key,
+          filterMcpConfig(value),
+        ]),
+      );
+    }
+
     const contextFiles = getContextFileNames(config)
       .map((contextFileName) =>
         path.join(effectiveExtensionPath, contextFileName),
@@ -256,7 +247,7 @@ export function loadExtension(context: LoadExtensionContext): Extension | null {
     };
   } catch (e) {
     console.error(
-      `Warning: error parsing extension config in ${configFilePath}: ${getErrorMessage(
+      `Warning: Skipping extension in ${effectiveExtensionPath}: ${getErrorMessage(
         e,
       )}`,
     );
@@ -264,7 +255,13 @@ export function loadExtension(context: LoadExtensionContext): Extension | null {
   }
 }
 
-function loadInstallMetadata(
+function filterMcpConfig(original: MCPServerConfig): MCPServerConfig {
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  const { trust, ...rest } = original;
+  return Object.freeze(rest);
+}
+
+export function loadInstallMetadata(
   extensionDir: string,
 ): ExtensionInstallMetadata | undefined {
   const metadataFilePath = path.join(extensionDir, INSTALL_METADATA_FILENAME);
@@ -301,7 +298,6 @@ export function annotateActiveExtensions(
   const manager = new ExtensionEnablementManager(
     ExtensionStorage.getUserExtensionsDir(),
   );
-
   const annotatedExtensions: GeminiCLIExtension[] = [];
   if (enabledExtensionNames.length === 0) {
     return extensions.map((extension) => ({
@@ -309,9 +305,7 @@ export function annotateActiveExtensions(
       version: extension.config.version,
       isActive: manager.isEnabled(extension.config.name, workspaceDir),
       path: extension.path,
-      source: extension.installMetadata?.source,
-      type: extension.installMetadata?.type,
-      ref: extension.installMetadata?.ref,
+      installMetadata: extension.installMetadata,
     }));
   }
 
@@ -328,9 +322,7 @@ export function annotateActiveExtensions(
       version: extension.config.version,
       isActive: false,
       path: extension.path,
-      source: extension.installMetadata?.source,
-      type: extension.installMetadata?.type,
-      ref: extension.installMetadata?.ref,
+      installMetadata: extension.installMetadata,
     }));
   }
 
@@ -349,6 +341,7 @@ export function annotateActiveExtensions(
       version: extension.config.version,
       isActive,
       path: extension.path,
+      installMetadata: extension.installMetadata,
     });
   }
 
@@ -359,47 +352,10 @@ export function annotateActiveExtensions(
   return annotatedExtensions;
 }
 
-/**
- * Clones a Git repository to a specified local path.
- * @param installMetadata The metadata for the extension to install.
- * @param destination The destination path to clone the repository to.
- */
-async function cloneFromGit(
-  installMetadata: ExtensionInstallMetadata,
-  destination: string,
-): Promise<void> {
-  try {
-    const git = simpleGit(destination);
-    await git.clone(installMetadata.source, './', ['--depth', '1']);
-
-    const remotes = await git.getRemotes(true);
-    if (remotes.length === 0) {
-      throw new Error(
-        `Unable to find any remotes for repo ${installMetadata.source}`,
-      );
-    }
-
-    const refToFetch = installMetadata.ref || 'HEAD';
-
-    await git.fetch(remotes[0].name, refToFetch);
-
-    // After fetching, checkout FETCH_HEAD to get the content of the fetched ref.
-    // This results in a detached HEAD state, which is fine for this purpose.
-    await git.checkout('FETCH_HEAD');
-  } catch (error) {
-    throw new Error(
-      `Failed to clone Git repository from ${installMetadata.source}`,
-      {
-        cause: error,
-      },
-    );
-  }
-}
-
 /**
  * Asks users a prompt and awaits for a y/n response
  * @param prompt A yes/no prompt to ask the user
- * @returns Whether or not the user answers 'y' (yes)
+ * @returns Whether or not the user answers 'y' (yes). Defaults to 'yes' on enter.
  */
 async function promptForContinuation(prompt: string): Promise<boolean> {
   const readline = await import('node:readline');
@@ -411,7 +367,7 @@ async function promptForContinuation(prompt: string): Promise<boolean> {
   return new Promise((resolve) => {
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve(answer.toLowerCase() === 'y');
+      resolve(['y', ''].includes(answer.trim().toLowerCase()));
     });
   });
 }
@@ -421,7 +377,7 @@ export async function installExtension(
   askConsent: boolean = false,
   cwd: string = process.cwd(),
 ): Promise<string> {
-  const logger = getClearcutLogger(cwd);
+  const telemetryConfig = getTelemetryConfig(cwd);
   let newExtensionConfig: ExtensionConfig | null = null;
   let localSourcePath: string | undefined;
 
@@ -445,9 +401,22 @@ export async function installExtension(
 
     let tempDir: string | undefined;
 
-    if (installMetadata.type === 'git') {
+    if (
+      installMetadata.type === 'git' ||
+      installMetadata.type === 'github-release'
+    ) {
       tempDir = await ExtensionStorage.createTmpDir();
-      await cloneFromGit(installMetadata, tempDir);
+      try {
+        const result = await downloadFromGitHubRelease(
+          installMetadata,
+          tempDir,
+        );
+        installMetadata.type = result.type;
+        installMetadata.releaseTag = result.tagName;
+      } catch (_error) {
+        await cloneFromGit(installMetadata, tempDir);
+        installMetadata.type = 'git';
+      }
       localSourcePath = tempDir;
     } else if (
       installMetadata.type === 'local' ||
@@ -459,15 +428,10 @@ export async function installExtension(
     }
 
     try {
-      newExtensionConfig = await loadExtensionConfig({
+      newExtensionConfig = loadExtensionConfig({
         extensionDir: localSourcePath,
         workspaceDir: cwd,
       });
-      if (!newExtensionConfig) {
-        throw new Error(
-          `Invalid extension at ${installMetadata.source}. Please make sure it has a valid gemini-extension.json file.`,
-        );
-      }
 
       const newExtensionName = newExtensionConfig.name;
       const extensionStorage = new ExtensionStorage(newExtensionName);
@@ -488,7 +452,11 @@ export async function installExtension(
       }
       await fs.promises.mkdir(destinationPath, { recursive: true });
 
-      if (installMetadata.type === 'local' || installMetadata.type === 'git') {
+      if (
+        installMetadata.type === 'local' ||
+        installMetadata.type === 'git' ||
+        installMetadata.type === 'github-release'
+      ) {
         await copyExtension(localSourcePath, destinationPath);
       }
 
@@ -504,7 +472,8 @@ export async function installExtension(
       }
     }
 
-    logger?.logExtensionInstallEvent(
+    logExtensionInstallEvent(
+      telemetryConfig,
       new ExtensionInstallEvent(
         newExtensionConfig!.name,
         newExtensionConfig!.version,
@@ -519,12 +488,17 @@ export async function installExtension(
     // Attempt to load config from the source path even if installation fails
     // to get the name and version for logging.
     if (!newExtensionConfig && localSourcePath) {
-      newExtensionConfig = await loadExtensionConfig({
-        extensionDir: localSourcePath,
-        workspaceDir: cwd,
-      });
+      try {
+        newExtensionConfig = loadExtensionConfig({
+          extensionDir: localSourcePath,
+          workspaceDir: cwd,
+        });
+      } catch {
+        // Ignore error, this is just for logging.
+      }
     }
-    logger?.logExtensionInstallEvent(
+    logExtensionInstallEvent(
+      telemetryConfig,
       new ExtensionInstallEvent(
         newExtensionConfig?.name ?? '',
         newExtensionConfig?.version ?? '',
@@ -537,33 +511,49 @@ export async function installExtension(
 }
 
 async function requestConsent(extensionConfig: ExtensionConfig) {
+  const output: string[] = [];
   const mcpServerEntries = Object.entries(extensionConfig.mcpServers || {});
+  output.push('Extensions may introduce unexpected behavior.');
+  output.push(
+    'Ensure you have investigated the extension source and trust the author.',
+  );
+
   if (mcpServerEntries.length) {
-    console.info('This extension will run the following MCP servers: ');
+    output.push('This extension will run the following MCP servers:');
     for (const [key, mcpServer] of mcpServerEntries) {
       const isLocal = !!mcpServer.command;
-      console.info(
-        `  * ${key} (${isLocal ? 'local' : 'remote'}): ${mcpServer.description}`,
-      );
+      const source =
+        mcpServer.httpUrl ??
+        `${mcpServer.command || ''}${mcpServer.args ? ' ' + mcpServer.args.join(' ') : ''}`;
+      output.push(`  * ${key} (${isLocal ? 'local' : 'remote'}): ${source}`);
     }
-    console.info('The extension will append info to your gemini.md context');
-
-    const shouldContinue = await promptForContinuation(
-      'Do you want to continue? (y/n): ',
+  }
+  if (extensionConfig.contextFileName) {
+    output.push(
+      `This extension will append info to your gemini.md context using ${extensionConfig.contextFileName}`,
     );
-    if (!shouldContinue) {
-      throw new Error('Installation cancelled by user.');
-    }
+  }
+  if (extensionConfig.excludeTools) {
+    output.push(
+      `This extension will exclude the following core tools: ${extensionConfig.excludeTools}`,
+    );
+  }
+  console.info(output.join('\n'));
+  const shouldContinue = await promptForContinuation(
+    'Do you want to continue? [Y/n]: ',
+  );
+  if (!shouldContinue) {
+    throw new Error('Installation cancelled by user.');
   }
 }
 
-export async function loadExtensionConfig(
+export function loadExtensionConfig(
   context: LoadExtensionContext,
-): Promise<ExtensionConfig | null> {
+): ExtensionConfig {
   const { extensionDir, workspaceDir } = context;
   const configFilePath = path.join(extensionDir, EXTENSIONS_CONFIG_FILENAME);
   if (!fs.existsSync(configFilePath)) {
-    return null;
+    throw new Error(`Configuration file not found at ${configFilePath}`);
   }
   try {
     const configContent = fs.readFileSync(configFilePath, 'utf-8');
@@ -574,26 +564,35 @@ export async function loadExtensionConfig(
       pathSeparator: path.sep,
     }) as unknown as ExtensionConfig;
     if (!config.name || !config.version) {
-      return null;
+      throw new Error(
+        `Invalid configuration in ${configFilePath}: missing ${!config.name ? '"name"' : '"version"'}`,
+      );
     }
     return config;
-  } catch (_) {
-    return null;
+  } catch (e) {
+    throw new Error(
+      `Failed to load extension config from ${configFilePath}: ${getErrorMessage(
+        e,
+      )}`,
+    );
   }
 }
 
 export async function uninstallExtension(
-  extensionName: string,
+  extensionIdentifier: string,
   cwd: string = process.cwd(),
 ): Promise<void> {
-  const logger = getClearcutLogger(cwd);
+  const telemetryConfig = getTelemetryConfig(cwd);
   const installedExtensions = loadUserExtensions();
-  if (
-    !installedExtensions.some(
-      (installed) => installed.config.name === extensionName,
-    )
-  ) {
-    throw new Error(`Extension "${extensionName}" not found.`);
+  const extensionName = installedExtensions.find(
+    (installed) =>
+      installed.config.name.toLowerCase() ===
+        extensionIdentifier.toLowerCase() ||
+      installed.installMetadata?.source.toLowerCase() ===
+        extensionIdentifier.toLowerCase(),
+  )?.config.name;
+  if (!extensionName) {
+    throw new Error(`Extension not found.`);
   }
   const manager = new ExtensionEnablementManager(
     ExtensionStorage.getUserExtensionsDir(),
@@ -605,7 +604,8 @@ export async function uninstallExtension(
     recursive: true,
     force: true,
   });
-  logger?.logExtensionUninstallEvent(
+  logExtensionUninstall(
+    telemetryConfig,
     new ExtensionUninstallEvent(extensionName, 'success'),
   );
 }
@@ -618,6 +618,9 @@ export function toOutputString(extension: Extension): string {
     if (extension.installMetadata.ref) {
       output += `\n Ref: ${extension.installMetadata.ref}`;
     }
+    if (extension.installMetadata.releaseTag) {
+      output += `\n Release tag: ${extension.installMetadata.releaseTag}`;
+    }
   }
   if (extension.contextFiles.length > 0) {
     output += `\n Context files:`;
@@ -640,83 +643,6 @@ export function toOutputString(extension: Extension): string {
   return output;
 }
 
-export async function updateExtensionByName(
-  extensionName: string,
-  cwd: string = process.cwd(),
-  extensions: GeminiCLIExtension[],
-  setExtensionUpdateState: (updateState: ExtensionUpdateState) => void,
-): Promise<ExtensionUpdateInfo> {
-  const extension = extensions.find(
-    (installed) => installed.name === extensionName,
-  );
-  if (!extension) {
-    throw new Error(
-      `Extension "${extensionName}" not found. Run gemini extensions list to see available extensions.`,
-    );
-  }
-  return await updateExtension(extension, cwd, setExtensionUpdateState);
-}
-
-export async function updateExtension(
-  extension: GeminiCLIExtension,
-  cwd: string = process.cwd(),
-  setExtensionUpdateState: (updateState: ExtensionUpdateState) => void,
-): Promise<ExtensionUpdateInfo> {
-  if (!extension.type) {
-    setExtensionUpdateState(ExtensionUpdateState.ERROR);
-    throw new Error(
-      `Extension ${extension.name} cannot be updated, type is unknown.`,
-    );
-  }
-  if (extension.type === 'link') {
-    setExtensionUpdateState(ExtensionUpdateState.UP_TO_DATE);
-    throw new Error(`Extension is linked so does not need to be updated`);
-  }
-  setExtensionUpdateState(ExtensionUpdateState.UPDATING);
-  const originalVersion = extension.version;
-
-  const tempDir = await ExtensionStorage.createTmpDir();
-  try {
-    await copyExtension(extension.path, tempDir);
-    await uninstallExtension(extension.name, cwd);
-    await installExtension(
-      {
-        source: extension.source!,
-        type: extension.type,
-        ref: extension.ref,
-      },
-      false,
-      cwd,
-    );
-
-    const updatedExtensionStorage = new ExtensionStorage(extension.name);
-    const updatedExtension = loadExtension({
-      extensionDir: updatedExtensionStorage.getExtensionDir(),
-      workspaceDir: cwd,
-    });
-    if (!updatedExtension) {
-      setExtensionUpdateState(ExtensionUpdateState.ERROR);
-      throw new Error('Updated extension not found after installation.');
-    }
-    const updatedVersion = updatedExtension.config.version;
-    setExtensionUpdateState(ExtensionUpdateState.UPDATED_NEEDS_RESTART);
-    return {
-      name: extension.name,
-      originalVersion,
-      updatedVersion,
-    };
-  } catch (e) {
-    console.error(
-      `Error updating extension, rolling back. ${getErrorMessage(e)}`,
-    );
-    setExtensionUpdateState(ExtensionUpdateState.ERROR);
-    await copyExtension(tempDir, extension.path);
-    throw e;
-  } finally {
-    await fs.promises.rm(tempDir, { recursive: true, force: true });
-  }
-}
-
 export function disableExtension(
   name: string,
   scope: SettingScope,
@@ -746,101 +672,6 @@ export function enableExtension(
   );
   const scopePath = scope === SettingScope.Workspace ? cwd : os.homedir();
   manager.enable(name, true, scopePath);
-}
-
-export async function updateAllUpdatableExtensions(
-  cwd: string = process.cwd(),
-  extensions: GeminiCLIExtension[],
-  extensionsState: Map<string, ExtensionUpdateState>,
-  setExtensionsUpdateState: (
-    updateState: Map<string, ExtensionUpdateState>,
-  ) => void,
-): Promise<ExtensionUpdateInfo[]> {
-  return await Promise.all(
-    extensions
-      .filter(
-        (extension) =>
-          extensionsState.get(extension.name) ===
-          ExtensionUpdateState.UPDATE_AVAILABLE,
-      )
-      .map((extension) =>
-        updateExtension(extension, cwd, (updateState) => {
-          const newState = new Map(extensionsState);
-          newState.set(extension.name, updateState);
-          setExtensionsUpdateState(newState);
-        }),
-      ),
-  );
-}
-
-export interface ExtensionUpdateCheckResult {
-  state: ExtensionUpdateState;
-  error?: string;
-}
-
-export async function checkForAllExtensionUpdates(
-  extensions: GeminiCLIExtension[],
-  setExtensionsUpdateState: (
-    updateState: Map<string, ExtensionUpdateState>,
-  ) => void,
-): Promise<Map<string, ExtensionUpdateState>> {
-  const finalState = new Map<string, ExtensionUpdateState>();
-  for (const extension of extensions) {
-    finalState.set(extension.name, await checkForExtensionUpdate(extension));
-  }
-  setExtensionsUpdateState(finalState);
-  return finalState;
-}
-
-export async function checkForExtensionUpdate(
-  extension: GeminiCLIExtension,
-): Promise<ExtensionUpdateState> {
-  if (extension.type !== 'git') {
-    return ExtensionUpdateState.NOT_UPDATABLE;
-  }
-
-  try {
-    const git = simpleGit(extension.path);
-    const remotes = await git.getRemotes(true);
-    if (remotes.length === 0) {
-      console.error('No git remotes found.');
-      return ExtensionUpdateState.ERROR;
-    }
-    const remoteUrl = remotes[0].refs.fetch;
-    if (!remoteUrl) {
-      console.error(`No fetch URL found for git remote ${remotes[0].name}.`);
-      return ExtensionUpdateState.ERROR;
-    }
-
-    // Determine the ref to check on the remote.
-    const refToCheck = extension.ref || 'HEAD';
-
-    const lsRemoteOutput = await git.listRemote([remoteUrl, refToCheck]);
-
-    if (typeof lsRemoteOutput !== 'string' || lsRemoteOutput.trim() === '') {
-      console.error(`Git ref ${refToCheck} not found.`);
-      return ExtensionUpdateState.ERROR;
-    }
-
-    const remoteHash = lsRemoteOutput.split('\t')[0];
-    const localHash = await git.revparse(['HEAD']);
-
-    if (!remoteHash) {
-      console.error(
-        `Unable to parse hash from git ls-remote output "${lsRemoteOutput}"`,
-      );
-      return ExtensionUpdateState.ERROR;
-    } else if (remoteHash === localHash) {
-      return ExtensionUpdateState.UP_TO_DATE;
-    } else {
-      return ExtensionUpdateState.UPDATE_AVAILABLE;
-    }
-  } catch (error) {
-    console.error(
-      `Failed to check for updates for extension "${
-        extension.name
-      }": ${getErrorMessage(error)}`,
-    );
-    return ExtensionUpdateState.ERROR;
-  }
+  const config = getTelemetryConfig(cwd);
+  logExtensionEnable(config, new ExtensionEnableEvent(name, scope));
 }

packages/cli/src/config/extensions/extensionEnablement.test.ts

@@ -4,11 +4,11 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import * as path from 'node:path';
 import fs from 'node:fs';
 import os from 'node:os';
-import path from 'node:path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { ExtensionEnablementManager } from './extensionEnablement.js';
+import { ExtensionEnablementManager, Override } from './extensionEnablement.js';
 
 // Helper to create a temporary directory for testing
 function createTestDir() {
@@ -48,7 +48,7 @@ describe('ExtensionEnablementManager', () => {
     });
 
     it('should enable a path based on an override rule', () => {
-      manager.disable('ext-test', true, '*'); // Disable globally
+      manager.disable('ext-test', true, '/');
       manager.enable('ext-test', true, '/home/user/projects/');
       expect(manager.isEnabled('ext-test', '/home/user/projects/my-app')).toBe(
         true,
@@ -56,7 +56,7 @@ describe('ExtensionEnablementManager', () => {
     });
 
     it('should disable a path based on a disable override rule', () => {
-      manager.enable('ext-test', true, '*'); // Enable globally
+      manager.enable('ext-test', true, '/');
       manager.disable('ext-test', true, '/home/user/projects/');
       expect(manager.isEnabled('ext-test', '/home/user/projects/my-app')).toBe(
         false,
@@ -78,65 +78,253 @@ describe('ExtensionEnablementManager', () => {
         false,
       );
     });
+
+    it('should handle', () => {
+      manager.enable('ext-test', true, '/home/user/projects');
+      manager.disable('ext-test', false, '/home/user/projects/my-app');
+      expect(manager.isEnabled('ext-test', '/home/user/projects/my-app')).toBe(
+        false,
+      );
+      expect(
+        manager.isEnabled('ext-test', '/home/user/projects/something-else'),
+      ).toBe(true);
+    });
   });
 
   describe('includeSubdirs', () => {
     it('should add a glob when enabling with includeSubdirs', () => {
       manager.enable('ext-test', true, '/path/to/dir');
       const config = manager.readConfig();
-      expect(config['ext-test'].overrides).toContain('/path/to/dir*');
+      expect(config['ext-test'].overrides).toContain('/path/to/dir/*');
     });
 
     it('should not add a glob when enabling without includeSubdirs', () => {
       manager.enable('ext-test', false, '/path/to/dir');
       const config = manager.readConfig();
-      expect(config['ext-test'].overrides).toContain('/path/to/dir');
-      expect(config['ext-test'].overrides).not.toContain('/path/to/dir*');
+      expect(config['ext-test'].overrides).toContain('/path/to/dir/');
+      expect(config['ext-test'].overrides).not.toContain('/path/to/dir/*');
     });
 
     it('should add a glob when disabling with includeSubdirs', () => {
       manager.disable('ext-test', true, '/path/to/dir');
       const config = manager.readConfig();
-      expect(config['ext-test'].overrides).toContain('!/path/to/dir*');
+      expect(config['ext-test'].overrides).toContain('!/path/to/dir/*');
     });
 
     it('should remove conflicting glob rule when enabling without subdirs', () => {
       manager.enable('ext-test', true, '/path/to/dir'); // Adds /path/to/dir*
       manager.enable('ext-test', false, '/path/to/dir'); // Should remove the glob
       const config = manager.readConfig();
-      expect(config['ext-test'].overrides).toContain('/path/to/dir');
-      expect(config['ext-test'].overrides).not.toContain('/path/to/dir*');
+      expect(config['ext-test'].overrides).toContain('/path/to/dir/');
+      expect(config['ext-test'].overrides).not.toContain('/path/to/dir/*');
     });
 
     it('should remove conflicting non-glob rule when enabling with subdirs', () => {
       manager.enable('ext-test', false, '/path/to/dir'); // Adds /path/to/dir
       manager.enable('ext-test', true, '/path/to/dir'); // Should remove the non-glob
       const config = manager.readConfig();
-      expect(config['ext-test'].overrides).toContain('/path/to/dir*');
-      expect(config['ext-test'].overrides).not.toContain('/path/to/dir');
+      expect(config['ext-test'].overrides).toContain('/path/to/dir/*');
+      expect(config['ext-test'].overrides).not.toContain('/path/to/dir/');
     });
 
     it('should remove conflicting rules when disabling', () => {
       manager.enable('ext-test', true, '/path/to/dir'); // enabled with glob
       manager.disable('ext-test', false, '/path/to/dir'); // disabled without
       const config = manager.readConfig();
-      expect(config['ext-test'].overrides).toContain('!/path/to/dir');
-      expect(config['ext-test'].overrides).not.toContain('/path/to/dir*');
+      expect(config['ext-test'].overrides).toContain('!/path/to/dir/');
+      expect(config['ext-test'].overrides).not.toContain('/path/to/dir/*');
     });
 
     it('should correctly evaluate isEnabled with subdirs', () => {
-      manager.disable('ext-test', true, '*');
+      manager.disable('ext-test', true, '/');
       manager.enable('ext-test', true, '/path/to/dir');
-      expect(manager.isEnabled('ext-test', '/path/to/dir')).toBe(true);
-      expect(manager.isEnabled('ext-test', '/path/to/dir/sub')).toBe(true);
-      expect(manager.isEnabled('ext-test', '/path/to/another')).toBe(false);
+      expect(manager.isEnabled('ext-test', '/path/to/dir/')).toBe(true);
+      expect(manager.isEnabled('ext-test', '/path/to/dir/sub/')).toBe(true);
+      expect(manager.isEnabled('ext-test', '/path/to/another/')).toBe(false);
     });
 
     it('should correctly evaluate isEnabled without subdirs', () => {
-      manager.disable('ext-test', true, '*');
+      manager.disable('ext-test', true, '/*');
       manager.enable('ext-test', false, '/path/to/dir');
       expect(manager.isEnabled('ext-test', '/path/to/dir')).toBe(true);
       expect(manager.isEnabled('ext-test', '/path/to/dir/sub')).toBe(false);
     });
   });
+
+  describe('pruning child rules', () => {
+    it('should remove child rules when enabling a parent with subdirs', () => {
+      // Pre-existing rules for children
+      manager.enable('ext-test', false, '/path/to/dir/subdir1');
+      manager.disable('ext-test', true, '/path/to/dir/subdir2');
+      manager.enable('ext-test', false, '/path/to/another/dir');
+
+      // Enable the parent directory
+      manager.enable('ext-test', true, '/path/to/dir');
+
+      const config = manager.readConfig();
+      const overrides = config['ext-test'].overrides;
+
+      // The new parent rule should be present
+      expect(overrides).toContain(`/path/to/dir/*`);
+
+      // Child rules should be removed
+      expect(overrides).not.toContain('/path/to/dir/subdir1/');
+      expect(overrides).not.toContain(`!/path/to/dir/subdir2/*`);
+
+      // Unrelated rules should remain
+      expect(overrides).toContain('/path/to/another/dir/');
+    });
+
+    it('should remove child rules when disabling a parent with subdirs', () => {
+      // Pre-existing rules for children
+      manager.enable('ext-test', false, '/path/to/dir/subdir1');
+      manager.disable('ext-test', true, '/path/to/dir/subdir2');
+      manager.enable('ext-test', false, '/path/to/another/dir');
+
+      // Disable the parent directory
+      manager.disable('ext-test', true, '/path/to/dir');
+
+      const config = manager.readConfig();
+      const overrides = config['ext-test'].overrides;
+
+      // The new parent rule should be present
+      expect(overrides).toContain(`!/path/to/dir/*`);
+
+      // Child rules should be removed
+      expect(overrides).not.toContain('/path/to/dir/subdir1/');
+      expect(overrides).not.toContain(`!/path/to/dir/subdir2/*`);
+
+      // Unrelated rules should remain
+      expect(overrides).toContain('/path/to/another/dir/');
+    });
+
+    it('should not remove child rules if includeSubdirs is false', () => {
+      manager.enable('ext-test', false, '/path/to/dir/subdir1');
+      manager.enable('ext-test', false, '/path/to/dir'); // Not including subdirs
+
+      const config = manager.readConfig();
+      const overrides = config['ext-test'].overrides;
+
+      expect(overrides).toContain('/path/to/dir/subdir1/');
+      expect(overrides).toContain('/path/to/dir/');
+    });
+  });
+
+  it('should enable a path based on an enable override', () => {
+    manager.disable('ext-test', true, '/Users/chrstn');
+    manager.enable('ext-test', true, '/Users/chrstn/gemini-cli');
+
+    expect(manager.isEnabled('ext-test', '/Users/chrstn/gemini-cli')).toBe(
+      true,
+    );
+  });
+
+  it('should ignore subdirs', () => {
+    manager.disable('ext-test', false, '/Users/chrstn');
+    expect(manager.isEnabled('ext-test', '/Users/chrstn/gemini-cli')).toBe(
+      true,
+    );
+  });
+});
+
+describe('Override', () => {
+  it('should create an override from input', () => {
+    const override = Override.fromInput('/path/to/dir', true);
+    expect(override.baseRule).toBe(`/path/to/dir/`);
+    expect(override.isDisable).toBe(false);
+    expect(override.includeSubdirs).toBe(true);
+  });
+
+  it('should create a disable override from input', () => {
+    const override = Override.fromInput('!/path/to/dir', false);
+    expect(override.baseRule).toBe(`/path/to/dir/`);
+    expect(override.isDisable).toBe(true);
+    expect(override.includeSubdirs).toBe(false);
+  });
+
+  it('should create an override from a file rule', () => {
+    const override = Override.fromFileRule('/path/to/dir');
+    expect(override.baseRule).toBe('/path/to/dir');
+    expect(override.isDisable).toBe(false);
+    expect(override.includeSubdirs).toBe(false);
+  });
+
+  it('should create a disable override from a file rule', () => {
+    const override = Override.fromFileRule('!/path/to/dir/');
+    expect(override.isDisable).toBe(true);
+    expect(override.baseRule).toBe('/path/to/dir/');
+    expect(override.includeSubdirs).toBe(false);
+  });
+
+  it('should create an override with subdirs from a file rule', () => {
+    const override = Override.fromFileRule('/path/to/dir/*');
+    expect(override.baseRule).toBe('/path/to/dir/');
+    expect(override.isDisable).toBe(false);
+    expect(override.includeSubdirs).toBe(true);
+  });
+
+  it('should correctly identify conflicting overrides', () => {
+    const override1 = Override.fromInput('/path/to/dir', true);
+    const override2 = Override.fromInput('/path/to/dir', false);
+    expect(override1.conflictsWith(override2)).toBe(true);
+  });
+
+  it('should correctly identify non-conflicting overrides', () => {
+    const override1 = Override.fromInput('/path/to/dir', true);
+    const override2 = Override.fromInput('/path/to/another/dir', true);
+    expect(override1.conflictsWith(override2)).toBe(false);
+  });
+
+  it('should correctly identify equal overrides', () => {
+    const override1 = Override.fromInput('/path/to/dir', true);
+    const override2 = Override.fromInput('/path/to/dir', true);
+    expect(override1.isEqualTo(override2)).toBe(true);
+  });
+
+  it('should correctly identify unequal overrides', () => {
+    const override1 = Override.fromInput('/path/to/dir', true);
+    const override2 = Override.fromInput('!/path/to/dir', true);
+    expect(override1.isEqualTo(override2)).toBe(false);
+  });
+
+  it('should generate the correct regex', () => {
+    const override = Override.fromInput('/path/to/dir', true);
+    const regex = override.asRegex();
+    expect(regex.test('/path/to/dir/')).toBe(true);
+    expect(regex.test('/path/to/dir/subdir')).toBe(true);
+    expect(regex.test('/path/to/another/dir')).toBe(false);
+  });
+
+  it('should correctly identify child overrides', () => {
+    const parent = Override.fromInput('/path/to/dir', true);
+    const child = Override.fromInput('/path/to/dir/subdir', false);
+    expect(child.isChildOf(parent)).toBe(true);
+  });
+
+  it('should correctly identify child overrides with glob', () => {
+    const parent = Override.fromInput('/path/to/dir/*', true);
+    const child = Override.fromInput('/path/to/dir/subdir', false);
+    expect(child.isChildOf(parent)).toBe(true);
+  });
+
+  it('should correctly identify non-child overrides', () => {
+    const parent = Override.fromInput('/path/to/dir', true);
+    const other = Override.fromInput('/path/to/another/dir', false);
+    expect(other.isChildOf(parent)).toBe(false);
+  });
+
+  it('should generate the correct output string', () => {
+    const override = Override.fromInput('/path/to/dir', true);
+    expect(override.output()).toBe(`/path/to/dir/*`);
+  });
+
+  it('should generate the correct output string for a disable override', () => {
+    const override = Override.fromInput('!/path/to/dir', false);
+    expect(override.output()).toBe(`!/path/to/dir/`);
+  });
+
+  it('should disable a path based on a disable override rule', () => {
+    const override = Override.fromInput('!/path/to/dir', false);
+    expect(override.output()).toBe(`!/path/to/dir/`);
+  });
 });

packages/cli/src/config/extensions/extensionEnablement.ts

@@ -15,6 +15,80 @@ export interface AllExtensionsEnablementConfig {
   [extensionName: string]: ExtensionEnablementConfig;
 }
 
+export class Override {
+  constructor(
+    public baseRule: string,
+    public isDisable: boolean,
+    public includeSubdirs: boolean,
+  ) {}
+
+  static fromInput(inputRule: string, includeSubdirs: boolean): Override {
+    const isDisable = inputRule.startsWith('!');
+    let baseRule = isDisable ? inputRule.substring(1) : inputRule;
+    baseRule = ensureLeadingAndTrailingSlash(baseRule);
+    return new Override(baseRule, isDisable, includeSubdirs);
+  }
+
+  static fromFileRule(fileRule: string): Override {
+    const isDisable = fileRule.startsWith('!');
+    let baseRule = isDisable ? fileRule.substring(1) : fileRule;
+    const includeSubdirs = baseRule.endsWith('*');
+    baseRule = includeSubdirs
+      ? baseRule.substring(0, baseRule.length - 1)
+      : baseRule;
+    return new Override(baseRule, isDisable, includeSubdirs);
+  }
+
+  conflictsWith(other: Override): boolean {
+    if (this.baseRule === other.baseRule) {
+      return (
+        this.includeSubdirs !== other.includeSubdirs ||
+        this.isDisable !== other.isDisable
+      );
+    }
+    return false;
+  }
+
+  isEqualTo(other: Override): boolean {
+    return (
+      this.baseRule === other.baseRule &&
+      this.includeSubdirs === other.includeSubdirs &&
+      this.isDisable === other.isDisable
+    );
+  }
+
+  asRegex(): RegExp {
+    return globToRegex(`${this.baseRule}${this.includeSubdirs ? '*' : ''}`);
+  }
+
+  isChildOf(parent: Override) {
+    if (!parent.includeSubdirs) {
+      return false;
+    }
+    return parent.asRegex().test(this.baseRule);
+  }
+
+  output(): string {
+    return `${this.isDisable ? '!' : ''}${this.baseRule}${this.includeSubdirs ? '*' : ''}`;
+  }
+
+  matchesPath(path: string) {
+    return this.asRegex().test(path);
+  }
+}
+
+const ensureLeadingAndTrailingSlash = function (dirPath: string): string {
+  // Normalize separators to forward slashes for consistent matching across platforms.
+  let result = dirPath.replace(/\\/g, '/');
+  if (result.charAt(0) !== '/') {
+    result = '/' + result;
+  }
+  if (result.charAt(result.length - 1) !== '/') {
+    result = result + '/';
+  }
+  return result;
+};
+
 /**
  * Converts a glob pattern to a RegExp object.
  * This is a simplified implementation that supports `*`.
@@ -25,7 +99,7 @@ export interface AllExtensionsEnablementConfig {
 function globToRegex(glob: string): RegExp {
   const regexString = glob
     .replace(/[.+?^${}()|[\]\\]/g, '\\$&') // Escape special regex characters
-    .replace(/\*/g, '.*'); // Convert * to .*
+    .replace(/(\/?)\*/g, '($1.*)?'); // Convert * to optional group
 
   return new RegExp(`^${regexString}$`);
 }
@@ -52,16 +126,13 @@ export class ExtensionEnablementManager {
     const extensionConfig = config[extensionName];
     // Extensions are enabled by default.
     let enabled = true;
-
-    for (const rule of extensionConfig?.overrides ?? []) {
-      const isDisableRule = rule.startsWith('!');
-      const globPattern = isDisableRule ? rule.substring(1) : rule;
-      const regex = globToRegex(globPattern);
-      if (regex.test(currentPath)) {
-        enabled = !isDisableRule;
+    const allOverrides = extensionConfig?.overrides ?? [];
+    for (const rule of allOverrides) {
+      const override = Override.fromFileRule(rule);
+      if (override.matchesPath(ensureLeadingAndTrailingSlash(currentPath))) {
+        enabled = !override.isDisable;
       }
     }
-
     return enabled;
   }
 
@@ -96,24 +167,19 @@ export class ExtensionEnablementManager {
     if (!config[extensionName]) {
       config[extensionName] = { overrides: [] };
     }
-
-    const pathWithGlob = `${scopePath}*`;
-    const pathWithoutGlob = scopePath;
-
-    const newPath = includeSubdirs ? pathWithGlob : pathWithoutGlob;
-    const conflictingPath = includeSubdirs ? pathWithoutGlob : pathWithGlob;
-
-    config[extensionName].overrides = config[extensionName].overrides.filter(
-      (rule) =>
-        rule !== conflictingPath &&
-        rule !== `!${conflictingPath}` &&
-        rule !== `!${newPath}`,
-    );
-
-    if (!config[extensionName].overrides.includes(newPath)) {
-      config[extensionName].overrides.push(newPath);
-    }
-
+    const override = Override.fromInput(scopePath, includeSubdirs);
+    const overrides = config[extensionName].overrides.filter((rule) => {
+      const fileOverride = Override.fromFileRule(rule);
+      if (
+        fileOverride.conflictsWith(override) ||
+        fileOverride.isEqualTo(override)
+      ) {
+        return false; // Remove conflicts and equivalent values.
+      }
+      return !fileOverride.isChildOf(override);
+    });
+    overrides.push(override.output());
+    config[extensionName].overrides = overrides;
     this.writeConfig(config);
   }
 
@@ -122,30 +188,7 @@ export class ExtensionEnablementManager {
     includeSubdirs: boolean,
     scopePath: string,
   ): void {
-    const config = this.readConfig();
-    if (!config[extensionName]) {
-      config[extensionName] = { overrides: [] };
-    }
-
-    const pathWithGlob = `${scopePath}*`;
-    const pathWithoutGlob = scopePath;
-
-    const targetPath = includeSubdirs ? pathWithGlob : pathWithoutGlob;
-    const newRule = `!${targetPath}`;
-    const conflictingPath = includeSubdirs ? pathWithoutGlob : pathWithGlob;
-
-    config[extensionName].overrides = config[extensionName].overrides.filter(
-      (rule) =>
-        rule !== conflictingPath &&
-        rule !== `!${conflictingPath}` &&
-        rule !== targetPath,
-    );
-
-    if (!config[extensionName].overrides.includes(newRule)) {
-      config[extensionName].overrides.push(newRule);
-    }
-
-    this.writeConfig(config);
+    this.enable(extensionName, includeSubdirs, `!${scopePath}`);
   }
 
   remove(extensionName: string): void {

packages/cli/src/config/extensions/github.test.ts

@@ -0,0 +1,337 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  checkForExtensionUpdate,
+  cloneFromGit,
+  findReleaseAsset,
+  parseGitHubRepoForReleases,
+} from './github.js';
+import { simpleGit, type SimpleGit } from 'simple-git';
+import { ExtensionUpdateState } from '../../ui/state/extensions.js';
+import type * as os from 'node:os';
+import type { GeminiCLIExtension } from '@google/gemini-cli-core';
+
+const mockPlatform = vi.hoisted(() => vi.fn());
+const mockArch = vi.hoisted(() => vi.fn());
+vi.mock('node:os', async (importOriginal) => {
+  const actual = await importOriginal<typeof os>();
+  return {
+    ...actual,
+    platform: mockPlatform,
+    arch: mockArch,
+  };
+});
+
+vi.mock('simple-git');
+
+describe('git extension helpers', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('cloneFromGit', () => {
+    const mockGit = {
+      clone: vi.fn(),
+      getRemotes: vi.fn(),
+      fetch: vi.fn(),
+      checkout: vi.fn(),
+    };
+
+    beforeEach(() => {
+      vi.mocked(simpleGit).mockReturnValue(mockGit as unknown as SimpleGit);
+    });
+
+    it('should clone, fetch and checkout a repo', async () => {
+      const installMetadata = {
+        source: 'http://my-repo.com',
+        ref: 'my-ref',
+        type: 'git' as const,
+      };
+      const destination = '/dest';
+      mockGit.getRemotes.mockResolvedValue([
+        { name: 'origin', refs: { fetch: 'http://my-repo.com' } },
+      ]);
+
+      await cloneFromGit(installMetadata, destination);
+
+      expect(mockGit.clone).toHaveBeenCalledWith('http://my-repo.com', './', [
+        '--depth',
+        '1',
+      ]);
+      expect(mockGit.getRemotes).toHaveBeenCalledWith(true);
+      expect(mockGit.fetch).toHaveBeenCalledWith('origin', 'my-ref');
+      expect(mockGit.checkout).toHaveBeenCalledWith('FETCH_HEAD');
+    });
+
+    it('should use HEAD if ref is not provided', async () => {
+      const installMetadata = {
+        source: 'http://my-repo.com',
+        type: 'git' as const,
+      };
+      const destination = '/dest';
+      mockGit.getRemotes.mockResolvedValue([
+        { name: 'origin', refs: { fetch: 'http://my-repo.com' } },
+      ]);
+
+      await cloneFromGit(installMetadata, destination);
+
+      expect(mockGit.fetch).toHaveBeenCalledWith('origin', 'HEAD');
+    });
+
+    it('should throw if no remotes are found', async () => {
+      const installMetadata = {
+        source: 'http://my-repo.com',
+        type: 'git' as const,
+      };
+      const destination = '/dest';
+      mockGit.getRemotes.mockResolvedValue([]);
+
+      await expect(cloneFromGit(installMetadata, destination)).rejects.toThrow(
+        'Failed to clone Git repository from http://my-repo.com',
+      );
+    });
+
+    it('should throw on clone error', async () => {
+      const installMetadata = {
+        source: 'http://my-repo.com',
+        type: 'git' as const,
+      };
+      const destination = '/dest';
+      mockGit.clone.mockRejectedValue(new Error('clone failed'));
+
+      await expect(cloneFromGit(installMetadata, destination)).rejects.toThrow(
+        'Failed to clone Git repository from http://my-repo.com',
+      );
+    });
+  });
+
+  describe('checkForExtensionUpdate', () => {
+    const mockGit = {
+      getRemotes: vi.fn(),
+      listRemote: vi.fn(),
+      revparse: vi.fn(),
+    };
+
+    beforeEach(() => {
+      vi.mocked(simpleGit).mockReturnValue(mockGit as unknown as SimpleGit);
+    });
+
+    it('should return NOT_UPDATABLE for non-git extensions', async () => {
+      const extension: GeminiCLIExtension = {
+        name: 'test',
+        path: '/ext',
+        version: '1.0.0',
+        isActive: true,
+        installMetadata: {
+          type: 'link',
+          source: '',
+        },
+      };
+      let result: ExtensionUpdateState | undefined = undefined;
+      await checkForExtensionUpdate(
+        extension,
+        (newState) => (result = newState),
+      );
+      expect(result).toBe(ExtensionUpdateState.NOT_UPDATABLE);
+    });
+
+    it('should return ERROR if no remotes found', async () => {
+      const extension: GeminiCLIExtension = {
+        name: 'test',
+        path: '/ext',
+        version: '1.0.0',
+        isActive: true,
+        installMetadata: {
+          type: 'git',
+          source: '',
+        },
+      };
+      mockGit.getRemotes.mockResolvedValue([]);
+      let result: ExtensionUpdateState | undefined = undefined;
+      await checkForExtensionUpdate(
+        extension,
+        (newState) => (result = newState),
+      );
+      expect(result).toBe(ExtensionUpdateState.ERROR);
+    });
+
+    it('should return UPDATE_AVAILABLE when remote hash is different', async () => {
+      const extension: GeminiCLIExtension = {
+        name: 'test',
+        path: '/ext',
+        version: '1.0.0',
+        isActive: true,
+        installMetadata: {
+          type: 'git',
+          source: 'my/ext',
+        },
+      };
+      mockGit.getRemotes.mockResolvedValue([
+        { name: 'origin', refs: { fetch: 'http://my-repo.com' } },
+      ]);
+      mockGit.listRemote.mockResolvedValue('remote-hash\tHEAD');
+      mockGit.revparse.mockResolvedValue('local-hash');
+
+      let result: ExtensionUpdateState | undefined = undefined;
+      await checkForExtensionUpdate(
+        extension,
+        (newState) => (result = newState),
+      );
+      expect(result).toBe(ExtensionUpdateState.UPDATE_AVAILABLE);
+    });
+
+    it('should return UP_TO_DATE when remote and local hashes are the same', async () => {
+      const extension: GeminiCLIExtension = {
+        name: 'test',
+        path: '/ext',
+        version: '1.0.0',
+        isActive: true,
+        installMetadata: {
+          type: 'git',
+          source: 'my/ext',
+        },
+      };
+      mockGit.getRemotes.mockResolvedValue([
+        { name: 'origin', refs: { fetch: 'http://my-repo.com' } },
+      ]);
+      mockGit.listRemote.mockResolvedValue('same-hash\tHEAD');
+      mockGit.revparse.mockResolvedValue('same-hash');
+
+      let result: ExtensionUpdateState | undefined = undefined;
+      await checkForExtensionUpdate(
+        extension,
+        (newState) => (result = newState),
+      );
+      expect(result).toBe(ExtensionUpdateState.UP_TO_DATE);
+    });
+
+    it('should return ERROR on git error', async () => {
+      const extension: GeminiCLIExtension = {
+        name: 'test',
+        path: '/ext',
+        version: '1.0.0',
+        isActive: true,
+        installMetadata: {
+          type: 'git',
+          source: 'my/ext',
+        },
+      };
+      mockGit.getRemotes.mockRejectedValue(new Error('git error'));
+
+      let result: ExtensionUpdateState | undefined = undefined;
+      await checkForExtensionUpdate(
+        extension,
+        (newState) => (result = newState),
+      );
+      expect(result).toBe(ExtensionUpdateState.ERROR);
+    });
+  });
+
+  describe('findReleaseAsset', () => {
+    const assets = [
+      { name: 'darwin.arm64.extension.tar.gz', browser_download_url: 'url1' },
+      { name: 'darwin.x64.extension.tar.gz', browser_download_url: 'url2' },
+      { name: 'linux.x64.extension.tar.gz', browser_download_url: 'url3' },
+      { name: 'win32.x64.extension.tar.gz', browser_download_url: 'url4' },
+      { name: 'extension-generic.tar.gz', browser_download_url: 'url5' },
+    ];
+
+    it('should find asset matching platform and architecture', () => {
+      mockPlatform.mockReturnValue('darwin');
+      mockArch.mockReturnValue('arm64');
+      const result = findReleaseAsset(assets);
+      expect(result).toEqual(assets[0]);
+    });
+
+    it('should find asset matching platform if arch does not match', () => {
+      mockPlatform.mockReturnValue('linux');
+      mockArch.mockReturnValue('arm64');
+      const result = findReleaseAsset(assets);
+      expect(result).toEqual(assets[2]);
+    });
+
+    it('should return undefined if no matching asset is found', () => {
+      mockPlatform.mockReturnValue('sunos');
+      mockArch.mockReturnValue('x64');
+      const result = findReleaseAsset(assets);
+      expect(result).toBeUndefined();
+    });
+
+    it('should find generic asset if it is the only one', () => {
+      const singleAsset = [
+        { name: 'extension.tar.gz', browser_download_url: 'url' },
+      ];
+      mockPlatform.mockReturnValue('darwin');
+      mockArch.mockReturnValue('arm64');
+      const result = findReleaseAsset(singleAsset);
+      expect(result).toEqual(singleAsset[0]);
+    });
+
+    it('should return undefined if multiple generic assets exist', () => {
+      const multipleGenericAssets = [
+        { name: 'extension-1.tar.gz', browser_download_url: 'url1' },
+        { name: 'extension-2.tar.gz', browser_download_url: 'url2' },
+      ];
+      mockPlatform.mockReturnValue('darwin');
+      mockArch.mockReturnValue('arm64');
+      const result = findReleaseAsset(multipleGenericAssets);
+      expect(result).toBeUndefined();
+    });
+  });
+
+  describe('parseGitHubRepoForReleases', () => {
+    it('should parse owner and repo from a full GitHub URL', () => {
+      const source = 'https://github.com/owner/repo.git';
+      const { owner, repo } = parseGitHubRepoForReleases(source);
+      expect(owner).toBe('owner');
+      expect(repo).toBe('repo');
+    });
+
+    it('should parse owner and repo from a full GitHub UR without .git', () => {
+      const source = 'https://github.com/owner/repo';
+      const { owner, repo } = parseGitHubRepoForReleases(source);
+      expect(owner).toBe('owner');
+      expect(repo).toBe('repo');
+    });
+
+    it('should fail on a GitHub SSH URL', () => {
+      const source = 'git@github.com:owner/repo.git';
+      expect(() => parseGitHubRepoForReleases(source)).toThrow(
+        'GitHub release-based extensions are not supported for SSH. You must use an HTTPS URI with a personal access token to download releases from private repositories. You can set your personal access token in the GITHUB_TOKEN environment variable and install the extension via SSH.',
+      );
+    });
+
+    it('should parse owner and repo from a shorthand string', () => {
+      const source = 'owner/repo';
+      const { owner, repo } = parseGitHubRepoForReleases(source);
+      expect(owner).toBe('owner');
+      expect(repo).toBe('repo');
+    });
+
+    it('should handle .git suffix in repo name', () => {
+      const source = 'owner/repo.git';
+      const { owner, repo } = parseGitHubRepoForReleases(source);
+      expect(owner).toBe('owner');
+      expect(repo).toBe('repo');
+    });
+
+    it('should throw error for invalid source format', () => {
+      const source = 'invalid-format';
+      expect(() => parseGitHubRepoForReleases(source)).toThrow(
+        'Invalid GitHub repository source: invalid-format. Expected "owner/repo" or a github repo uri.',
+      );
+    });
+
+    it('should throw error for source with too many parts', () => {
+      const source = 'https://github.com/owner/repo/extra';
+      expect(() => parseGitHubRepoForReleases(source)).toThrow(
+        'Invalid GitHub repository source: https://github.com/owner/repo/extra. Expected "owner/repo" or a github repo uri.',
+      );
+    });
+  });
+});

packages/cli/src/config/extensions/github.ts

@@ -0,0 +1,402 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { simpleGit } from 'simple-git';
+import { getErrorMessage } from '../../utils/errors.js';
+import type {
+  ExtensionInstallMetadata,
+  GeminiCLIExtension,
+} from '@google/gemini-cli-core';
+import { ExtensionUpdateState } from '../../ui/state/extensions.js';
+import * as os from 'node:os';
+import * as https from 'node:https';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { execSync } from 'node:child_process';
+import { loadExtension } from '../extension.js';
+import { quote } from 'shell-quote';
+
+function getGitHubToken(): string | undefined {
+  return process.env['GITHUB_TOKEN'];
+}
+
+/**
+ * Clones a Git repository to a specified local path.
+ * @param installMetadata The metadata for the extension to install.
+ * @param destination The destination path to clone the repository to.
+ */
+export async function cloneFromGit(
+  installMetadata: ExtensionInstallMetadata,
+  destination: string,
+): Promise<void> {
+  try {
+    const git = simpleGit(destination);
+    let sourceUrl = installMetadata.source;
+    const token = getGitHubToken();
+    if (token) {
+      try {
+        const parsedUrl = new URL(sourceUrl);
+        if (
+          parsedUrl.protocol === 'https:' &&
+          parsedUrl.hostname === 'github.com'
+        ) {
+          if (!parsedUrl.username) {
+            parsedUrl.username = token;
+          }
+          sourceUrl = parsedUrl.toString();
+        }
+      } catch {
+        // If source is not a valid URL, we don't inject the token.
+        // We let git handle the source as is.
+      }
+    }
+    await git.clone(sourceUrl, './', ['--depth', '1']);
+
+    const remotes = await git.getRemotes(true);
+    if (remotes.length === 0) {
+      throw new Error(
+        `Unable to find any remotes for repo ${installMetadata.source}`,
+      );
+    }
+
+    const refToFetch = installMetadata.ref || 'HEAD';
+
+    await git.fetch(remotes[0].name, refToFetch);
+
+    // After fetching, checkout FETCH_HEAD to get the content of the fetched ref.
+    // This results in a detached HEAD state, which is fine for this purpose.
+    await git.checkout('FETCH_HEAD');
+  } catch (error) {
+    throw new Error(
+      `Failed to clone Git repository from ${installMetadata.source}`,
+      {
+        cause: error,
+      },
+    );
+  }
+}
+
+export function parseGitHubRepoForReleases(source: string): {
+  owner: string;
+  repo: string;
+} {
+  // Default to a github repo path, so `source` can be just an org/repo
+  const parsedUrl = URL.parse(source, 'https://github.com');
+  // The pathname should be "/owner/repo".
+  const parts = parsedUrl?.pathname.substring(1).split('/');
+  if (parts?.length !== 2) {
+    throw new Error(
+      `Invalid GitHub repository source: ${source}. Expected "owner/repo" or a github repo uri.`,
+    );
+  }
+  const owner = parts[0];
+  const repo = parts[1].replace('.git', '');
+
+  if (owner.startsWith('git@github.com')) {
+    throw new Error(
+      `GitHub release-based extensions are not supported for SSH. You must use an HTTPS URI with a personal access token to download releases from private repositories. You can set your personal access token in the GITHUB_TOKEN environment variable and install the extension via SSH.`,
+    );
+  }
+
+  return { owner, repo };
+}
+
+async function fetchReleaseFromGithub(
+  owner: string,
+  repo: string,
+  ref?: string,
+): Promise<GithubReleaseData> {
+  const endpoint = ref ? `releases/tags/${ref}` : 'releases/latest';
+  const url = `https://api.github.com/repos/${owner}/${repo}/${endpoint}`;
+  return await fetchJson(url);
+}
+
+export async function checkForExtensionUpdate(
+  extension: GeminiCLIExtension,
+  setExtensionUpdateState: (updateState: ExtensionUpdateState) => void,
+  cwd: string = process.cwd(),
+): Promise<void> {
+  setExtensionUpdateState(ExtensionUpdateState.CHECKING_FOR_UPDATES);
+  const installMetadata = extension.installMetadata;
+  if (installMetadata?.type === 'local') {
+    const newExtension = loadExtension({
+      extensionDir: installMetadata.source,
+      workspaceDir: cwd,
+    });
+    if (!newExtension) {
+      console.error(
+        `Failed to check for update for local extension "${extension.name}". Could not load extension from source path: ${installMetadata.source}`,
+      );
+      setExtensionUpdateState(ExtensionUpdateState.ERROR);
+      return;
+    }
+    if (newExtension.config.version !== extension.version) {
+      setExtensionUpdateState(ExtensionUpdateState.UPDATE_AVAILABLE);
+      return;
+    }
+    setExtensionUpdateState(ExtensionUpdateState.UP_TO_DATE);
+    return;
+  }
+  if (
+    !installMetadata ||
+    (installMetadata.type !== 'git' &&
+      installMetadata.type !== 'github-release')
+  ) {
+    setExtensionUpdateState(ExtensionUpdateState.NOT_UPDATABLE);
+    return;
+  }
+  try {
+    if (installMetadata.type === 'git') {
+      const git = simpleGit(extension.path);
+      const remotes = await git.getRemotes(true);
+      if (remotes.length === 0) {
+        console.error('No git remotes found.');
+        setExtensionUpdateState(ExtensionUpdateState.ERROR);
+        return;
+      }
+      const remoteUrl = remotes[0].refs.fetch;
+      if (!remoteUrl) {
+        console.error(`No fetch URL found for git remote ${remotes[0].name}.`);
+        setExtensionUpdateState(ExtensionUpdateState.ERROR);
+        return;
+      }
+
+      // Determine the ref to check on the remote.
+      const refToCheck = installMetadata.ref || 'HEAD';
+
+      const lsRemoteOutput = await git.listRemote([remoteUrl, refToCheck]);
+
+      if (typeof lsRemoteOutput !== 'string' || lsRemoteOutput.trim() === '') {
+        console.error(`Git ref ${refToCheck} not found.`);
+        setExtensionUpdateState(ExtensionUpdateState.ERROR);
+        return;
+      }
+
+      const remoteHash = lsRemoteOutput.split('\t')[0];
+      const localHash = await git.revparse(['HEAD']);
+
+      if (!remoteHash) {
+        console.error(
+          `Unable to parse hash from git ls-remote output "${lsRemoteOutput}"`,
+        );
+        setExtensionUpdateState(ExtensionUpdateState.ERROR);
+        return;
+      }
+      if (remoteHash === localHash) {
+        setExtensionUpdateState(ExtensionUpdateState.UP_TO_DATE);
+        return;
+      }
+      setExtensionUpdateState(ExtensionUpdateState.UPDATE_AVAILABLE);
+      return;
+    } else {
+      const { source, releaseTag } = installMetadata;
+      if (!source) {
+        console.error(`No "source" provided for extension.`);
+        setExtensionUpdateState(ExtensionUpdateState.ERROR);
+        return;
+      }
+      const { owner, repo } = parseGitHubRepoForReleases(source);
+
+      const releaseData = await fetchReleaseFromGithub(
+        owner,
+        repo,
+        installMetadata.ref,
+      );
+      if (releaseData.tag_name !== releaseTag) {
+        setExtensionUpdateState(ExtensionUpdateState.UPDATE_AVAILABLE);
+        return;
+      }
+      setExtensionUpdateState(ExtensionUpdateState.UP_TO_DATE);
+      return;
+    }
+  } catch (error) {
+    console.error(
+      `Failed to check for updates for extension "${installMetadata.source}": ${getErrorMessage(error)}`,
+    );
+    setExtensionUpdateState(ExtensionUpdateState.ERROR);
+    return;
+  }
+}
+export interface GitHubDownloadResult {
+  tagName: string;
+  type: 'git' | 'github-release';
+}
+export async function downloadFromGitHubRelease(
+  installMetadata: ExtensionInstallMetadata,
+  destination: string,
+): Promise<GitHubDownloadResult> {
+  const { source, ref } = installMetadata;
+  const { owner, repo } = parseGitHubRepoForReleases(source);
+
+  try {
+    const releaseData = await fetchReleaseFromGithub(owner, repo, ref);
+    if (!releaseData) {
+      throw new Error(
+        `No release data found for ${owner}/${repo} at tag ${ref}`,
+      );
+    }
+
+    const asset = findReleaseAsset(releaseData.assets);
+    let archiveUrl: string | undefined;
+    let isTar = false;
+    let isZip = false;
+    if (asset) {
+      archiveUrl = asset.browser_download_url;
+    } else {
+      if (releaseData.tarball_url) {
+        archiveUrl = releaseData.tarball_url;
+        isTar = true;
+      } else if (releaseData.zipball_url) {
+        archiveUrl = releaseData.zipball_url;
+        isZip = true;
+      }
+    }
+    if (!archiveUrl) {
+      throw new Error(
+        `No assets found for release with tag ${releaseData.tag_name}`,
+      );
+    }
+    let downloadedAssetPath = path.join(
+      destination,
+      path.basename(new URL(archiveUrl).pathname),
+    );
+    if (isTar && !downloadedAssetPath.endsWith('.tar.gz')) {
+      downloadedAssetPath += '.tar.gz';
+    } else if (isZip && !downloadedAssetPath.endsWith('.zip')) {
+      downloadedAssetPath += '.zip';
+    }
+
+    await downloadFile(archiveUrl, downloadedAssetPath);
+
+    extractFile(downloadedAssetPath, destination);
+
+    await fs.promises.unlink(downloadedAssetPath);
+    return {
+      tagName: releaseData.tag_name,
+      type: 'github-release',
+    };
+  } catch (error) {
+    throw new Error(
+      `Failed to download release from ${installMetadata.source}: ${getErrorMessage(error)}`,
+    );
+  }
+}
+
+interface GithubReleaseData {
+  assets: Asset[];
+  tag_name: string;
+  tarball_url?: string;
+  zipball_url?: string;
+}
+
+interface Asset {
+  name: string;
+  browser_download_url: string;
+}
+
+export function findReleaseAsset(assets: Asset[]): Asset | undefined {
+  const platform = os.platform();
+  const arch = os.arch();
+
+  const platformArchPrefix = `${platform}.${arch}.`;
+  const platformPrefix = `${platform}.`;
+
+  // Check for platform + architecture specific asset
+  const platformArchAsset = assets.find((asset) =>
+    asset.name.toLowerCase().startsWith(platformArchPrefix),
+  );
+  if (platformArchAsset) {
+    return platformArchAsset;
+  }
+
+  // Check for platform specific asset
+  const platformAsset = assets.find((asset) =>
+    asset.name.toLowerCase().startsWith(platformPrefix),
+  );
+  if (platformAsset) {
+    return platformAsset;
+  }
+
+  // Check for generic asset if only one is available
+  const genericAsset = assets.find(
+    (asset) =>
+      !asset.name.toLowerCase().includes('darwin') &&
+      !asset.name.toLowerCase().includes('linux') &&
+      !asset.name.toLowerCase().includes('win32'),
+  );
+  if (assets.length === 1) {
+    return genericAsset;
+  }
+
+  return undefined;
+}
+
+async function fetchJson<T>(url: string): Promise<T> {
+  const headers: { 'User-Agent': string; Authorization?: string } = {
+    'User-Agent': 'gemini-cli',
+  };
+  const token = getGitHubToken();
+  if (token) {
+    headers.Authorization = `token ${token}`;
+  }
+  return new Promise((resolve, reject) => {
+    https
+      .get(url, { headers }, (res) => {
+        if (res.statusCode !== 200) {
+          return reject(
+            new Error(`Request failed with status code ${res.statusCode}`),
+          );
+        }
+        const chunks: Buffer[] = [];
+        res.on('data', (chunk) => chunks.push(chunk));
+        res.on('end', () => {
+          const data = Buffer.concat(chunks).toString();
+          resolve(JSON.parse(data) as T);
+        });
+      })
+      .on('error', reject);
+  });
+}
+
+async function downloadFile(url: string, dest: string): Promise<void> {
+  const headers: { 'User-agent': string; Authorization?: string } = {
+    'User-agent': 'gemini-cli',
+  };
+  const token = getGitHubToken();
+  if (token) {
+    headers.Authorization = `token ${token}`;
+  }
+  return new Promise((resolve, reject) => {
+    https
+      .get(url, { headers }, (res) => {
+        if (res.statusCode === 302 || res.statusCode === 301) {
+          downloadFile(res.headers.location!, dest).then(resolve).catch(reject);
+          return;
+        }
+        if (res.statusCode !== 200) {
+          return reject(
+            new Error(`Request failed with status code ${res.statusCode}`),
+          );
+        }
+        const file = fs.createWriteStream(dest);
+        res.pipe(file);
+        file.on('finish', () => file.close(resolve as () => void));
+      })
+      .on('error', reject);
+  });
+}
+
+function extractFile(file: string, dest: string) {
+  const safeFile = quote([file]);
+  const safeDest = quote([dest]);
+  if (file.endsWith('.tar.gz')) {
+    execSync(`tar -xzf ${safeFile} -C ${safeDest}`);
+  } else if (file.endsWith('.zip')) {
+    execSync(`unzip ${safeFile} -d ${safeDest}`);
+  } else {
+    throw new Error(`Unsupported file extension for extraction: ${file}`);
+  }
+}

packages/cli/src/config/extensions/update.test.ts

@@ -0,0 +1,461 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { vi } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import {
+  EXTENSIONS_CONFIG_FILENAME,
+  INSTALL_METADATA_FILENAME,
+  annotateActiveExtensions,
+  loadExtension,
+} from '../extension.js';
+import { checkForAllExtensionUpdates, updateExtension } from './update.js';
+import { GEMINI_DIR } from '@google/gemini-cli-core';
+import { isWorkspaceTrusted } from '../trustedFolders.js';
+import { ExtensionUpdateState } from '../../ui/state/extensions.js';
+import { createExtension } from '../../test-utils/createExtension.js';
+
+const mockGit = {
+  clone: vi.fn(),
+  getRemotes: vi.fn(),
+  fetch: vi.fn(),
+  checkout: vi.fn(),
+  listRemote: vi.fn(),
+  revparse: vi.fn(),
+  // Not a part of the actual API, but we need to use this to do the correct
+  // file system interactions.
+  path: vi.fn(),
+};
+
+vi.mock('simple-git', () => ({
+  simpleGit: vi.fn((path: string) => {
+    mockGit.path.mockReturnValue(path);
+    return mockGit;
+  }),
+}));
+
+vi.mock('os', async (importOriginal) => {
+  const mockedOs = await importOriginal<typeof os>();
+  return {
+    ...mockedOs,
+    homedir: vi.fn(),
+  };
+});
+
+vi.mock('../trustedFolders.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../trustedFolders.js')>();
+  return {
+    ...actual,
+    isWorkspaceTrusted: vi.fn(),
+  };
+});
+
+const mockLogExtensionInstallEvent = vi.hoisted(() => vi.fn());
+const mockLogExtensionUninstall = vi.hoisted(() => vi.fn());
+
+vi.mock('@google/gemini-cli-core', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('@google/gemini-cli-core')>();
+  return {
+    ...actual,
+    logExtensionInstallEvent: mockLogExtensionInstallEvent,
+    logExtensionUninstall: mockLogExtensionUninstall,
+    ExtensionInstallEvent: vi.fn(),
+    ExtensionUninstallEvent: vi.fn(),
+  };
+});
+
+describe('update tests', () => {
+  let tempHomeDir: string;
+  let tempWorkspaceDir: string;
+  let userExtensionsDir: string;
+
+  beforeEach(() => {
+    tempHomeDir = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'gemini-cli-test-home-'),
+    );
+    tempWorkspaceDir = fs.mkdtempSync(
+      path.join(tempHomeDir, 'gemini-cli-test-workspace-'),
+    );
+    vi.mocked(os.homedir).mockReturnValue(tempHomeDir);
+    userExtensionsDir = path.join(tempHomeDir, GEMINI_DIR, 'extensions');
+    // Clean up before each test
+    fs.rmSync(userExtensionsDir, { recursive: true, force: true });
+    fs.mkdirSync(userExtensionsDir, { recursive: true });
+    vi.mocked(isWorkspaceTrusted).mockReturnValue(true);
+    vi.spyOn(process, 'cwd').mockReturnValue(tempWorkspaceDir);
+    Object.values(mockGit).forEach((fn) => fn.mockReset());
+  });
+
+  afterEach(() => {
+    fs.rmSync(tempHomeDir, { recursive: true, force: true });
+    fs.rmSync(tempWorkspaceDir, { recursive: true, force: true });
+  });
+
+  describe('updateExtension', () => {
+    it('should update a git-installed extension', async () => {
+      const gitUrl = 'https://github.com/google/gemini-extensions.git';
+      const extensionName = 'gemini-extensions';
+      const targetExtDir = path.join(userExtensionsDir, extensionName);
+      const metadataPath = path.join(targetExtDir, INSTALL_METADATA_FILENAME);
+
+      fs.mkdirSync(targetExtDir, { recursive: true });
+      fs.writeFileSync(
+        path.join(targetExtDir, EXTENSIONS_CONFIG_FILENAME),
+        JSON.stringify({ name: extensionName, version: '1.0.0' }),
+      );
+      fs.writeFileSync(
+        metadataPath,
+        JSON.stringify({ source: gitUrl, type: 'git' }),
+      );
+
+      mockGit.clone.mockImplementation(async (_, destination) => {
+        fs.mkdirSync(path.join(mockGit.path(), destination), {
+          recursive: true,
+        });
+        fs.writeFileSync(
+          path.join(mockGit.path(), destination, EXTENSIONS_CONFIG_FILENAME),
+          JSON.stringify({ name: extensionName, version: '1.1.0' }),
+        );
+      });
+      mockGit.getRemotes.mockResolvedValue([{ name: 'origin' }]);
+      const extension = annotateActiveExtensions(
+        [
+          loadExtension({
+            extensionDir: targetExtDir,
+            workspaceDir: tempWorkspaceDir,
+          })!,
+        ],
+        [],
+        process.cwd(),
+      )[0];
+      const updateInfo = await updateExtension(
+        extension,
+        tempHomeDir,
+        ExtensionUpdateState.UPDATE_AVAILABLE,
+        () => {},
+      );
+
+      expect(updateInfo).toEqual({
+        name: 'gemini-extensions',
+        originalVersion: '1.0.0',
+        updatedVersion: '1.1.0',
+      });
+
+      const updatedConfig = JSON.parse(
+        fs.readFileSync(
+          path.join(targetExtDir, EXTENSIONS_CONFIG_FILENAME),
+          'utf-8',
+        ),
+      );
+      expect(updatedConfig.version).toBe('1.1.0');
+    });
+
+    it('should call setExtensionUpdateState with UPDATING and then UPDATED_NEEDS_RESTART on success', async () => {
+      const extensionName = 'test-extension';
+      const extensionDir = createExtension({
+        extensionsDir: userExtensionsDir,
+        name: extensionName,
+        version: '1.0.0',
+        installMetadata: {
+          source: 'https://some.git/repo',
+          type: 'git',
+        },
+      });
+
+      mockGit.clone.mockImplementation(async (_, destination) => {
+        fs.mkdirSync(path.join(mockGit.path(), destination), {
+          recursive: true,
+        });
+        fs.writeFileSync(
+          path.join(mockGit.path(), destination, EXTENSIONS_CONFIG_FILENAME),
+          JSON.stringify({ name: extensionName, version: '1.1.0' }),
+        );
+      });
+      mockGit.getRemotes.mockResolvedValue([{ name: 'origin' }]);
+
+      const setExtensionUpdateState = vi.fn();
+
+      const extension = annotateActiveExtensions(
+        [
+          loadExtension({
+            extensionDir,
+            workspaceDir: tempWorkspaceDir,
+          })!,
+        ],
+        [],
+        process.cwd(),
+      )[0];
+      await updateExtension(
+        extension,
+        tempHomeDir,
+        ExtensionUpdateState.UPDATE_AVAILABLE,
+        setExtensionUpdateState,
+      );
+
+      expect(setExtensionUpdateState).toHaveBeenCalledWith(
+        ExtensionUpdateState.UPDATING,
+      );
+      expect(setExtensionUpdateState).toHaveBeenCalledWith(
+        ExtensionUpdateState.UPDATED_NEEDS_RESTART,
+      );
+    });
+
+    it('should call setExtensionUpdateState with ERROR on failure', async () => {
+      const extensionName = 'test-extension';
+      const extensionDir = createExtension({
+        extensionsDir: userExtensionsDir,
+        name: extensionName,
+        version: '1.0.0',
+        installMetadata: {
+          source: 'https://some.git/repo',
+          type: 'git',
+        },
+      });
+
+      mockGit.clone.mockRejectedValue(new Error('Git clone failed'));
+      mockGit.getRemotes.mockResolvedValue([{ name: 'origin' }]);
+
+      const setExtensionUpdateState = vi.fn();
+      const extension = annotateActiveExtensions(
+        [
+          loadExtension({
+            extensionDir,
+            workspaceDir: tempWorkspaceDir,
+          })!,
+        ],
+        [],
+        process.cwd(),
+      )[0];
+      await expect(
+        updateExtension(
+          extension,
+          tempHomeDir,
+          ExtensionUpdateState.UPDATE_AVAILABLE,
+          setExtensionUpdateState,
+        ),
+      ).rejects.toThrow();
+
+      expect(setExtensionUpdateState).toHaveBeenCalledWith(
+        ExtensionUpdateState.UPDATING,
+      );
+      expect(setExtensionUpdateState).toHaveBeenCalledWith(
+        ExtensionUpdateState.ERROR,
+      );
+    });
+  });
+
+  describe('checkForAllExtensionUpdates', () => {
+    it('should return UpdateAvailable for a git extension with updates', async () => {
+      const extensionDir = createExtension({
+        extensionsDir: userExtensionsDir,
+        name: 'test-extension',
+        version: '1.0.0',
+        installMetadata: {
+          source: 'https://some.git/repo',
+          type: 'git',
+        },
+      });
+      const extension = annotateActiveExtensions(
+        [
+          loadExtension({
+            extensionDir,
+            workspaceDir: tempWorkspaceDir,
+          })!,
+        ],
+        [],
+        process.cwd(),
+      )[0];
+
+      mockGit.getRemotes.mockResolvedValue([
+        { name: 'origin', refs: { fetch: 'https://some.git/repo' } },
+      ]);
+      mockGit.listRemote.mockResolvedValue('remoteHash	HEAD');
+      mockGit.revparse.mockResolvedValue('localHash');
+
+      let extensionState = new Map();
+      const results = await checkForAllExtensionUpdates(
+        [extension],
+        extensionState,
+        (newState) => {
+          if (typeof newState === 'function') {
+            newState(extensionState);
+          } else {
+            extensionState = newState;
+          }
+        },
+      );
+      const result = results.get('test-extension');
+      expect(result).toBe(ExtensionUpdateState.UPDATE_AVAILABLE);
+    });
+
+    it('should return UpToDate for a git extension with no updates', async () => {
+      const extensionDir = createExtension({
+        extensionsDir: userExtensionsDir,
+        name: 'test-extension',
+        version: '1.0.0',
+        installMetadata: {
+          source: 'https://some.git/repo',
+          type: 'git',
+        },
+      });
+      const extension = annotateActiveExtensions(
+        [
+          loadExtension({
+            extensionDir,
+            workspaceDir: tempWorkspaceDir,
+          })!,
+        ],
+        [],
+        process.cwd(),
+      )[0];
+
+      mockGit.getRemotes.mockResolvedValue([
+        { name: 'origin', refs: { fetch: 'https://some.git/repo' } },
+      ]);
+      mockGit.listRemote.mockResolvedValue('sameHash	HEAD');
+      mockGit.revparse.mockResolvedValue('sameHash');
+
+      let extensionState = new Map();
+      const results = await checkForAllExtensionUpdates(
+        [extension],
+        extensionState,
+        (newState) => {
+          if (typeof newState === 'function') {
+            newState(extensionState);
+          } else {
+            extensionState = newState;
+          }
+        },
+      );
+      const result = results.get('test-extension');
+      expect(result).toBe(ExtensionUpdateState.UP_TO_DATE);
+    });
+
+    it('should return UpToDate for a local extension with no updates', async () => {
+      const localExtensionSourcePath = path.join(tempHomeDir, 'local-source');
+      const sourceExtensionDir = createExtension({
+        extensionsDir: localExtensionSourcePath,
+        name: 'my-local-ext',
+        version: '1.0.0',
+      });
+
+      const installedExtensionDir = createExtension({
+        extensionsDir: userExtensionsDir,
+        name: 'local-extension',
+        version: '1.0.0',
+        installMetadata: { source: sourceExtensionDir, type: 'local' },
+      });
+      const extension = annotateActiveExtensions(
+        [
+          loadExtension({
+            extensionDir: installedExtensionDir,
+            workspaceDir: tempWorkspaceDir,
+          })!,
+        ],
+        [],
+        process.cwd(),
+      )[0];
+      let extensionState = new Map();
+      const results = await checkForAllExtensionUpdates(
+        [extension],
+        extensionState,
+        (newState) => {
+          if (typeof newState === 'function') {
+            newState(extensionState);
+          } else {
+            extensionState = newState;
+          }
+        },
+        tempWorkspaceDir,
+      );
+      const result = results.get('local-extension');
+      expect(result).toBe(ExtensionUpdateState.UP_TO_DATE);
+    });
+
+    it('should return UpdateAvailable for a local extension with updates', async () => {
+      const localExtensionSourcePath = path.join(tempHomeDir, 'local-source');
+      const sourceExtensionDir = createExtension({
+        extensionsDir: localExtensionSourcePath,
+        name: 'my-local-ext',
+        version: '1.1.0',
+      });
+
+      const installedExtensionDir = createExtension({
+        extensionsDir: userExtensionsDir,
+        name: 'local-extension',
+        version: '1.0.0',
+        installMetadata: { source: sourceExtensionDir, type: 'local' },
+      });
+      const extension = annotateActiveExtensions(
+        [
+          loadExtension({
+            extensionDir: installedExtensionDir,
+            workspaceDir: tempWorkspaceDir,
+          })!,
+        ],
+        [],
+        process.cwd(),
+      )[0];
+      let extensionState = new Map();
+      const results = await checkForAllExtensionUpdates(
+        [extension],
+        extensionState,
+        (newState) => {
+          if (typeof newState === 'function') {
+            newState(extensionState);
+          } else {
+            extensionState = newState;
+          }
+        },
+        tempWorkspaceDir,
+      );
+      const result = results.get('local-extension');
+      expect(result).toBe(ExtensionUpdateState.UPDATE_AVAILABLE);
+    });
+
+    it('should return Error when git check fails', async () => {
+      const extensionDir = createExtension({
+        extensionsDir: userExtensionsDir,
+        name: 'error-extension',
+        version: '1.0.0',
+        installMetadata: {
+          source: 'https://some.git/repo',
+          type: 'git',
+        },
+      });
+      const extension = annotateActiveExtensions(
+        [
+          loadExtension({
+            extensionDir,
+            workspaceDir: tempWorkspaceDir,
+          })!,
+        ],
+        [],
+        process.cwd(),
+      )[0];
+
+      mockGit.getRemotes.mockRejectedValue(new Error('Git error'));
+
+      let extensionState = new Map();
+      const results = await checkForAllExtensionUpdates(
+        [extension],
+        extensionState,
+        (newState) => {
+          if (typeof newState === 'function') {
+            newState(extensionState);
+          } else {
+            extensionState = newState;
+          }
+        },
+      );
+      const result = results.get('error-extension');
+      expect(result).toBe(ExtensionUpdateState.ERROR);
+    });
+  });
+});

packages/cli/src/config/extensions/update.ts

@@ -0,0 +1,161 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import type { GeminiCLIExtension } from '@google/gemini-cli-core';
+import * as fs from 'node:fs';
+import { getErrorMessage } from '../../utils/errors.js';
+import { ExtensionUpdateState } from '../../ui/state/extensions.js';
+import { type Dispatch, type SetStateAction } from 'react';
+import {
+  copyExtension,
+  installExtension,
+  uninstallExtension,
+  loadExtension,
+  loadInstallMetadata,
+  ExtensionStorage,
+} from '../extension.js';
+import { checkForExtensionUpdate } from './github.js';
+
+export interface ExtensionUpdateInfo {
+  name: string;
+  originalVersion: string;
+  updatedVersion: string;
+}
+
+export async function updateExtension(
+  extension: GeminiCLIExtension,
+  cwd: string = process.cwd(),
+  currentState: ExtensionUpdateState,
+  setExtensionUpdateState: (updateState: ExtensionUpdateState) => void,
+): Promise<ExtensionUpdateInfo | undefined> {
+  if (currentState === ExtensionUpdateState.UPDATING) {
+    return undefined;
+  }
+  setExtensionUpdateState(ExtensionUpdateState.UPDATING);
+  const installMetadata = loadInstallMetadata(extension.path);
+
+  if (!installMetadata?.type) {
+    setExtensionUpdateState(ExtensionUpdateState.ERROR);
+    throw new Error(
+      `Extension ${extension.name} cannot be updated, type is unknown.`,
+    );
+  }
+  if (installMetadata?.type === 'link') {
+    setExtensionUpdateState(ExtensionUpdateState.UP_TO_DATE);
+    throw new Error(`Extension is linked so does not need to be updated`);
+  }
+  const originalVersion = extension.version;
+
+  const tempDir = await ExtensionStorage.createTmpDir();
+  try {
+    await copyExtension(extension.path, tempDir);
+    await uninstallExtension(extension.name, cwd);
+    await installExtension(installMetadata, false, cwd);
+
+    const updatedExtensionStorage = new ExtensionStorage(extension.name);
+    const updatedExtension = loadExtension({
+      extensionDir: updatedExtensionStorage.getExtensionDir(),
+      workspaceDir: cwd,
+    });
+    if (!updatedExtension) {
+      setExtensionUpdateState(ExtensionUpdateState.ERROR);
+      throw new Error('Updated extension not found after installation.');
+    }
+    const updatedVersion = updatedExtension.config.version;
+    setExtensionUpdateState(ExtensionUpdateState.UPDATED_NEEDS_RESTART);
+    return {
+      name: extension.name,
+      originalVersion,
+      updatedVersion,
+    };
+  } catch (e) {
+    console.error(
+      `Error updating extension, rolling back. ${getErrorMessage(e)}`,
+    );
+    setExtensionUpdateState(ExtensionUpdateState.ERROR);
+    await copyExtension(tempDir, extension.path);
+    throw e;
+  } finally {
+    await fs.promises.rm(tempDir, { recursive: true, force: true });
+  }
+}
+
+export async function updateAllUpdatableExtensions(
+  cwd: string = process.cwd(),
+  extensions: GeminiCLIExtension[],
+  extensionsState: Map<string, ExtensionUpdateState>,
+  setExtensionsUpdateState: Dispatch<
+    SetStateAction<Map<string, ExtensionUpdateState>>
+  >,
+): Promise<ExtensionUpdateInfo[]> {
+  return (
+    await Promise.all(
+      extensions
+        .filter(
+          (extension) =>
+            extensionsState.get(extension.name) ===
+            ExtensionUpdateState.UPDATE_AVAILABLE,
+        )
+        .map((extension) =>
+          updateExtension(
+            extension,
+            cwd,
+            extensionsState.get(extension.name)!,
+            (updateState) => {
+              setExtensionsUpdateState((prev) => {
+                const finalState = new Map(prev);
+                finalState.set(extension.name, updateState);
+                return finalState;
+              });
+            },
+          ),
+        ),
+    )
+  ).filter((updateInfo) => !!updateInfo);
+}
+
+export interface ExtensionUpdateCheckResult {
+  state: ExtensionUpdateState;
+  error?: string;
+}
+
+export async function checkForAllExtensionUpdates(
+  extensions: GeminiCLIExtension[],
+  extensionsUpdateState: Map<string, ExtensionUpdateState>,
+  setExtensionsUpdateState: Dispatch<
+    SetStateAction<Map<string, ExtensionUpdateState>>
+  >,
+  cwd: string = process.cwd(),
+): Promise<Map<string, ExtensionUpdateState>> {
+  for (const extension of extensions) {
+    const initialState = extensionsUpdateState.get(extension.name);
+    if (initialState === undefined) {
+      if (!extension.installMetadata) {
+        setExtensionsUpdateState((prev) => {
+          extensionsUpdateState = new Map(prev);
+          extensionsUpdateState.set(
+            extension.name,
+            ExtensionUpdateState.NOT_UPDATABLE,
+          );
+          return extensionsUpdateState;
+        });
+        continue;
+      }
+      await checkForExtensionUpdate(
+        extension,
+        (updatedState) => {
+          setExtensionsUpdateState((prev) => {
+            extensionsUpdateState = new Map(prev);
+            extensionsUpdateState.set(extension.name, updatedState);
+            return extensionsUpdateState;
+          });
+        },
+        cwd,
+      );
+    }
+  }
+  return extensionsUpdateState;
+}

packages/cli/src/config/settings.ts

@@ -107,7 +107,7 @@ const MIGRATION_MAP: Record<string, string> = {
   preferredEditor: 'general.preferredEditor',
   sandbox: 'tools.sandbox',
   selectedAuthType: 'security.auth.selectedType',
-  shouldUseNodePtyShell: 'tools.usePty',
+  shouldUseNodePtyShell: 'tools.shell.enableInteractiveShell',
   shellPager: 'tools.shell.pager',
   shellShowColor: 'tools.shell.showColor',
   skipNextSpeakerCheck: 'model.skipNextSpeakerCheck',

packages/cli/src/config/settingsSchema.ts

@@ -639,16 +639,6 @@ const SETTINGS_SCHEMA = {
           'Sandbox execution environment (can be a boolean or a path string).',
         showInDialog: false,
       },
-      usePty: {
-        type: 'boolean',
-        label: 'Use node-pty for Shell Execution',
-        category: 'Tools',
-        requiresRestart: true,
-        default: false,
-        description:
-          'Use node-pty for shell command execution. Fallback to child_process still applies.',
-        showInDialog: true,
-      },
       shell: {
         type: 'object',
         label: 'Shell',
@@ -658,6 +648,16 @@ const SETTINGS_SCHEMA = {
         description: 'Settings for shell execution.',
         showInDialog: false,
         properties: {
+          enableInteractiveShell: {
+            type: 'boolean',
+            label: 'Enable Interactive Shell',
+            category: 'Tools',
+            requiresRestart: true,
+            default: false,
+            description:
+              'Use node-pty for an interactive shell experience. Fallback to child_process still applies.',
+            showInDialog: true,
+          },
           pager: {
             type: 'string',
             label: 'Pager',

packages/cli/src/test-utils/createExtension.ts

@@ -0,0 +1,49 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import {
+  EXTENSIONS_CONFIG_FILENAME,
+  INSTALL_METADATA_FILENAME,
+} from '../config/extension.js';
+import {
+  type MCPServerConfig,
+  type ExtensionInstallMetadata,
+} from '@google/gemini-cli-core';
+
+export function createExtension({
+  extensionsDir = 'extensions-dir',
+  name = 'my-extension',
+  version = '1.0.0',
+  addContextFile = false,
+  contextFileName = undefined as string | undefined,
+  mcpServers = {} as Record<string, MCPServerConfig>,
+  installMetadata = undefined as ExtensionInstallMetadata | undefined,
+} = {}): string {
+  const extDir = path.join(extensionsDir, name);
+  fs.mkdirSync(extDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(extDir, EXTENSIONS_CONFIG_FILENAME),
+    JSON.stringify({ name, version, contextFileName, mcpServers }),
+  );
+
+  if (addContextFile) {
+    fs.writeFileSync(path.join(extDir, 'GEMINI.md'), 'context');
+  }
+
+  if (contextFileName) {
+    fs.writeFileSync(path.join(extDir, contextFileName), 'context');
+  }
+
+  if (installMetadata) {
+    fs.writeFileSync(
+      path.join(extDir, INSTALL_METADATA_FILENAME),
+      JSON.stringify(installMetadata),
+    );
+  }
+  return extDir;
+}

packages/cli/src/test-utils/mockCommandContext.ts

@@ -54,6 +54,8 @@ export const createMockCommandContext = (
       loadHistory: vi.fn(),
       toggleCorgiMode: vi.fn(),
       toggleVimEnabled: vi.fn(),
+      extensionsUpdateState: new Map(),
+      setExtensionsUpdateState: vi.fn(),
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
     } as any,
     session: {

packages/cli/src/ui/AppContainer.tsx

@@ -83,8 +83,7 @@ import { useAutoAcceptIndicator } from './hooks/useAutoAcceptIndicator.js';
 import { useWorkspaceMigration } from './hooks/useWorkspaceMigration.js';
 import { useSessionStats } from './contexts/SessionContext.js';
 import { useGitBranchName } from './hooks/useGitBranchName.js';
-import type { ExtensionUpdateState } from './state/extensions.js';
-import { checkForAllExtensionUpdates } from '../config/extension.js';
+import { useExtensionUpdates } from './hooks/useExtensionUpdates.js';
 
 const CTRL_EXIT_PROMPT_DURATION_MS = 1000;
 
@@ -145,9 +144,14 @@ export const AppContainer = (props: AppContainerProps) => {
   const [isTrustedFolder, setIsTrustedFolder] = useState<boolean | undefined>(
     config.isTrustedFolder(),
   );
-  const [extensionsUpdateState, setExtensionsUpdateState] = useState(
-    new Map<string, ExtensionUpdateState>(),
-  );
+
+  const extensions = config.getExtensions();
+  const { extensionsUpdateState, setExtensionsUpdateState } =
+    useExtensionUpdates(
+      extensions,
+      historyManager.addItem,
+      config.getWorkingDir(),
+    );
 
   // Helper to determine the effective model, considering the fallback state.
   const getEffectiveModel = useCallback(() => {
@@ -1192,11 +1196,6 @@ Logging in with Google... Please restart Gemini CLI to continue.
     ],
   );
 
-  const extensions = config.getExtensions();
-  useEffect(() => {
-    checkForAllExtensionUpdates(extensions, setExtensionsUpdateState);
-  }, [extensions, setExtensionsUpdateState]);
-
   return (
     <UIStateContext.Provider value={uiState}>
       <UIActionsContext.Provider value={uiActions}>

packages/cli/src/ui/commands/extensionsCommand.test.ts

@@ -4,10 +4,11 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import type { GeminiCLIExtension } from '@google/gemini-cli-core';
 import {
   updateAllUpdatableExtensions,
-  updateExtensionByName,
-} from '../../config/extension.js';
+  updateExtension,
+} from '../../config/extensions/update.js';
 import { createMockCommandContext } from '../../test-utils/mockCommandContext.js';
 import { MessageType } from '../types.js';
 import { extensionsCommand } from './extensionsCommand.js';
@@ -20,14 +21,15 @@ import {
   beforeEach,
   type MockedFunction,
 } from 'vitest';
+import { ExtensionUpdateState } from '../state/extensions.js';
 
-vi.mock('../../config/extension.js', () => ({
-  updateExtensionByName: vi.fn(),
+vi.mock('../../config/extensions/update.js', () => ({
+  updateExtension: vi.fn(),
   updateAllUpdatableExtensions: vi.fn(),
 }));
 
-const mockUpdateExtensionByName = updateExtensionByName as MockedFunction<
-  typeof updateExtensionByName
+const mockUpdateExtension = updateExtension as MockedFunction<
+  typeof updateExtension
 >;
 
 const mockUpdateAllUpdatableExtensions =
@@ -35,6 +37,8 @@ const mockUpdateAllUpdatableExtensions =
     typeof updateAllUpdatableExtensions
   >;
 
+const mockGetExtensions = vi.fn();
+
 describe('extensionsCommand', () => {
   let mockContext: CommandContext;
 
@@ -43,7 +47,7 @@ describe('extensionsCommand', () => {
     mockContext = createMockCommandContext({
       services: {
         config: {
-          getExtensions: () => [],
+          getExtensions: mockGetExtensions,
           getWorkingDir: () => '/test/dir',
         },
       },
@@ -147,36 +151,73 @@ describe('extensionsCommand', () => {
     });
 
     it('should update a single extension by name', async () => {
-      mockUpdateExtensionByName.mockResolvedValue({
+      const extension: GeminiCLIExtension = {
         name: 'ext-one',
-        originalVersion: '1.0.0',
+        type: 'git',
+        version: '1.0.0',
+        isActive: true,
+        path: '/test/dir/ext-one',
+        autoUpdate: false,
+      };
+      mockUpdateExtension.mockResolvedValue({
+        name: extension.name,
+        originalVersion: extension.version,
         updatedVersion: '1.0.1',
       });
+      mockGetExtensions.mockReturnValue([extension]);
+      mockContext.ui.extensionsUpdateState.set(
+        extension.name,
+        ExtensionUpdateState.UPDATE_AVAILABLE,
+      );
       await updateAction(mockContext, 'ext-one');
-      expect(mockUpdateExtensionByName).toHaveBeenCalledWith(
-        'ext-one',
+      expect(mockUpdateExtension).toHaveBeenCalledWith(
+        extension,
         '/test/dir',
-        [],
+        ExtensionUpdateState.UPDATE_AVAILABLE,
         expect.any(Function),
       );
     });
 
     it('should handle errors when updating a single extension', async () => {
-      mockUpdateExtensionByName.mockRejectedValue(
-        new Error('Extension not found'),
-      );
+      mockUpdateExtension.mockRejectedValue(new Error('Extension not found'));
+      mockGetExtensions.mockReturnValue([]);
       await updateAction(mockContext, 'ext-one');
       expect(mockContext.ui.addItem).toHaveBeenCalledWith(
         {
           type: MessageType.ERROR,
-          text: 'Extension not found',
+          text: 'Extension ext-one not found.',
         },
         expect.any(Number),
       );
     });
 
     it('should update multiple extensions by name', async () => {
-      mockUpdateExtensionByName
+      const extensionOne: GeminiCLIExtension = {
+        name: 'ext-one',
+        type: 'git',
+        version: '1.0.0',
+        isActive: true,
+        path: '/test/dir/ext-one',
+        autoUpdate: false,
+      };
+      const extensionTwo: GeminiCLIExtension = {
+        name: 'ext-two',
+        type: 'git',
+        version: '1.0.0',
+        isActive: true,
+        path: '/test/dir/ext-two',
+        autoUpdate: false,
+      };
+      mockGetExtensions.mockReturnValue([extensionOne, extensionTwo]);
+      mockContext.ui.extensionsUpdateState.set(
+        extensionOne.name,
+        ExtensionUpdateState.UPDATE_AVAILABLE,
+      );
+      mockContext.ui.extensionsUpdateState.set(
+        extensionTwo.name,
+        ExtensionUpdateState.UPDATE_AVAILABLE,
+      );
+      mockUpdateExtension
         .mockResolvedValueOnce({
           name: 'ext-one',
           originalVersion: '1.0.0',
@@ -188,7 +229,7 @@ describe('extensionsCommand', () => {
           updatedVersion: '2.0.1',
         });
       await updateAction(mockContext, 'ext-one ext-two');
-      expect(mockUpdateExtensionByName).toHaveBeenCalledTimes(2);
+      expect(mockUpdateExtension).toHaveBeenCalledTimes(2);
       expect(mockContext.ui.setPendingItem).toHaveBeenCalledWith({
         type: MessageType.EXTENSIONS_LIST,
       });

packages/cli/src/ui/commands/extensionsCommand.ts

@@ -5,11 +5,12 @@
  */
 
 import {
-  updateExtensionByName,
   updateAllUpdatableExtensions,
   type ExtensionUpdateInfo,
-} from '../../config/extension.js';
+  updateExtension,
+} from '../../config/extensions/update.js';
 import { getErrorMessage } from '../../utils/errors.js';
+import { ExtensionUpdateState } from '../state/extensions.js';
 import { MessageType } from '../types.js';
 import {
   type CommandContext,
@@ -55,19 +56,36 @@ async function updateAction(context: CommandContext, args: string) {
         context.ui.setExtensionsUpdateState,
       );
     } else if (names?.length) {
+      const workingDir = context.services.config!.getWorkingDir();
+      const extensions = context.services.config!.getExtensions();
       for (const name of names) {
-        updateInfos.push(
-          await updateExtensionByName(
-            name,
-            context.services.config!.getWorkingDir(),
-            context.services.config!.getExtensions(),
-            (updateState) => {
-              const newState = new Map(context.ui.extensionsUpdateState);
-              newState.set(name, updateState);
-              context.ui.setExtensionsUpdateState(newState);
-            },
-          ),
+        const extension = extensions.find(
+          (extension) => extension.name === name,
         );
+        if (!extension) {
+          context.ui.addItem(
+            {
+              type: MessageType.ERROR,
+              text: `Extension ${name} not found.`,
+            },
+            Date.now(),
+          );
+          continue;
+        }
+        const updateInfo = await updateExtension(
+          extension,
+          workingDir,
+          context.ui.extensionsUpdateState.get(extension.name) ??
+            ExtensionUpdateState.UNKNOWN,
+          (updateState) => {
+            context.ui.setExtensionsUpdateState((prev) => {
+              const newState = new Map(prev);
+              newState.set(name, updateState);
+              return newState;
+            });
+          },
+        );
+        if (updateInfo) updateInfos.push(updateInfo);
       }
     }
 

packages/cli/src/ui/commands/types.ts

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import type { ReactNode } from 'react';
+import type { Dispatch, ReactNode, SetStateAction } from 'react';
 import type { Content, PartListUnion } from '@google/genai';
 import type { HistoryItemWithoutId, HistoryItem } from '../types.js';
 import type { Config, GitService, Logger } from '@google/gemini-cli-core';
@@ -63,9 +63,9 @@ export interface CommandContext {
     setGeminiMdFileCount: (count: number) => void;
     reloadCommands: () => void;
     extensionsUpdateState: Map<string, ExtensionUpdateState>;
-    setExtensionsUpdateState: (
-      updateState: Map<string, ExtensionUpdateState>,
-    ) => void;
+    setExtensionsUpdateState: Dispatch<
+      SetStateAction<Map<string, ExtensionUpdateState>>
+    >;
   };
   // Session-specific data
   session: {

packages/cli/src/ui/components/SettingsDialog.test.tsx

@@ -1262,7 +1262,7 @@ describe('SettingsDialog', () => {
           },
         },
         tools: {
-          usePty: true,
+          enableInteractiveShell: true,
           autoAccept: true,
           useRipgrep: true,
         },
@@ -1375,7 +1375,7 @@ describe('SettingsDialog', () => {
           },
           tools: {
             useRipgrep: true,
-            usePty: false,
+            enableInteractiveShell: false,
           },
         },
       );
@@ -1449,7 +1449,7 @@ describe('SettingsDialog', () => {
     it('should render with tools and security settings', () => {
       const settings = createMockSettings({
         tools: {
-          usePty: true,
+          enableInteractiveShell: true,
           autoAccept: false,
           useRipgrep: true,
           truncateToolOutputThreshold: 25000,
@@ -1508,7 +1508,7 @@ describe('SettingsDialog', () => {
           },
         },
         tools: {
-          usePty: false,
+          enableInteractiveShell: false,
           autoAccept: false,
           useRipgrep: false,
         },

packages/cli/src/ui/components/messages/ToolGroupMessage.tsx

@@ -12,7 +12,7 @@ import { ToolCallStatus } from '../../types.js';
 import { ToolMessage } from './ToolMessage.js';
 import { ToolConfirmationMessage } from './ToolConfirmationMessage.js';
 import { theme } from '../../semantic-colors.js';
-import { SHELL_COMMAND_NAME } from '../../constants.js';
+import { SHELL_COMMAND_NAME, SHELL_NAME } from '../../constants.js';
 import { useConfig } from '../../contexts/ConfigContext.js';
 
 interface ToolGroupMessageProps {
@@ -47,11 +47,15 @@ export const ToolGroupMessage: React.FC<ToolGroupMessageProps> = ({
   );
 
   const config = useConfig();
-  const isShellCommand = toolCalls.some((t) => t.name === SHELL_COMMAND_NAME);
+  const isShellCommand = toolCalls.some(
+    (t) => t.name === SHELL_COMMAND_NAME || t.name === SHELL_NAME,
+  );
   const borderColor =
-    hasPending || isShellCommand || isShellFocused
-      ? theme.status.warning
-      : theme.border.default;
+    isShellCommand || isShellFocused
+      ? theme.ui.symbol
+      : hasPending
+        ? theme.status.warning
+        : theme.border.default;
 
   const staticHeight = /* border */ 2 + /* marginBottom */ 1;
   // This is a bit of a magic number, but it accounts for the border and

packages/cli/src/ui/components/messages/ToolMessage.tsx

@@ -14,7 +14,11 @@ import { AnsiOutputText } from '../AnsiOutput.js';
 import { GeminiRespondingSpinner } from '../GeminiRespondingSpinner.js';
 import { MaxSizedBox } from '../shared/MaxSizedBox.js';
 import { ShellInputPrompt } from '../ShellInputPrompt.js';
-import { SHELL_COMMAND_NAME, TOOL_STATUS } from '../../constants.js';
+import {
+  SHELL_COMMAND_NAME,
+  SHELL_NAME,
+  TOOL_STATUS,
+} from '../../constants.js';
 import { theme } from '../../semantic-colors.js';
 import type { AnsiOutput, Config } from '@google/gemini-cli-core';
 
@@ -58,6 +62,11 @@ export const ToolMessage: React.FC<ToolMessageProps> = ({
     ptyId === activeShellPtyId &&
     shellFocused;
 
+  const isThisShellFocusable =
+    (name === SHELL_COMMAND_NAME || name === 'Shell') &&
+    status === ToolCallStatus.Executing &&
+    config?.getShouldUseNodePtyShell();
+
   const availableHeight = availableTerminalHeight
     ? Math.max(
         availableTerminalHeight - STATIC_HEIGHT - RESERVED_LINE_COUNT,
@@ -83,16 +92,18 @@ export const ToolMessage: React.FC<ToolMessageProps> = ({
   return (
     <Box paddingX={1} paddingY={0} flexDirection="column">
       <Box minHeight={1}>
-        <ToolStatusIndicator status={status} />
+        <ToolStatusIndicator status={status} name={name} />
         <ToolInfo
           name={name}
           status={status}
           description={description}
           emphasis={emphasis}
         />
-        {isThisShellFocused && (
-          <Box marginLeft={1}>
-            <Text color={theme.text.accent}>[Focused]</Text>
+        {isThisShellFocusable && (
+          <Box marginLeft={1} flexShrink={0}>
+            <Text color={theme.text.accent}>
+              {isThisShellFocused ? '(Focused)' : '(ctrl+f to focus)'}
+            </Text>
           </Box>
         )}
         {emphasis === 'high' && <TrailingIndicator />}
@@ -118,7 +129,7 @@ export const ToolMessage: React.FC<ToolMessageProps> = ({
                 </Box>
               </MaxSizedBox>
             ) : typeof resultDisplay === 'object' &&
-              !Array.isArray(resultDisplay) ? (
+              'fileDiff' in resultDisplay ? (
               <DiffRenderer
                 diffContent={resultDisplay.fileDiff}
                 filename={resultDisplay.fileName}
@@ -148,43 +159,50 @@ export const ToolMessage: React.FC<ToolMessageProps> = ({
 
 type ToolStatusIndicatorProps = {
   status: ToolCallStatus;
+  name: string;
 };
 
 const ToolStatusIndicator: React.FC<ToolStatusIndicatorProps> = ({
   status,
-}) => (
-  <Box minWidth={STATUS_INDICATOR_WIDTH}>
-    {status === ToolCallStatus.Pending && (
-      <Text color={theme.status.success}>{TOOL_STATUS.PENDING}</Text>
-    )}
-    {status === ToolCallStatus.Executing && (
-      <GeminiRespondingSpinner
-        spinnerType="toggle"
-        nonRespondingDisplay={TOOL_STATUS.EXECUTING}
-      />
-    )}
-    {status === ToolCallStatus.Success && (
-      <Text color={theme.status.success} aria-label={'Success:'}>
-        {TOOL_STATUS.SUCCESS}
-      </Text>
-    )}
-    {status === ToolCallStatus.Confirming && (
-      <Text color={theme.status.warning} aria-label={'Confirming:'}>
-        {TOOL_STATUS.CONFIRMING}
-      </Text>
-    )}
-    {status === ToolCallStatus.Canceled && (
-      <Text color={theme.status.warning} aria-label={'Canceled:'} bold>
-        {TOOL_STATUS.CANCELED}
-      </Text>
-    )}
-    {status === ToolCallStatus.Error && (
-      <Text color={theme.status.error} aria-label={'Error:'} bold>
-        {TOOL_STATUS.ERROR}
-      </Text>
-    )}
-  </Box>
-);
+  name,
+}) => {
+  const isShell = name === SHELL_COMMAND_NAME || name === SHELL_NAME;
+  const statusColor = isShell ? theme.ui.symbol : theme.status.warning;
+
+  return (
+    <Box minWidth={STATUS_INDICATOR_WIDTH}>
+      {status === ToolCallStatus.Pending && (
+        <Text color={theme.status.success}>{TOOL_STATUS.PENDING}</Text>
+      )}
+      {status === ToolCallStatus.Executing && (
+        <GeminiRespondingSpinner
+          spinnerType="toggle"
+          nonRespondingDisplay={TOOL_STATUS.EXECUTING}
+        />
+      )}
+      {status === ToolCallStatus.Success && (
+        <Text color={theme.status.success} aria-label={'Success:'}>
+          {TOOL_STATUS.SUCCESS}
+        </Text>
+      )}
+      {status === ToolCallStatus.Confirming && (
+        <Text color={statusColor} aria-label={'Confirming:'}>
+          {TOOL_STATUS.CONFIRMING}
+        </Text>
+      )}
+      {status === ToolCallStatus.Canceled && (
+        <Text color={statusColor} aria-label={'Canceled:'} bold>
+          {TOOL_STATUS.CANCELED}
+        </Text>
+      )}
+      {status === ToolCallStatus.Error && (
+        <Text color={theme.status.error} aria-label={'Error:'} bold>
+          {TOOL_STATUS.ERROR}
+        </Text>
+      )}
+    </Box>
+  );
+};
 
 type ToolInfo = {
   name: string;

packages/cli/src/ui/constants.ts

@@ -16,6 +16,8 @@ export const STREAM_DEBOUNCE_MS = 100;
 
 export const SHELL_COMMAND_NAME = 'Shell Command';
 
+export const SHELL_NAME = 'Shell';
+
 // Tool status symbols used in ToolMessage component
 export const TOOL_STATUS = {
   SUCCESS: '✓',

packages/cli/src/ui/hooks/shellCommandProcessor.test.ts

@@ -238,7 +238,7 @@ describe('useShellCommandProcessor', () => {
         '/test/dir',
         expect.any(Function),
         expect.any(Object),
-        false, // usePty
+        false, // enableInteractiveShell
         expect.any(Object),
       );
 

packages/cli/src/ui/hooks/shellCommandProcessor.ts

@@ -143,6 +143,8 @@ export const useShellCommandProcessor = (
           const activeTheme = themeManager.getActiveTheme();
           const shellExecutionConfig = {
             ...config.getShellExecutionConfig(),
+            terminalWidth,
+            terminalHeight,
             defaultFg: activeTheme.colors.Foreground,
             defaultBg: activeTheme.colors.Background,
           };
@@ -158,14 +160,14 @@ export const useShellCommandProcessor = (
                   if (isBinaryStream) break;
                   // PTY provides the full screen state, so we just replace.
                   // Child process provides chunks, so we append.
-                  if (
+                  if (config.getShouldUseNodePtyShell()) {
+                    cumulativeStdout = event.chunk;
+                    shouldUpdate = true;
+                  } else if (
                     typeof event.chunk === 'string' &&
                     typeof cumulativeStdout === 'string'
                   ) {
                     cumulativeStdout += event.chunk;
-                  } else {
-                    cumulativeStdout = event.chunk;
-                    shouldUpdate = true;
                   }
                   break;
                 case 'binary_detected':

packages/cli/src/ui/hooks/slashCommandProcessor.ts

@@ -4,7 +4,14 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { useCallback, useMemo, useEffect, useState } from 'react';
+import {
+  useCallback,
+  useMemo,
+  useEffect,
+  useState,
+  type Dispatch,
+  type SetStateAction,
+} from 'react';
 import { type PartListUnion } from '@google/genai';
 import process from 'node:process';
 import type { UseHistoryManagerReturn } from './useHistoryManager.js';
@@ -45,9 +52,9 @@ interface SlashCommandProcessorActions {
   quit: (messages: HistoryItem[]) => void;
   setDebugMessage: (message: string) => void;
   toggleCorgiMode: () => void;
-  setExtensionsUpdateState: (
-    updateState: Map<string, ExtensionUpdateState>,
-  ) => void;
+  setExtensionsUpdateState: Dispatch<
+    SetStateAction<Map<string, ExtensionUpdateState>>
+  >;
 }
 
 /**

packages/cli/src/ui/hooks/useExtensionUpdates.test.ts

@@ -0,0 +1,207 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { vi } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import {
+  EXTENSIONS_CONFIG_FILENAME,
+  annotateActiveExtensions,
+  loadExtension,
+} from '../../config/extension.js';
+import { createExtension } from '../../test-utils/createExtension.js';
+import { useExtensionUpdates } from './useExtensionUpdates.js';
+import { GEMINI_DIR, type GeminiCLIExtension } from '@google/gemini-cli-core';
+import { isWorkspaceTrusted } from '../../config/trustedFolders.js';
+import { renderHook, waitFor } from '@testing-library/react';
+import { MessageType } from '../types.js';
+
+const mockGit = {
+  clone: vi.fn(),
+  getRemotes: vi.fn(),
+  fetch: vi.fn(),
+  checkout: vi.fn(),
+  listRemote: vi.fn(),
+  revparse: vi.fn(),
+  // Not a part of the actual API, but we need to use this to do the correct
+  // file system interactions.
+  path: vi.fn(),
+};
+
+vi.mock('simple-git', () => ({
+  simpleGit: vi.fn((path: string) => {
+    mockGit.path.mockReturnValue(path);
+    return mockGit;
+  }),
+}));
+
+vi.mock('os', async (importOriginal) => {
+  const mockedOs = await importOriginal<typeof os>();
+  return {
+    ...mockedOs,
+    homedir: vi.fn(),
+  };
+});
+
+vi.mock('../../config/trustedFolders.js', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('../../config/trustedFolders.js')>();
+  return {
+    ...actual,
+    isWorkspaceTrusted: vi.fn(),
+  };
+});
+
+const mockLogExtensionInstallEvent = vi.hoisted(() => vi.fn());
+const mockLogExtensionUninstall = vi.hoisted(() => vi.fn());
+
+vi.mock('@google/gemini-cli-core', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('@google/gemini-cli-core')>();
+  return {
+    ...actual,
+    logExtensionInstallEvent: mockLogExtensionInstallEvent,
+    logExtensionUninstall: mockLogExtensionUninstall,
+    ExtensionInstallEvent: vi.fn(),
+    ExtensionUninstallEvent: vi.fn(),
+  };
+});
+
+vi.mock('child_process', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('child_process')>();
+  return {
+    ...actual,
+    execSync: vi.fn(),
+  };
+});
+
+const mockQuestion = vi.hoisted(() => vi.fn());
+const mockClose = vi.hoisted(() => vi.fn());
+vi.mock('node:readline', () => ({
+  createInterface: vi.fn(() => ({
+    question: mockQuestion,
+    close: mockClose,
+  })),
+}));
+
+describe('useExtensionUpdates', () => {
+  let tempHomeDir: string;
+  let userExtensionsDir: string;
+
+  beforeEach(() => {
+    tempHomeDir = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'gemini-cli-test-home-'),
+    );
+    vi.mocked(os.homedir).mockReturnValue(tempHomeDir);
+    userExtensionsDir = path.join(tempHomeDir, GEMINI_DIR, 'extensions');
+    fs.mkdirSync(userExtensionsDir, { recursive: true });
+    Object.values(mockGit).forEach((fn) => fn.mockReset());
+  });
+
+  afterEach(() => {
+    fs.rmSync(tempHomeDir, { recursive: true, force: true });
+  });
+
+  it('should check for updates and log a message if an update is available', async () => {
+    const extensions = [
+      {
+        name: 'test-extension',
+        type: 'git',
+        version: '1.0.0',
+        path: '/some/path',
+        isActive: true,
+        installMetadata: {
+          type: 'git',
+          source: 'https://some/repo',
+          autoUpdate: false,
+        },
+      },
+    ];
+    const addItem = vi.fn();
+    const cwd = '/test/cwd';
+
+    mockGit.getRemotes.mockResolvedValue([
+      {
+        name: 'origin',
+        refs: {
+          fetch: 'https://github.com/google/gemini-cli.git',
+        },
+      },
+    ]);
+    mockGit.revparse.mockResolvedValue('local-hash');
+    mockGit.listRemote.mockResolvedValue('remote-hash\tHEAD');
+
+    renderHook(() =>
+      useExtensionUpdates(extensions as GeminiCLIExtension[], addItem, cwd),
+    );
+
+    await waitFor(() => {
+      expect(addItem).toHaveBeenCalledWith(
+        {
+          type: MessageType.INFO,
+          text: 'Extension test-extension has an update available, run "/extensions update test-extension" to install it.',
+        },
+        expect.any(Number),
+      );
+    });
+  });
+
+  it('should check for updates and automatically update if autoUpdate is true', async () => {
+    const extensionDir = createExtension({
+      extensionsDir: userExtensionsDir,
+      name: 'test-extension',
+      version: '1.0.0',
+      installMetadata: {
+        source: 'https://some.git/repo',
+        type: 'git',
+        autoUpdate: true,
+      },
+    });
+    const extension = annotateActiveExtensions(
+      [loadExtension({ extensionDir, workspaceDir: tempHomeDir })!],
+      [],
+      tempHomeDir,
+    )[0];
+
+    const addItem = vi.fn();
+    mockGit.getRemotes.mockResolvedValue([
+      {
+        name: 'origin',
+        refs: {
+          fetch: 'https://github.com/google/gemini-cli.git',
+        },
+      },
+    ]);
+    mockGit.revparse.mockResolvedValue('local-hash');
+    mockGit.listRemote.mockResolvedValue('remote-hash\tHEAD');
+    mockGit.clone.mockImplementation(async (_, destination) => {
+      fs.mkdirSync(path.join(mockGit.path(), destination), {
+        recursive: true,
+      });
+      fs.writeFileSync(
+        path.join(mockGit.path(), destination, EXTENSIONS_CONFIG_FILENAME),
+        JSON.stringify({ name: 'test-extension', version: '1.1.0' }),
+      );
+    });
+    vi.mocked(isWorkspaceTrusted).mockReturnValue(true);
+
+    renderHook(() => useExtensionUpdates([extension], addItem, tempHomeDir));
+
+    await waitFor(
+      () => {
+        expect(addItem).toHaveBeenCalledWith(
+          {
+            type: MessageType.INFO,
+            text: 'Extension "test-extension" successfully updated: 1.0.0 → 1.1.0.',
+          },
+          expect.any(Number),
+        );
+      },
+      { timeout: 2000 },
+    );
+  });
+});

packages/cli/src/ui/hooks/useExtensionUpdates.ts

@@ -0,0 +1,88 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import type { GeminiCLIExtension } from '@google/gemini-cli-core';
+import { getErrorMessage } from '../../utils/errors.js';
+import { ExtensionUpdateState } from '../state/extensions.js';
+import { useMemo, useState } from 'react';
+import type { UseHistoryManagerReturn } from './useHistoryManager.js';
+import { MessageType } from '../types.js';
+import {
+  checkForAllExtensionUpdates,
+  updateExtension,
+} from '../../config/extensions/update.js';
+
+export const useExtensionUpdates = (
+  extensions: GeminiCLIExtension[],
+  addItem: UseHistoryManagerReturn['addItem'],
+  cwd: string,
+) => {
+  const [extensionsUpdateState, setExtensionsUpdateState] = useState(
+    new Map<string, ExtensionUpdateState>(),
+  );
+  useMemo(() => {
+    const checkUpdates = async () => {
+      const updateState = await checkForAllExtensionUpdates(
+        extensions,
+        extensionsUpdateState,
+        setExtensionsUpdateState,
+      );
+      for (const extension of extensions) {
+        const prevState = extensionsUpdateState.get(extension.name);
+        const currentState = updateState.get(extension.name);
+        if (
+          prevState === currentState ||
+          currentState !== ExtensionUpdateState.UPDATE_AVAILABLE
+        ) {
+          continue;
+        }
+        if (extension.installMetadata?.autoUpdate) {
+          updateExtension(extension, cwd, currentState, (newState) => {
+            setExtensionsUpdateState((prev) => {
+              const finalState = new Map(prev);
+              finalState.set(extension.name, newState);
+              return finalState;
+            });
+          })
+            .then((result) => {
+              if (!result) return;
+              addItem(
+                {
+                  type: MessageType.INFO,
+                  text: `Extension "${extension.name}" successfully updated: ${result.originalVersion} → ${result.updatedVersion}.`,
+                },
+                Date.now(),
+              );
+            })
+            .catch((error) => {
+              console.error(
+                `Error updating extension "${extension.name}": ${getErrorMessage(error)}.`,
+              );
+            });
+        } else {
+          addItem(
+            {
+              type: MessageType.INFO,
+              text: `Extension ${extension.name} has an update available, run "/extensions update ${extension.name}" to install it.`,
+            },
+            Date.now(),
+          );
+        }
+      }
+    };
+    checkUpdates();
+  }, [
+    extensions,
+    extensionsUpdateState,
+    setExtensionsUpdateState,
+    addItem,
+    cwd,
+  ]);
+  return {
+    extensionsUpdateState,
+    setExtensionsUpdateState,
+  };
+};

packages/cli/src/ui/privacy/CloudFreePrivacyNotice.tsx

@@ -7,7 +7,7 @@
 import { Box, Newline, Text } from 'ink';
 import { RadioButtonSelect } from '../components/shared/RadioButtonSelect.js';
 import { usePrivacySettings } from '../hooks/usePrivacySettings.js';
-import { CloudPaidPrivacyNotice } from './CloudPaidPrivacyNotice.js';
+
 import type { Config } from '@google/gemini-cli-core';
 import { theme } from '../semantic-colors.js';
 import { useKeypress } from '../hooks/useKeypress.js';
@@ -26,7 +26,10 @@ export const CloudFreePrivacyNotice = ({
 
   useKeypress(
     (key) => {
-      if (privacyState.error && key.name === 'escape') {
+      if (
+        (privacyState.error || privacyState.isFreeTier === false) &&
+        key.name === 'escape'
+      ) {
         onExit();
       }
     },
@@ -49,7 +52,19 @@ export const CloudFreePrivacyNotice = ({
   }
 
   if (privacyState.isFreeTier === false) {
-    return <CloudPaidPrivacyNotice onExit={onExit} />;
+    return (
+      <Box flexDirection="column" marginY={1}>
+        <Text bold color={theme.text.accent}>
+          Gemini Code Assist Privacy Notice
+        </Text>
+        <Newline />
+        <Text>
+          https://developers.google.com/gemini-code-assist/resources/privacy-notices
+        </Text>
+        <Newline />
+        <Text color={theme.text.secondary}>Press Esc to exit.</Text>
+      </Box>
+    );
   }
 
   const items = [

packages/cli/src/ui/state/extensions.ts

@@ -12,4 +12,5 @@ export enum ExtensionUpdateState {
   UP_TO_DATE = 'up to date',
   ERROR = 'error checking for updates',
   NOT_UPDATABLE = 'not updatable',
+  UNKNOWN = 'unknown',
 }

packages/core/index.ts

@@ -24,12 +24,16 @@ export {
   DEFAULT_TRUNCATE_TOOL_OUTPUT_THRESHOLD,
 } from './src/config/config.js';
 export { detectIdeFromEnv, getIdeInfo } from './src/ide/detect-ide.js';
-export { logIdeConnection } from './src/telemetry/loggers.js';
+export {
+  logExtensionEnable,
+  logIdeConnection,
+} from './src/telemetry/loggers.js';
 
 export {
   IdeConnectionEvent,
   IdeConnectionType,
   ExtensionInstallEvent,
+  ExtensionEnableEvent,
   ExtensionUninstallEvent,
 } from './src/telemetry/types.js';
 export { makeFakeConfig } from './src/test-utils/config.js';

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-core",
-  "version": "0.6.0-nightly",
+  "version": "0.6.0",
   "description": "Gemini CLI Core",
   "repository": {
     "type": "git",

packages/core/src/config/config.ts

@@ -117,9 +117,15 @@ export interface GeminiCLIExtension {
   version: string;
   isActive: boolean;
   path: string;
-  source?: string;
-  type?: 'git' | 'local' | 'link';
+  installMetadata?: ExtensionInstallMetadata;
+}
+
+export interface ExtensionInstallMetadata {
+  source: string;
+  type: 'git' | 'local' | 'link' | 'github-release';
+  releaseTag?: string; // Only present for github-release installs.
   ref?: string;
+  autoUpdate?: boolean;
 }
 
 export interface FileFilteringOptions {

packages/core/src/core/client.test.ts

@@ -695,55 +695,6 @@ describe('Gemini Client (client.ts)', () => {
       // Assert that the chat was reset
       expect(newChat).not.toBe(initialChat);
     });
-
-    it('should use current model from config for token counting after sendMessage', async () => {
-      const initialModel = mockConfig.getModel();
-
-      // mock the model has been changed between calls of `countTokens`
-      const firstCurrentModel = initialModel + '-changed-1';
-      const secondCurrentModel = initialModel + '-changed-2';
-      vi.mocked(mockConfig.getModel)
-        .mockReturnValueOnce(firstCurrentModel)
-        .mockReturnValueOnce(secondCurrentModel);
-
-      vi.mocked(mockContentGenerator.countTokens)
-        .mockResolvedValueOnce({ totalTokens: 100000 })
-        .mockResolvedValueOnce({ totalTokens: 5000 });
-
-      const mockSendMessage = vi.fn().mockResolvedValue({ text: 'Summary' });
-
-      const mockChatHistory = [
-        { role: 'user', parts: [{ text: 'Long conversation' }] },
-        { role: 'model', parts: [{ text: 'Long response' }] },
-      ];
-
-      const mockChat = {
-        getHistory: vi.fn().mockImplementation(() => [...mockChatHistory]),
-        setHistory: vi.fn(),
-        sendMessage: mockSendMessage,
-      } as unknown as GeminiChat;
-
-      client['chat'] = mockChat;
-      client['startChat'] = vi.fn().mockResolvedValue(mockChat);
-
-      const result = await client.tryCompressChat('prompt-id-4', false);
-
-      expect(mockContentGenerator.countTokens).toHaveBeenCalledTimes(2);
-      expect(mockContentGenerator.countTokens).toHaveBeenNthCalledWith(1, {
-        model: firstCurrentModel,
-        contents: [...mockChatHistory],
-      });
-      expect(mockContentGenerator.countTokens).toHaveBeenNthCalledWith(2, {
-        model: secondCurrentModel,
-        contents: expect.any(Array),
-      });
-
-      expect(result).toEqual({
-        compressionStatus: CompressionStatus.COMPRESSED,
-        originalTokenCount: 100000,
-        newTokenCount: 5000,
-      });
-    });
   });
 
   describe('sendMessageStream', () => {

packages/core/src/core/client.ts

@@ -751,8 +751,7 @@ export class GeminiClient {
 
     const { totalTokens: newTokenCount } =
       await this.getContentGeneratorOrFail().countTokens({
-        // model might change after calling `sendMessage`, so we get the newest value from config
-        model: this.config.getModel(),
+        model,
         contents: chat.getHistory(),
       });
     if (newTokenCount === undefined) {

packages/core/src/services/shellExecutionService.test.ts

@@ -10,6 +10,7 @@ import type { Readable } from 'node:stream';
 import { type ChildProcess } from 'node:child_process';
 import type { ShellOutputEvent } from './shellExecutionService.js';
 import { ShellExecutionService } from './shellExecutionService.js';
+import type { AnsiOutput } from '../utils/terminalSerializer.js';
 
 // Hoisted Mocks
 const mockPtySpawn = vi.hoisted(() => vi.fn());
@@ -54,6 +55,10 @@ vi.mock('../utils/terminalSerializer.js', () => ({
   serializeTerminalToObject: mockSerializeTerminalToObject,
 }));
 
+const mockProcessKill = vi
+  .spyOn(process, 'kill')
+  .mockImplementation(() => true);
+
 const shellExecutionConfig = {
   terminalWidth: 80,
   terminalHeight: 24,
@@ -61,9 +66,25 @@ const shellExecutionConfig = {
   showColor: false,
 };
 
-const mockProcessKill = vi
-  .spyOn(process, 'kill')
-  .mockImplementation(() => true);
+const createExpectedAnsiOutput = (text: string | string[]): AnsiOutput => {
+  const lines = Array.isArray(text) ? text : text.split('\n');
+  const expected: AnsiOutput = Array.from(
+    { length: shellExecutionConfig.terminalHeight },
+    (_, i) => [
+      {
+        text: expect.stringMatching((lines[i] || '').trim()),
+        bold: false,
+        italic: false,
+        underline: false,
+        dim: false,
+        inverse: false,
+        fg: '',
+        bg: '',
+      },
+    ],
+  );
+  return expected;
+};
 
 describe('ShellExecutionService', () => {
   let mockPtyProcess: EventEmitter & {
@@ -77,6 +98,11 @@ describe('ShellExecutionService', () => {
   let mockHeadlessTerminal: {
     resize: Mock;
     scrollLines: Mock;
+    buffer: {
+      active: {
+        viewportY: number;
+      };
+    };
   };
   let onOutputEventMock: Mock<(event: ShellOutputEvent) => void>;
 
@@ -110,6 +136,11 @@ describe('ShellExecutionService', () => {
     mockHeadlessTerminal = {
       resize: vi.fn(),
       scrollLines: vi.fn(),
+      buffer: {
+        active: {
+          viewportY: 0,
+        },
+      },
     };
 
     mockPtySpawn.mockReturnValue(mockPtyProcess);
@@ -161,7 +192,7 @@ describe('ShellExecutionService', () => {
 
       expect(onOutputEventMock).toHaveBeenCalledWith({
         type: 'data',
-        chunk: 'file1.txt',
+        chunk: createExpectedAnsiOutput('file1.txt'),
       });
     });
 
@@ -175,7 +206,7 @@ describe('ShellExecutionService', () => {
       expect(onOutputEventMock).toHaveBeenCalledWith(
         expect.objectContaining({
           type: 'data',
-          chunk: expect.stringContaining('aredword'),
+          chunk: createExpectedAnsiOutput('aredword'),
         }),
       );
     });
@@ -197,7 +228,7 @@ describe('ShellExecutionService', () => {
 
       expect(onOutputEventMock).toHaveBeenCalledWith(
         expect.objectContaining({
-          chunk: expect.stringMatching(/^\s*$/),
+          chunk: createExpectedAnsiOutput(''),
         }),
       );
     });
@@ -438,17 +469,44 @@ describe('ShellExecutionService', () => {
       );
     });
 
-    it('should call onOutputEvent with plain string when showColor is false', async () => {
-      await simulateExecution('ls --color=auto', (pty) => {
-        pty.onData.mock.calls[0][0]('a\u001b[31mred\u001b[0mword');
-        pty.onExit.mock.calls[0][0]({ exitCode: 0, signal: null });
-      });
+    it('should call onOutputEvent with AnsiOutput when showColor is false', async () => {
+      await simulateExecution(
+        'ls --color=auto',
+        (pty) => {
+          pty.onData.mock.calls[0][0]('a\u001b[31mred\u001b[0mword');
+          pty.onExit.mock.calls[0][0]({ exitCode: 0, signal: null });
+        },
+        { ...shellExecutionConfig, showColor: false },
+      );
+
+      const expected = createExpectedAnsiOutput('aredword');
 
-      expect(mockSerializeTerminalToObject).not.toHaveBeenCalled();
       expect(onOutputEventMock).toHaveBeenCalledWith(
         expect.objectContaining({
           type: 'data',
-          chunk: 'aredword',
+          chunk: expected,
+        }),
+      );
+    });
+
+    it('should handle multi-line output correctly when showColor is false', async () => {
+      await simulateExecution(
+        'ls --color=auto',
+        (pty) => {
+          pty.onData.mock.calls[0][0](
+            'line 1\n\u001b[32mline 2\u001b[0m\nline 3',
+          );
+          pty.onExit.mock.calls[0][0]({ exitCode: 0, signal: null });
+        },
+        { ...shellExecutionConfig, showColor: false },
+      );
+
+      const expected = createExpectedAnsiOutput(['line 1', 'line 2', 'line 3']);
+
+      expect(onOutputEventMock).toHaveBeenCalledWith(
+        expect.objectContaining({
+          type: 'data',
+          chunk: expected,
         }),
       );
     });
@@ -541,7 +599,7 @@ describe('ShellExecutionService child_process fallback', () => {
       expect(onOutputEventMock).toHaveBeenCalledWith(
         expect.objectContaining({
           type: 'data',
-          chunk: expect.stringContaining('aredword'),
+          chunk: 'aredword',
         }),
       );
     });

packages/core/src/services/shellExecutionService.ts

@@ -85,17 +85,6 @@ interface ActivePty {
   headlessTerminal: pkg.Terminal;
 }
 
-const getVisibleText = (terminal: pkg.Terminal): string => {
-  const buffer = terminal.buffer.active;
-  const lines: string[] = [];
-  for (let i = 0; i < terminal.rows; i++) {
-    const line = buffer.getLine(buffer.viewportY + i);
-    const lineContent = line ? line.translateToString(true) : '';
-    lines.push(lineContent);
-  }
-  return lines.join('\n').trimEnd();
-};
-
 const getFullBufferText = (terminal: pkg.Terminal): string => {
   const buffer = terminal.buffer.active;
   const lines: string[] = [];
@@ -379,6 +368,7 @@ export class ShellExecutionService {
           cols,
           rows,
         });
+        headlessTerminal.scrollToTop();
 
         this.activePtys.set(ptyProcess.pid, { ptyProcess, headlessTerminal });
 
@@ -404,14 +394,33 @@ export class ShellExecutionService {
             if (!isStreamingRawContent) {
               return;
             }
-            const newOutput = shellExecutionConfig.showColor
-              ? serializeTerminalToObject(headlessTerminal, {
-                  defaultFg: shellExecutionConfig.defaultFg,
-                  defaultBg: shellExecutionConfig.defaultBg,
-                })
-              : getVisibleText(headlessTerminal);
-
-            // console.log(newOutput)
+            let newOutput: AnsiOutput;
+            if (shellExecutionConfig.showColor) {
+              newOutput = serializeTerminalToObject(headlessTerminal, {
+                defaultFg: shellExecutionConfig.defaultFg,
+                defaultBg: shellExecutionConfig.defaultBg,
+              });
+            } else {
+              const buffer = headlessTerminal.buffer.active;
+              const lines: AnsiOutput = [];
+              for (let y = 0; y < headlessTerminal.rows; y++) {
+                const line = buffer.getLine(buffer.viewportY + y);
+                const lineContent = line ? line.translateToString(true) : '';
+                lines.push([
+                  {
+                    text: lineContent,
+                    bold: false,
+                    italic: false,
+                    underline: false,
+                    dim: false,
+                    inverse: false,
+                    fg: '',
+                    bg: '',
+                  },
+                ]);
+              }
+              newOutput = lines;
+            }
 
             // Using stringify for a quick deep comparison.
             if (JSON.stringify(output) !== JSON.stringify(newOutput)) {
@@ -602,6 +611,9 @@ export class ShellExecutionService {
     if (activePty) {
       try {
         activePty.headlessTerminal.scrollLines(lines);
+        if (activePty.headlessTerminal.buffer.active.viewportY < 0) {
+          activePty.headlessTerminal.scrollToTop();
+        }
       } catch (e) {
         // Ignore errors if the pty has already exited, which can happen
         // due to a race condition between the exit event and this call.

packages/core/src/telemetry/clearcut-logger/clearcut-logger.ts

@@ -28,6 +28,7 @@ import type {
   ToolOutputTruncatedEvent,
   ExtensionUninstallEvent,
   ModelRoutingEvent,
+  ExtensionEnableEvent,
 } from '../types.js';
 import { EventMetadataKey } from './event-metadata-key.js';
 import type { Config } from '../../config/config.js';
@@ -61,6 +62,7 @@ export enum EventNames {
   INVALID_CHUNK = 'invalid_chunk',
   CONTENT_RETRY = 'content_retry',
   CONTENT_RETRY_FAILURE = 'content_retry_failure',
+  EXTENSION_ENABLE = 'extension_enable',
   EXTENSION_INSTALL = 'extension_install',
   EXTENSION_UNINSTALL = 'extension_uninstall',
   TOOL_OUTPUT_TRUNCATED = 'tool_output_truncated',
@@ -959,6 +961,25 @@ export class ClearcutLogger {
     this.flushIfNeeded();
   }
 
+  logExtensionEnableEvent(event: ExtensionEnableEvent): void {
+    const data: EventValue[] = [
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_EXTENSION_NAME,
+        value: event.extension_name,
+      },
+      {
+        gemini_cli_key:
+          EventMetadataKey.GEMINI_CLI_EXTENSION_ENABLE_SETTING_SCOPE,
+        value: event.setting_scope,
+      },
+    ];
+
+    this.enqueueLogEvent(
+      this.createLogEvent(EventNames.EXTENSION_ENABLE, data),
+    );
+    this.flushIfNeeded();
+  }
+
   /**
    * Adds default fields to data, and returns a new data array.  This fields
    * should exist on all log events.

packages/core/src/telemetry/clearcut-logger/event-metadata-key.ts

@@ -353,6 +353,9 @@ export enum EventMetadataKey {
   // Logs the status of the extension uninstall
   GEMINI_CLI_EXTENSION_UNINSTALL_STATUS = 96,
 
+  // Logs the setting scope for an extension enablement.
+  GEMINI_CLI_EXTENSION_ENABLE_SETTING_SCOPE = 102,
+
   // ==========================================================================
   // Tool Output Truncated Event Keys
   // ===========================================================================

packages/core/src/telemetry/constants.ts

@@ -12,6 +12,9 @@ export const EVENT_API_REQUEST = 'gemini_cli.api_request';
 export const EVENT_API_ERROR = 'gemini_cli.api_error';
 export const EVENT_API_RESPONSE = 'gemini_cli.api_response';
 export const EVENT_CLI_CONFIG = 'gemini_cli.config';
+export const EVENT_EXTENSION_ENABLE = 'gemini_cli.extension_enable';
+export const EVENT_EXTENSION_INSTALL = 'gemini_cli.extension_install';
+export const EVENT_EXTENSION_UNINSTALL = 'gemini_cli.extension_uninstall';
 export const EVENT_FLASH_FALLBACK = 'gemini_cli.flash_fallback';
 export const EVENT_RIPGREP_FALLBACK = 'gemini_cli.ripgrep_fallback';
 export const EVENT_NEXT_SPEAKER_CHECK = 'gemini_cli.next_speaker_check';

packages/core/src/telemetry/index.ts

@@ -36,6 +36,9 @@ export {
   logKittySequenceOverflow,
   logChatCompression,
   logToolOutputTruncated,
+  logExtensionEnable,
+  logExtensionInstallEvent,
+  logExtensionUninstall,
 } from './loggers.js';
 export type { SlashCommandEvent, ChatCompressionEvent } from './types.js';
 export {

packages/core/src/telemetry/loggers.test.ts

@@ -33,6 +33,9 @@ import {
   EVENT_FILE_OPERATION,
   EVENT_RIPGREP_FALLBACK,
   EVENT_MODEL_ROUTING,
+  EVENT_EXTENSION_ENABLE,
+  EVENT_EXTENSION_INSTALL,
+  EVENT_EXTENSION_UNINSTALL,
 } from './constants.js';
 import {
   logApiRequest,
@@ -47,6 +50,9 @@ import {
   logRipgrepFallback,
   logToolOutputTruncated,
   logModelRouting,
+  logExtensionEnable,
+  logExtensionInstallEvent,
+  logExtensionUninstall,
 } from './loggers.js';
 import { ToolCallDecision } from './tool-call-decision.js';
 import {
@@ -62,11 +68,14 @@ import {
   FileOperationEvent,
   ToolOutputTruncatedEvent,
   ModelRoutingEvent,
+  ExtensionEnableEvent,
+  ExtensionInstallEvent,
+  ExtensionUninstallEvent,
 } from './types.js';
 import * as metrics from './metrics.js';
 import { FileOperation } from './metrics.js';
 import * as sdk from './sdk.js';
-import { vi, describe, beforeEach, it, expect } from 'vitest';
+import { vi, describe, beforeEach, it, expect, afterEach } from 'vitest';
 import type { GenerateContentResponseUsageMetadata } from '@google/genai';
 import * as uiTelemetry from './uiTelemetry.js';
 import { makeFakeConfig } from '../test-utils/config.js';
@@ -1108,4 +1117,122 @@ describe('loggers', () => {
       expect(metrics.recordModelRoutingMetrics).not.toHaveBeenCalled();
     });
   });
+
+  describe('logExtensionInstall', () => {
+    const mockConfig = {
+      getSessionId: () => 'test-session-id',
+      getUsageStatisticsEnabled: () => true,
+    } as unknown as Config;
+
+    beforeEach(() => {
+      vi.spyOn(ClearcutLogger.prototype, 'logExtensionInstallEvent');
+    });
+
+    afterEach(() => {
+      vi.resetAllMocks();
+    });
+
+    it('should log extension install event', () => {
+      const event = new ExtensionInstallEvent(
+        'vscode',
+        '0.1.0',
+        'git',
+        'success',
+      );
+
+      logExtensionInstallEvent(mockConfig, event);
+
+      expect(
+        ClearcutLogger.prototype.logExtensionInstallEvent,
+      ).toHaveBeenCalledWith(event);
+
+      expect(mockLogger.emit).toHaveBeenCalledWith({
+        body: 'Installed extension vscode',
+        attributes: {
+          'session.id': 'test-session-id',
+          'user.email': 'test-user@example.com',
+          'event.name': EVENT_EXTENSION_INSTALL,
+          'event.timestamp': '2025-01-01T00:00:00.000Z',
+          extension_name: 'vscode',
+          extension_version: '0.1.0',
+          extension_source: 'git',
+          status: 'success',
+        },
+      });
+    });
+  });
+
+  describe('logExtensionUninstall', () => {
+    const mockConfig = {
+      getSessionId: () => 'test-session-id',
+      getUsageStatisticsEnabled: () => true,
+    } as unknown as Config;
+
+    beforeEach(() => {
+      vi.spyOn(ClearcutLogger.prototype, 'logExtensionUninstallEvent');
+    });
+
+    afterEach(() => {
+      vi.resetAllMocks();
+    });
+
+    it('should log extension uninstall event', () => {
+      const event = new ExtensionUninstallEvent('vscode', 'success');
+
+      logExtensionUninstall(mockConfig, event);
+
+      expect(
+        ClearcutLogger.prototype.logExtensionUninstallEvent,
+      ).toHaveBeenCalledWith(event);
+
+      expect(mockLogger.emit).toHaveBeenCalledWith({
+        body: 'Uninstalled extension vscode',
+        attributes: {
+          'session.id': 'test-session-id',
+          'user.email': 'test-user@example.com',
+          'event.name': EVENT_EXTENSION_UNINSTALL,
+          'event.timestamp': '2025-01-01T00:00:00.000Z',
+          extension_name: 'vscode',
+          status: 'success',
+        },
+      });
+    });
+  });
+
+  describe('logExtensionEnable', () => {
+    const mockConfig = {
+      getSessionId: () => 'test-session-id',
+      getUsageStatisticsEnabled: () => true,
+    } as unknown as Config;
+
+    beforeEach(() => {
+      vi.spyOn(ClearcutLogger.prototype, 'logExtensionEnableEvent');
+    });
+
+    afterEach(() => {
+      vi.resetAllMocks();
+    });
+
+    it('should log extension enable event', () => {
+      const event = new ExtensionEnableEvent('vscode', 'user');
+
+      logExtensionEnable(mockConfig, event);
+
+      expect(
+        ClearcutLogger.prototype.logExtensionEnableEvent,
+      ).toHaveBeenCalledWith(event);
+
+      expect(mockLogger.emit).toHaveBeenCalledWith({
+        body: 'Enabled extension vscode',
+        attributes: {
+          'session.id': 'test-session-id',
+          'user.email': 'test-user@example.com',
+          'event.name': EVENT_EXTENSION_ENABLE,
+          'event.timestamp': '2025-01-01T00:00:00.000Z',
+          extension_name: 'vscode',
+          setting_scope: 'user',
+        },
+      });
+    });
+  });
 });

packages/core/src/telemetry/loggers.ts

@@ -13,6 +13,8 @@ import {
   EVENT_API_REQUEST,
   EVENT_API_RESPONSE,
   EVENT_CLI_CONFIG,
+  EVENT_EXTENSION_UNINSTALL,
+  EVENT_EXTENSION_ENABLE,
   EVENT_IDE_CONNECTION,
   EVENT_TOOL_CALL,
   EVENT_USER_PROMPT,
@@ -29,6 +31,7 @@ import {
   EVENT_FILE_OPERATION,
   EVENT_RIPGREP_FALLBACK,
   EVENT_MODEL_ROUTING,
+  EVENT_EXTENSION_INSTALL,
 } from './constants.js';
 import type {
   ApiErrorEvent,
@@ -54,6 +57,9 @@ import type {
   RipgrepFallbackEvent,
   ToolOutputTruncatedEvent,
   ModelRoutingEvent,
+  ExtensionEnableEvent,
+  ExtensionUninstallEvent,
+  ExtensionInstallEvent,
 } from './types.js';
 import {
   recordApiErrorMetrics,
@@ -691,3 +697,73 @@ export function logModelRouting(
   logger.emit(logRecord);
   recordModelRoutingMetrics(config, event);
 }
+
+export function logExtensionInstallEvent(
+  config: Config,
+  event: ExtensionInstallEvent,
+): void {
+  ClearcutLogger.getInstance(config)?.logExtensionInstallEvent(event);
+  if (!isTelemetrySdkInitialized()) return;
+
+  const attributes: LogAttributes = {
+    ...getCommonAttributes(config),
+    ...event,
+    'event.name': EVENT_EXTENSION_INSTALL,
+    'event.timestamp': new Date().toISOString(),
+    extension_name: event.extension_name,
+    extension_version: event.extension_version,
+    extension_source: event.extension_source,
+    status: event.status,
+  };
+
+  const logger = logs.getLogger(SERVICE_NAME);
+  const logRecord: LogRecord = {
+    body: `Installed extension ${event.extension_name}`,
+    attributes,
+  };
+  logger.emit(logRecord);
+}
+
+export function logExtensionUninstall(
+  config: Config,
+  event: ExtensionUninstallEvent,
+): void {
+  ClearcutLogger.getInstance(config)?.logExtensionUninstallEvent(event);
+  if (!isTelemetrySdkInitialized()) return;
+
+  const attributes: LogAttributes = {
+    ...getCommonAttributes(config),
+    ...event,
+    'event.name': EVENT_EXTENSION_UNINSTALL,
+    'event.timestamp': new Date().toISOString(),
+  };
+
+  const logger = logs.getLogger(SERVICE_NAME);
+  const logRecord: LogRecord = {
+    body: `Uninstalled extension ${event.extension_name}`,
+    attributes,
+  };
+  logger.emit(logRecord);
+}
+
+export function logExtensionEnable(
+  config: Config,
+  event: ExtensionEnableEvent,
+): void {
+  ClearcutLogger.getInstance(config)?.logExtensionEnableEvent(event);
+  if (!isTelemetrySdkInitialized()) return;
+
+  const attributes: LogAttributes = {
+    ...getCommonAttributes(config),
+    ...event,
+    'event.name': EVENT_EXTENSION_ENABLE,
+    'event.timestamp': new Date().toISOString(),
+  };
+
+  const logger = logs.getLogger(SERVICE_NAME);
+  const logRecord: LogRecord = {
+    body: `Enabled extension ${event.extension_name}`,
+    attributes,
+  };
+  logger.emit(logRecord);
+}

packages/core/src/telemetry/sdk.ts

@@ -198,6 +198,9 @@ export function initializeTelemetry(config: Config): void {
   process.on('SIGINT', () => {
     shutdownTelemetry(config);
   });
+  process.on('exit', () => {
+    shutdownTelemetry(config);
+  });
 }
 
 export async function shutdownTelemetry(config: Config): Promise<void> {

packages/core/src/telemetry/types.ts

@@ -576,6 +576,7 @@ export type TelemetryEvent =
   | InvalidChunkEvent
   | ContentRetryEvent
   | ContentRetryFailureEvent
+  | ExtensionEnableEvent
   | ExtensionInstallEvent
   | ExtensionUninstallEvent
   | ModelRoutingEvent
@@ -648,3 +649,17 @@ export class ExtensionUninstallEvent implements BaseTelemetryEvent {
     this.status = status;
   }
 }
+
+export class ExtensionEnableEvent implements BaseTelemetryEvent {
+  'event.name': 'extension_enable';
+  'event.timestamp': string;
+  extension_name: string;
+  setting_scope: string;
+
+  constructor(extension_name: string, settingScope: string) {
+    this['event.name'] = 'extension_enable';
+    this['event.timestamp'] = new Date().toISOString();
+    this.extension_name = extension_name;
+    this.setting_scope = settingScope;
+  }
+}

packages/test-utils/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-test-utils",
-  "version": "0.6.0-nightly",
+  "version": "0.6.0",
   "private": true,
   "main": "src/index.ts",
   "license": "Apache-2.0",

packages/vscode-ide-companion/package.json

@@ -2,7 +2,7 @@
   "name": "gemini-cli-vscode-ide-companion",
   "displayName": "Gemini CLI Companion",
   "description": "Enable Gemini CLI with direct access to your IDE workspace.",
-  "version": "0.6.0-nightly",
+  "version": "0.6.0",
   "publisher": "google",
   "icon": "assets/icon.png",
   "repository": {

packages/vscode-ide-companion/scripts/generate-notices.js

@@ -94,7 +94,7 @@ function collectDependencies(packageName, packageLock, dependenciesMap) {
   const packageInfo = packageLock.packages[`node_modules/${packageName}`];
   if (!packageInfo) {
     console.warn(
-      `Warning: Could not find package info for ${packageName} in npm-shrinkwrap.json.`,
+      `Warning: Could not find package info for ${packageName} in package-lock.json.`,
     );
     return;
   }
@@ -114,7 +114,7 @@ async function main() {
     const packageJsonContent = await fs.readFile(packageJsonPath, 'utf-8');
     const packageJson = JSON.parse(packageJsonContent);
 
-    const packageLockJsonPath = path.join(projectRoot, 'npm-shrinkwrap.json');
+    const packageLockJsonPath = path.join(projectRoot, 'package-lock.json');
     const packageLockJsonContent = await fs.readFile(
       packageLockJsonPath,
       'utf-8',

scripts/check-lockfile.js

@@ -10,7 +10,7 @@ import { fileURLToPath } from 'node:url';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const root = join(__dirname, '..');
-const lockfilePath = join(root, 'npm-shrinkwrap.json');
+const lockfilePath = join(root, 'package-lock.json');
 
 function readJsonFile(filePath) {
   try {
@@ -64,7 +64,7 @@ for (const [location, details] of Object.entries(packages)) {
 
 if (invalidPackages.length > 0) {
   console.error(
-    '\nError: The following dependencies in npm-shrinkwrap.json are missing the "resolved" or "integrity" field:',
+    '\nError: The following dependencies in package-lock.json are missing the "resolved" or "integrity" field:',
   );
   invalidPackages.forEach((pkg) => console.error(`- ${pkg}`));
   process.exitCode = 1;

scripts/version.js

@@ -75,7 +75,7 @@ if (cliPackageJson.config?.sandboxImageUri) {
   writeJson(cliPackageJsonPath, cliPackageJson);
 }
 
-// 6. Run `npm install` to update npm-shrinkwrap.json.
+// 6. Run `npm install` to update package-lock.json.
 run('npm install');
 
 console.log(`Successfully bumped versions to v${newVersion}.`);