lint

Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com>
Co-authored-by: Sam Roberts <158088236+g-samroberts@users.noreply.github.com>

.github/scripts/pr-triage.sh

@@ -22,7 +22,7 @@ get_issue_labels() {
     # Check cache
     case "${ISSUE_LABELS_CACHE_FLAT}" in
         *"|${ISSUE_NUM}:"*) 
-            local suffix="${ISSUE_LABELS_CACHE_FLAT#*|${ISSUE_NUM}:}"
+            local suffix="${ISSUE_LABELS_CACHE_FLAT#*|"${ISSUE_NUM}":}"
             echo "${suffix%%|*}"
             return
             ;; 

.github/workflows/chained_e2e.yml

@@ -224,8 +224,6 @@ jobs:
     if: |
       always() && (needs.merge_queue_skipper.result !='success' || needs.merge_queue_skipper.outputs.skip != 'true')
     runs-on: 'gemini-cli-windows-16-core'
-    continue-on-error: true
-
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
@@ -315,6 +313,7 @@ jobs:
     needs:
       - 'e2e_linux'
       - 'e2e_mac'
+      - 'e2e_windows'
       - 'evals'
       - 'merge_queue_skipper'
     runs-on: 'gemini-cli-ubuntu-16-core'
@@ -323,6 +322,7 @@ jobs:
         run: |
           if [[ ${{ needs.e2e_linux.result }} != 'success' || \
                ${{ needs.e2e_mac.result }} != 'success' || \
+               ${{ needs.e2e_windows.result }} != 'success' || \
                ${{ needs.evals.result }} != 'success' ]]; then
             echo "One or more E2E jobs failed."
             exit 1

.github/workflows/ci.yml

@@ -360,7 +360,6 @@ jobs:
     runs-on: 'gemini-cli-windows-16-core'
     needs: 'merge_queue_skipper'
     if: "${{needs.merge_queue_skipper.outputs.skip == 'false'}}"
-    continue-on-error: true
     timeout-minutes: 60
     strategy:
       matrix:
@@ -458,6 +457,7 @@ jobs:
       - 'link_checker'
       - 'test_linux'
       - 'test_mac'
+      - 'test_windows'
       - 'codeql'
       - 'bundle_size'
     runs-on: 'gemini-cli-ubuntu-16-core'
@@ -468,6 +468,7 @@ jobs:
                (${{ needs.link_checker.result }} != 'success' && ${{ needs.link_checker.result }} != 'skipped') || \
                (${{ needs.test_linux.result }} != 'success' && ${{ needs.test_linux.result }} != 'skipped') || \
                (${{ needs.test_mac.result }} != 'success' && ${{ needs.test_mac.result }} != 'skipped') || \
+               (${{ needs.test_windows.result }} != 'success' && ${{ needs.test_windows.result }} != 'skipped') || \
                (${{ needs.codeql.result }} != 'success' && ${{ needs.codeql.result }} != 'skipped') || \
                (${{ needs.bundle_size.result }} != 'success' && ${{ needs.bundle_size.result }} != 'skipped') ]]; then
             echo "One or more CI jobs failed."

.github/workflows/evals-nightly.yml

@@ -27,6 +27,7 @@ jobs:
       fail-fast: false
       matrix:
         model:
+          - 'gemini-3.1-pro-preview-customtools'
           - 'gemini-3-pro-preview'
           - 'gemini-3-flash-preview'
           - 'gemini-2.5-pro'

.github/workflows/gemini-self-assign-issue.yml

@@ -48,6 +48,24 @@ jobs:
             const repo = context.repo.repo;
             const MAX_ISSUES_ASSIGNED = 3;
 
+            const issue = await github.rest.issues.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issueNumber,
+            });
+
+            const hasHelpWantedLabel = issue.data.labels.some(label => label.name === 'help wanted');
+
+            if (!hasHelpWantedLabel) {
+              await github.rest.issues.createComment({
+                owner: owner,
+                repo: repo,
+                issue_number: issueNumber,
+                body: `👋 @${commenter}, thanks for your interest in this issue! We're reserving self-assignment for issues that have been marked with the \`help wanted\` label. Feel free to check out our list of [issues that need attention](https://github.com/google-gemini/gemini-cli/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22).`
+              });
+              return;
+            }
+
             // Search for open issues already assigned to the commenter in this repo
             const { data: assignedIssues } = await github.rest.search.issuesAndPullRequests({
               q: `is:issue repo:${owner}/${repo} assignee:${commenter} is:open`,
@@ -64,13 +82,6 @@ jobs:
               return; // exit
             }
 
-            // Check if the issue is already assigned
-            const issue = await github.rest.issues.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: issueNumber,
-            });
-
             if (issue.data.assignees.length > 0) {
               // Comment that it's already assigned
               await github.rest.issues.createComment({

.github/workflows/pr-rate-limiter.yaml

@@ -0,0 +1,29 @@
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+
+name: 'PR rate limiter'
+
+permissions: {}
+
+on:
+  pull_request_target:
+    types:
+      - 'opened'
+      - 'reopened'
+
+jobs:
+  limit:
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    permissions:
+      contents: 'read'
+      pull-requests: 'write'
+    steps:
+      - name: 'Limit open pull requests per user'
+        uses: 'Homebrew/actions/limit-pull-requests@9ceb7934560eb61d131dde205a6c2d77b2e1529d' # master
+        with:
+          except-author-associations: 'MEMBER,OWNER,COLLABORATOR'
+          comment-limit: 8
+          comment: >
+            You already have 7 pull requests open. Please work on getting
+            existing PRs merged before opening more.
+          close-limit: 8
+          close: true

docs/changelogs/preview.md

@@ -1,6 +1,6 @@
-# Preview release: v0.30.0-preview.3
+# Preview release: v0.30.0-preview.5
 
-Released: February 19, 2026
+Released: February 24, 2026
 
 Our preview release includes the latest, new, and experimental features. This
 release may not be as stable as our [latest weekly release](latest.md).
@@ -25,6 +25,10 @@ npm install -g @google/gemini-cli@preview
 
 ## What's Changed
 
+- fix(patch): cherry-pick 2c1d6f8 to release/v0.30.0-preview.4-pr-19369 to patch
+  version v0.30.0-preview.4 and create version 0.30.0-preview.5 by
+  @gemini-cli-robot in
+  [#20086](https://github.com/google-gemini/gemini-cli/pull/20086)
 - fix(patch): cherry-pick 261788c to release/v0.30.0-preview.0-pr-19453 to patch
   version v0.30.0-preview.0 and create version 0.30.0-preview.1 by
   @gemini-cli-robot in
@@ -311,4 +315,4 @@ npm install -g @google/gemini-cli@preview
   [#19008](https://github.com/google-gemini/gemini-cli/pull/19008)
 
 **Full changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.29.0-preview.5...v0.30.0-preview.3
+https://github.com/google-gemini/gemini-cli/compare/v0.29.0-preview.5...v0.30.0-preview.5

docs/cli/plan-mode.md

@@ -143,13 +143,27 @@ based on the task description.
 
 ### Customizing Policies
 
-Plan Mode is designed to be read-only by default to ensure safety during the
-research phase. However, you may occasionally need to allow specific tools to
-assist in your planning.
+Plan Mode's default tool restrictions are managed by the [policy engine] and
+defined in the built-in [`plan.toml`] file. The built-in policy (Tier 1)
+enforces the read-only state, but you can customize these rules by creating your
+own policies in your `~/.gemini/policies/` directory (Tier 2).
 
-Because user policies (Tier 2) have a higher base priority than built-in
-policies (Tier 1), you can override Plan Mode's default restrictions by creating
-a rule in your `~/.gemini/policies/` directory.
+#### Example: Automatically approve read-only MCP tools
+
+By default, read-only MCP tools require user confirmation in Plan Mode. You can
+use `toolAnnotations` and the `mcpName` wildcard to customize this behavior for
+your specific environment.
+
+`~/.gemini/policies/mcp-read-only.toml`
+
+```toml
+[[rule]]
+mcpName = "*"
+toolAnnotations = { readOnlyHint = true }
+decision = "allow"
+priority = 100
+modes = ["plan"]
+```
 
 #### Example: Allow git commands in Plan Mode
 
@@ -243,3 +257,5 @@ argsPattern = "\"file_path\":\"[^\"]+[\\\\/]+\\.gemini[\\\\/]+plans[\\\\/]+[\\w-
 [`exit_plan_mode`]: /docs/tools/planning.md#2-exit_plan_mode-exitplanmode
 [`ask_user`]: /docs/tools/ask-user.md
 [YOLO mode]: /docs/reference/configuration.md#command-line-arguments
+[`plan.toml`]:
+  https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/policy/policies/plan.toml

docs/cli/settings.md

@@ -112,14 +112,15 @@ they appear in the UI.
 
 ### Security
 
-| UI Label                              | Setting                                         | Description                                                                                                                                                             | Default |
-| ------------------------------------- | ----------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
-| Disable YOLO Mode                     | `security.disableYoloMode`                      | Disable YOLO mode, even if enabled by a flag.                                                                                                                           | `false` |
-| Allow Permanent Tool Approval         | `security.enablePermanentToolApproval`          | Enable the "Allow for all future sessions" option in tool confirmation dialogs.                                                                                         | `false` |
-| Blocks extensions from Git            | `security.blockGitExtensions`                   | Blocks installing and loading extensions from Git.                                                                                                                      | `false` |
-| Extension Source Regex Allowlist      | `security.allowedExtensions`                    | List of Regex patterns for allowed extensions. If nonempty, only extensions that match the patterns in this list are allowed. Overrides the blockGitExtensions setting. | `[]`    |
-| Folder Trust                          | `security.folderTrust.enabled`                  | Setting to track whether Folder trust is enabled.                                                                                                                       | `true`  |
-| Enable Environment Variable Redaction | `security.environmentVariableRedaction.enabled` | Enable redaction of environment variables that may contain secrets.                                                                                                     | `false` |
+| UI Label                              | Setting                                         | Description                                                                                                                                                                                                                          | Default |
+| ------------------------------------- | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- |
+| Disable YOLO Mode                     | `security.disableYoloMode`                      | Disable YOLO mode, even if enabled by a flag.                                                                                                                                                                                        | `false` |
+| Allow Permanent Tool Approval         | `security.enablePermanentToolApproval`          | Enable the "Allow for all future sessions" option in tool confirmation dialogs.                                                                                                                                                      | `false` |
+| Blocks extensions from Git            | `security.blockGitExtensions`                   | Blocks installing and loading extensions from Git.                                                                                                                                                                                   | `false` |
+| Extension Source Regex Allowlist      | `security.allowedExtensions`                    | List of Regex patterns for allowed extensions. If nonempty, only extensions that match the patterns in this list are allowed. Overrides the blockGitExtensions setting.                                                              | `[]`    |
+| Folder Trust                          | `security.folderTrust.enabled`                  | Setting to track whether Folder trust is enabled.                                                                                                                                                                                    | `true`  |
+| Enable Environment Variable Redaction | `security.environmentVariableRedaction.enabled` | Enable redaction of environment variables that may contain secrets.                                                                                                                                                                  | `false` |
+| Enable Context-Aware Security         | `security.enableConseca`                        | Enable the context-aware security checker. This feature uses an LLM to dynamically generate and enforce security policies for tool use based on your prompt, providing an additional layer of protection against unintended actions. | `false` |
 
 ### Advanced
 

docs/core/subagents.md

@@ -80,6 +80,122 @@ Gemini CLI comes with the following built-in subagents:
   invoked by the user.
 - **Configuration:** Enabled by default. No specific configuration options.
 
+### Browser Agent (experimental)
+
+- **Name:** `browser_agent`
+- **Purpose:** Automate web browser tasks — navigating websites, filling forms,
+  clicking buttons, and extracting information from web pages — using the
+  accessibility tree.
+- **When to use:** "Go to example.com and fill out the contact form," "Extract
+  the pricing table from this page," "Click the login button and enter my
+  credentials."
+
+> **Note:** This is a preview feature currently under active development.
+
+#### Prerequisites
+
+The browser agent requires:
+
+- **Chrome** version 144 or later (any recent stable release will work).
+- **Node.js** with `npx` available (used to launch the
+  [`chrome-devtools-mcp`](https://www.npmjs.com/package/chrome-devtools-mcp)
+  server).
+
+#### Enabling the browser agent
+
+The browser agent is disabled by default. Enable it in your `settings.json`:
+
+```json
+{
+  "agents": {
+    "overrides": {
+      "browser_agent": {
+        "enabled": true
+      }
+    }
+  }
+}
+```
+
+#### Session modes
+
+The `sessionMode` setting controls how Chrome is launched and managed. Set it
+under `agents.browser`:
+
+```json
+{
+  "agents": {
+    "overrides": {
+      "browser_agent": {
+        "enabled": true
+      }
+    },
+    "browser": {
+      "sessionMode": "persistent"
+    }
+  }
+}
+```
+
+The available modes are:
+
+| Mode         | Description                                                                                                                                                                                 |
+| :----------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `persistent` | **(Default)** Launches Chrome with a persistent profile stored at `~/.gemini/cli-browser-profile/`. Cookies, history, and settings are preserved between sessions.                          |
+| `isolated`   | Launches Chrome with a temporary profile that is deleted after each session. Use this for clean-state automation.                                                                           |
+| `existing`   | Attaches to an already-running Chrome instance. You must enable remote debugging first by navigating to `chrome://inspect/#remote-debugging` in Chrome. No new browser process is launched. |
+
+#### Configuration reference
+
+All browser-specific settings go under `agents.browser` in your `settings.json`.
+
+| Setting       | Type      | Default        | Description                                                                                     |
+| :------------ | :-------- | :------------- | :---------------------------------------------------------------------------------------------- |
+| `sessionMode` | `string`  | `"persistent"` | How Chrome is managed: `"persistent"`, `"isolated"`, or `"existing"`.                           |
+| `headless`    | `boolean` | `false`        | Run Chrome in headless mode (no visible window).                                                |
+| `profilePath` | `string`  | —              | Custom path to a browser profile directory.                                                     |
+| `visualModel` | `string`  | —              | Model override for the visual agent (for example, `"gemini-2.5-computer-use-preview-10-2025"`). |
+
+#### Security
+
+The browser agent enforces the following security restrictions:
+
+- **Blocked URL patterns:** `file://`, `javascript:`, `data:text/html`,
+  `chrome://extensions`, and `chrome://settings/passwords` are always blocked.
+- **Sensitive action confirmation:** Actions like form filling, file uploads,
+  and form submissions require user confirmation through the standard policy
+  engine.
+
+#### Visual agent
+
+By default, the browser agent interacts with pages through the accessibility
+tree using element `uid` values. For tasks that require visual identification
+(for example, "click the yellow button" or "find the red error message"), you
+can enable the visual agent by setting a `visualModel`:
+
+```json
+{
+  "agents": {
+    "overrides": {
+      "browser_agent": {
+        "enabled": true
+      }
+    },
+    "browser": {
+      "visualModel": "gemini-2.5-computer-use-preview-10-2025"
+    }
+  }
+}
+```
+
+When enabled, the agent gains access to the `analyze_screenshot` tool, which
+captures a screenshot and sends it to the vision model for analysis. The model
+returns coordinates and element descriptions that the browser agent uses with
+the `click_at` tool for precise, coordinate-based interactions.
+
+> **Note:** The visual agent requires API key or Vertex AI authentication. It is
+> not available when using Google Login.
+
 ## Creating custom subagents
 
 You can create your own subagents to automate specific workflows or enforce

docs/extensions/reference.md

@@ -116,7 +116,9 @@ The manifest file defines the extension's behavior and configuration.
   "description": "My awesome extension",
   "mcpServers": {
     "my-server": {
-      "command": "node my-server.js"
+      "command": "node",
+      "args": ["${extensionPath}/my-server.js"],
+      "cwd": "${extensionPath}"
     }
   },
   "contextFileName": "GEMINI.md",
@@ -124,19 +126,41 @@ The manifest file defines the extension's behavior and configuration.
 }
 ```
 
-- `name`: A unique identifier for the extension. Use lowercase letters, numbers,
-  and dashes. This name must match the extension's directory name.
-- `version`: The current version of the extension.
-- `description`: A short summary shown in the extension gallery.
-- <a id="mcp-servers"></a>`mcpServers`: A map of Model Context Protocol (MCP)
-  servers. Extension servers follow the same format as standard
-  [CLI configuration](../reference/configuration.md).
-- `contextFileName`: The name of the context file (defaults to `GEMINI.md`). Can
-  also be an array of strings to load multiple context files.
-- `excludeTools`: An array of tools to block from the model. You can restrict
-  specific arguments, such as `run_shell_command(rm -rf)`.
-- `themes`: An optional list of themes provided by the extension. See
-  [Themes](../cli/themes.md) for more information.
+- `name`: The name of the extension. This is used to uniquely identify the
+  extension and for conflict resolution when extension commands have the same
+  name as user or project commands. The name should be lowercase or numbers and
+  use dashes instead of underscores or spaces. This is how users will refer to
+  your extension in the CLI. Note that we expect this name to match the
+  extension directory name.
+- `version`: The version of the extension.
+- `description`: A short description of the extension. This will be displayed on
+  [geminicli.com/extensions](https://geminicli.com/extensions).
+- `mcpServers`: A map of MCP servers to settings. The key is the name of the
+  server, and the value is the server configuration. These servers will be
+  loaded on startup just like MCP servers defined in a
+  [`settings.json` file](../reference/configuration.md). If both an extension
+  and a `settings.json` file define an MCP server with the same name, the server
+  defined in the `settings.json` file takes precedence.
+  - Note that all MCP server configuration options are supported except for
+    `trust`.
+  - For portability, you should use `${extensionPath}` to refer to files within
+    your extension directory.
+  - Separate your executable and its arguments using `command` and `args`
+    instead of putting them both in `command`.
+- `contextFileName`: The name of the file that contains the context for the
+  extension. This will be used to load the context from the extension directory.
+  If this property is not used but a `GEMINI.md` file is present in your
+  extension directory, then that file will be loaded.
+- `excludeTools`: An array of tool names to exclude from the model. You can also
+  specify command-specific restrictions for tools that support it, like the
+  `run_shell_command` tool. For example,
+  `"excludeTools": ["run_shell_command(rm -rf)"]` will block the `rm -rf`
+  command. Note that this differs from the MCP server `excludeTools`
+  functionality, which can be listed in the MCP server config.
+
+When Gemini CLI starts, it loads all the extensions and merges their
+configurations. If there are any conflicts, the workspace configuration takes
+precedence.
 
 ### Extension settings
 

docs/hooks/reference.md

@@ -98,6 +98,8 @@ and parameter rewriting.
   - `tool_name`: (`string`) The name of the tool being called.
   - `tool_input`: (`object`) The raw arguments generated by the model.
   - `mcp_context`: (`object`) Optional metadata for MCP-based tools.
+  - `original_request_name`: (`string`) The original name of the tool being
+    called, if this is a tail tool call.
 - **Relevant Output Fields**:
   - `decision`: Set to `"deny"` (or `"block"`) to prevent the tool from
     executing.
@@ -120,12 +122,18 @@ hiding sensitive output from the agent.
   - `tool_response`: (`object`) The result containing `llmContent`,
     `returnDisplay`, and optional `error`.
   - `mcp_context`: (`object`)
+  - `original_request_name`: (`string`) The original name of the tool being
+    called, if this is a tail tool call.
 - **Relevant Output Fields**:
   - `decision`: Set to `"deny"` to hide the real tool output from the agent.
   - `reason`: Required if denied. This text **replaces** the tool result sent
     back to the model.
   - `hookSpecificOutput.additionalContext`: Text that is **appended** to the
     tool result for the agent.
+  - `hookSpecificOutput.tailToolCallRequest`: (`{ name: string, args: object }`)
+    A request to execute another tool immediately after this one. The result of
+    this "tail call" will replace the original tool's response. Ideal for
+    programmatic tool routing.
   - `continue`: Set to `false` to **kill the entire agent loop** immediately.
 - **Exit Code 2 (Block Result)**: Hides the tool result. Uses `stderr` as the
   replacement content sent to the agent. **The turn continues.**

docs/ide-integration/index.md

@@ -170,6 +170,20 @@ messages and how to resolve them.
   - **Solution:** Run `/ide enable` to try and reconnect. If the issue
     continues, open a new terminal window or restart your IDE.
 
+### Manual PID override
+
+If automatic IDE detection fails, or if you are running Gemini CLI in a
+standalone terminal and want to manually associate it with a specific IDE
+instance, you can set the `GEMINI_CLI_IDE_PID` environment variable to the
+process ID (PID) of your IDE.
+
+```bash
+export GEMINI_CLI_IDE_PID=12345
+```
+
+When this variable is set, Gemini CLI will skip automatic detection and attempt
+to connect using the provided PID.
+
 ### Configuration errors
 
 - **Message:**

docs/reference/configuration.md

@@ -646,6 +646,27 @@ their corresponding top-level category object in your `settings.json` file.
   - **Default:** `{}`
   - **Requires restart:** Yes
 
+- **`agents.browser.sessionMode`** (enum):
+  - **Description:** Session mode: 'persistent', 'isolated', or 'existing'.
+  - **Default:** `"persistent"`
+  - **Values:** `"persistent"`, `"isolated"`, `"existing"`
+  - **Requires restart:** Yes
+
+- **`agents.browser.headless`** (boolean):
+  - **Description:** Run browser in headless mode.
+  - **Default:** `false`
+  - **Requires restart:** Yes
+
+- **`agents.browser.profilePath`** (string):
+  - **Description:** Path to browser profile directory for session persistence.
+  - **Default:** `undefined`
+  - **Requires restart:** Yes
+
+- **`agents.browser.visualModel`** (string):
+  - **Description:** Model override for the visual agent.
+  - **Default:** `undefined`
+  - **Requires restart:** Yes
+
 #### `context`
 
 - **`context.fileName`** (string | string[]):
@@ -873,6 +894,14 @@ their corresponding top-level category object in your `settings.json` file.
   - **Default:** `undefined`
   - **Requires restart:** Yes
 
+- **`security.enableConseca`** (boolean):
+  - **Description:** Enable the context-aware security checker. This feature
+    uses an LLM to dynamically generate and enforce security policies for tool
+    use based on your prompt, providing an additional layer of protection
+    against unintended actions.
+  - **Default:** `false`
+  - **Requires restart:** Yes
+
 #### `advanced`
 
 - **`advanced.autoConfigureMemory`** (boolean):
@@ -1266,6 +1295,11 @@ the `advanced.excludedEnvVars` setting in your `settings.json` file.
   - Specifies the default Gemini model to use.
   - Overrides the hardcoded default
   - Example: `export GEMINI_MODEL="gemini-3-flash-preview"`
+- **`GEMINI_CLI_IDE_PID`**:
+  - Manually specifies the PID of the IDE process to use for integration. This
+    is useful when running Gemini CLI in a standalone terminal while still
+    wanting to associate it with a specific IDE instance.
+  - Overrides the automatic IDE detection logic.
 - **`GEMINI_CLI_HOME`**:
   - Specifies the root directory for Gemini CLI's user-level configuration and
     storage.

docs/reference/policy-engine.md

@@ -205,6 +205,10 @@ toolName = "run_shell_command"
 # to form a composite name like "mcpName__toolName".
 mcpName = "my-custom-server"
 
+# (Optional) Metadata hints provided by the tool. A rule matches if all
+# key-value pairs provided here are present in the tool's annotations.
+toolAnnotations = { readOnlyHint = true }
+
 # (Optional) A regex to match against the tool's arguments.
 argsPattern = '"command":"(git|npm)'
 

docs/tools/index.md

@@ -52,6 +52,9 @@ These tools help the model manage its plan and interact with you.
   complex plans.
 - **[Agent Skills](../cli/skills.md) (`activate_skill`):** Loads specialized
   procedural expertise when needed.
+- **[Browser agent](../core/subagents.md#browser-agent-experimental)
+  (`browser_agent`):** Automates web browser tasks through the accessibility
+  tree.
 - **Internal docs (`get_internal_docs`):** Accesses Gemini CLI's own
   documentation to help answer your questions.
 

evals/frugalReads.eval.ts

@@ -78,22 +78,23 @@ describe('Frugal reads eval', () => {
       ).toBe(true);
 
       let totalLinesRead = 0;
-      const readRanges: { offset: number; limit: number }[] = [];
+      const readRanges: { start_line: number; end_line: number }[] = [];
 
       for (const call of targetFileReads) {
         const args = JSON.parse(call.toolRequest.args);
 
         expect(
-          args.limit,
-          'Agent read the entire file (missing limit) instead of using ranged read',
+          args.end_line,
+          'Agent read the entire file (missing end_line) instead of using ranged read',
         ).toBeDefined();
 
-        const limit = args.limit;
-        const offset = args.offset ?? 0;
-        totalLinesRead += limit;
-        readRanges.push({ offset, limit });
+        const end_line = args.end_line;
+        const start_line = args.start_line ?? 1;
+        const linesRead = end_line - start_line + 1;
+        totalLinesRead += linesRead;
+        readRanges.push({ start_line, end_line });
 
-        expect(args.limit, 'Agent read too many lines at once').toBeLessThan(
+        expect(linesRead, 'Agent read too many lines at once').toBeLessThan(
           1001,
         );
       }
@@ -108,7 +109,7 @@ describe('Frugal reads eval', () => {
       const errorLines = [500, 510, 520];
       for (const line of errorLines) {
         const covered = readRanges.some(
-          (range) => line >= range.offset && line < range.offset + range.limit,
+          (range) => line >= range.start_line && line <= range.end_line,
         );
         expect(covered, `Agent should have read around line ${line}`).toBe(
           true,
@@ -191,8 +192,8 @@ describe('Frugal reads eval', () => {
       for (const call of targetFileReads) {
         const args = JSON.parse(call.toolRequest.args);
         expect(
-          args.limit,
-          'Agent should have used ranged read (limit) to save tokens',
+          args.end_line,
+          'Agent should have used ranged read (end_line) to save tokens',
         ).toBeDefined();
       }
     },
@@ -253,7 +254,7 @@ describe('Frugal reads eval', () => {
       // and just read the whole file to be efficient with tool calls.
       const readEntireFile = targetFileReads.some((call) => {
         const args = JSON.parse(call.toolRequest.args);
-        return args.limit === undefined;
+        return args.end_line === undefined;
       });
 
       expect(

evals/frugalSearch.eval.ts

@@ -68,7 +68,7 @@ describe('Frugal Search', () => {
         const args = getParams(call);
         return (
           args.file_path === 'src/legacy_processor.ts' &&
-          (args.limit === undefined || args.limit === null)
+          (args.end_line === undefined || args.end_line === null)
         );
       });
 
@@ -87,7 +87,7 @@ describe('Frugal Search', () => {
         if (
           call.toolRequest.name === 'read_file' &&
           args.file_path === 'src/legacy_processor.ts' &&
-          args.limit !== undefined
+          args.end_line !== undefined
         ) {
           return true;
         }

evals/interactive-hang.eval.ts

@@ -56,7 +56,7 @@ describe('interactive_commands', () => {
       const scaffoldCall = logs.find(
         (l) =>
           l.toolRequest.name === 'run_shell_command' &&
-          /npm (init|create)|npx create-|yarn create|pnpm create/.test(
+          /npm (init|create)|npx (.*)?create-|yarn create|pnpm create/.test(
             l.toolRequest.args,
           ),
       );

integration-tests/hooks-system.tail-tool-call.responses

@@ -0,0 +1,2 @@
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"functionCall":{"name":"read_file","args":{"file_path":"original.txt"}}}],"role":"model"},"finishReason":"STOP","index":0}]}]}
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"text":"Tail call completed successfully."}],"role":"model"},"finishReason":"STOP","index":0}]}]}

integration-tests/hooks-system.test.ts

@@ -286,6 +286,113 @@ describe('Hooks System Integration', () => {
     });
   });
 
+  describe('Command Hooks - Tail Tool Calls', () => {
+    it('should execute a tail tool call from AfterTool hooks and replace original response', async () => {
+      // Create a script that acts as the hook.
+      // It will trigger on "read_file" and issue a tail call to "write_file".
+      rig.setup('should execute a tail tool call from AfterTool hooks', {
+        fakeResponsesPath: join(
+          import.meta.dirname,
+          'hooks-system.tail-tool-call.responses',
+        ),
+      });
+
+      const hookOutput = {
+        decision: 'allow',
+        hookSpecificOutput: {
+          hookEventName: 'AfterTool',
+          tailToolCallRequest: {
+            name: 'write_file',
+            args: {
+              file_path: 'tail-called-file.txt',
+              content: 'Content from tail call',
+            },
+          },
+        },
+      };
+
+      const hookScript = `console.log(JSON.stringify(${JSON.stringify(
+        hookOutput,
+      )})); process.exit(0);`;
+
+      const scriptPath = join(rig.testDir!, 'tail_call_hook.js');
+      writeFileSync(scriptPath, hookScript);
+      const commandPath = scriptPath.replace(/\\/g, '/');
+
+      rig.setup('should execute a tail tool call from AfterTool hooks', {
+        fakeResponsesPath: join(
+          import.meta.dirname,
+          'hooks-system.tail-tool-call.responses',
+        ),
+        settings: {
+          hooksConfig: {
+            enabled: true,
+          },
+          hooks: {
+            AfterTool: [
+              {
+                matcher: 'read_file',
+                hooks: [
+                  {
+                    type: 'command',
+                    command: `node "${commandPath}"`,
+                    timeout: 5000,
+                  },
+                ],
+              },
+            ],
+          },
+        },
+      });
+
+      // Create a test file to trigger the read_file tool
+      rig.createFile('original.txt', 'Original content');
+
+      const cliOutput = await rig.run({
+        args: 'Read original.txt', // Fake responses should trigger read_file on this
+      });
+
+      // 1. Verify that write_file was called (as a tail call replacing read_file)
+      // Since read_file was replaced before finalizing, it will not appear in the tool logs.
+      const foundWriteFile = await rig.waitForToolCall('write_file');
+      expect(foundWriteFile).toBeTruthy();
+
+      // Ensure hook logs are flushed and the final LLM response is received.
+      // The mock LLM is configured to respond with "Tail call completed successfully."
+      expect(cliOutput).toContain('Tail call completed successfully.');
+
+      // Ensure telemetry is written to disk
+      await rig.waitForTelemetryReady();
+
+      // Read hook logs to debug
+      const hookLogs = rig.readHookLogs();
+      const relevantHookLog = hookLogs.find(
+        (l) => l.hookCall.hook_event_name === 'AfterTool',
+      );
+
+      expect(relevantHookLog).toBeDefined();
+
+      // 2. Verify write_file was executed.
+      // In non-interactive mode, the CLI deduplicates tool execution logs by callId.
+      // Since a tail call reuses the original callId, "Tool: write_file" is not printed.
+      // Instead, we verify the side-effect (file creation) and the telemetry log.
+
+      // 3. Verify the tail-called tool actually wrote the file
+      const modifiedContent = rig.readFile('tail-called-file.txt');
+      expect(modifiedContent).toBe('Content from tail call');
+
+      // 4. Verify telemetry for the final tool call.
+      // The original 'read_file' call is replaced, so only 'write_file' is finalized and logged.
+      const toolLogs = rig.readToolLogs();
+      const successfulTools = toolLogs.filter((t) => t.toolRequest.success);
+      expect(
+        successfulTools.some((t) => t.toolRequest.name === 'write_file'),
+      ).toBeTruthy();
+      // The original request name should be preserved in the log payload if possible,
+      // but the executed tool name is 'write_file'.
+    });
+  });
+
   describe('BeforeModel Hooks - LLM Request Modification', () => {
     it('should modify LLM requests with BeforeModel hooks', async () => {
       // Create a hook script that replaces the LLM request with a modified version

integration-tests/symlink-install.test.ts

@@ -0,0 +1,136 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect, it, beforeEach, afterEach } from 'vitest';
+import { TestRig, InteractiveRun } from './test-helper.js';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import {
+  writeFileSync,
+  mkdirSync,
+  symlinkSync,
+  readFileSync,
+  unlinkSync,
+} from 'node:fs';
+import { join, dirname } from 'node:path';
+import { GEMINI_DIR } from '@google/gemini-cli-core';
+import * as pty from '@lydell/node-pty';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const BUNDLE_PATH = join(__dirname, '..', 'bundle/gemini.js');
+
+const extension = `{
+  "name": "test-symlink-extension",
+  "version": "0.0.1"
+}`;
+
+const otherExtension = `{
+  "name": "malicious-extension",
+  "version": "6.6.6"
+}`;
+
+describe('extension symlink install spoofing protection', () => {
+  let rig: TestRig;
+
+  beforeEach(() => {
+    rig = new TestRig();
+  });
+
+  afterEach(async () => await rig.cleanup());
+
+  it('canonicalizes the trust path and prevents symlink spoofing', async () => {
+    // Enable folder trust for this test
+    rig.setup('symlink spoofing test', {
+      settings: {
+        security: {
+          folderTrust: {
+            enabled: true,
+          },
+        },
+      },
+    });
+
+    const realExtPath = join(rig.testDir!, 'real-extension');
+    mkdirSync(realExtPath);
+    writeFileSync(join(realExtPath, 'gemini-extension.json'), extension);
+
+    const maliciousExtPath = join(
+      os.tmpdir(),
+      `malicious-extension-${Date.now()}`,
+    );
+    mkdirSync(maliciousExtPath);
+    writeFileSync(
+      join(maliciousExtPath, 'gemini-extension.json'),
+      otherExtension,
+    );
+
+    const symlinkPath = join(rig.testDir!, 'symlink-extension');
+    symlinkSync(realExtPath, symlinkPath);
+
+    // Function to run a command with a PTY to avoid headless mode
+    const runPty = (args: string[]) => {
+      const ptyProcess = pty.spawn(process.execPath, [BUNDLE_PATH, ...args], {
+        name: 'xterm-color',
+        cols: 80,
+        rows: 80,
+        cwd: rig.testDir!,
+        env: {
+          ...process.env,
+          GEMINI_CLI_HOME: rig.homeDir!,
+          GEMINI_CLI_INTEGRATION_TEST: 'true',
+          GEMINI_PTY_INFO: 'node-pty',
+        },
+      });
+      return new InteractiveRun(ptyProcess);
+    };
+
+    // 1. Install via symlink, trust it
+    const run1 = runPty(['extensions', 'install', symlinkPath]);
+    await run1.expectText('Do you want to trust this folder', 30000);
+    await run1.type('y\r');
+    await run1.expectText('trust this workspace', 30000);
+    await run1.type('y\r');
+    await run1.expectText('Do you want to continue', 30000);
+    await run1.type('y\r');
+    await run1.expectText('installed successfully', 30000);
+    await run1.kill();
+
+    // 2. Verify trustedFolders.json contains the REAL path, not the symlink path
+    const trustedFoldersPath = join(
+      rig.homeDir!,
+      GEMINI_DIR,
+      'trustedFolders.json',
+    );
+    // Wait for file to be written
+    let attempts = 0;
+    while (!fs.existsSync(trustedFoldersPath) && attempts < 50) {
+      await new Promise((resolve) => setTimeout(resolve, 100));
+      attempts++;
+    }
+
+    const trustedFolders = JSON.parse(
+      readFileSync(trustedFoldersPath, 'utf-8'),
+    );
+    const trustedPaths = Object.keys(trustedFolders);
+    const canonicalRealExtPath = fs.realpathSync(realExtPath);
+
+    expect(trustedPaths).toContain(canonicalRealExtPath);
+    expect(trustedPaths).not.toContain(symlinkPath);
+
+    // 3. Swap the symlink to point to the malicious extension
+    unlinkSync(symlinkPath);
+    symlinkSync(maliciousExtPath, symlinkPath);
+
+    // 4. Try to install again via the same symlink path.
+    // It should NOT be trusted because the real path changed.
+    const run2 = runPty(['extensions', 'install', symlinkPath]);
+    await run2.expectText('Do you want to trust this folder', 30000);
+    await run2.type('n\r');
+    await run2.expectText('Installation aborted', 30000);
+    await run2.kill();
+  }, 60000);
+});

package-lock.json

@@ -13,6 +13,7 @@
       "dependencies": {
         "ink": "npm:@jrichman/ink@6.4.11",
         "latest-version": "^9.0.0",
+        "node-fetch-native": "^1.6.7",
         "proper-lockfile": "^4.1.2",
         "punycode": "^2.3.1",
         "simple-git": "^3.28.0"
@@ -37,6 +38,7 @@
         "@vitest/eslint-plugin": "^1.3.4",
         "cross-env": "^7.0.3",
         "depcheck": "^1.4.7",
+        "domexception": "^4.0.0",
         "esbuild": "^0.25.0",
         "esbuild-plugin-wasm": "^1.1.0",
         "eslint": "^9.24.0",
@@ -5714,18 +5716,6 @@
         "url": "https://bevry.me/fund"
       }
     },
-    "node_modules/bl": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
-      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "buffer": "^5.5.0",
-        "inherits": "^2.0.4",
-        "readable-stream": "^3.4.0"
-      }
-    },
     "node_modules/body-parser": {
       "version": "2.2.2",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
@@ -5804,31 +5794,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/buffer": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "base64-js": "^1.3.1",
-        "ieee754": "^1.1.13"
-      }
-    },
     "node_modules/buffer-crc32": {
       "version": "0.2.13",
       "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
@@ -7210,16 +7175,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/detect-libc": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.0.4.tgz",
-      "integrity": "sha512-3UDv+G9CsCKO1WKMGw9fwq/SWJYbI0c5Y7LU1AXYoDdbhE2AHQ6N6Nb34sG8Fj7T5APy8qXDCKuuIHd1BR0tVA==",
-      "license": "Apache-2.0",
-      "optional": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/devlop": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
@@ -7292,6 +7247,20 @@
       ],
       "license": "BSD-2-Clause"
     },
+    "node_modules/domexception": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/domexception/-/domexception-4.0.0.tgz",
+      "integrity": "sha512-A2is4PLG+eeSfoTMA95/s4pvAoSo2mKtiM5jlHkAVewmiO8ISFTFKZjH7UAM1Atli/OT/7JHOrJRJiMKUZKYBw==",
+      "deprecated": "Use your platform's native DOMException instead",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "webidl-conversions": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/domhandler": {
       "version": "5.0.3",
       "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-5.0.3.tgz",
@@ -8262,16 +8231,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/expand-template": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
-      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
-      "license": "(MIT OR WTFPL)",
-      "optional": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/expand-tilde": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/expand-tilde/-/expand-tilde-2.0.2.tgz",
@@ -8810,13 +8769,6 @@
         "node": ">= 0.8"
       }
     },
-    "node_modules/fs-constants": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
-      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/fs-extra": {
       "version": "11.3.1",
       "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.1.tgz",
@@ -9051,13 +9003,6 @@
         "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
       }
     },
-    "node_modules/github-from-package": {
-      "version": "0.0.0",
-      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
-      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/glob": {
       "version": "12.0.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-12.0.0.tgz",
@@ -9797,27 +9742,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/ieee754": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "BSD-3-Clause",
-      "optional": true
-    },
     "node_modules/ignore": {
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
@@ -11027,6 +10951,14 @@
         "prebuild-install": "^7.0.1"
       }
     },
+    "node_modules/keytar/node_modules/prebuild-install": {
+      "name": "nop",
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/nop/-/nop-1.0.0.tgz",
+      "integrity": "sha512-XdkOuXGx0DTwlqb0DWTcDqelgU/F3YyZ+PTRaecpDVpkYskcnh3OeUYKfvjcRQ2D1diTIGxi/a3eHVjW5yPupQ==",
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/keyv": {
       "version": "4.5.4",
       "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
@@ -11824,13 +11756,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/mkdirp-classic": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
-      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/mnemonist": {
       "version": "0.40.3",
       "resolved": "https://registry.npmjs.org/mnemonist/-/mnemonist-0.40.3.tgz",
@@ -12002,13 +11927,6 @@
         "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
-    "node_modules/napi-build-utils": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
-      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/natural-compare": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
@@ -12032,19 +11950,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/node-abi": {
-      "version": "3.75.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.75.0.tgz",
-      "integrity": "sha512-OhYaY5sDsIka7H7AtijtI9jwGYLyl29eQn/W623DiN/MIv5sUqc4g7BIDThX+gb7di9f6xK02nkp8sdfFWZLTg==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "semver": "^7.3.5"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/node-addon-api": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-4.3.0.tgz",
@@ -12092,6 +11997,12 @@
         }
       }
     },
+    "node_modules/node-fetch-native": {
+      "version": "1.6.7",
+      "resolved": "https://registry.npmjs.org/node-fetch-native/-/node-fetch-native-1.6.7.tgz",
+      "integrity": "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==",
+      "license": "MIT"
+    },
     "node_modules/node-fetch/node_modules/tr46": {
       "version": "0.0.3",
       "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
@@ -13222,33 +13133,6 @@
         "node": "^10 || ^12 || >=14"
       }
     },
-    "node_modules/prebuild-install": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
-      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "detect-libc": "^2.0.0",
-        "expand-template": "^2.0.3",
-        "github-from-package": "0.0.0",
-        "minimist": "^1.2.3",
-        "mkdirp-classic": "^0.5.3",
-        "napi-build-utils": "^2.0.0",
-        "node-abi": "^3.3.0",
-        "pump": "^3.0.0",
-        "rc": "^1.2.7",
-        "simple-get": "^4.0.0",
-        "tar-fs": "^2.0.0",
-        "tunnel-agent": "^0.6.0"
-      },
-      "bin": {
-        "prebuild-install": "bin.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
@@ -14557,53 +14441,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/simple-concat": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
-      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/simple-get": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
-      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "decompress-response": "^6.0.0",
-        "once": "^1.3.1",
-        "simple-concat": "^1.0.0"
-      }
-    },
     "node_modules/simple-git": {
       "version": "3.28.0",
       "resolved": "https://registry.npmjs.org/simple-git/-/simple-git-3.28.0.tgz",
@@ -15409,43 +15246,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/tar-fs": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
-      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "chownr": "^1.1.1",
-        "mkdirp-classic": "^0.5.2",
-        "pump": "^3.0.0",
-        "tar-stream": "^2.1.4"
-      }
-    },
-    "node_modules/tar-fs/node_modules/chownr": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
-      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
-      "license": "ISC",
-      "optional": true
-    },
-    "node_modules/tar-stream": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
-      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "bl": "^4.0.3",
-        "end-of-stream": "^1.4.1",
-        "fs-constants": "^1.0.0",
-        "inherits": "^2.0.3",
-        "readable-stream": "^3.1.1"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/teeny-request": {
       "version": "9.0.0",
       "resolved": "https://registry.npmjs.org/teeny-request/-/teeny-request-9.0.0.tgz",
@@ -15929,19 +15729,6 @@
         "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
       }
     },
-    "node_modules/tunnel-agent": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
-      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
-      "license": "Apache-2.0",
-      "optional": true,
-      "dependencies": {
-        "safe-buffer": "^5.0.1"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/type-check": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
@@ -16500,6 +16287,16 @@
         }
       }
     },
+    "node_modules/webidl-conversions": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
+      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/whatwg-encoding": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",

package.json

@@ -70,7 +70,8 @@
       "wrap-ansi": "7.0.0"
     },
     "glob": "^12.0.0",
-    "node-domexception": "^1.0.0"
+    "node-domexception": "npm:empty@^0.10.1",
+    "prebuild-install": "npm:nop@1.0.0"
   },
   "bin": {
     "gemini": "bundle/gemini.js"
@@ -97,6 +98,7 @@
     "@vitest/eslint-plugin": "^1.3.4",
     "cross-env": "^7.0.3",
     "depcheck": "^1.4.7",
+    "domexception": "^4.0.0",
     "esbuild": "^0.25.0",
     "esbuild-plugin-wasm": "^1.1.0",
     "eslint": "^9.24.0",
@@ -130,6 +132,7 @@
   "dependencies": {
     "ink": "npm:@jrichman/ink@6.4.11",
     "latest-version": "^9.0.0",
+    "node-fetch-native": "^1.6.7",
     "proper-lockfile": "^4.1.2",
     "punycode": "^2.3.1",
     "simple-git": "^3.28.0"

packages/a2a-server/src/config/config.test.ts

@@ -267,4 +267,47 @@ describe('loadConfig', () => {
       customIgnoreFilePaths: [testPath],
     });
   });
+
+  describe('tool configuration', () => {
+    it('should pass V1 allowedTools to Config properly', async () => {
+      const settings: Settings = {
+        allowedTools: ['shell', 'edit'],
+      };
+      await loadConfig(settings, mockExtensionLoader, taskId);
+      expect(Config).toHaveBeenCalledWith(
+        expect.objectContaining({
+          allowedTools: ['shell', 'edit'],
+        }),
+      );
+    });
+
+    it('should pass V2 tools.allowed to Config properly', async () => {
+      const settings: Settings = {
+        tools: {
+          allowed: ['shell', 'fetch'],
+        },
+      };
+      await loadConfig(settings, mockExtensionLoader, taskId);
+      expect(Config).toHaveBeenCalledWith(
+        expect.objectContaining({
+          allowedTools: ['shell', 'fetch'],
+        }),
+      );
+    });
+
+    it('should prefer V1 allowedTools over V2 tools.allowed if both present', async () => {
+      const settings: Settings = {
+        allowedTools: ['v1-tool'],
+        tools: {
+          allowed: ['v2-tool'],
+        },
+      };
+      await loadConfig(settings, mockExtensionLoader, taskId);
+      expect(Config).toHaveBeenCalledWith(
+        expect.objectContaining({
+          allowedTools: ['v1-tool'],
+        }),
+      );
+    });
+  });
 });

packages/a2a-server/src/config/config.ts

@@ -68,8 +68,9 @@ export async function loadConfig(
     debugMode: process.env['DEBUG'] === 'true' || false,
     question: '', // Not used in server mode directly like CLI
 
-    coreTools: settings.coreTools || undefined,
-    excludeTools: settings.excludeTools || undefined,
+    coreTools: settings.coreTools || settings.tools?.core || undefined,
+    excludeTools: settings.excludeTools || settings.tools?.exclude || undefined,
+    allowedTools: settings.allowedTools || settings.tools?.allowed || undefined,
     showMemoryUsage: settings.showMemoryUsage || false,
     approvalMode:
       process.env['GEMINI_YOLO_MODE'] === 'true'

packages/a2a-server/src/config/settings.ts

@@ -27,6 +27,12 @@ export interface Settings {
   mcpServers?: Record<string, MCPServerConfig>;
   coreTools?: string[];
   excludeTools?: string[];
+  allowedTools?: string[];
+  tools?: {
+    allowed?: string[];
+    exclude?: string[];
+    core?: string[];
+  };
   telemetry?: TelemetrySettings;
   showMemoryUsage?: boolean;
   checkpointing?: CheckpointingSettings;

packages/a2a-server/src/http/server.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env -S node --no-warnings=DEP0040
 
 /**
  * @license

packages/cli/index.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env -S node --no-warnings=DEP0040
 
 /**
  * @license

packages/cli/src/commands/extensions/install.test.ts

@@ -16,14 +16,20 @@ import {
 } from 'vitest';
 import { handleInstall, installCommand } from './install.js';
 import yargs from 'yargs';
-import { debugLogger, type GeminiCLIExtension } from '@google/gemini-cli-core';
+import * as core from '@google/gemini-cli-core';
+import type { inferInstallMetadata } from '../../config/extension-manager.js';
+import { ExtensionManager } from '../../config/extension-manager.js';
 import type {
-  ExtensionManager,
-  inferInstallMetadata,
-} from '../../config/extension-manager.js';
-import type { requestConsentNonInteractive } from '../../config/extensions/consent.js';
+  promptForConsentNonInteractive,
+  requestConsentNonInteractive,
+} from '../../config/extensions/consent.js';
+import type {
+  isWorkspaceTrusted,
+  loadTrustedFolders,
+} from '../../config/trustedFolders.js';
 import type * as fs from 'node:fs/promises';
 import type { Stats } from 'node:fs';
+import * as path from 'node:path';
 
 const mockInstallOrUpdateExtension: Mock<
   typeof ExtensionManager.prototype.installOrUpdateExtension
@@ -31,28 +37,54 @@ const mockInstallOrUpdateExtension: Mock<
 const mockRequestConsentNonInteractive: Mock<
   typeof requestConsentNonInteractive
 > = vi.hoisted(() => vi.fn());
+const mockPromptForConsentNonInteractive: Mock<
+  typeof promptForConsentNonInteractive
+> = vi.hoisted(() => vi.fn());
 const mockStat: Mock<typeof fs.stat> = vi.hoisted(() => vi.fn());
 const mockInferInstallMetadata: Mock<typeof inferInstallMetadata> = vi.hoisted(
   () => vi.fn(),
 );
+const mockIsWorkspaceTrusted: Mock<typeof isWorkspaceTrusted> = vi.hoisted(() =>
+  vi.fn(),
+);
+const mockLoadTrustedFolders: Mock<typeof loadTrustedFolders> = vi.hoisted(() =>
+  vi.fn(),
+);
+const mockDiscover: Mock<typeof core.FolderTrustDiscoveryService.discover> =
+  vi.hoisted(() => vi.fn());
 
 vi.mock('../../config/extensions/consent.js', () => ({
   requestConsentNonInteractive: mockRequestConsentNonInteractive,
+  promptForConsentNonInteractive: mockPromptForConsentNonInteractive,
+  INSTALL_WARNING_MESSAGE: 'warning',
 }));
 
-vi.mock('../../config/extension-manager.js', async (importOriginal) => {
+vi.mock('../../config/trustedFolders.js', () => ({
+  isWorkspaceTrusted: mockIsWorkspaceTrusted,
+  loadTrustedFolders: mockLoadTrustedFolders,
+  TrustLevel: {
+    TRUST_FOLDER: 'TRUST_FOLDER',
+  },
+}));
+
+vi.mock('@google/gemini-cli-core', async (importOriginal) => {
   const actual =
-    await importOriginal<typeof import('../../config/extension-manager.js')>();
+    await importOriginal<typeof import('@google/gemini-cli-core')>();
   return {
     ...actual,
-    ExtensionManager: vi.fn().mockImplementation(() => ({
-      installOrUpdateExtension: mockInstallOrUpdateExtension,
-      loadExtensions: vi.fn(),
-    })),
-    inferInstallMetadata: mockInferInstallMetadata,
+    FolderTrustDiscoveryService: {
+      discover: mockDiscover,
+    },
   };
 });
 
+vi.mock('../../config/extension-manager.js', async (importOriginal) => ({
+  ...(await importOriginal<
+    typeof import('../../config/extension-manager.js')
+  >()),
+  inferInstallMetadata: mockInferInstallMetadata,
+}));
+
 vi.mock('../../utils/errors.js', () => ({
   getErrorMessage: vi.fn((error: Error) => error.message),
 }));
@@ -83,12 +115,31 @@ describe('handleInstall', () => {
   let processSpy: MockInstance;
 
   beforeEach(() => {
-    debugLogSpy = vi.spyOn(debugLogger, 'log');
-    debugErrorSpy = vi.spyOn(debugLogger, 'error');
+    debugLogSpy = vi.spyOn(core.debugLogger, 'log');
+    debugErrorSpy = vi.spyOn(core.debugLogger, 'error');
     processSpy = vi
       .spyOn(process, 'exit')
       .mockImplementation(() => undefined as never);
 
+    vi.spyOn(ExtensionManager.prototype, 'loadExtensions').mockResolvedValue(
+      [],
+    );
+    vi.spyOn(
+      ExtensionManager.prototype,
+      'installOrUpdateExtension',
+    ).mockImplementation(mockInstallOrUpdateExtension);
+
+    mockIsWorkspaceTrusted.mockReturnValue({ isTrusted: true, source: 'file' });
+    mockDiscover.mockResolvedValue({
+      commands: [],
+      mcps: [],
+      hooks: [],
+      skills: [],
+      settings: [],
+      securityWarnings: [],
+      discoveryErrors: [],
+    });
+
     mockInferInstallMetadata.mockImplementation(async (source, args) => {
       if (
         source.startsWith('http://') ||
@@ -114,12 +165,29 @@ describe('handleInstall', () => {
     mockStat.mockClear();
     mockInferInstallMetadata.mockClear();
     vi.clearAllMocks();
+    vi.restoreAllMocks();
   });
 
+  function createMockExtension(
+    overrides: Partial<core.GeminiCLIExtension> = {},
+  ): core.GeminiCLIExtension {
+    return {
+      name: 'mock-extension',
+      version: '1.0.0',
+      isActive: true,
+      path: '/mock/path',
+      contextFiles: [],
+      id: 'mock-id',
+      ...overrides,
+    };
+  }
+
   it('should install an extension from a http source', async () => {
-    mockInstallOrUpdateExtension.mockResolvedValue({
-      name: 'http-extension',
-    } as unknown as GeminiCLIExtension);
+    mockInstallOrUpdateExtension.mockResolvedValue(
+      createMockExtension({
+        name: 'http-extension',
+      }),
+    );
 
     await handleInstall({
       source: 'http://google.com',
@@ -131,9 +199,11 @@ describe('handleInstall', () => {
   });
 
   it('should install an extension from a https source', async () => {
-    mockInstallOrUpdateExtension.mockResolvedValue({
-      name: 'https-extension',
-    } as unknown as GeminiCLIExtension);
+    mockInstallOrUpdateExtension.mockResolvedValue(
+      createMockExtension({
+        name: 'https-extension',
+      }),
+    );
 
     await handleInstall({
       source: 'https://google.com',
@@ -145,9 +215,11 @@ describe('handleInstall', () => {
   });
 
   it('should install an extension from a git source', async () => {
-    mockInstallOrUpdateExtension.mockResolvedValue({
-      name: 'git-extension',
-    } as unknown as GeminiCLIExtension);
+    mockInstallOrUpdateExtension.mockResolvedValue(
+      createMockExtension({
+        name: 'git-extension',
+      }),
+    );
 
     await handleInstall({
       source: 'git@some-url',
@@ -171,9 +243,11 @@ describe('handleInstall', () => {
   });
 
   it('should install an extension from a sso source', async () => {
-    mockInstallOrUpdateExtension.mockResolvedValue({
-      name: 'sso-extension',
-    } as unknown as GeminiCLIExtension);
+    mockInstallOrUpdateExtension.mockResolvedValue(
+      createMockExtension({
+        name: 'sso-extension',
+      }),
+    );
 
     await handleInstall({
       source: 'sso://google.com',
@@ -185,12 +259,14 @@ describe('handleInstall', () => {
   });
 
   it('should install an extension from a local path', async () => {
-    mockInstallOrUpdateExtension.mockResolvedValue({
-      name: 'local-extension',
-    } as unknown as GeminiCLIExtension);
+    mockInstallOrUpdateExtension.mockResolvedValue(
+      createMockExtension({
+        name: 'local-extension',
+      }),
+    );
     mockStat.mockResolvedValue({} as Stats);
     await handleInstall({
-      source: '/some/path',
+      source: path.join('/', 'some', 'path'),
     });
 
     expect(debugLogSpy).toHaveBeenCalledWith(
@@ -208,4 +284,144 @@ describe('handleInstall', () => {
     expect(debugErrorSpy).toHaveBeenCalledWith('Install extension failed');
     expect(processSpy).toHaveBeenCalledWith(1);
   });
+
+  it('should proceed if local path is already trusted', async () => {
+    mockInstallOrUpdateExtension.mockResolvedValue(
+      createMockExtension({
+        name: 'local-extension',
+      }),
+    );
+    mockStat.mockResolvedValue({} as Stats);
+    mockIsWorkspaceTrusted.mockReturnValue({ isTrusted: true, source: 'file' });
+
+    await handleInstall({
+      source: path.join('/', 'some', 'path'),
+    });
+
+    expect(mockIsWorkspaceTrusted).toHaveBeenCalled();
+    expect(mockPromptForConsentNonInteractive).not.toHaveBeenCalled();
+    expect(debugLogSpy).toHaveBeenCalledWith(
+      'Extension "local-extension" installed successfully and enabled.',
+    );
+  });
+
+  it('should prompt and proceed if user accepts trust', async () => {
+    mockInstallOrUpdateExtension.mockResolvedValue(
+      createMockExtension({
+        name: 'local-extension',
+      }),
+    );
+    mockStat.mockResolvedValue({} as Stats);
+    mockIsWorkspaceTrusted.mockReturnValue({
+      isTrusted: undefined,
+      source: undefined,
+    });
+    mockPromptForConsentNonInteractive.mockResolvedValue(true);
+    const mockSetValue = vi.fn();
+    mockLoadTrustedFolders.mockReturnValue({
+      setValue: mockSetValue,
+      user: { path: '', config: {} },
+      errors: [],
+      rules: [],
+      isPathTrusted: vi.fn(),
+    });
+
+    await handleInstall({
+      source: path.join('/', 'untrusted', 'path'),
+    });
+
+    expect(mockIsWorkspaceTrusted).toHaveBeenCalled();
+    expect(mockPromptForConsentNonInteractive).toHaveBeenCalled();
+    expect(mockSetValue).toHaveBeenCalledWith(
+      expect.stringContaining(path.join('untrusted', 'path')),
+      'TRUST_FOLDER',
+    );
+    expect(debugLogSpy).toHaveBeenCalledWith(
+      'Extension "local-extension" installed successfully and enabled.',
+    );
+  });
+
+  it('should prompt and abort if user denies trust', async () => {
+    mockStat.mockResolvedValue({} as Stats);
+    mockIsWorkspaceTrusted.mockReturnValue({
+      isTrusted: undefined,
+      source: undefined,
+    });
+    mockPromptForConsentNonInteractive.mockResolvedValue(false);
+
+    await handleInstall({
+      source: path.join('/', 'evil', 'path'),
+    });
+
+    expect(mockIsWorkspaceTrusted).toHaveBeenCalled();
+    expect(mockPromptForConsentNonInteractive).toHaveBeenCalled();
+    expect(debugErrorSpy).toHaveBeenCalledWith(
+      expect.stringContaining('Installation aborted: Folder'),
+    );
+    expect(processSpy).toHaveBeenCalledWith(1);
+  });
+
+  it('should include discovery results in trust prompt', async () => {
+    mockInstallOrUpdateExtension.mockResolvedValue(
+      createMockExtension({
+        name: 'local-extension',
+      }),
+    );
+    mockStat.mockResolvedValue({} as Stats);
+    mockIsWorkspaceTrusted.mockReturnValue({
+      isTrusted: undefined,
+      source: undefined,
+    });
+    mockDiscover.mockResolvedValue({
+      commands: ['custom-cmd'],
+      mcps: [],
+      hooks: [],
+      skills: ['cool-skill'],
+      settings: [],
+      securityWarnings: ['Security risk!'],
+      discoveryErrors: ['Read error'],
+    });
+    mockPromptForConsentNonInteractive.mockResolvedValue(true);
+    mockLoadTrustedFolders.mockReturnValue({
+      setValue: vi.fn(),
+      user: { path: '', config: {} },
+      errors: [],
+      rules: [],
+      isPathTrusted: vi.fn(),
+    });
+
+    await handleInstall({
+      source: '/untrusted/path',
+    });
+
+    expect(mockPromptForConsentNonInteractive).toHaveBeenCalledWith(
+      expect.stringContaining('This folder contains:'),
+      false,
+    );
+    expect(mockPromptForConsentNonInteractive).toHaveBeenCalledWith(
+      expect.stringContaining('custom-cmd'),
+      false,
+    );
+    expect(mockPromptForConsentNonInteractive).toHaveBeenCalledWith(
+      expect.stringContaining('cool-skill'),
+      false,
+    );
+    expect(mockPromptForConsentNonInteractive).toHaveBeenCalledWith(
+      expect.stringContaining('Security Warnings:'),
+      false,
+    );
+    expect(mockPromptForConsentNonInteractive).toHaveBeenCalledWith(
+      expect.stringContaining('Security risk!'),
+      false,
+    );
+    expect(mockPromptForConsentNonInteractive).toHaveBeenCalledWith(
+      expect.stringContaining('Discovery Errors:'),
+      false,
+    );
+    expect(mockPromptForConsentNonInteractive).toHaveBeenCalledWith(
+      expect.stringContaining('Read error'),
+      false,
+    );
+  });
 });
+// Implementation completed.

packages/cli/src/commands/extensions/install.ts

@@ -5,10 +5,16 @@
  */
 
 import type { CommandModule } from 'yargs';
-import { debugLogger } from '@google/gemini-cli-core';
+import chalk from 'chalk';
+import {
+  debugLogger,
+  FolderTrustDiscoveryService,
+  getRealPath,
+} from '@google/gemini-cli-core';
 import { getErrorMessage } from '../../utils/errors.js';
 import {
   INSTALL_WARNING_MESSAGE,
+  promptForConsentNonInteractive,
   requestConsentNonInteractive,
 } from '../../config/extensions/consent.js';
 import {
@@ -16,6 +22,11 @@ import {
   inferInstallMetadata,
 } from '../../config/extension-manager.js';
 import { loadSettings } from '../../config/settings.js';
+import {
+  isWorkspaceTrusted,
+  loadTrustedFolders,
+  TrustLevel,
+} from '../../config/trustedFolders.js';
 import { promptForSetting } from '../../config/extensions/extensionSettings.js';
 import { exitCli } from '../utils.js';
 
@@ -36,6 +47,95 @@ export async function handleInstall(args: InstallArgs) {
       allowPreRelease: args.allowPreRelease,
     });
 
+    const workspaceDir = process.cwd();
+    const settings = loadSettings(workspaceDir).merged;
+
+    if (installMetadata.type === 'local' || installMetadata.type === 'link') {
+      const resolvedPath = getRealPath(source);
+      installMetadata.source = resolvedPath;
+      const trustResult = isWorkspaceTrusted(settings, resolvedPath);
+      if (trustResult.isTrusted !== true) {
+        const discoveryResults =
+          await FolderTrustDiscoveryService.discover(resolvedPath);
+
+        const hasDiscovery =
+          discoveryResults.commands.length > 0 ||
+          discoveryResults.mcps.length > 0 ||
+          discoveryResults.hooks.length > 0 ||
+          discoveryResults.skills.length > 0 ||
+          discoveryResults.settings.length > 0;
+
+        const promptLines = [
+          '',
+          chalk.bold('Do you trust the files in this folder?'),
+          '',
+          `The extension source at "${resolvedPath}" is not trusted.`,
+          '',
+          'Trusting a folder allows Gemini CLI to load its local configurations,',
+          'including custom commands, hooks, MCP servers, agent skills, and',
+          'settings. These configurations could execute code on your behalf or',
+          'change the behavior of the CLI.',
+          '',
+        ];
+
+        if (discoveryResults.discoveryErrors.length > 0) {
+          promptLines.push(chalk.red('❌ Discovery Errors:'));
+          for (const error of discoveryResults.discoveryErrors) {
+            promptLines.push(chalk.red(`  • ${error}`));
+          }
+          promptLines.push('');
+        }
+
+        if (discoveryResults.securityWarnings.length > 0) {
+          promptLines.push(chalk.yellow('⚠️  Security Warnings:'));
+          for (const warning of discoveryResults.securityWarnings) {
+            promptLines.push(chalk.yellow(`  • ${warning}`));
+          }
+          promptLines.push('');
+        }
+
+        if (hasDiscovery) {
+          promptLines.push(chalk.bold('This folder contains:'));
+          const groups = [
+            { label: 'Commands', items: discoveryResults.commands },
+            { label: 'MCP Servers', items: discoveryResults.mcps },
+            { label: 'Hooks', items: discoveryResults.hooks },
+            { label: 'Skills', items: discoveryResults.skills },
+            { label: 'Setting overrides', items: discoveryResults.settings },
+          ].filter((g) => g.items.length > 0);
+
+          for (const group of groups) {
+            promptLines.push(
+              `  • ${chalk.bold(group.label)} (${group.items.length}):`,
+            );
+            for (const item of group.items) {
+              promptLines.push(`    - ${item}`);
+            }
+          }
+          promptLines.push('');
+        }
+
+        promptLines.push(
+          chalk.yellow(
+            'Do you want to trust this folder and continue with the installation? [y/N]: ',
+          ),
+        );
+
+        const confirmed = await promptForConsentNonInteractive(
+          promptLines.join('\n'),
+          false,
+        );
+        if (confirmed) {
+          const trustedFolders = loadTrustedFolders();
+          await trustedFolders.setValue(resolvedPath, TrustLevel.TRUST_FOLDER);
+        } else {
+          throw new Error(
+            `Installation aborted: Folder "${resolvedPath}" is not trusted.`,
+          );
+        }
+      }
+    }
+
     const requestConsent = args.consent
       ? () => Promise.resolve(true)
       : requestConsentNonInteractive;
@@ -44,12 +144,11 @@ export async function handleInstall(args: InstallArgs) {
       debugLogger.log(INSTALL_WARNING_MESSAGE);
     }
 
-    const workspaceDir = process.cwd();
     const extensionManager = new ExtensionManager({
       workspaceDir,
       requestConsent,
       requestSetting: promptForSetting,
-      settings: loadSettings(workspaceDir).merged,
+      settings,
     });
     await extensionManager.loadExtensions();
     const extension =

packages/cli/src/config/config.ts

@@ -878,6 +878,7 @@ export async function loadCliConfig(
         agents: refreshedSettings.merged.agents,
       };
     },
+    enableConseca: settings.security?.enableConseca,
   });
 }
 

packages/cli/src/config/extension-manager.ts

@@ -32,6 +32,7 @@ import {
   ExtensionUninstallEvent,
   ExtensionUpdateEvent,
   getErrorMessage,
+  getRealPath,
   logExtensionDisable,
   logExtensionEnable,
   logExtensionInstallEvent,
@@ -202,13 +203,11 @@ export class ExtensionManager extends ExtensionLoader {
       const extensionsDir = ExtensionStorage.getUserExtensionsDir();
       await fs.promises.mkdir(extensionsDir, { recursive: true });
 
-      if (
-        !path.isAbsolute(installMetadata.source) &&
-        (installMetadata.type === 'local' || installMetadata.type === 'link')
-      ) {
-        installMetadata.source = path.resolve(
-          this.workspaceDir,
-          installMetadata.source,
+      if (installMetadata.type === 'local' || installMetadata.type === 'link') {
+        installMetadata.source = getRealPath(
+          path.isAbsolute(installMetadata.source)
+            ? installMetadata.source
+            : path.resolve(this.workspaceDir, installMetadata.source),
         );
       }
 

packages/cli/src/config/extension.test.ts

@@ -25,6 +25,7 @@ import {
   KeychainTokenStorage,
   loadAgentsFromDirectory,
   loadSkillsFromDir,
+  getRealPath,
 } from '@google/gemini-cli-core';
 import {
   loadSettings,
@@ -186,11 +187,11 @@ describe('extension tests', () => {
       errors: [],
     });
     vi.mocked(loadSkillsFromDir).mockResolvedValue([]);
-    tempHomeDir = fs.mkdtempSync(
-      path.join(os.tmpdir(), 'gemini-cli-test-home-'),
+    tempHomeDir = getRealPath(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'gemini-cli-test-home-')),
     );
-    tempWorkspaceDir = fs.mkdtempSync(
-      path.join(tempHomeDir, 'gemini-cli-test-workspace-'),
+    tempWorkspaceDir = getRealPath(
+      fs.mkdtempSync(path.join(tempHomeDir, 'gemini-cli-test-workspace-')),
     );
     userExtensionsDir = path.join(tempHomeDir, EXTENSIONS_DIRECTORY_NAME);
     mockRequestConsent = vi.fn();
@@ -329,12 +330,14 @@ describe('extension tests', () => {
     });
 
     it('should load a linked extension correctly', async () => {
-      const sourceExtDir = createExtension({
-        extensionsDir: tempWorkspaceDir,
-        name: 'my-linked-extension',
-        version: '1.0.0',
-        contextFileName: 'context.md',
-      });
+      const sourceExtDir = getRealPath(
+        createExtension({
+          extensionsDir: tempWorkspaceDir,
+          name: 'my-linked-extension',
+          version: '1.0.0',
+          contextFileName: 'context.md',
+        }),
+      );
       fs.writeFileSync(path.join(sourceExtDir, 'context.md'), 'linked context');
 
       await extensionManager.loadExtensions();
@@ -361,18 +364,20 @@ describe('extension tests', () => {
     });
 
     it('should hydrate ${extensionPath} correctly for linked extensions', async () => {
-      const sourceExtDir = createExtension({
-        extensionsDir: tempWorkspaceDir,
-        name: 'my-linked-extension-with-path',
-        version: '1.0.0',
-        mcpServers: {
-          'test-server': {
-            command: 'node',
-            args: ['${extensionPath}${/}server${/}index.js'],
-            cwd: '${extensionPath}${/}server',
+      const sourceExtDir = getRealPath(
+        createExtension({
+          extensionsDir: tempWorkspaceDir,
+          name: 'my-linked-extension-with-path',
+          version: '1.0.0',
+          mcpServers: {
+            'test-server': {
+              command: 'node',
+              args: ['${extensionPath}${/}server${/}index.js'],
+              cwd: '${extensionPath}${/}server',
+            },
           },
-        },
-      });
+        }),
+      );
 
       await extensionManager.loadExtensions();
       await extensionManager.installOrUpdateExtension({
@@ -844,11 +849,13 @@ describe('extension tests', () => {
 
       it('should generate id from the original source for linked extensions', async () => {
         const extDevelopmentDir = path.join(tempHomeDir, 'local_extensions');
-        const actualExtensionDir = createExtension({
-          extensionsDir: extDevelopmentDir,
-          name: 'link-ext-name',
-          version: '1.0.0',
-        });
+        const actualExtensionDir = getRealPath(
+          createExtension({
+            extensionsDir: extDevelopmentDir,
+            name: 'link-ext-name',
+            version: '1.0.0',
+          }),
+        );
         await extensionManager.loadExtensions();
         await extensionManager.installOrUpdateExtension({
           type: 'link',
@@ -994,11 +1001,13 @@ describe('extension tests', () => {
 
   describe('installExtension', () => {
     it('should install an extension from a local path', async () => {
-      const sourceExtDir = createExtension({
-        extensionsDir: tempHomeDir,
-        name: 'my-local-extension',
-        version: '1.0.0',
-      });
+      const sourceExtDir = getRealPath(
+        createExtension({
+          extensionsDir: tempHomeDir,
+          name: 'my-local-extension',
+          version: '1.0.0',
+        }),
+      );
       const targetExtDir = path.join(userExtensionsDir, 'my-local-extension');
       const metadataPath = path.join(targetExtDir, INSTALL_METADATA_FILENAME);
 
@@ -1040,7 +1049,7 @@ describe('extension tests', () => {
     });
 
     it('should throw an error and cleanup if gemini-extension.json is missing', async () => {
-      const sourceExtDir = path.join(tempHomeDir, 'bad-extension');
+      const sourceExtDir = getRealPath(path.join(tempHomeDir, 'bad-extension'));
       fs.mkdirSync(sourceExtDir, { recursive: true });
       const configPath = path.join(sourceExtDir, EXTENSIONS_CONFIG_FILENAME);
 
@@ -1056,7 +1065,7 @@ describe('extension tests', () => {
     });
 
     it('should throw an error for invalid JSON in gemini-extension.json', async () => {
-      const sourceExtDir = path.join(tempHomeDir, 'bad-json-ext');
+      const sourceExtDir = getRealPath(path.join(tempHomeDir, 'bad-json-ext'));
       fs.mkdirSync(sourceExtDir, { recursive: true });
       const configPath = path.join(sourceExtDir, EXTENSIONS_CONFIG_FILENAME);
       fs.writeFileSync(configPath, '{ "name": "bad-json", "version": "1.0.0"'); // Malformed JSON
@@ -1066,22 +1075,17 @@ describe('extension tests', () => {
           source: sourceExtDir,
           type: 'local',
         }),
-      ).rejects.toThrow(
-        new RegExp(
-          `^Failed to load extension config from ${configPath.replace(
-            /\\/g,
-            '\\\\',
-          )}`,
-        ),
-      );
+      ).rejects.toThrow(`Failed to load extension config from ${configPath}`);
     });
 
     it('should throw an error for missing name in gemini-extension.json', async () => {
-      const sourceExtDir = createExtension({
-        extensionsDir: tempHomeDir,
-        name: 'missing-name-ext',
-        version: '1.0.0',
-      });
+      const sourceExtDir = getRealPath(
+        createExtension({
+          extensionsDir: tempHomeDir,
+          name: 'missing-name-ext',
+          version: '1.0.0',
+        }),
+      );
       const configPath = path.join(sourceExtDir, EXTENSIONS_CONFIG_FILENAME);
       // Overwrite with invalid config
       fs.writeFileSync(configPath, JSON.stringify({ version: '1.0.0' }));
@@ -1134,11 +1138,13 @@ describe('extension tests', () => {
     });
 
     it('should install a linked extension', async () => {
-      const sourceExtDir = createExtension({
-        extensionsDir: tempHomeDir,
-        name: 'my-linked-extension',
-        version: '1.0.0',
-      });
+      const sourceExtDir = getRealPath(
+        createExtension({
+          extensionsDir: tempHomeDir,
+          name: 'my-linked-extension',
+          version: '1.0.0',
+        }),
+      );
       const targetExtDir = path.join(userExtensionsDir, 'my-linked-extension');
       const metadataPath = path.join(targetExtDir, INSTALL_METADATA_FILENAME);
       const configPath = path.join(targetExtDir, EXTENSIONS_CONFIG_FILENAME);
@@ -1439,11 +1445,13 @@ ${INSTALL_WARNING_MESSAGE}`,
     });
 
     it('should save the autoUpdate flag to the install metadata', async () => {
-      const sourceExtDir = createExtension({
-        extensionsDir: tempHomeDir,
-        name: 'my-local-extension',
-        version: '1.0.0',
-      });
+      const sourceExtDir = getRealPath(
+        createExtension({
+          extensionsDir: tempHomeDir,
+          name: 'my-local-extension',
+          version: '1.0.0',
+        }),
+      );
       const targetExtDir = path.join(userExtensionsDir, 'my-local-extension');
       const metadataPath = path.join(targetExtDir, INSTALL_METADATA_FILENAME);
 

packages/cli/src/config/extensions/consent.test.ts

@@ -84,7 +84,7 @@ describe('consent', () => {
       { input: '', expected: true },
       { input: 'n', expected: false },
       { input: 'N', expected: false },
-      { input: 'yes', expected: false },
+      { input: 'yes', expected: true },
     ])(
       'should return $expected for input "$input"',
       async ({ input, expected }) => {

packages/cli/src/config/extensions/consent.ts

@@ -91,10 +91,12 @@ export async function requestConsentInteractive(
  * This should not be called from interactive mode as it will break the CLI.
  *
  * @param prompt A yes/no prompt to ask the user
- * @returns Whether or not the user answers 'y' (yes). Defaults to 'yes' on enter.
+ * @param defaultValue Whether to resolve as true or false on enter.
+ * @returns Whether or not the user answers 'y' (yes).
  */
-async function promptForConsentNonInteractive(
+export async function promptForConsentNonInteractive(
   prompt: string,
+  defaultValue = true,
 ): Promise<boolean> {
   const readline = await import('node:readline');
   const rl = readline.createInterface({
@@ -105,7 +107,12 @@ async function promptForConsentNonInteractive(
   return new Promise((resolve) => {
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve(['y', ''].includes(answer.trim().toLowerCase()));
+      const trimmedAnswer = answer.trim().toLowerCase();
+      if (trimmedAnswer === '') {
+        resolve(defaultValue);
+      } else {
+        resolve(['y', 'yes'].includes(trimmedAnswer));
+      }
     });
   });
 }

packages/cli/src/config/extensions/extensionSettings.test.ts

@@ -21,7 +21,7 @@ import { ExtensionStorage } from './storage.js';
 import prompts from 'prompts';
 import * as fsPromises from 'node:fs/promises';
 import * as fs from 'node:fs';
-import { KeychainTokenStorage } from '@google/gemini-cli-core';
+import { HybridSecretStorage } from '@google/gemini-cli-core';
 import { EXTENSION_SETTINGS_FILENAME } from './variables.js';
 
 vi.mock('prompts');
@@ -38,7 +38,7 @@ vi.mock('@google/gemini-cli-core', async (importOriginal) => {
     await importOriginal<typeof import('@google/gemini-cli-core')>();
   return {
     ...actual,
-    KeychainTokenStorage: vi.fn(),
+    HybridSecretStorage: vi.fn(),
   };
 });
 
@@ -51,33 +51,29 @@ describe('extensionSettings', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mockKeychainData = {};
-    vi.mocked(KeychainTokenStorage).mockImplementation(
-      (serviceName: string) => {
-        if (!mockKeychainData[serviceName]) {
-          mockKeychainData[serviceName] = {};
-        }
-        const keychainData = mockKeychainData[serviceName];
-        return {
-          getSecret: vi
-            .fn()
-            .mockImplementation(
-              async (key: string) => keychainData[key] || null,
-            ),
-          setSecret: vi
-            .fn()
-            .mockImplementation(async (key: string, value: string) => {
-              keychainData[key] = value;
-            }),
-          deleteSecret: vi.fn().mockImplementation(async (key: string) => {
-            delete keychainData[key];
+    vi.mocked(HybridSecretStorage).mockImplementation((serviceName: string) => {
+      if (!mockKeychainData[serviceName]) {
+        mockKeychainData[serviceName] = {};
+      }
+      const keychainData = mockKeychainData[serviceName];
+      return {
+        getSecret: vi
+          .fn()
+          .mockImplementation(async (key: string) => keychainData[key] || null),
+        setSecret: vi
+          .fn()
+          .mockImplementation(async (key: string, value: string) => {
+            keychainData[key] = value;
           }),
-          listSecrets: vi
-            .fn()
-            .mockImplementation(async () => Object.keys(keychainData)),
-          isAvailable: vi.fn().mockResolvedValue(true),
-        } as unknown as KeychainTokenStorage;
-      },
-    );
+        deleteSecret: vi.fn().mockImplementation(async (key: string) => {
+          delete keychainData[key];
+        }),
+        listSecrets: vi
+          .fn()
+          .mockImplementation(async () => Object.keys(keychainData)),
+        isAvailable: vi.fn().mockResolvedValue(true),
+      } as unknown as HybridSecretStorage;
+    });
     tempHomeDir = os.tmpdir() + path.sep + `gemini-cli-test-home-${Date.now()}`;
     tempWorkspaceDir = path.join(
       os.tmpdir(),
@@ -215,7 +211,7 @@ describe('extensionSettings', () => {
         VAR1: 'previous-VAR1',
         SENSITIVE_VAR: 'secret',
       };
-      const userKeychain = new KeychainTokenStorage(
+      const userKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext 12345`,
       );
       await userKeychain.setSecret('SENSITIVE_VAR', 'secret');
@@ -255,7 +251,7 @@ describe('extensionSettings', () => {
         settings: [],
       };
       const previousSettings = { SENSITIVE_VAR: 'secret' };
-      const userKeychain = new KeychainTokenStorage(
+      const userKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext 12345`,
       );
       await userKeychain.setSecret('SENSITIVE_VAR', 'secret');
@@ -421,53 +417,11 @@ describe('extensionSettings', () => {
         undefined,
       );
 
-      const userKeychain = new KeychainTokenStorage(
+      const userKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext 12345`,
       );
       expect(await userKeychain.getSecret('SENSITIVE_VAR')).toBeNull();
     });
-
-    it('should not attempt to clear secrets if keychain is unavailable', async () => {
-      // Arrange
-      const mockIsAvailable = vi.fn().mockResolvedValue(false);
-      const mockListSecrets = vi.fn();
-
-      vi.mocked(KeychainTokenStorage).mockImplementation(
-        () =>
-          ({
-            isAvailable: mockIsAvailable,
-            listSecrets: mockListSecrets,
-            deleteSecret: vi.fn(),
-            getSecret: vi.fn(),
-            setSecret: vi.fn(),
-          }) as unknown as KeychainTokenStorage,
-      );
-
-      const config: ExtensionConfig = {
-        name: 'test-ext',
-        version: '1.0.0',
-        settings: [], // Empty settings triggers clearSettings
-      };
-
-      const previousConfig: ExtensionConfig = {
-        name: 'test-ext',
-        version: '1.0.0',
-        settings: [{ name: 's1', description: 'd1', envVar: 'VAR1' }],
-      };
-
-      // Act
-      await maybePromptForSettings(
-        config,
-        '12345',
-        mockRequestSetting,
-        previousConfig,
-        undefined,
-      );
-
-      // Assert
-      expect(mockIsAvailable).toHaveBeenCalled();
-      expect(mockListSecrets).not.toHaveBeenCalled();
-    });
   });
 
   describe('promptForSetting', () => {
@@ -549,7 +503,7 @@ describe('extensionSettings', () => {
     it('should return combined contents from user .env and keychain for USER scope', async () => {
       const userEnvPath = path.join(extensionDir, EXTENSION_SETTINGS_FILENAME);
       await fsPromises.writeFile(userEnvPath, 'VAR1=user-value1');
-      const userKeychain = new KeychainTokenStorage(
+      const userKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext 12345`,
       );
       await userKeychain.setSecret('SENSITIVE_VAR', 'user-secret');
@@ -573,7 +527,7 @@ describe('extensionSettings', () => {
         EXTENSION_SETTINGS_FILENAME,
       );
       await fsPromises.writeFile(workspaceEnvPath, 'VAR1=workspace-value1');
-      const workspaceKeychain = new KeychainTokenStorage(
+      const workspaceKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext 12345 ${tempWorkspaceDir}`,
       );
       await workspaceKeychain.setSecret('SENSITIVE_VAR', 'workspace-secret');
@@ -590,6 +544,29 @@ describe('extensionSettings', () => {
         SENSITIVE_VAR: 'workspace-secret',
       });
     });
+
+    it('should ignore .env if it is a directory', async () => {
+      const workspaceEnvPath = path.join(
+        tempWorkspaceDir,
+        EXTENSION_SETTINGS_FILENAME,
+      );
+      fs.mkdirSync(workspaceEnvPath);
+      const workspaceKeychain = new HybridSecretStorage(
+        `Gemini CLI Extensions test-ext 12345 ${tempWorkspaceDir}`,
+      );
+      await workspaceKeychain.setSecret('SENSITIVE_VAR', 'workspace-secret');
+
+      const contents = await getScopedEnvContents(
+        config,
+        extensionId,
+        ExtensionSettingScope.WORKSPACE,
+        tempWorkspaceDir,
+      );
+
+      expect(contents).toEqual({
+        SENSITIVE_VAR: 'workspace-secret',
+      });
+    });
   });
 
   describe('getEnvContents (merged)', () => {
@@ -611,7 +588,7 @@ describe('extensionSettings', () => {
         userEnvPath,
         'VAR1=user-value1\nVAR3=user-value3',
       );
-      const userKeychain = new KeychainTokenStorage(
+      const userKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext ${extensionId}`,
       );
       await userKeychain.setSecret('VAR2', 'user-secret2');
@@ -622,7 +599,7 @@ describe('extensionSettings', () => {
         EXTENSION_SETTINGS_FILENAME,
       );
       await fsPromises.writeFile(workspaceEnvPath, 'VAR1=workspace-value1');
-      const workspaceKeychain = new KeychainTokenStorage(
+      const workspaceKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext ${extensionId} ${tempWorkspaceDir}`,
       );
       await workspaceKeychain.setSecret('VAR2', 'workspace-secret2');
@@ -655,7 +632,7 @@ describe('extensionSettings', () => {
     beforeEach(async () => {
       const userEnvPath = path.join(extensionDir, '.env');
       await fsPromises.writeFile(userEnvPath, 'VAR1=value1\n');
-      const userKeychain = new KeychainTokenStorage(
+      const userKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext 12345`,
       );
       await userKeychain.setSecret('VAR2', 'value2');
@@ -696,6 +673,26 @@ describe('extensionSettings', () => {
       expect(actualContent).toContain('VAR1=new-workspace-value');
     });
 
+    it('should throw an error when trying to write to a workspace with a .env directory', async () => {
+      const workspaceEnvPath = path.join(tempWorkspaceDir, '.env');
+      fs.mkdirSync(workspaceEnvPath);
+
+      mockRequestSetting.mockResolvedValue('new-workspace-value');
+
+      await expect(
+        updateSetting(
+          config,
+          '12345',
+          'VAR1',
+          mockRequestSetting,
+          ExtensionSettingScope.WORKSPACE,
+          tempWorkspaceDir,
+        ),
+      ).rejects.toThrow(
+        /Cannot write extension settings to .* because it is a directory./,
+      );
+    });
+
     it('should update a sensitive setting in USER scope', async () => {
       mockRequestSetting.mockResolvedValue('new-value2');
 
@@ -708,7 +705,7 @@ describe('extensionSettings', () => {
         tempWorkspaceDir,
       );
 
-      const userKeychain = new KeychainTokenStorage(
+      const userKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext 12345`,
       );
       expect(await userKeychain.getSecret('VAR2')).toBe('new-value2');
@@ -726,7 +723,7 @@ describe('extensionSettings', () => {
         tempWorkspaceDir,
       );
 
-      const workspaceKeychain = new KeychainTokenStorage(
+      const workspaceKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext 12345 ${tempWorkspaceDir}`,
       );
       expect(await workspaceKeychain.getSecret('VAR2')).toBe(
@@ -780,7 +777,7 @@ describe('extensionSettings', () => {
         tempWorkspaceDir,
       );
 
-      const userKeychain = new KeychainTokenStorage(
+      const userKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext 12345`,
       );
       expect(await userKeychain.getSecret('VAR2')).toBeNull();
@@ -806,7 +803,7 @@ describe('extensionSettings', () => {
     it('should not throw if deleting a non-existent sensitive setting with empty value', async () => {
       mockRequestSetting.mockResolvedValue('');
       // Ensure it doesn't exist first
-      const userKeychain = new KeychainTokenStorage(
+      const userKeychain = new HybridSecretStorage(
         `Gemini CLI Extensions test-ext 12345`,
       );
       await userKeychain.deleteSecret('VAR2');

packages/cli/src/config/extensions/extensionSettings.ts

@@ -13,7 +13,7 @@ import { ExtensionStorage } from './storage.js';
 import type { ExtensionConfig } from '../extension.js';
 
 import prompts from 'prompts';
-import { debugLogger, KeychainTokenStorage } from '@google/gemini-cli-core';
+import { debugLogger, HybridSecretStorage } from '@google/gemini-cli-core';
 import { EXTENSION_SETTINGS_FILENAME } from './variables.js';
 
 export enum ExtensionSettingScope {
@@ -78,7 +78,7 @@ export async function maybePromptForSettings(
   // The user can change the scope later using the `settings set` command.
   const scope = ExtensionSettingScope.USER;
   const envFilePath = getEnvFilePath(extensionName, scope);
-  const keychain = new KeychainTokenStorage(
+  const keychain = new HybridSecretStorage(
     getKeychainStorageName(extensionName, extensionId, scope),
   );
 
@@ -124,6 +124,15 @@ export async function maybePromptForSettings(
 
   const envContent = formatEnvContent(nonSensitiveSettings);
 
+  if (fsSync.existsSync(envFilePath)) {
+    const stat = fsSync.statSync(envFilePath);
+    if (stat.isDirectory()) {
+      throw new Error(
+        `Cannot write extension settings to ${envFilePath} because it is a directory.`,
+      );
+    }
+  }
+
   await fs.writeFile(envFilePath, envContent);
 }
 
@@ -167,14 +176,17 @@ export async function getScopedEnvContents(
   workspaceDir?: string,
 ): Promise<Record<string, string>> {
   const { name: extensionName } = extensionConfig;
-  const keychain = new KeychainTokenStorage(
+  const keychain = new HybridSecretStorage(
     getKeychainStorageName(extensionName, extensionId, scope, workspaceDir),
   );
   const envFilePath = getEnvFilePath(extensionName, scope, workspaceDir);
   let customEnv: Record<string, string> = {};
   if (fsSync.existsSync(envFilePath)) {
-    const envFile = fsSync.readFileSync(envFilePath, 'utf-8');
-    customEnv = dotenv.parse(envFile);
+    const stat = fsSync.statSync(envFilePath);
+    if (!stat.isDirectory()) {
+      const envFile = fsSync.readFileSync(envFilePath, 'utf-8');
+      customEnv = dotenv.parse(envFile);
+    }
   }
 
   if (extensionConfig.settings) {
@@ -238,7 +250,7 @@ export async function updateSetting(
   }
 
   const newValue = await requestSetting(settingToUpdate);
-  const keychain = new KeychainTokenStorage(
+  const keychain = new HybridSecretStorage(
     getKeychainStorageName(extensionName, extensionId, scope, workspaceDir),
   );
 
@@ -260,6 +272,12 @@ export async function updateSetting(
   const envFilePath = getEnvFilePath(extensionName, scope, workspaceDir);
   let envContent = '';
   if (fsSync.existsSync(envFilePath)) {
+    const stat = fsSync.statSync(envFilePath);
+    if (stat.isDirectory()) {
+      throw new Error(
+        `Cannot write extension settings to ${envFilePath} because it is a directory.`,
+      );
+    }
     envContent = await fs.readFile(envFilePath, 'utf-8');
   }
 
@@ -321,13 +339,13 @@ function getSettingsChanges(
 
 async function clearSettings(
   envFilePath: string,
-  keychain: KeychainTokenStorage,
+  keychain: HybridSecretStorage,
 ) {
   if (fsSync.existsSync(envFilePath)) {
-    await fs.writeFile(envFilePath, '');
-  }
-  if (!(await keychain.isAvailable())) {
-    return;
+    const stat = fsSync.statSync(envFilePath);
+    if (!stat.isDirectory()) {
+      await fs.writeFile(envFilePath, '');
+    }
   }
   const secrets = await keychain.listSecrets();
   for (const secret of secrets) {

packages/cli/src/config/settings.test.ts

@@ -75,6 +75,7 @@ import {
   SettingScope,
   LoadedSettings,
   sanitizeEnvVar,
+  createTestMergedSettings,
 } from './settings.js';
 import {
   FatalConfigError,
@@ -1838,36 +1839,50 @@ describe('Settings Loading and Merging', () => {
       expect(process.env['GEMINI_API_KEY']).toEqual('test-key');
     });
 
-    it('does not load env files from untrusted spaces', () => {
+    it('does not load env files from untrusted spaces when sandboxed', () => {
       setup({ isFolderTrustEnabled: true, isWorkspaceTrustedValue: false });
       const settings = {
         security: { folderTrust: { enabled: true } },
+        tools: { sandbox: true },
       } as Settings;
       loadEnvironment(settings, MOCK_WORKSPACE_DIR, isWorkspaceTrusted);
 
       expect(process.env['TESTTEST']).not.toEqual('1234');
     });
 
-    it('does not load env files when trust is undefined', () => {
+    it('does load env files from untrusted spaces when NOT sandboxed', () => {
+      setup({ isFolderTrustEnabled: true, isWorkspaceTrustedValue: false });
+      const settings = {
+        security: { folderTrust: { enabled: true } },
+        tools: { sandbox: false },
+      } as Settings;
+      loadEnvironment(settings, MOCK_WORKSPACE_DIR, isWorkspaceTrusted);
+
+      expect(process.env['TESTTEST']).toEqual('1234');
+    });
+
+    it('does not load env files when trust is undefined and sandboxed', () => {
       delete process.env['TESTTEST'];
       // isWorkspaceTrusted returns {isTrusted: undefined} for matched rules with no trust value, or no matching rules.
       setup({ isFolderTrustEnabled: true, isWorkspaceTrustedValue: undefined });
       const settings = {
         security: { folderTrust: { enabled: true } },
+        tools: { sandbox: true },
       } as Settings;
 
       const mockTrustFn = vi.fn().mockReturnValue({ isTrusted: undefined });
       loadEnvironment(settings, MOCK_WORKSPACE_DIR, mockTrustFn);
 
       expect(process.env['TESTTEST']).not.toEqual('1234');
-      expect(process.env['GEMINI_API_KEY']).not.toEqual('test-key');
+      expect(process.env['GEMINI_API_KEY']).toEqual('test-key');
     });
 
     it('loads whitelisted env files from untrusted spaces if sandboxing is enabled', () => {
       setup({ isFolderTrustEnabled: true, isWorkspaceTrustedValue: false });
-      const settings = loadSettings(MOCK_WORKSPACE_DIR);
-      settings.merged.tools.sandbox = true;
-      loadEnvironment(settings.merged, MOCK_WORKSPACE_DIR);
+      const settings = createTestMergedSettings({
+        tools: { sandbox: true },
+      });
+      loadEnvironment(settings, MOCK_WORKSPACE_DIR, isWorkspaceTrusted);
 
       // GEMINI_API_KEY is in the whitelist, so it should be loaded.
       expect(process.env['GEMINI_API_KEY']).toEqual('test-key');
@@ -1880,10 +1895,10 @@ describe('Settings Loading and Merging', () => {
       process.argv.push('-s');
       try {
         setup({ isFolderTrustEnabled: true, isWorkspaceTrustedValue: false });
-        const settings = loadSettings(MOCK_WORKSPACE_DIR);
-        // Ensure sandbox is NOT in settings to test argv sniffing
-        settings.merged.tools.sandbox = undefined;
-        loadEnvironment(settings.merged, MOCK_WORKSPACE_DIR);
+        const settings = createTestMergedSettings({
+          tools: { sandbox: false },
+        });
+        loadEnvironment(settings, MOCK_WORKSPACE_DIR, isWorkspaceTrusted);
 
         expect(process.env['GEMINI_API_KEY']).toEqual('test-key');
         expect(process.env['TESTTEST']).not.toEqual('1234');
@@ -2782,7 +2797,7 @@ describe('Settings Loading and Merging', () => {
           MOCK_WORKSPACE_DIR,
         );
 
-        expect(process.env['GEMINI_API_KEY']).toBeUndefined();
+        expect(process.env['GEMINI_API_KEY']).toEqual('secret');
       });
 
       it('should NOT be tricked by positional arguments that look like flags', () => {
@@ -2801,7 +2816,7 @@ describe('Settings Loading and Merging', () => {
           MOCK_WORKSPACE_DIR,
         );
 
-        expect(process.env['GEMINI_API_KEY']).toBeUndefined();
+        expect(process.env['GEMINI_API_KEY']).toEqual('secret');
       });
     });
 

packages/cli/src/config/settings.ts

@@ -573,10 +573,6 @@ export function loadEnvironment(
     relevantArgs.includes('-s') ||
     relevantArgs.includes('--sandbox');
 
-  if (trustResult.isTrusted !== true && !isSandboxed) {
-    return;
-  }
-
   // Cloud Shell environment variable handling
   if (process.env['CLOUD_SHELL'] === 'true') {
     setUpCloudShellEnvironment(envFilePath, isTrusted, isSandboxed);

packages/cli/src/config/settingsSchema.ts

@@ -974,6 +974,60 @@ const SETTINGS_SCHEMA = {
           ref: 'AgentOverride',
         },
       },
+      browser: {
+        type: 'object',
+        label: 'Browser Agent',
+        category: 'Advanced',
+        requiresRestart: true,
+        default: {},
+        description: 'Settings specific to the browser agent.',
+        showInDialog: false,
+        properties: {
+          sessionMode: {
+            type: 'enum',
+            label: 'Browser Session Mode',
+            category: 'Advanced',
+            requiresRestart: true,
+            default: 'persistent',
+            description:
+              "Session mode: 'persistent', 'isolated', or 'existing'.",
+            showInDialog: false,
+            options: [
+              { value: 'persistent', label: 'Persistent' },
+              { value: 'isolated', label: 'Isolated' },
+              { value: 'existing', label: 'Existing' },
+            ],
+          },
+          headless: {
+            type: 'boolean',
+            label: 'Browser Headless',
+            category: 'Advanced',
+            requiresRestart: true,
+            default: false,
+            description: 'Run browser in headless mode.',
+            showInDialog: false,
+          },
+          profilePath: {
+            type: 'string',
+            label: 'Browser Profile Path',
+            category: 'Advanced',
+            requiresRestart: true,
+            default: undefined as string | undefined,
+            description:
+              'Path to browser profile directory for session persistence.',
+            showInDialog: false,
+          },
+          visualModel: {
+            type: 'string',
+            label: 'Browser Visual Model',
+            category: 'Advanced',
+            requiresRestart: true,
+            default: undefined as string | undefined,
+            description: 'Model override for the visual agent.',
+            showInDialog: false,
+          },
+        },
+      },
     },
   },
 
@@ -1493,6 +1547,16 @@ const SETTINGS_SCHEMA = {
           },
         },
       },
+      enableConseca: {
+        type: 'boolean',
+        label: 'Enable Context-Aware Security',
+        category: 'Security',
+        requiresRestart: true,
+        default: false,
+        description:
+          'Enable the context-aware security checker. This feature uses an LLM to dynamically generate and enforce security policies for tool use based on your prompt, providing an additional layer of protection against unintended actions.',
+        showInDialog: true,
+      },
     },
   },
 

packages/cli/src/test-utils/render.tsx

@@ -393,9 +393,11 @@ export const render = (
       exitOnCtrlC: false,
       patchConsole: false,
       onRender: (metrics: RenderMetrics) => {
-        if (isInkRenderMetrics(metrics)) {
-          stdout.onRender(metrics.staticOutput ?? '', metrics.output);
-        }
+        const output = isInkRenderMetrics(metrics) ? metrics.output : '...';
+        const staticOutput = isInkRenderMetrics(metrics)
+          ? (metrics.staticOutput ?? '')
+          : '';
+        stdout.onRender(staticOutput, output);
       },
     });
   });

packages/cli/src/ui/colors.ts

@@ -53,6 +53,12 @@ export const Colors: ColorsTheme = {
   get DarkGray() {
     return themeManager.getColors().DarkGray;
   },
+  get InputBackground() {
+    return themeManager.getColors().InputBackground;
+  },
+  get MessageBackground() {
+    return themeManager.getColors().MessageBackground;
+  },
   get GradientColors() {
     return themeManager.getActiveTheme().colors.GradientColors;
   },

packages/cli/src/ui/commands/policiesCommand.test.ts

@@ -9,7 +9,11 @@ import { policiesCommand } from './policiesCommand.js';
 import { CommandKind } from './types.js';
 import { MessageType } from '../types.js';
 import { createMockCommandContext } from '../../test-utils/mockCommandContext.js';
-import { type Config, PolicyDecision } from '@google/gemini-cli-core';
+import {
+  type Config,
+  PolicyDecision,
+  ApprovalMode,
+} from '@google/gemini-cli-core';
 
 describe('policiesCommand', () => {
   let mockContext: ReturnType<typeof createMockCommandContext>;
@@ -106,6 +110,7 @@ describe('policiesCommand', () => {
       expect(content).toContain(
         '### Yolo Mode Policies (combined with normal mode policies)',
       );
+      expect(content).toContain('### Plan Mode Policies');
       expect(content).toContain(
         '**DENY** tool: `dangerousTool` [Priority: 10]',
       );
@@ -114,5 +119,45 @@ describe('policiesCommand', () => {
       );
       expect(content).toContain('**ASK_USER** all tools');
     });
+
+    it('should show plan-only rules in plan mode section', async () => {
+      const mockRules = [
+        {
+          decision: PolicyDecision.ALLOW,
+          toolName: 'glob',
+          priority: 70,
+          modes: [ApprovalMode.PLAN],
+        },
+        {
+          decision: PolicyDecision.DENY,
+          priority: 60,
+          modes: [ApprovalMode.PLAN],
+        },
+        {
+          decision: PolicyDecision.ALLOW,
+          toolName: 'shell',
+          priority: 50,
+        },
+      ];
+      const mockPolicyEngine = {
+        getRules: vi.fn().mockReturnValue(mockRules),
+      };
+      mockContext.services.config = {
+        getPolicyEngine: vi.fn().mockReturnValue(mockPolicyEngine),
+      } as unknown as Config;
+
+      const listCommand = policiesCommand.subCommands![0];
+      await listCommand.action!(mockContext, '');
+
+      const call = vi.mocked(mockContext.ui.addItem).mock.calls[0];
+      const content = (call[0] as { text: string }).text;
+
+      // Plan-only rules appear under Plan Mode section
+      expect(content).toContain('### Plan Mode Policies');
+      // glob ALLOW is plan-only, should appear in plan section
+      expect(content).toContain('**ALLOW** tool: `glob` [Priority: 70]');
+      // shell ALLOW has no modes (applies to all), appears in normal section
+      expect(content).toContain('**ALLOW** tool: `shell` [Priority: 50]');
+    });
   });
 });

packages/cli/src/ui/commands/policiesCommand.ts

@@ -12,6 +12,7 @@ interface CategorizedRules {
   normal: PolicyRule[];
   autoEdit: PolicyRule[];
   yolo: PolicyRule[];
+  plan: PolicyRule[];
 }
 
 const categorizeRulesByMode = (
@@ -21,6 +22,7 @@ const categorizeRulesByMode = (
     normal: [],
     autoEdit: [],
     yolo: [],
+    plan: [],
   };
   const ALL_MODES = Object.values(ApprovalMode);
   rules.forEach((rule) => {
@@ -29,6 +31,7 @@ const categorizeRulesByMode = (
     if (modeSet.has(ApprovalMode.DEFAULT)) result.normal.push(rule);
     if (modeSet.has(ApprovalMode.AUTO_EDIT)) result.autoEdit.push(rule);
     if (modeSet.has(ApprovalMode.YOLO)) result.yolo.push(rule);
+    if (modeSet.has(ApprovalMode.PLAN)) result.plan.push(rule);
   });
   return result;
 };
@@ -82,6 +85,9 @@ const listPoliciesCommand: SlashCommand = {
     const uniqueYolo = categorized.yolo.filter(
       (rule) => !normalRulesSet.has(rule),
     );
+    const uniquePlan = categorized.plan.filter(
+      (rule) => !normalRulesSet.has(rule),
+    );
 
     let content = '**Active Policies**\n\n';
     content += formatSection('Normal Mode Policies', categorized.normal);
@@ -93,6 +99,7 @@ const listPoliciesCommand: SlashCommand = {
       'Yolo Mode Policies (combined with normal mode policies)',
       uniqueYolo,
     );
+    content += formatSection('Plan Mode Policies', uniquePlan);
 
     context.ui.addItem(
       {

packages/cli/src/ui/components/Header.test.tsx

@@ -96,6 +96,8 @@ describe('<Header />', () => {
       },
       background: {
         primary: '',
+        message: '',
+        input: '',
         diff: { added: '', removed: '' },
       },
       border: {

packages/cli/src/ui/components/InputPrompt.tsx

@@ -56,10 +56,6 @@ import {
 } from '../utils/commandUtils.js';
 import * as path from 'node:path';
 import { SCREEN_READER_USER_PREFIX } from '../textConstants.js';
-import {
-  DEFAULT_BACKGROUND_OPACITY,
-  DEFAULT_INPUT_BACKGROUND_OPACITY,
-} from '../constants.js';
 import { getSafeLowColorBackground } from '../themes/color-utils.js';
 import { isLowColorDepth } from '../utils/terminalUtils.js';
 import { useShellFocusState } from '../contexts/ShellFocusContext.js';
@@ -226,7 +222,6 @@ export const InputPrompt: React.FC<InputPromptProps> = ({
     backgroundShells,
     backgroundShellHeight,
     shortcutsHelpVisible,
-    hintMode,
   } = useUIState();
   const [suppressCompletion, setSuppressCompletion] = useState(false);
   const { handlePress: registerPlainTabPress, resetCount: resetPlainTabPress } =
@@ -1422,14 +1417,8 @@ export const InputPrompt: React.FC<InputPromptProps> = ({
         />
       ) : null}
       <HalfLinePaddedBox
-        backgroundBaseColor={
-          hintMode ? theme.text.accent : theme.text.secondary
-        }
-        backgroundOpacity={
-          showCursor
-            ? DEFAULT_INPUT_BACKGROUND_OPACITY
-            : DEFAULT_BACKGROUND_OPACITY
-        }
+        backgroundBaseColor={theme.background.input}
+        backgroundOpacity={1}
         useBackgroundColor={useBackgroundColor}
       >
         <Box

packages/cli/src/ui/components/ShortcutsHelp.tsx

@@ -67,7 +67,7 @@ export const ShortcutsHelp: React.FC = () => {
 
   return (
     <Box flexDirection="column" width="100%">
-      <SectionHeader title="Shortcuts (for more, see /help)" />
+      <SectionHeader title=" Shortcuts" subtitle=" See /help for more" />
       <Box flexDirection="row" flexWrap="wrap" paddingLeft={1} paddingRight={2}>
         {itemsForDisplay.map((item, index) => (
           <Box

packages/cli/src/ui/components/__snapshots__/ShortcutsHelp.test.tsx.snap

@@ -1,7 +1,8 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
 exports[`ShortcutsHelp > renders correctly in 'narrow' mode on 'linux' 1`] = `
-"── Shortcuts (for more, see /help) ─────
+"────────────────────────────────────────
+ Shortcuts See /help for more
  ! shell mode
  @ select file or folder
  Esc Esc clear & rewind
@@ -16,7 +17,8 @@ exports[`ShortcutsHelp > renders correctly in 'narrow' mode on 'linux' 1`] = `
 `;
 
 exports[`ShortcutsHelp > renders correctly in 'narrow' mode on 'mac' 1`] = `
-"── Shortcuts (for more, see /help) ─────
+"────────────────────────────────────────
+ Shortcuts See /help for more
  ! shell mode
  @ select file or folder
  Esc Esc clear & rewind
@@ -31,7 +33,8 @@ exports[`ShortcutsHelp > renders correctly in 'narrow' mode on 'mac' 1`] = `
 `;
 
 exports[`ShortcutsHelp > renders correctly in 'wide' mode on 'linux' 1`] = `
-"── Shortcuts (for more, see /help) ─────────────────────────────────────────────────────────────────
+"────────────────────────────────────────────────────────────────────────────────────────────────────
+ Shortcuts See /help for more
  ! shell mode                    Shift+Tab cycle mode            Ctrl+V paste images
  @ select file or folder         Ctrl+Y YOLO mode                Alt+M raw markdown mode
  Esc Esc clear & rewind          Ctrl+R reverse-search history   Ctrl+X open external editor
@@ -40,7 +43,8 @@ exports[`ShortcutsHelp > renders correctly in 'wide' mode on 'linux' 1`] = `
 `;
 
 exports[`ShortcutsHelp > renders correctly in 'wide' mode on 'mac' 1`] = `
-"── Shortcuts (for more, see /help) ─────────────────────────────────────────────────────────────────
+"────────────────────────────────────────────────────────────────────────────────────────────────────
+ Shortcuts See /help for more
  ! shell mode                    Shift+Tab cycle mode            Ctrl+V paste images
  @ select file or folder         Ctrl+Y YOLO mode                Option+M raw markdown mode
  Esc Esc clear & rewind          Ctrl+R reverse-search history   Ctrl+X open external editor

packages/cli/src/ui/components/messages/ShellToolMessage.tsx

@@ -58,7 +58,10 @@ export const ShellToolMessage: React.FC<ShellToolMessageProps> = ({
   borderColor,
 
   borderDimColor,
+
   isExpandable,
+
+  originalRequestName,
 }) => {
   const {
     activePtyId: activeShellPtyId,
@@ -129,6 +132,7 @@ export const ShellToolMessage: React.FC<ShellToolMessageProps> = ({
           status={status}
           description={description}
           emphasis={emphasis}
+          originalRequestName={originalRequestName}
         />
 
         <FocusHint

packages/cli/src/ui/components/messages/ToolConfirmationMessage.test.tsx

@@ -520,4 +520,77 @@ describe('ToolConfirmationMessage', () => {
     expect(output).toMatchSnapshot();
     unmount();
   });
+
+  it('should show MCP tool details expand hint for MCP confirmations', async () => {
+    const confirmationDetails: ToolCallConfirmationDetails = {
+      type: 'mcp',
+      title: 'Confirm MCP Tool',
+      serverName: 'test-server',
+      toolName: 'test-tool',
+      toolDisplayName: 'Test Tool',
+      toolArgs: {
+        url: 'https://www.google.co.jp',
+      },
+      toolDescription: 'Navigates browser to a URL.',
+      toolParameterSchema: {
+        type: 'object',
+        properties: {
+          url: {
+            type: 'string',
+            description: 'Destination URL',
+          },
+        },
+        required: ['url'],
+      },
+      onConfirm: vi.fn(),
+    };
+
+    const { lastFrame, waitUntilReady, unmount } = renderWithProviders(
+      <ToolConfirmationMessage
+        callId="test-call-id"
+        confirmationDetails={confirmationDetails}
+        config={mockConfig}
+        availableTerminalHeight={30}
+        terminalWidth={80}
+      />,
+    );
+    await waitUntilReady();
+
+    const output = lastFrame();
+    expect(output).toContain('MCP Tool Details:');
+    expect(output).toContain('(press Ctrl+O to expand MCP tool details)');
+    expect(output).not.toContain('https://www.google.co.jp');
+    expect(output).not.toContain('Navigates browser to a URL.');
+    unmount();
+  });
+
+  it('should omit empty MCP invocation arguments from details', async () => {
+    const confirmationDetails: ToolCallConfirmationDetails = {
+      type: 'mcp',
+      title: 'Confirm MCP Tool',
+      serverName: 'test-server',
+      toolName: 'test-tool',
+      toolDisplayName: 'Test Tool',
+      toolArgs: {},
+      toolDescription: 'No arguments required.',
+      onConfirm: vi.fn(),
+    };
+
+    const { lastFrame, waitUntilReady, unmount } = renderWithProviders(
+      <ToolConfirmationMessage
+        callId="test-call-id"
+        confirmationDetails={confirmationDetails}
+        config={mockConfig}
+        availableTerminalHeight={30}
+        terminalWidth={80}
+      />,
+    );
+    await waitUntilReady();
+
+    const output = lastFrame();
+    expect(output).toContain('MCP Tool Details:');
+    expect(output).toContain('(press Ctrl+O to expand MCP tool details)');
+    expect(output).not.toContain('Invocation Arguments:');
+    unmount();
+  });
 });

packages/cli/src/ui/components/messages/ToolConfirmationMessage.tsx

@@ -5,7 +5,7 @@
  */
 
 import type React from 'react';
-import { useMemo, useCallback } from 'react';
+import { useMemo, useCallback, useState } from 'react';
 import { Box, Text } from 'ink';
 import { DiffRenderer } from './DiffRenderer.js';
 import { RenderInline } from '../../utils/InlineMarkdownRenderer.js';
@@ -29,6 +29,7 @@ import { useKeypress } from '../../hooks/useKeypress.js';
 import { theme } from '../../semantic-colors.js';
 import { useSettings } from '../../contexts/SettingsContext.js';
 import { keyMatchers, Command } from '../../keyMatchers.js';
+import { formatCommand } from '../../utils/keybindingUtils.js';
 import {
   REDIRECTION_WARNING_NOTE_LABEL,
   REDIRECTION_WARNING_NOTE_TEXT,
@@ -64,6 +65,17 @@ export const ToolConfirmationMessage: React.FC<
   terminalWidth,
 }) => {
   const { confirm, isDiffingEnabled } = useToolActions();
+  const [mcpDetailsExpansionState, setMcpDetailsExpansionState] = useState<{
+    callId: string;
+    expanded: boolean;
+  }>({
+    callId,
+    expanded: false,
+  });
+  const isMcpToolDetailsExpanded =
+    mcpDetailsExpansionState.callId === callId
+      ? mcpDetailsExpansionState.expanded
+      : false;
 
   const settings = useSettings();
   const allowPermanentApproval =
@@ -86,9 +98,81 @@ export const ToolConfirmationMessage: React.FC<
     [confirm, callId],
   );
 
+  const mcpToolDetailsText = useMemo(() => {
+    if (confirmationDetails.type !== 'mcp') {
+      return null;
+    }
+
+    const detailsLines: string[] = [];
+    const hasNonEmptyToolArgs =
+      confirmationDetails.toolArgs !== undefined &&
+      !(
+        typeof confirmationDetails.toolArgs === 'object' &&
+        confirmationDetails.toolArgs !== null &&
+        Object.keys(confirmationDetails.toolArgs).length === 0
+      );
+    if (hasNonEmptyToolArgs) {
+      let argsText: string;
+      try {
+        argsText = stripUnsafeCharacters(
+          JSON.stringify(confirmationDetails.toolArgs, null, 2),
+        );
+      } catch {
+        argsText = '[unserializable arguments]';
+      }
+      detailsLines.push('Invocation Arguments:');
+      detailsLines.push(argsText);
+    }
+
+    const description = confirmationDetails.toolDescription?.trim();
+    if (description) {
+      if (detailsLines.length > 0) {
+        detailsLines.push('');
+      }
+      detailsLines.push('Description:');
+      detailsLines.push(stripUnsafeCharacters(description));
+    }
+
+    if (confirmationDetails.toolParameterSchema !== undefined) {
+      let schemaText: string;
+      try {
+        schemaText = stripUnsafeCharacters(
+          JSON.stringify(confirmationDetails.toolParameterSchema, null, 2),
+        );
+      } catch {
+        schemaText = '[unserializable schema]';
+      }
+      if (detailsLines.length > 0) {
+        detailsLines.push('');
+      }
+      detailsLines.push('Input Schema:');
+      detailsLines.push(schemaText);
+    }
+
+    if (detailsLines.length === 0) {
+      return null;
+    }
+
+    return detailsLines.join('\n');
+  }, [confirmationDetails]);
+
+  const hasMcpToolDetails = !!mcpToolDetailsText;
+  const expandDetailsHintKey = formatCommand(Command.SHOW_MORE_LINES);
+
   useKeypress(
     (key) => {
       if (!isFocused) return false;
+      if (
+        confirmationDetails.type === 'mcp' &&
+        hasMcpToolDetails &&
+        keyMatchers[Command.SHOW_MORE_LINES](key)
+      ) {
+        setMcpDetailsExpansionState({
+          callId,
+          expanded: !isMcpToolDetailsExpanded,
+        });
+        return true;
+      }
       if (keyMatchers[Command.ESCAPE](key)) {
         handleConfirm(ToolConfirmationOutcome.Cancel);
         return true;
@@ -100,7 +184,7 @@ export const ToolConfirmationMessage: React.FC<
       }
       return false;
     },
-    { isActive: isFocused },
+    { isActive: isFocused, priority: true },
   );
 
   const handleSelect = useCallback(
@@ -504,12 +588,31 @@ export const ToolConfirmationMessage: React.FC<
 
       bodyContent = (
         <Box flexDirection="column">
-          <Text color={theme.text.link}>
-            MCP Server: {sanitizeForDisplay(mcpProps.serverName)}
-          </Text>
-          <Text color={theme.text.link}>
-            Tool: {sanitizeForDisplay(mcpProps.toolName)}
-          </Text>
+          <>
+            <Text color={theme.text.link}>
+              MCP Server: {sanitizeForDisplay(mcpProps.serverName)}
+            </Text>
+            <Text color={theme.text.link}>
+              Tool: {sanitizeForDisplay(mcpProps.toolName)}
+            </Text>
+          </>
+          {hasMcpToolDetails && (
+            <Box flexDirection="column" marginTop={1}>
+              <Text color={theme.text.primary}>MCP Tool Details:</Text>
+              {isMcpToolDetailsExpanded ? (
+                <>
+                  <Text color={theme.text.secondary}>
+                    (press {expandDetailsHintKey} to collapse MCP tool details)
+                  </Text>
+                  <Text color={theme.text.link}>{mcpToolDetailsText}</Text>
+                </>
+              ) : (
+                <Text color={theme.text.secondary}>
+                  (press {expandDetailsHintKey} to expand MCP tool details)
+                </Text>
+              )}
+            </Box>
+          )}
         </Box>
       );
     }
@@ -522,8 +625,17 @@ export const ToolConfirmationMessage: React.FC<
     terminalWidth,
     handleConfirm,
     deceptiveUrlWarningText,
+    isMcpToolDetailsExpanded,
+    hasMcpToolDetails,
+    mcpToolDetailsText,
+    expandDetailsHintKey,
   ]);
 
+  const bodyOverflowDirection: 'top' | 'bottom' =
+    confirmationDetails.type === 'mcp' && isMcpToolDetailsExpanded
+      ? 'bottom'
+      : 'top';
+
   if (confirmationDetails.type === 'edit') {
     if (confirmationDetails.isModifying) {
       return (
@@ -559,7 +671,7 @@ export const ToolConfirmationMessage: React.FC<
             <MaxSizedBox
               maxHeight={availableBodyContentHeight()}
               maxWidth={terminalWidth}
-              overflowDirection="top"
+              overflowDirection={bodyOverflowDirection}
             >
               {bodyContent}
             </MaxSizedBox>

packages/cli/src/ui/components/messages/ToolMessage.test.tsx

@@ -375,20 +375,25 @@ describe('<ToolMessage />', () => {
     unmount();
   });
 
-  it('renders progress information appended to description for executing tools', async () => {
+  it('renders McpProgressIndicator with percentage and message for executing tools', async () => {
     const { lastFrame, waitUntilReady, unmount } = renderWithContext(
       <ToolMessage
         {...baseProps}
         status={CoreToolCallStatus.Executing}
+        progress={42}
+        progressTotal={100}
         progressMessage="Working on it..."
-        progressPercent={42}
       />,
       StreamingState.Responding,
     );
     await waitUntilReady();
-    expect(lastFrame()).toContain(
-      'A tool for testing (Working on it... - 42%)',
-    );
+    const output = lastFrame();
+    expect(output).toContain('42%');
+    expect(output).toContain('Working on it...');
+    expect(output).toContain('\u2588');
+    expect(output).toContain('\u2591');
+    expect(output).not.toContain('A tool for testing (Working on it... - 42%)');
+    expect(output).toMatchSnapshot();
     unmount();
   });
 
@@ -397,12 +402,37 @@ describe('<ToolMessage />', () => {
       <ToolMessage
         {...baseProps}
         status={CoreToolCallStatus.Executing}
-        progressPercent={75}
+        progress={75}
+        progressTotal={100}
       />,
       StreamingState.Responding,
     );
     await waitUntilReady();
-    expect(lastFrame()).toContain('A tool for testing (75%)');
+    const output = lastFrame();
+    expect(output).toContain('75%');
+    expect(output).toContain('\u2588');
+    expect(output).toContain('\u2591');
+    expect(output).not.toContain('A tool for testing (75%)');
+    expect(output).toMatchSnapshot();
+    unmount();
+  });
+
+  it('renders indeterminate progress when total is missing', async () => {
+    const { lastFrame, waitUntilReady, unmount } = renderWithContext(
+      <ToolMessage
+        {...baseProps}
+        status={CoreToolCallStatus.Executing}
+        progress={7}
+      />,
+      StreamingState.Responding,
+    );
+    await waitUntilReady();
+    const output = lastFrame();
+    expect(output).toContain('7');
+    expect(output).toContain('\u2588');
+    expect(output).toContain('\u2591');
+    expect(output).not.toContain('%');
+    expect(output).toMatchSnapshot();
     unmount();
   });
 });

packages/cli/src/ui/components/messages/ToolMessage.tsx

@@ -13,6 +13,7 @@ import {
   ToolStatusIndicator,
   ToolInfo,
   TrailingIndicator,
+  McpProgressIndicator,
   type TextEmphasis,
   STATUS_INDICATOR_WIDTH,
   isThisShellFocusable as checkIsShellFocusable,
@@ -20,7 +21,7 @@ import {
   useFocusHint,
   FocusHint,
 } from './ToolShared.js';
-import { type Config } from '@google/gemini-cli-core';
+import { type Config, CoreToolCallStatus } from '@google/gemini-cli-core';
 import { ShellInputPrompt } from '../ShellInputPrompt.js';
 
 export type { TextEmphasis };
@@ -56,7 +57,9 @@ export const ToolMessage: React.FC<ToolMessageProps> = ({
   ptyId,
   config,
   progressMessage,
-  progressPercent,
+  originalRequestName,
+  progress,
+  progressTotal,
 }) => {
   const isThisShellFocused = checkIsShellFocused(
     name,
@@ -91,8 +94,7 @@ export const ToolMessage: React.FC<ToolMessageProps> = ({
           status={status}
           description={description}
           emphasis={emphasis}
-          progressMessage={progressMessage}
-          progressPercent={progressPercent}
+          originalRequestName={originalRequestName}
         />
         <FocusHint
           shouldShowFocusHint={shouldShowFocusHint}
@@ -112,6 +114,14 @@ export const ToolMessage: React.FC<ToolMessageProps> = ({
         paddingX={1}
         flexDirection="column"
       >
+        {status === CoreToolCallStatus.Executing && progress !== undefined && (
+          <McpProgressIndicator
+            progress={progress}
+            total={progressTotal}
+            message={progressMessage}
+            barWidth={20}
+          />
+        )}
         <ToolResultDisplay
           resultDisplay={resultDisplay}
           availableTerminalHeight={availableTerminalHeight}

packages/cli/src/ui/components/messages/ToolShared.test.tsx

@@ -0,0 +1,72 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import { render } from '../../../test-utils/render.js';
+import { Text } from 'ink';
+import { McpProgressIndicator } from './ToolShared.js';
+
+vi.mock('../GeminiRespondingSpinner.js', () => ({
+  GeminiRespondingSpinner: () => <Text>MockSpinner</Text>,
+}));
+
+describe('McpProgressIndicator', () => {
+  it('renders determinate progress at 50%', async () => {
+    const { lastFrame, waitUntilReady } = render(
+      <McpProgressIndicator progress={50} total={100} barWidth={20} />,
+    );
+    await waitUntilReady();
+    const output = lastFrame();
+    expect(output).toMatchSnapshot();
+    expect(output).toContain('50%');
+  });
+
+  it('renders complete progress at 100%', async () => {
+    const { lastFrame, waitUntilReady } = render(
+      <McpProgressIndicator progress={100} total={100} barWidth={20} />,
+    );
+    await waitUntilReady();
+    const output = lastFrame();
+    expect(output).toMatchSnapshot();
+    expect(output).toContain('100%');
+  });
+
+  it('renders indeterminate progress with raw count', async () => {
+    const { lastFrame, waitUntilReady } = render(
+      <McpProgressIndicator progress={7} barWidth={20} />,
+    );
+    await waitUntilReady();
+    const output = lastFrame();
+    expect(output).toMatchSnapshot();
+    expect(output).toContain('7');
+    expect(output).not.toContain('%');
+  });
+
+  it('renders progress with a message', async () => {
+    const { lastFrame, waitUntilReady } = render(
+      <McpProgressIndicator
+        progress={30}
+        total={100}
+        message="Downloading..."
+        barWidth={20}
+      />,
+    );
+    await waitUntilReady();
+    const output = lastFrame();
+    expect(output).toMatchSnapshot();
+    expect(output).toContain('Downloading...');
+  });
+
+  it('clamps progress exceeding total to 100%', async () => {
+    const { lastFrame, waitUntilReady } = render(
+      <McpProgressIndicator progress={150} total={100} barWidth={20} />,
+    );
+    await waitUntilReady();
+    const output = lastFrame();
+    expect(output).toContain('100%');
+    expect(output).not.toContain('150%');
+  });
+});

packages/cli/src/ui/components/messages/ToolShared.tsx

@@ -187,8 +187,7 @@ type ToolInfoProps = {
   description: string;
   status: CoreToolCallStatus;
   emphasis: TextEmphasis;
-  progressMessage?: string;
-  progressPercent?: number;
+  originalRequestName?: string;
 };
 
 export const ToolInfo: React.FC<ToolInfoProps> = ({
@@ -196,8 +195,7 @@ export const ToolInfo: React.FC<ToolInfoProps> = ({
   description,
   status: coreStatus,
   emphasis,
-  progressMessage,
-  progressPercent,
+  originalRequestName,
 }) => {
   const status = mapCoreStatusToDisplayStatus(coreStatus);
   const nameColor = React.useMemo<string>(() => {
@@ -218,34 +216,22 @@ export const ToolInfo: React.FC<ToolInfoProps> = ({
   // Hide description for completed Ask User tools (the result display speaks for itself)
   const isCompletedAskUser = isCompletedAskUserTool(name, status);
 
-  let displayDescription = description;
-  if (status === ToolCallStatus.Executing) {
-    const parts: string[] = [];
-    if (progressMessage) {
-      parts.push(progressMessage);
-    }
-    if (progressPercent !== undefined) {
-      parts.push(`${Math.round(progressPercent)}%`);
-    }
-
-    if (parts.length > 0) {
-      const progressInfo = parts.join(' - ');
-      displayDescription = description
-        ? `${description} (${progressInfo})`
-        : progressInfo;
-    }
-  }
-
   return (
     <Box overflow="hidden" height={1} flexGrow={1} flexShrink={1}>
       <Text strikethrough={status === ToolCallStatus.Canceled} wrap="truncate">
         <Text color={nameColor} bold>
           {name}
         </Text>
+        {originalRequestName && originalRequestName !== name && (
+          <Text color={theme.text.secondary} italic>
+            {' '}
+            (redirection from {originalRequestName})
+          </Text>
+        )}
         {!isCompletedAskUser && (
           <>
             {' '}
-            <Text color={theme.text.secondary}>{displayDescription}</Text>
+            <Text color={theme.text.secondary}>{description}</Text>
           </>
         )}
       </Text>
@@ -253,6 +239,54 @@ export const ToolInfo: React.FC<ToolInfoProps> = ({
   );
 };
 
+export interface McpProgressIndicatorProps {
+  progress: number;
+  total?: number;
+  message?: string;
+  barWidth: number;
+}
+
+export const McpProgressIndicator: React.FC<McpProgressIndicatorProps> = ({
+  progress,
+  total,
+  message,
+  barWidth,
+}) => {
+  const percentage =
+    total && total > 0
+      ? Math.min(100, Math.round((progress / total) * 100))
+      : null;
+
+  let rawFilled: number;
+  if (total && total > 0) {
+    rawFilled = Math.round((progress / total) * barWidth);
+  } else {
+    rawFilled = Math.floor(progress) % (barWidth + 1);
+  }
+
+  const filled = Math.max(
+    0,
+    Math.min(Number.isFinite(rawFilled) ? rawFilled : 0, barWidth),
+  );
+  const empty = Math.max(0, barWidth - filled);
+  const progressBar = '\u2588'.repeat(filled) + '\u2591'.repeat(empty);
+
+  return (
+    <Box flexDirection="column">
+      <Box>
+        <Text color={theme.text.accent}>
+          {progressBar} {percentage !== null ? `${percentage}%` : `${progress}`}
+        </Text>
+      </Box>
+      {message && (
+        <Text color={theme.text.secondary} wrap="truncate">
+          {message}
+        </Text>
+      )}
+    </Box>
+  );
+};
+
 export const TrailingIndicator: React.FC = () => (
   <Text color={theme.text.primary} wrap="truncate">
     {' '}

packages/cli/src/ui/components/messages/UserMessage.tsx

@@ -15,7 +15,6 @@ import {
   calculateTransformedLine,
 } from '../shared/text-buffer.js';
 import { HalfLinePaddedBox } from '../shared/HalfLinePaddedBox.js';
-import { DEFAULT_BACKGROUND_OPACITY } from '../../constants.js';
 import { useConfig } from '../../contexts/ConfigContext.js';
 
 interface UserMessageProps {
@@ -52,8 +51,8 @@ export const UserMessage: React.FC<UserMessageProps> = ({ text, width }) => {
 
   return (
     <HalfLinePaddedBox
-      backgroundBaseColor={theme.text.secondary}
-      backgroundOpacity={DEFAULT_BACKGROUND_OPACITY}
+      backgroundBaseColor={theme.background.message}
+      backgroundOpacity={1}
       useBackgroundColor={useBackgroundColor}
     >
       <Box

packages/cli/src/ui/components/messages/UserShellMessage.tsx

@@ -8,7 +8,6 @@ import type React from 'react';
 import { Box, Text } from 'ink';
 import { theme } from '../../semantic-colors.js';
 import { HalfLinePaddedBox } from '../shared/HalfLinePaddedBox.js';
-import { DEFAULT_BACKGROUND_OPACITY } from '../../constants.js';
 import { useConfig } from '../../contexts/ConfigContext.js';
 
 interface UserShellMessageProps {
@@ -28,8 +27,8 @@ export const UserShellMessage: React.FC<UserShellMessageProps> = ({
 
   return (
     <HalfLinePaddedBox
-      backgroundBaseColor={theme.text.secondary}
-      backgroundOpacity={DEFAULT_BACKGROUND_OPACITY}
+      backgroundBaseColor={theme.background.message}
+      backgroundOpacity={1}
       useBackgroundColor={useBackgroundColor}
     >
       <Box

packages/cli/src/ui/components/messages/__snapshots__/ToolMessage.test.tsx.snap

@@ -92,6 +92,16 @@ exports[`<ToolMessage /> > renders DiffRenderer for diff results 1`] = `
 "
 `;
 
+exports[`<ToolMessage /> > renders McpProgressIndicator with percentage and message for executing tools 1`] = `
+"╭──────────────────────────────────────────────────────────────────────────────╮
+│ MockRespondingSpinnertest-tool A tool for testing                            │
+│                                                                              │
+│ ████████░░░░░░░░░░░░ 42%                                                     │
+│ Working on it...                                                             │
+│ Test result                                                                  │
+"
+`;
+
 exports[`<ToolMessage /> > renders basic tool information 1`] = `
 "╭──────────────────────────────────────────────────────────────────────────────╮
 │ ✓  test-tool A tool for testing                                              │
@@ -115,3 +125,21 @@ exports[`<ToolMessage /> > renders emphasis correctly 2`] = `
 │ Test result                                                                  │
 "
 `;
+
+exports[`<ToolMessage /> > renders indeterminate progress when total is missing 1`] = `
+"╭──────────────────────────────────────────────────────────────────────────────╮
+│ MockRespondingSpinnertest-tool A tool for testing                            │
+│                                                                              │
+│ ███████░░░░░░░░░░░░░ 7                                                       │
+│ Test result                                                                  │
+"
+`;
+
+exports[`<ToolMessage /> > renders only percentage when progressMessage is missing 1`] = `
+"╭──────────────────────────────────────────────────────────────────────────────╮
+│ MockRespondingSpinnertest-tool A tool for testing                            │
+│                                                                              │
+│ ███████████████░░░░░ 75%                                                     │
+│ Test result                                                                  │
+"
+`;

packages/cli/src/ui/components/messages/__snapshots__/ToolShared.test.tsx.snap

@@ -0,0 +1,22 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`McpProgressIndicator > renders complete progress at 100% 1`] = `
+"████████████████████ 100%
+"
+`;
+
+exports[`McpProgressIndicator > renders determinate progress at 50% 1`] = `
+"██████████░░░░░░░░░░ 50%
+"
+`;
+
+exports[`McpProgressIndicator > renders indeterminate progress with raw count 1`] = `
+"███████░░░░░░░░░░░░░ 7
+"
+`;
+
+exports[`McpProgressIndicator > renders progress with a message 1`] = `
+"██████░░░░░░░░░░░░░░ 30%
+Downloading...
+"
+`;

packages/cli/src/ui/components/shared/SectionHeader.test.tsx

@@ -30,9 +30,15 @@ describe('<SectionHeader />', () => {
       title: 'Narrow Container',
       width: 25,
     },
-  ])('$description', async ({ title, width }) => {
+    {
+      description: 'renders correctly with a subtitle',
+      title: 'Shortcuts',
+      subtitle: ' See /help for more',
+      width: 40,
+    },
+  ])('$description', async ({ title, subtitle, width }) => {
     const { lastFrame, waitUntilReady, unmount } = renderWithProviders(
-      <SectionHeader title={title} />,
+      <SectionHeader title={title} subtitle={subtitle} />,
       { width },
     );
     await waitUntilReady();

packages/cli/src/ui/components/shared/SectionHeader.tsx

@@ -8,16 +8,13 @@ import type React from 'react';
 import { Box, Text } from 'ink';
 import { theme } from '../../semantic-colors.js';
 
-export const SectionHeader: React.FC<{ title: string }> = ({ title }) => (
-  <Box width="100%" flexDirection="row" overflow="hidden">
-    <Text color={theme.text.secondary} wrap="truncate-end">
-      {`── ${title}`}
-    </Text>
+export const SectionHeader: React.FC<{ title: string; subtitle?: string }> = ({
+  title,
+  subtitle,
+}) => (
+  <Box width="100%" flexDirection="column" overflow="hidden">
     <Box
-      flexGrow={1}
-      flexShrink={0}
-      minWidth={2}
-      marginLeft={1}
+      width="100%"
       borderStyle="single"
       borderTop
       borderBottom={false}
@@ -25,5 +22,15 @@ export const SectionHeader: React.FC<{ title: string }> = ({ title }) => (
       borderRight={false}
       borderColor={theme.text.secondary}
     />
+    <Box flexDirection="row">
+      <Text color={theme.text.primary} bold wrap="truncate-end">
+        {title}
+      </Text>
+      {subtitle && (
+        <Text color={theme.text.secondary} wrap="truncate-end">
+          {subtitle}
+        </Text>
+      )}
+    </Box>
   </Box>
 );

packages/cli/src/ui/components/shared/__snapshots__/SectionHeader.test.tsx.snap

@@ -1,16 +1,25 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
 exports[`<SectionHeader /> > 'renders correctly in a narrow contain…' 1`] = `
-"── Narrow Container ─────
+"─────────────────────────
+Narrow Container
 "
 `;
 
 exports[`<SectionHeader /> > 'renders correctly when title is trunc…' 1`] = `
-"── Very Long Hea… ──
+"────────────────────
+Very Long Header Ti…
 "
 `;
 
 exports[`<SectionHeader /> > 'renders correctly with a standard tit…' 1`] = `
-"── My Header ───────────────────────────
+"────────────────────────────────────────
+My Header
+"
+`;
+
+exports[`<SectionHeader /> > 'renders correctly with a subtitle' 1`] = `
+"────────────────────────────────────────
+Shortcuts See /help for more
 "
 `;

packages/cli/src/ui/constants.ts

@@ -37,7 +37,7 @@ export const EXPAND_HINT_DURATION_MS = 5000;
 
 export const DEFAULT_BACKGROUND_OPACITY = 0.16;
 export const DEFAULT_INPUT_BACKGROUND_OPACITY = 0.24;
-export const DEFAULT_BORDER_OPACITY = 0.2;
+export const DEFAULT_BORDER_OPACITY = 0.4;
 
 export const KEYBOARD_SHORTCUTS_URL =
   'https://geminicli.com/docs/cli/keyboard-shortcuts/';

packages/cli/src/ui/hooks/toolMapping.test.ts

@@ -263,6 +263,41 @@ describe('toolMapping', () => {
       expect(result.borderBottom).toBe(false);
     });
 
+    it('maps raw progress and progressTotal from Executing calls', () => {
+      const toolCall: ExecutingToolCall = {
+        status: CoreToolCallStatus.Executing,
+        request: mockRequest,
+        tool: mockTool,
+        invocation: mockInvocation,
+        progressMessage: 'Downloading...',
+        progress: 5,
+        progressTotal: 10,
+      };
+
+      const result = mapToDisplay(toolCall);
+      const displayTool = result.tools[0];
+
+      expect(displayTool.progress).toBe(5);
+      expect(displayTool.progressTotal).toBe(10);
+      expect(displayTool.progressMessage).toBe('Downloading...');
+    });
+
+    it('leaves progress fields undefined for non-Executing calls', () => {
+      const toolCall: SuccessfulToolCall = {
+        status: CoreToolCallStatus.Success,
+        request: mockRequest,
+        tool: mockTool,
+        invocation: mockInvocation,
+        response: mockResponse,
+      };
+
+      const result = mapToDisplay(toolCall);
+      const displayTool = result.tools[0];
+
+      expect(displayTool.progress).toBeUndefined();
+      expect(displayTool.progressTotal).toBeUndefined();
+    });
+
     it('sets resultDisplay to undefined for pre-execution statuses', () => {
       const toolCall: ScheduledToolCall = {
         status: CoreToolCallStatus.Scheduled,
@@ -275,5 +310,20 @@ describe('toolMapping', () => {
       expect(result.tools[0].resultDisplay).toBeUndefined();
       expect(result.tools[0].status).toBe(CoreToolCallStatus.Scheduled);
     });
+
+    it('propagates originalRequestName correctly', () => {
+      const toolCall: ScheduledToolCall = {
+        status: CoreToolCallStatus.Scheduled,
+        request: {
+          ...mockRequest,
+          originalRequestName: 'original_tool',
+        },
+        tool: mockTool,
+        invocation: mockInvocation,
+      };
+
+      const result = mapToDisplay(toolCall);
+      expect(result.tools[0].originalRequestName).toBe('original_tool');
+    });
   });
 });

packages/cli/src/ui/hooks/toolMapping.ts

@@ -60,7 +60,8 @@ export function mapToDisplay(
     let ptyId: number | undefined = undefined;
     let correlationId: string | undefined = undefined;
     let progressMessage: string | undefined = undefined;
-    let progressPercent: number | undefined = undefined;
+    let progress: number | undefined = undefined;
+    let progressTotal: number | undefined = undefined;
 
     switch (call.status) {
       case CoreToolCallStatus.Success:
@@ -80,7 +81,8 @@ export function mapToDisplay(
         resultDisplay = call.liveOutput;
         ptyId = call.pid;
         progressMessage = call.progressMessage;
-        progressPercent = call.progressPercent;
+        progress = call.progress;
+        progressTotal = call.progressTotal;
         break;
       case CoreToolCallStatus.Scheduled:
       case CoreToolCallStatus.Validating:
@@ -105,8 +107,10 @@ export function mapToDisplay(
       ptyId,
       correlationId,
       progressMessage,
-      progressPercent,
+      progress,
+      progressTotal,
       approvalMode: call.approvalMode,
+      originalRequestName: call.request.originalRequestName,
     };
   });
 

packages/cli/src/ui/hooks/useGeminiStream.test.tsx

@@ -39,6 +39,7 @@ import {
   coreEvents,
   CoreEvent,
   MCPDiscoveryState,
+  getPlanModeExitMessage,
 } from '@google/gemini-cli-core';
 import type { Part, PartListUnion } from '@google/genai';
 import type { UseHistoryManagerReturn } from './useHistoryManager.js';
@@ -2079,6 +2080,34 @@ describe('useGeminiStream', () => {
         expect.objectContaining({ correlationId: 'corr-call2' }),
       );
     });
+
+    it('should inject a notification message when manually exiting Plan Mode', async () => {
+      // Setup mockConfig to return PLAN mode initially
+      (mockConfig.getApprovalMode as Mock).mockReturnValue(ApprovalMode.PLAN);
+
+      // Render the hook, which will initialize the previousApprovalModeRef with PLAN
+      const { result, client } = renderTestHook([]);
+
+      // Update mockConfig to return DEFAULT mode (new mode)
+      (mockConfig.getApprovalMode as Mock).mockReturnValue(
+        ApprovalMode.DEFAULT,
+      );
+
+      await act(async () => {
+        // Trigger manual exit from Plan Mode
+        await result.current.handleApprovalModeChange(ApprovalMode.DEFAULT);
+      });
+
+      // Verify that addHistory was called with the notification message
+      expect(client.addHistory).toHaveBeenCalledWith({
+        role: 'user',
+        parts: [
+          {
+            text: getPlanModeExitMessage(ApprovalMode.DEFAULT, true),
+          },
+        ],
+      });
+    });
   });
 
   describe('handleFinishedEvent', () => {

packages/cli/src/ui/hooks/useGeminiStream.ts

@@ -36,6 +36,7 @@ import {
   CoreToolCallStatus,
   buildUserSteeringHintPrompt,
   generateSteeringAckMessage,
+  getPlanModeExitMessage,
 } from '@google/gemini-cli-core';
 import type {
   Config,
@@ -203,6 +204,9 @@ export const useGeminiStream = (
   const abortControllerRef = useRef<AbortController | null>(null);
   const turnCancelledRef = useRef(false);
   const activeQueryIdRef = useRef<string | null>(null);
+  const previousApprovalModeRef = useRef<ApprovalMode>(
+    config.getApprovalMode(),
+  );
   const [isResponding, setIsResponding] = useState<boolean>(false);
   const [thought, thoughtRef, setThought] =
     useStateAndRef<ThoughtSummary | null>(null);
@@ -1435,6 +1439,34 @@ export const useGeminiStream = (
 
   const handleApprovalModeChange = useCallback(
     async (newApprovalMode: ApprovalMode) => {
+      if (
+        previousApprovalModeRef.current === ApprovalMode.PLAN &&
+        newApprovalMode !== ApprovalMode.PLAN &&
+        streamingState === StreamingState.Idle
+      ) {
+        if (geminiClient) {
+          try {
+            await geminiClient.addHistory({
+              role: 'user',
+              parts: [
+                {
+                  text: getPlanModeExitMessage(newApprovalMode, true),
+                },
+              ],
+            });
+          } catch (error) {
+            onDebugMessage(
+              `Failed to notify model of Plan Mode exit: ${getErrorMessage(error)}`,
+            );
+            addItem({
+              type: MessageType.ERROR,
+              text: 'Failed to update the model about exiting Plan Mode. The model might be out of sync. Please consider restarting the session if you see unexpected behavior.',
+            });
+          }
+        }
+      }
+      previousApprovalModeRef.current = newApprovalMode;
+
       // Auto-approve pending tool calls when switching to auto-approval modes
       if (
         newApprovalMode === ApprovalMode.YOLO ||
@@ -1473,7 +1505,7 @@ export const useGeminiStream = (
         }
       }
     },
-    [config, toolCalls],
+    [config, toolCalls, geminiClient, streamingState, addItem, onDebugMessage],
   );
 
   const handleCompletedTools = useCallback(

packages/cli/src/ui/hooks/useToolScheduler.test.ts

@@ -13,6 +13,7 @@ import {
   Scheduler,
   type Config,
   type MessageBus,
+  type ExecutingToolCall,
   type CompletedToolCall,
   type ToolCallsUpdateMessage,
   type AnyDeclarativeTool,
@@ -110,7 +111,7 @@ describe('useToolScheduler', () => {
       tool: createMockTool(),
       invocation: createMockInvocation(),
       liveOutput: 'Loading...',
-    };
+    } as ExecutingToolCall;
 
     act(() => {
       void mockMessageBus.publish({
@@ -405,4 +406,62 @@ describe('useToolScheduler', () => {
       toolCalls.find((t) => t.request.callId === 'call-sub')?.schedulerId,
     ).toBe('subagent-1');
   });
+
+  it('adapts success/error status to executing when a tail call is present', () => {
+    vi.useFakeTimers();
+    const { result } = renderHook(() =>
+      useToolScheduler(
+        vi.fn().mockResolvedValue(undefined),
+        mockConfig,
+        () => undefined,
+      ),
+    );
+
+    const startTime = Date.now();
+    vi.advanceTimersByTime(1000);
+
+    const mockToolCall = {
+      status: CoreToolCallStatus.Success as const,
+      request: {
+        callId: 'call-1',
+        name: 'test_tool',
+        args: {},
+        isClientInitiated: false,
+        prompt_id: 'p1',
+      },
+      tool: createMockTool(),
+      invocation: createMockInvocation(),
+      response: {
+        callId: 'call-1',
+        resultDisplay: 'OK',
+        responseParts: [],
+        error: undefined,
+        errorType: undefined,
+      },
+      tailToolCallRequest: {
+        name: 'tail_tool',
+        args: {},
+        isClientInitiated: false,
+        prompt_id: '123',
+      },
+    };
+
+    act(() => {
+      void mockMessageBus.publish({
+        type: MessageBusType.TOOL_CALLS_UPDATE,
+        toolCalls: [mockToolCall],
+        schedulerId: ROOT_SCHEDULER_ID,
+      } as ToolCallsUpdateMessage);
+    });
+
+    const [toolCalls, , , , , lastOutputTime] = result.current;
+
+    // Check if status has been adapted to 'executing'
+    expect(toolCalls[0].status).toBe(CoreToolCallStatus.Executing);
+
+    // Check if lastOutputTime was updated due to the transitional state
+    expect(lastOutputTime).toBeGreaterThan(startTime);
+
+    vi.useRealTimers();
+  });
 });

packages/cli/src/ui/hooks/useToolScheduler.ts

@@ -14,6 +14,7 @@ import {
   Scheduler,
   type EditorType,
   type ToolCallsUpdateMessage,
+  CoreToolCallStatus,
 } from '@google/gemini-cli-core';
 import { useCallback, useState, useMemo, useEffect, useRef } from 'react';
 
@@ -115,7 +116,16 @@ export function useToolScheduler(
   useEffect(() => {
     const handler = (event: ToolCallsUpdateMessage) => {
       // Update output timer for UI spinners (Side Effect)
-      if (event.toolCalls.some((tc) => tc.status === 'executing')) {
+      const hasExecuting = event.toolCalls.some(
+        (tc) =>
+          tc.status === CoreToolCallStatus.Executing ||
+          ((tc.status === CoreToolCallStatus.Success ||
+            tc.status === CoreToolCallStatus.Error) &&
+            'tailToolCallRequest' in tc &&
+            tc.tailToolCallRequest != null),
+      );
+
+      if (hasExecuting) {
         setLastToolOutputTime(Date.now());
       }
 
@@ -238,9 +248,23 @@ function adaptToolCalls(
     const prev = prevMap.get(coreCall.request.callId);
     const responseSubmittedToGemini = prev?.responseSubmittedToGemini ?? false;
 
+    let status = coreCall.status;
+    // If a tool call has completed but scheduled a tail call, it is in a transitional
+    // state. Force the UI to render it as "executing".
+    if (
+      (status === CoreToolCallStatus.Success ||
+        status === CoreToolCallStatus.Error) &&
+      'tailToolCallRequest' in coreCall &&
+      coreCall.tailToolCallRequest != null
+    ) {
+      status = CoreToolCallStatus.Executing;
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return {
       ...coreCall,
+      status,
       responseSubmittedToGemini,
-    };
+    } as TrackedToolCall;
   });
 }

packages/cli/src/ui/keyMatchers.test.ts

@@ -352,7 +352,6 @@ describe('keyMatchers', () => {
         createKey('l', { ctrl: true }),
       ],
     },
-
     // Shell commands
     {
       command: Command.REVERSE_SEARCH,

packages/cli/src/ui/themes/no-color.ts

@@ -24,6 +24,8 @@ const noColorColorsTheme: ColorsTheme = {
   Comment: '',
   Gray: '',
   DarkGray: '',
+  InputBackground: '',
+  MessageBackground: '',
 };
 
 const noColorSemanticColors: SemanticColors = {
@@ -36,6 +38,8 @@ const noColorSemanticColors: SemanticColors = {
   },
   background: {
     primary: '',
+    message: '',
+    input: '',
     diff: {
       added: '',
       removed: '',

packages/cli/src/ui/themes/semantic-tokens.ts

@@ -16,6 +16,8 @@ export interface SemanticColors {
   };
   background: {
     primary: string;
+    message: string;
+    input: string;
     diff: {
       added: string;
       removed: string;
@@ -48,13 +50,15 @@ export const lightSemanticColors: SemanticColors = {
   },
   background: {
     primary: lightTheme.Background,
+    message: lightTheme.MessageBackground!,
+    input: lightTheme.InputBackground!,
     diff: {
       added: lightTheme.DiffAdded,
       removed: lightTheme.DiffRemoved,
     },
   },
   border: {
-    default: lightTheme.Gray,
+    default: lightTheme.DarkGray,
     focused: lightTheme.AccentBlue,
   },
   ui: {
@@ -80,13 +84,15 @@ export const darkSemanticColors: SemanticColors = {
   },
   background: {
     primary: darkTheme.Background,
+    message: darkTheme.MessageBackground!,
+    input: darkTheme.InputBackground!,
     diff: {
       added: darkTheme.DiffAdded,
       removed: darkTheme.DiffRemoved,
     },
   },
   border: {
-    default: darkTheme.Gray,
+    default: darkTheme.DarkGray,
     focused: darkTheme.AccentBlue,
   },
   ui: {

packages/cli/src/ui/themes/solarized-dark.ts

@@ -36,6 +36,8 @@ const semanticColors: SemanticColors = {
   },
   background: {
     primary: '#002b36',
+    message: '#073642',
+    input: '#073642',
     diff: {
       added: '#00382f',
       removed: '#3d0115',

packages/cli/src/ui/themes/solarized-light.ts

@@ -36,6 +36,8 @@ const semanticColors: SemanticColors = {
   },
   background: {
     primary: '#fdf6e3',
+    message: '#eee8d5',
+    input: '#eee8d5',
     diff: {
       added: '#d7f2d7',
       removed: '#f2d7d7',

packages/cli/src/ui/themes/theme-manager.ts

@@ -29,7 +29,11 @@ import {
   getThemeTypeFromBackgroundColor,
   resolveColor,
 } from './color-utils.js';
-import { DEFAULT_BORDER_OPACITY } from '../constants.js';
+import {
+  DEFAULT_BACKGROUND_OPACITY,
+  DEFAULT_INPUT_BACKGROUND_OPACITY,
+  DEFAULT_BORDER_OPACITY,
+} from '../constants.js';
 import { ANSI } from './ansi.js';
 import { ANSILight } from './ansi-light.js';
 import { NoColorTheme } from './no-color.js';
@@ -310,7 +314,21 @@ class ThemeManager {
       this.cachedColors = {
         ...colors,
         Background: this.terminalBackground,
-        DarkGray: interpolateColor(colors.Gray, this.terminalBackground, 0.5),
+        DarkGray: interpolateColor(
+          this.terminalBackground,
+          colors.Gray,
+          DEFAULT_BORDER_OPACITY,
+        ),
+        InputBackground: interpolateColor(
+          this.terminalBackground,
+          colors.Gray,
+          DEFAULT_INPUT_BACKGROUND_OPACITY,
+        ),
+        MessageBackground: interpolateColor(
+          this.terminalBackground,
+          colors.Gray,
+          DEFAULT_BACKGROUND_OPACITY,
+        ),
       };
     } else {
       this.cachedColors = colors;
@@ -336,27 +354,22 @@ class ThemeManager {
       this.terminalBackground &&
       this.isThemeCompatible(activeTheme, this.terminalBackground)
     ) {
+      const colors = this.getColors();
       this.cachedSemanticColors = {
         ...semanticColors,
         background: {
           ...semanticColors.background,
           primary: this.terminalBackground,
+          message: colors.MessageBackground!,
+          input: colors.InputBackground!,
         },
         border: {
           ...semanticColors.border,
-          default: interpolateColor(
-            this.terminalBackground,
-            activeTheme.colors.Gray,
-            DEFAULT_BORDER_OPACITY,
-          ),
+          default: colors.DarkGray,
         },
         ui: {
           ...semanticColors.ui,
-          dark: interpolateColor(
-            activeTheme.colors.Gray,
-            this.terminalBackground,
-            0.5,
-          ),
+          dark: colors.DarkGray,
         },
       };
     } else {

packages/cli/src/ui/themes/theme.test.ts

@@ -37,11 +37,11 @@ describe('createCustomTheme', () => {
 
   it('should interpolate DarkGray when not provided', () => {
     const theme = createCustomTheme(baseTheme);
-    // Interpolate between Gray (#cccccc) and Background (#000000) at 0.5
+    // Interpolate between Background (#000000) and Gray (#cccccc) at 0.4
     // #cccccc is RGB(204, 204, 204)
     // #000000 is RGB(0, 0, 0)
-    // Midpoint is RGB(102, 102, 102) which is #666666
-    expect(theme.colors.DarkGray).toBe('#666666');
+    // Result is RGB(82, 82, 82) which is #525252
+    expect(theme.colors.DarkGray).toBe('#525252');
   });
 
   it('should use provided DarkGray', () => {
@@ -64,8 +64,8 @@ describe('createCustomTheme', () => {
       },
     };
     const theme = createCustomTheme(customTheme);
-    // Should be interpolated between #cccccc and #000000 at 0.5 -> #666666
-    expect(theme.colors.DarkGray).toBe('#666666');
+    // Should be interpolated between #000000 and #cccccc at 0.4 -> #525252
+    expect(theme.colors.DarkGray).toBe('#525252');
   });
 
   it('should prefer text.secondary over Gray for interpolation', () => {
@@ -81,8 +81,8 @@ describe('createCustomTheme', () => {
       },
     };
     const theme = createCustomTheme(customTheme);
-    // Interpolate between #cccccc and #000000 -> #666666
-    expect(theme.colors.DarkGray).toBe('#666666');
+    // Interpolate between #000000 and #cccccc -> #525252
+    expect(theme.colors.DarkGray).toBe('#525252');
   });
 });
 

packages/cli/src/ui/themes/theme.ts

@@ -15,7 +15,11 @@ import {
 } from './color-utils.js';
 
 import type { CustomTheme } from '@google/gemini-cli-core';
-import { DEFAULT_BORDER_OPACITY } from '../constants.js';
+import {
+  DEFAULT_BACKGROUND_OPACITY,
+  DEFAULT_INPUT_BACKGROUND_OPACITY,
+  DEFAULT_BORDER_OPACITY,
+} from '../constants.js';
 
 export type { CustomTheme };
 
@@ -37,6 +41,8 @@ export interface ColorsTheme {
   Comment: string;
   Gray: string;
   DarkGray: string;
+  InputBackground?: string;
+  MessageBackground?: string;
   GradientColors?: string[];
 }
 
@@ -55,7 +61,17 @@ export const lightTheme: ColorsTheme = {
   DiffRemoved: '#FFCCCC',
   Comment: '#008000',
   Gray: '#97a0b0',
-  DarkGray: interpolateColor('#97a0b0', '#FAFAFA', 0.5),
+  DarkGray: interpolateColor('#FAFAFA', '#97a0b0', DEFAULT_BORDER_OPACITY),
+  InputBackground: interpolateColor(
+    '#FAFAFA',
+    '#97a0b0',
+    DEFAULT_INPUT_BACKGROUND_OPACITY,
+  ),
+  MessageBackground: interpolateColor(
+    '#FAFAFA',
+    '#97a0b0',
+    DEFAULT_BACKGROUND_OPACITY,
+  ),
   GradientColors: ['#4796E4', '#847ACE', '#C3677F'],
 };
 
@@ -74,7 +90,17 @@ export const darkTheme: ColorsTheme = {
   DiffRemoved: '#430000',
   Comment: '#6C7086',
   Gray: '#6C7086',
-  DarkGray: interpolateColor('#6C7086', '#1E1E2E', 0.5),
+  DarkGray: interpolateColor('#1E1E2E', '#6C7086', DEFAULT_BORDER_OPACITY),
+  InputBackground: interpolateColor(
+    '#1E1E2E',
+    '#6C7086',
+    DEFAULT_INPUT_BACKGROUND_OPACITY,
+  ),
+  MessageBackground: interpolateColor(
+    '#1E1E2E',
+    '#6C7086',
+    DEFAULT_BACKGROUND_OPACITY,
+  ),
   GradientColors: ['#4796E4', '#847ACE', '#C3677F'],
 };
 
@@ -94,6 +120,8 @@ export const ansiTheme: ColorsTheme = {
   Comment: 'gray',
   Gray: 'gray',
   DarkGray: 'gray',
+  InputBackground: 'black',
+  MessageBackground: 'black',
 };
 
 export class Theme {
@@ -131,17 +159,27 @@ export class Theme {
       },
       background: {
         primary: this.colors.Background,
+        message:
+          this.colors.MessageBackground ??
+          interpolateColor(
+            this.colors.Background,
+            this.colors.Gray,
+            DEFAULT_BACKGROUND_OPACITY,
+          ),
+        input:
+          this.colors.InputBackground ??
+          interpolateColor(
+            this.colors.Background,
+            this.colors.Gray,
+            DEFAULT_INPUT_BACKGROUND_OPACITY,
+          ),
         diff: {
           added: this.colors.DiffAdded,
           removed: this.colors.DiffRemoved,
         },
       },
       border: {
-        default: interpolateColor(
-          this.colors.Background,
-          this.colors.Gray,
-          DEFAULT_BORDER_OPACITY,
-        ),
+        default: this.colors.DarkGray,
         focused: this.colors.AccentBlue,
       },
       ui: {
@@ -242,10 +280,20 @@ export function createCustomTheme(customTheme: CustomTheme): Theme {
     DarkGray:
       customTheme.DarkGray ??
       interpolateColor(
-        customTheme.text?.secondary ?? customTheme.Gray ?? '',
         customTheme.background?.primary ?? customTheme.Background ?? '',
-        0.5,
+        customTheme.text?.secondary ?? customTheme.Gray ?? '',
+        DEFAULT_BORDER_OPACITY,
       ),
+    InputBackground: interpolateColor(
+      customTheme.background?.primary ?? customTheme.Background ?? '',
+      customTheme.text?.secondary ?? customTheme.Gray ?? '',
+      DEFAULT_INPUT_BACKGROUND_OPACITY,
+    ),
+    MessageBackground: interpolateColor(
+      customTheme.background?.primary ?? customTheme.Background ?? '',
+      customTheme.text?.secondary ?? customTheme.Gray ?? '',
+      DEFAULT_BACKGROUND_OPACITY,
+    ),
     GradientColors: customTheme.ui?.gradient ?? customTheme.GradientColors,
   };
 
@@ -400,19 +448,15 @@ export function createCustomTheme(customTheme: CustomTheme): Theme {
     },
     background: {
       primary: customTheme.background?.primary ?? colors.Background,
+      message: colors.MessageBackground!,
+      input: colors.InputBackground!,
       diff: {
         added: customTheme.background?.diff?.added ?? colors.DiffAdded,
         removed: customTheme.background?.diff?.removed ?? colors.DiffRemoved,
       },
     },
     border: {
-      default:
-        customTheme.border?.default ??
-        interpolateColor(
-          colors.Background,
-          colors.Gray,
-          DEFAULT_BORDER_OPACITY,
-        ),
+      default: colors.DarkGray,
       focused: customTheme.border?.focused ?? colors.AccentBlue,
     },
     ui: {

packages/cli/src/ui/types.ts

@@ -109,7 +109,9 @@ export interface IndividualToolCallDisplay {
   correlationId?: string;
   approvalMode?: ApprovalMode;
   progressMessage?: string;
-  progressPercent?: number;
+  originalRequestName?: string;
+  progress?: number;
+  progressTotal?: number;
 }
 
 export interface CompressionProps {

packages/cli/src/utils/activityLogger.ts

@@ -22,13 +22,82 @@ import WebSocket from 'ws';
 const ACTIVITY_ID_HEADER = 'x-activity-request-id';
 const MAX_BUFFER_SIZE = 100;
 
-/** Type guard: Array.isArray doesn't narrow readonly arrays in TS 5.8 */
 function isHeaderRecord(
   h: http.OutgoingHttpHeaders | readonly string[],
 ): h is http.OutgoingHttpHeaders {
   return !Array.isArray(h);
 }
 
+function isRequestOptions(value: unknown): value is http.RequestOptions {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    !(value instanceof URL) &&
+    !Array.isArray(value)
+  );
+}
+
+function isIncomingMessageCallback(
+  value: unknown,
+): value is (res: http.IncomingMessage) => void {
+  return typeof value === 'function';
+}
+
+type HttpRequestArgs =
+  | []
+  | [
+      url: string | URL | http.RequestOptions,
+      options?: http.RequestOptions | ((res: http.IncomingMessage) => void),
+      callback?: (res: http.IncomingMessage) => void,
+    ];
+
+function callHttpRequest(
+  originalFn: typeof http.request,
+  args: HttpRequestArgs,
+): http.ClientRequest {
+  if (args.length === 0) {
+    return originalFn({});
+  }
+  if (args.length === 1) {
+    const first = args[0];
+    if (typeof first === 'string' || first instanceof URL) {
+      return originalFn(first);
+    }
+    if (isRequestOptions(first)) {
+      return originalFn(first);
+    }
+    return originalFn({});
+  }
+  if (args.length === 2) {
+    const first = args[0];
+    const second = args[1];
+    if (typeof first === 'string' || first instanceof URL) {
+      if (isIncomingMessageCallback(second)) {
+        return originalFn(first, second);
+      }
+      if (isRequestOptions(second)) {
+        return originalFn(first, second);
+      }
+    }
+    if (isRequestOptions(first) && isIncomingMessageCallback(second)) {
+      return originalFn(first, second);
+    }
+  }
+  if (args.length === 3) {
+    const first = args[0];
+    const second = args[1];
+    const third = args[2];
+    if (
+      (typeof first === 'string' || first instanceof URL) &&
+      isRequestOptions(second) &&
+      isIncomingMessageCallback(third)
+    ) {
+      return originalFn(first, second, third);
+    }
+  }
+  return originalFn({});
+}
+
 export interface NetworkLog {
   id: string;
   timestamp: number;
@@ -364,7 +433,7 @@ export class ActivityLogger extends EventEmitter {
 
     const wrapRequest = (
       originalFn: typeof http.request,
-      args: unknown[],
+      args: HttpRequestArgs,
       protocol: string,
     ) => {
       const firstArg = args[0];
@@ -373,8 +442,10 @@ export class ActivityLogger extends EventEmitter {
         options = firstArg;
       } else if (firstArg instanceof URL) {
         options = firstArg;
+      } else if (firstArg && typeof firstArg === 'object') {
+        options = isRequestOptions(firstArg) ? firstArg : {};
       } else {
-        options = (firstArg ?? {}) as http.RequestOptions;
+        options = {};
       }
 
       let url = '';
@@ -393,9 +464,9 @@ export class ActivityLogger extends EventEmitter {
           `${protocol}//${options.hostname || options.host || 'localhost'}${options.path || '/'}`;
       }
 
-      if (url.includes('127.0.0.1') || url.includes('localhost'))
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
-        return originalFn.apply(http, args as any);
+      if (url.includes('127.0.0.1') || url.includes('localhost')) {
+        return callHttpRequest(originalFn, args);
+      }
 
       const rawHeaders =
         typeof options === 'object' &&
@@ -410,24 +481,23 @@ export class ActivityLogger extends EventEmitter {
 
       if (headers[ACTIVITY_ID_HEADER]) {
         delete headers[ACTIVITY_ID_HEADER];
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
-        return originalFn.apply(http, args as any);
+        return callHttpRequest(originalFn, args);
       }
 
       const id = Math.random().toString(36).substring(7);
       this.requestStartTimes.set(id, Date.now());
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
-      const req = originalFn.apply(http, args as any);
+      const req = callHttpRequest(originalFn, args);
       const requestChunks: Buffer[] = [];
 
       const oldWrite = req.write;
       const oldEnd = req.end;
 
-      req.write = function (chunk: unknown, ...etc: unknown[]) {
+      req.write = function (chunk: string | Uint8Array, ...etc: unknown[]) {
         if (chunk) {
           const encoding =
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
-            typeof etc[0] === 'string' ? (etc[0] as BufferEncoding) : undefined;
+            typeof etc[0] === 'string' && Buffer.isEncoding(etc[0])
+              ? etc[0]
+              : undefined;
           requestChunks.push(
             Buffer.isBuffer(chunk)
               ? chunk
@@ -438,19 +508,21 @@ export class ActivityLogger extends EventEmitter {
                   ),
           );
         }
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
-        return oldWrite.apply(this, [chunk, ...etc] as any);
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion, @typescript-eslint/no-unsafe-return
+        return (oldWrite as any).apply(this, [chunk, ...etc]);
       };
 
       req.end = function (
         this: http.ClientRequest,
-        chunk: unknown,
+        chunkOrCb?: string | Uint8Array | (() => void),
         ...etc: unknown[]
       ) {
-        if (chunk && typeof chunk !== 'function') {
+        const chunk = typeof chunkOrCb === 'function' ? undefined : chunkOrCb;
+        if (chunk) {
           const encoding =
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
-            typeof etc[0] === 'string' ? (etc[0] as BufferEncoding) : undefined;
+            typeof etc[0] === 'string' && Buffer.isEncoding(etc[0])
+              ? etc[0]
+              : undefined;
           requestChunks.push(
             Buffer.isBuffer(chunk)
               ? chunk
@@ -473,7 +545,7 @@ export class ActivityLogger extends EventEmitter {
           pending: true,
         });
         // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion, @typescript-eslint/no-unsafe-return
-        return (oldEnd as any).apply(this, [chunk, ...etc]);
+        return (oldEnd as any).apply(this, [chunkOrCb, ...etc]);
       };
 
       req.on('response', (res: http.IncomingMessage) => {
@@ -545,12 +617,44 @@ export class ActivityLogger extends EventEmitter {
       return req;
     };
 
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
-    (http as any).request = (...args: unknown[]) =>
-      wrapRequest(originalRequest, args, 'http:');
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
-    (https as any).request = (...args: unknown[]) =>
-      wrapRequest(originalHttpsRequest as typeof http.request, args, 'https:');
+    Object.defineProperty(http, 'request', {
+      value: (
+        url: string | URL | http.RequestOptions,
+        options?: http.RequestOptions | ((res: http.IncomingMessage) => void),
+        callback?: (res: http.IncomingMessage) => void,
+      ): http.ClientRequest => {
+        const args: HttpRequestArgs =
+          callback !== undefined
+            ? [url, options, callback]
+            : options !== undefined
+              ? [url, options]
+              : [url];
+        return wrapRequest(originalRequest, args, 'http:');
+      },
+      writable: true,
+      configurable: true,
+    });
+    Object.defineProperty(https, 'request', {
+      value: (
+        url: string | URL | http.RequestOptions,
+        options?: http.RequestOptions | ((res: http.IncomingMessage) => void),
+        callback?: (res: http.IncomingMessage) => void,
+      ): http.ClientRequest => {
+        const args: HttpRequestArgs =
+          callback !== undefined
+            ? [url, options, callback]
+            : options !== undefined
+              ? [url, options]
+              : [url];
+        return wrapRequest(
+          originalHttpsRequest as typeof http.request,
+          args,
+          'https:',
+        );
+      },
+      writable: true,
+      configurable: true,
+    });
   }
 
   logConsole(payload: ConsoleLogPayload) {

packages/core/src/agents/browser/analyzeScreenshot.test.ts

@@ -0,0 +1,247 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { createAnalyzeScreenshotTool } from './analyzeScreenshot.js';
+import type { BrowserManager, McpToolCallResult } from './browserManager.js';
+import type { Config } from '../../config/config.js';
+import type { MessageBus } from '../../confirmation-bus/message-bus.js';
+
+const mockMessageBus = {
+  waitForConfirmation: vi.fn().mockResolvedValue({ approved: true }),
+} as unknown as MessageBus;
+
+function createMockBrowserManager(
+  callToolResult?: McpToolCallResult,
+): BrowserManager {
+  return {
+    callTool: vi.fn().mockResolvedValue(
+      callToolResult ?? {
+        content: [
+          { type: 'text', text: 'Screenshot captured' },
+          {
+            type: 'image',
+            data: 'base64encodeddata',
+            mimeType: 'image/png',
+          },
+        ],
+      },
+    ),
+  } as unknown as BrowserManager;
+}
+
+function createMockConfig(
+  generateContentResult?: unknown,
+  generateContentError?: Error,
+): Config {
+  const generateContent = generateContentError
+    ? vi.fn().mockRejectedValue(generateContentError)
+    : vi.fn().mockResolvedValue(
+        generateContentResult ?? {
+          candidates: [
+            {
+              content: {
+                parts: [
+                  {
+                    text: 'The blue submit button is at coordinates (250, 400).',
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      );
+
+  return {
+    getBrowserAgentConfig: vi.fn().mockReturnValue({
+      customConfig: { visualModel: 'test-visual-model' },
+    }),
+    getContentGenerator: vi.fn().mockReturnValue({
+      generateContent,
+    }),
+  } as unknown as Config;
+}
+
+describe('analyzeScreenshot', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('createAnalyzeScreenshotTool', () => {
+    it('creates a tool with the correct name and schema', () => {
+      const browserManager = createMockBrowserManager();
+      const config = createMockConfig();
+      const tool = createAnalyzeScreenshotTool(
+        browserManager,
+        config,
+        mockMessageBus,
+      );
+
+      expect(tool.name).toBe('analyze_screenshot');
+    });
+  });
+
+  describe('AnalyzeScreenshotInvocation', () => {
+    it('captures a screenshot and returns visual analysis', async () => {
+      const browserManager = createMockBrowserManager();
+      const config = createMockConfig();
+      const tool = createAnalyzeScreenshotTool(
+        browserManager,
+        config,
+        mockMessageBus,
+      );
+
+      const invocation = tool.build({
+        instruction: 'Find the blue submit button',
+      });
+      const result = await invocation.execute(new AbortController().signal);
+
+      // Verify screenshot was captured
+      expect(browserManager.callTool).toHaveBeenCalledWith(
+        'take_screenshot',
+        {},
+      );
+
+      // Verify the visual model was called
+      const contentGenerator = config.getContentGenerator();
+      expect(contentGenerator.generateContent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          model: 'test-visual-model',
+          contents: expect.arrayContaining([
+            expect.objectContaining({
+              role: 'user',
+              parts: expect.arrayContaining([
+                expect.objectContaining({
+                  inlineData: {
+                    mimeType: 'image/png',
+                    data: 'base64encodeddata',
+                  },
+                }),
+              ]),
+            }),
+          ]),
+        }),
+        'visual-analysis',
+        'utility_tool',
+      );
+
+      // Verify result
+      expect(result.llmContent).toContain('Visual Analysis Result');
+      expect(result.llmContent).toContain(
+        'The blue submit button is at coordinates (250, 400).',
+      );
+      expect(result.error).toBeUndefined();
+    });
+
+    it('returns an error when screenshot capture fails (no image)', async () => {
+      const browserManager = createMockBrowserManager({
+        content: [{ type: 'text', text: 'No screenshot available' }],
+      });
+      const config = createMockConfig();
+      const tool = createAnalyzeScreenshotTool(
+        browserManager,
+        config,
+        mockMessageBus,
+      );
+
+      const invocation = tool.build({
+        instruction: 'Find the button',
+      });
+      const result = await invocation.execute(new AbortController().signal);
+
+      expect(result.error).toBeDefined();
+      expect(result.llmContent).toContain('Failed to capture screenshot');
+      // Should NOT call the visual model
+      const contentGenerator = config.getContentGenerator();
+      expect(contentGenerator.generateContent).not.toHaveBeenCalled();
+    });
+
+    it('returns an error when visual model returns empty response', async () => {
+      const browserManager = createMockBrowserManager();
+      const config = createMockConfig({
+        candidates: [{ content: { parts: [] } }],
+      });
+      const tool = createAnalyzeScreenshotTool(
+        browserManager,
+        config,
+        mockMessageBus,
+      );
+
+      const invocation = tool.build({
+        instruction: 'Check the layout',
+      });
+      const result = await invocation.execute(new AbortController().signal);
+
+      expect(result.error).toBeDefined();
+      expect(result.llmContent).toContain('Visual model returned no analysis');
+    });
+
+    it('returns a model-unavailability fallback for 404 errors', async () => {
+      const browserManager = createMockBrowserManager();
+      const config = createMockConfig(
+        undefined,
+        new Error('Model not found: 404'),
+      );
+      const tool = createAnalyzeScreenshotTool(
+        browserManager,
+        config,
+        mockMessageBus,
+      );
+
+      const invocation = tool.build({
+        instruction: 'Find the red error',
+      });
+      const result = await invocation.execute(new AbortController().signal);
+
+      expect(result.error).toBeDefined();
+      expect(result.llmContent).toContain(
+        'Visual analysis model is not available',
+      );
+    });
+
+    it('returns a model-unavailability fallback for 403 errors', async () => {
+      const browserManager = createMockBrowserManager();
+      const config = createMockConfig(
+        undefined,
+        new Error('permission denied: 403'),
+      );
+      const tool = createAnalyzeScreenshotTool(
+        browserManager,
+        config,
+        mockMessageBus,
+      );
+
+      const invocation = tool.build({
+        instruction: 'Identify the element',
+      });
+      const result = await invocation.execute(new AbortController().signal);
+
+      expect(result.error).toBeDefined();
+      expect(result.llmContent).toContain(
+        'Visual analysis model is not available',
+      );
+    });
+
+    it('returns a generic error for non-model errors', async () => {
+      const browserManager = createMockBrowserManager();
+      const config = createMockConfig(undefined, new Error('Network timeout'));
+      const tool = createAnalyzeScreenshotTool(
+        browserManager,
+        config,
+        mockMessageBus,
+      );
+
+      const invocation = tool.build({
+        instruction: 'Find something',
+      });
+      const result = await invocation.execute(new AbortController().signal);
+
+      expect(result.error).toBeDefined();
+      expect(result.llmContent).toContain('Visual analysis failed');
+      expect(result.llmContent).toContain('Network timeout');
+    });
+  });
+});

packages/core/src/agents/browser/analyzeScreenshot.ts

@@ -0,0 +1,250 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @fileoverview Tool for visual identification via a single model call.
+ *
+ * The semantic browser agent uses this tool when it needs to identify
+ * elements by visual attributes not present in the accessibility tree
+ * (e.g., color, layout, precise coordinates).
+ *
+ * Unlike the semantic agent which works with the accessibility tree,
+ * this tool sends a screenshot to a computer-use model for visual analysis.
+ * It returns the model's analysis (coordinates, element descriptions) back
+ * to the browser agent, which retains full control of subsequent actions.
+ */
+
+import {
+  DeclarativeTool,
+  BaseToolInvocation,
+  Kind,
+  type ToolResult,
+  type ToolInvocation,
+} from '../../tools/tools.js';
+import type { MessageBus } from '../../confirmation-bus/message-bus.js';
+import type { BrowserManager } from './browserManager.js';
+import type { Config } from '../../config/config.js';
+import { getVisualAgentModel } from './modelAvailability.js';
+import { debugLogger } from '../../utils/debugLogger.js';
+import { LlmRole } from '../../telemetry/llmRole.js';
+
+/**
+ * System prompt for the visual analysis model call.
+ */
+const VISUAL_SYSTEM_PROMPT = `You are a Visual Analysis Agent. You receive a screenshot of a browser page and an instruction.
+
+Your job is to ANALYZE the screenshot and provide precise information that a browser automation agent can act on.
+
+COORDINATE SYSTEM:
+- Coordinates are pixel-based relative to the viewport
+- (0,0) is top-left of the visible area
+- Estimate element positions from the screenshot
+
+RESPONSE FORMAT:
+- For coordinate identification: provide exact (x, y) pixel coordinates
+- For element identification: describe the element's visual location and appearance
+- For layout analysis: describe the spatial relationships between elements
+- Be concise and actionable — the browser agent will use your response to decide what action to take
+
+IMPORTANT:
+- You are NOT performing actions — you are only providing visual analysis
+- Include coordinates when possible so the caller can use click_at(x, y)
+- If the element is not visible in the screenshot, say so explicitly`;
+
+/**
+ * Invocation for the analyze_screenshot tool.
+ * Makes a single generateContent call with a screenshot.
+ */
+class AnalyzeScreenshotInvocation extends BaseToolInvocation<
+  Record<string, unknown>,
+  ToolResult
+> {
+  constructor(
+    private readonly browserManager: BrowserManager,
+    private readonly config: Config,
+    params: Record<string, unknown>,
+    messageBus: MessageBus,
+  ) {
+    super(params, messageBus, 'analyze_screenshot', 'Analyze Screenshot');
+  }
+
+  getDescription(): string {
+    const instruction = String(this.params['instruction'] ?? '');
+    return `Visual analysis: "${instruction}"`;
+  }
+
+  async execute(signal: AbortSignal): Promise<ToolResult> {
+    try {
+      const instruction = String(this.params['instruction'] ?? '');
+
+      debugLogger.log(`Visual analysis requested: ${instruction}`);
+
+      // Capture screenshot via MCP tool
+      const screenshotResult = await this.browserManager.callTool(
+        'take_screenshot',
+        {},
+      );
+
+      // Extract base64 image data from MCP response.
+      // Search ALL content items for image type — MCP returns [text, image]
+      // where content[0] is a text description and content[1] is the actual PNG.
+      let screenshotBase64 = '';
+      let mimeType = 'image/png';
+      if (screenshotResult.content && Array.isArray(screenshotResult.content)) {
+        for (const item of screenshotResult.content) {
+          if (item.type === 'image' && item.data) {
+            screenshotBase64 = item.data;
+            mimeType = item.mimeType ?? 'image/png';
+            break;
+          }
+        }
+      }
+
+      if (!screenshotBase64) {
+        return {
+          llmContent:
+            'Failed to capture screenshot for visual analysis. Use accessibility tree elements instead.',
+          returnDisplay: 'Screenshot capture failed',
+          error: { message: 'Screenshot capture failed' },
+        };
+      }
+
+      // Make a single generateContent call with the visual model
+      const visualModel = getVisualAgentModel(this.config);
+      const contentGenerator = this.config.getContentGenerator();
+
+      const response = await contentGenerator.generateContent(
+        {
+          model: visualModel,
+          config: {
+            temperature: 0,
+            topP: 0.95,
+            systemInstruction: VISUAL_SYSTEM_PROMPT,
+            abortSignal: signal,
+          },
+          contents: [
+            {
+              role: 'user',
+              parts: [
+                {
+                  text: `Analyze this screenshot and respond to the following instruction:\n\n${instruction}`,
+                },
+                {
+                  inlineData: {
+                    mimeType,
+                    data: screenshotBase64,
+                  },
+                },
+              ],
+            },
+          ],
+        },
+        'visual-analysis',
+        LlmRole.UTILITY_TOOL,
+      );
+
+      // Extract text from response
+      const responseText =
+        response.candidates?.[0]?.content?.parts
+          ?.filter((p) => p.text)
+          .map((p) => p.text)
+          .join('\n') ?? '';
+
+      if (!responseText) {
+        return {
+          llmContent:
+            'Visual model returned no analysis. Use accessibility tree elements instead.',
+          returnDisplay: 'Visual analysis returned empty response',
+          error: { message: 'Empty visual analysis response' },
+        };
+      }
+
+      debugLogger.log(`Visual analysis complete: ${responseText}`);
+
+      return {
+        llmContent: `Visual Analysis Result:\n${responseText}`,
+        returnDisplay: `Visual Analysis Result:\n${responseText}`,
+      };
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      debugLogger.error(`Visual analysis failed: ${errorMsg}`);
+
+      // Provide a graceful fallback message for model unavailability
+      const isModelError =
+        errorMsg.includes('404') ||
+        errorMsg.includes('403') ||
+        errorMsg.includes('not found') ||
+        errorMsg.includes('permission');
+
+      const fallbackMsg = isModelError
+        ? 'Visual analysis model is not available. Use accessibility tree elements (uids from take_snapshot) for all interactions instead.'
+        : `Visual analysis failed: ${errorMsg}. Use accessibility tree elements instead.`;
+
+      return {
+        llmContent: fallbackMsg,
+        returnDisplay: fallbackMsg,
+        error: { message: errorMsg },
+      };
+    }
+  }
+}
+
+/**
+ * DeclarativeTool for screenshot-based visual analysis.
+ */
+class AnalyzeScreenshotTool extends DeclarativeTool<
+  Record<string, unknown>,
+  ToolResult
+> {
+  constructor(
+    private readonly browserManager: BrowserManager,
+    private readonly config: Config,
+    messageBus: MessageBus,
+  ) {
+    super(
+      'analyze_screenshot',
+      'analyze_screenshot',
+      'Analyze the current page visually using a screenshot. Use when you need to identify elements by visual attributes (color, layout, position) not available in the accessibility tree, or when you need precise pixel coordinates for click_at. Returns visual analysis — you perform the actions yourself.',
+      Kind.Other,
+      {
+        type: 'object',
+        properties: {
+          instruction: {
+            type: 'string',
+            description:
+              'What to identify or analyze visually (e.g., "Find the coordinates of the blue submit button", "What is the layout of the navigation menu?").',
+          },
+        },
+        required: ['instruction'],
+      },
+      messageBus,
+      true, // isOutputMarkdown
+      false, // canUpdateOutput
+    );
+  }
+
+  build(
+    params: Record<string, unknown>,
+  ): ToolInvocation<Record<string, unknown>, ToolResult> {
+    return new AnalyzeScreenshotInvocation(
+      this.browserManager,
+      this.config,
+      params,
+      this.messageBus,
+    );
+  }
+}
+
+/**
+ * Creates the analyze_screenshot tool for the browser agent.
+ */
+export function createAnalyzeScreenshotTool(
+  browserManager: BrowserManager,
+  config: Config,
+  messageBus: MessageBus,
+): AnalyzeScreenshotTool {
+  return new AnalyzeScreenshotTool(browserManager, config, messageBus);
+}

packages/core/src/agents/browser/browserAgentDefinition.ts

@@ -0,0 +1,172 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @fileoverview Browser Agent definition following the LocalAgentDefinition pattern.
+ *
+ * This agent uses LocalAgentExecutor for its reAct loop, like CodebaseInvestigatorAgent.
+ * It is available ONLY via delegate_to_agent, NOT as a direct tool.
+ *
+ * Tools are configured dynamically at invocation time via browserAgentFactory.
+ */
+
+import type { LocalAgentDefinition } from '../types.js';
+import type { Config } from '../../config/config.js';
+import { z } from 'zod';
+import {
+  isPreviewModel,
+  PREVIEW_GEMINI_FLASH_MODEL,
+  DEFAULT_GEMINI_FLASH_MODEL,
+} from '../../config/models.js';
+
+/** Canonical agent name — used for routing and configuration lookup. */
+export const BROWSER_AGENT_NAME = 'browser_agent';
+
+/**
+ * Output schema for browser agent results.
+ */
+export const BrowserTaskResultSchema = z.object({
+  success: z.boolean().describe('Whether the task was completed successfully'),
+  summary: z
+    .string()
+    .describe('A summary of what was accomplished or what went wrong'),
+  data: z
+    .unknown()
+    .optional()
+    .describe('Optional extracted data from the task'),
+});
+
+const VISUAL_SECTION = `
+VISUAL IDENTIFICATION (analyze_screenshot):
+When you need to identify elements by visual attributes not in the AX tree (e.g., "click the yellow button", "find the red error message"), or need precise pixel coordinates:
+1. Call analyze_screenshot with a clear instruction describing what to find
+2. It returns visual analysis with coordinates/descriptions — it does NOT perform actions
+3. Use the returned coordinates with click_at(x, y) or other tools yourself
+4. If the analysis is insufficient, call it again with a more specific instruction
+`;
+
+/**
+ * System prompt for the semantic browser agent.
+ * Extracted from prototype (computer_use_subagent_cdt branch).
+ *
+ * @param visionEnabled Whether visual tools (analyze_screenshot, click_at) are available.
+ */
+export function buildBrowserSystemPrompt(visionEnabled: boolean): string {
+  return `You are an expert browser automation agent (Orchestrator). Your goal is to completely fulfill the user's request.
+
+IMPORTANT: You will receive an accessibility tree snapshot showing elements with uid values (e.g., uid=87_4 button "Login"). 
+Use these uid values directly with your tools:
+- click(uid="87_4") to click the Login button
+- fill(uid="87_2", value="john") to fill a text field
+- fill_form(elements=[{uid: "87_2", value: "john"}, {uid: "87_3", value: "pass"}]) to fill multiple fields at once
+
+PARALLEL TOOL CALLS - CRITICAL:
+- Do NOT make parallel calls for actions that change page state (click, fill, press_key, etc.)
+- Each action changes the DOM and invalidates UIDs from the current snapshot
+- Make state-changing actions ONE AT A TIME, then observe the results
+
+OVERLAY/POPUP HANDLING:
+Before interacting with page content, scan the accessibility tree for blocking overlays:
+- Tooltips, popups, modals, cookie banners, newsletter prompts, promo dialogs
+- These often have: close buttons (×, X, Close, Dismiss), "Got it", "Accept", "No thanks" buttons
+- Common patterns: elements with role="dialog", role="tooltip", role="alertdialog", or aria-modal="true"
+- If you see such elements, DISMISS THEM FIRST by clicking close/dismiss buttons before proceeding
+- If a click seems to have no effect, check if an overlay appeared or is blocking the target
+${visionEnabled ? VISUAL_SECTION : ''}
+
+COMPLEX WEB APPS (spreadsheets, rich editors, canvas apps):
+Many web apps (Google Sheets/Docs, Notion, Figma, etc.) use custom rendering rather than standard HTML inputs.
+- fill does NOT work on these apps. Instead, click the target element, then use type_text to enter the value.
+- type_text supports a submitKey parameter to press a key after typing (e.g., submitKey="Enter" to submit, submitKey="Tab" to move to the next field). This is much faster than separate press_key calls.
+- Navigate cells/fields using keyboard shortcuts (Tab, Enter, ArrowDown) — more reliable than clicking UIDs.
+- Use the Name Box (cell reference input, usually showing "A1") to jump to specific cells.
+
+TERMINAL FAILURES — STOP IMMEDIATELY:
+Some errors are unrecoverable and retrying will never help. When you see ANY of these, call complete_task immediately with success=false and include the EXACT error message (including any remediation steps it contains) in your summary:
+- "Could not connect to Chrome" or "Failed to connect to Chrome" or "Timed out connecting to Chrome" — Include the full error message with its remediation steps in your summary verbatim. Do NOT paraphrase or omit instructions.
+- "Browser closed" or "Target closed" or "Session closed" — The browser process has terminated. Include the error and tell the user to try again.
+- "net::ERR_" network errors on the SAME URL after 2 retries — the site is unreachable. Report the URL and error.
+- Any error that appears IDENTICALLY 3+ times in a row — it will not resolve by retrying.
+Do NOT keep retrying terminal errors. Report them with actionable remediation steps and exit immediately.
+
+CRITICAL: When you have fully completed the user's task, you MUST call the complete_task tool with a summary of what you accomplished. Do NOT just return text - you must explicitly call complete_task to exit the loop.`;
+}
+
+/**
+ * Browser Agent Definition Factory.
+ *
+ * Following the CodebaseInvestigatorAgent pattern:
+ * - Returns a factory function that takes Config for dynamic model selection
+ * - kind: 'local' for LocalAgentExecutor
+ * - toolConfig is set dynamically by browserAgentFactory
+ */
+export const BrowserAgentDefinition = (
+  config: Config,
+  visionEnabled = false,
+): LocalAgentDefinition<typeof BrowserTaskResultSchema> => {
+  // Use Preview Flash model if the main model is any of the preview models.
+  // If the main model is not a preview model, use the default flash model.
+  const model = isPreviewModel(config.getModel())
+    ? PREVIEW_GEMINI_FLASH_MODEL
+    : DEFAULT_GEMINI_FLASH_MODEL;
+
+  return {
+    name: BROWSER_AGENT_NAME,
+    kind: 'local',
+    experimental: true,
+    displayName: 'Browser Agent',
+    description: `Specialized autonomous agent for end-to-end web browser automation and objective-driven problem solving. Delegate complete, high-level tasks to this agent — it independently plans, executes multi-step interactions, interprets dynamic page feedback (e.g., game states, form validation errors, search results), and iterates until the goal is achieved. It perceives page structure through the Accessibility Tree, handles overlays and popups, and supports complex web apps.`,
+
+    inputConfig: {
+      inputSchema: {
+        type: 'object',
+        properties: {
+          task: {
+            type: 'string',
+            description: 'The task to perform in the browser.',
+          },
+        },
+        required: ['task'],
+      },
+    },
+
+    outputConfig: {
+      outputName: 'result',
+      description: 'The result of the browser task.',
+      schema: BrowserTaskResultSchema,
+    },
+
+    processOutput: (output) => JSON.stringify(output, null, 2),
+
+    modelConfig: {
+      // Dynamic model based on whether user is using preview models
+      model,
+      generateContentConfig: {
+        temperature: 0.1,
+        topP: 0.95,
+      },
+    },
+
+    runConfig: {
+      maxTimeMinutes: 10,
+      maxTurns: 50,
+    },
+
+    // Tools are set dynamically by browserAgentFactory after MCP connection
+    // This is undefined here and will be set at invocation time
+    toolConfig: undefined,
+
+    promptConfig: {
+      query: `Your task is:
+<task>
+\${task}
+</task>
+
+First, use new_page to open the relevant URL. Then call take_snapshot to see the page and proceed with your task.`,
+      systemPrompt: buildBrowserSystemPrompt(visionEnabled),
+    },
+  };
+};

packages/core/src/agents/browser/browserAgentFactory.test.ts

@@ -0,0 +1,258 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import {
+  createBrowserAgentDefinition,
+  cleanupBrowserAgent,
+} from './browserAgentFactory.js';
+import { makeFakeConfig } from '../../test-utils/config.js';
+import type { Config } from '../../config/config.js';
+import type { MessageBus } from '../../confirmation-bus/message-bus.js';
+import type { BrowserManager } from './browserManager.js';
+
+// Create mock browser manager
+const mockBrowserManager = {
+  ensureConnection: vi.fn().mockResolvedValue(undefined),
+  getDiscoveredTools: vi.fn().mockResolvedValue([
+    // Semantic tools
+    { name: 'take_snapshot', description: 'Take snapshot' },
+    { name: 'click', description: 'Click element' },
+    { name: 'fill', description: 'Fill form field' },
+    { name: 'navigate_page', description: 'Navigate to URL' },
+    // Visual tools (from --experimental-vision)
+    { name: 'click_at', description: 'Click at coordinates' },
+  ]),
+  callTool: vi.fn().mockResolvedValue({ content: [] }),
+  close: vi.fn().mockResolvedValue(undefined),
+};
+
+// Mock dependencies
+vi.mock('./browserManager.js', () => ({
+  BrowserManager: vi.fn(() => mockBrowserManager),
+}));
+
+vi.mock('../../utils/debugLogger.js', () => ({
+  debugLogger: {
+    log: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+  },
+}));
+
+import {
+  buildBrowserSystemPrompt,
+  BROWSER_AGENT_NAME,
+} from './browserAgentDefinition.js';
+
+describe('browserAgentFactory', () => {
+  let mockConfig: Config;
+  let mockMessageBus: MessageBus;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    // Reset mock implementations
+    mockBrowserManager.ensureConnection.mockResolvedValue(undefined);
+    mockBrowserManager.getDiscoveredTools.mockResolvedValue([
+      // Semantic tools
+      { name: 'take_snapshot', description: 'Take snapshot' },
+      { name: 'click', description: 'Click element' },
+      { name: 'fill', description: 'Fill form field' },
+      { name: 'navigate_page', description: 'Navigate to URL' },
+      // Visual tools (from --experimental-vision)
+      { name: 'click_at', description: 'Click at coordinates' },
+    ]);
+    mockBrowserManager.close.mockResolvedValue(undefined);
+
+    mockConfig = makeFakeConfig({
+      agents: {
+        overrides: {
+          browser_agent: {
+            enabled: true,
+          },
+        },
+        browser: {
+          headless: false,
+        },
+      },
+    });
+
+    mockMessageBus = {
+      publish: vi.fn().mockResolvedValue(undefined),
+      subscribe: vi.fn(),
+      unsubscribe: vi.fn(),
+    } as unknown as MessageBus;
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('createBrowserAgentDefinition', () => {
+    it('should ensure browser connection', async () => {
+      await createBrowserAgentDefinition(mockConfig, mockMessageBus);
+
+      expect(mockBrowserManager.ensureConnection).toHaveBeenCalled();
+    });
+
+    it('should return agent definition with discovered tools', async () => {
+      const { definition } = await createBrowserAgentDefinition(
+        mockConfig,
+        mockMessageBus,
+      );
+
+      expect(definition.name).toBe(BROWSER_AGENT_NAME);
+      // 5 MCP tools + 1 type_text composite tool (no analyze_screenshot without visualModel)
+      expect(definition.toolConfig?.tools).toHaveLength(6);
+    });
+
+    it('should return browser manager for cleanup', async () => {
+      const { browserManager } = await createBrowserAgentDefinition(
+        mockConfig,
+        mockMessageBus,
+      );
+
+      expect(browserManager).toBeDefined();
+    });
+
+    it('should call printOutput when provided', async () => {
+      const printOutput = vi.fn();
+
+      await createBrowserAgentDefinition(
+        mockConfig,
+        mockMessageBus,
+        printOutput,
+      );
+
+      expect(printOutput).toHaveBeenCalled();
+    });
+
+    it('should create definition with correct structure', async () => {
+      const { definition } = await createBrowserAgentDefinition(
+        mockConfig,
+        mockMessageBus,
+      );
+
+      expect(definition.kind).toBe('local');
+      expect(definition.inputConfig).toBeDefined();
+      expect(definition.outputConfig).toBeDefined();
+      expect(definition.promptConfig).toBeDefined();
+    });
+
+    it('should exclude visual prompt section when visualModel is not configured', async () => {
+      const { definition } = await createBrowserAgentDefinition(
+        mockConfig,
+        mockMessageBus,
+      );
+
+      const systemPrompt = definition.promptConfig?.systemPrompt ?? '';
+      expect(systemPrompt).not.toContain('analyze_screenshot');
+      expect(systemPrompt).not.toContain('VISUAL IDENTIFICATION');
+    });
+
+    it('should include visual prompt section when visualModel is configured', async () => {
+      const configWithVision = makeFakeConfig({
+        agents: {
+          overrides: {
+            browser_agent: {
+              enabled: true,
+            },
+          },
+          browser: {
+            headless: false,
+            visualModel: 'gemini-2.5-flash-preview',
+          },
+        },
+      });
+
+      const { definition } = await createBrowserAgentDefinition(
+        configWithVision,
+        mockMessageBus,
+      );
+
+      const systemPrompt = definition.promptConfig?.systemPrompt ?? '';
+      expect(systemPrompt).toContain('analyze_screenshot');
+      expect(systemPrompt).toContain('VISUAL IDENTIFICATION');
+    });
+
+    it('should include analyze_screenshot tool when visualModel is configured', async () => {
+      const configWithVision = makeFakeConfig({
+        agents: {
+          overrides: {
+            browser_agent: {
+              enabled: true,
+            },
+          },
+          browser: {
+            headless: false,
+            visualModel: 'gemini-2.5-flash-preview',
+          },
+        },
+      });
+
+      const { definition } = await createBrowserAgentDefinition(
+        configWithVision,
+        mockMessageBus,
+      );
+
+      // 5 MCP tools + 1 type_text + 1 analyze_screenshot
+      expect(definition.toolConfig?.tools).toHaveLength(7);
+      const toolNames =
+        definition.toolConfig?.tools
+          ?.filter(
+            (t): t is { name: string } => typeof t === 'object' && 'name' in t,
+          )
+          .map((t) => t.name) ?? [];
+      expect(toolNames).toContain('analyze_screenshot');
+    });
+  });
+
+  describe('cleanupBrowserAgent', () => {
+    it('should call close on browser manager', async () => {
+      await cleanupBrowserAgent(
+        mockBrowserManager as unknown as BrowserManager,
+      );
+
+      expect(mockBrowserManager.close).toHaveBeenCalled();
+    });
+
+    it('should handle errors during cleanup gracefully', async () => {
+      const errorManager = {
+        close: vi.fn().mockRejectedValue(new Error('Close failed')),
+      } as unknown as BrowserManager;
+
+      // Should not throw
+      await expect(cleanupBrowserAgent(errorManager)).resolves.toBeUndefined();
+    });
+  });
+});
+
+describe('buildBrowserSystemPrompt', () => {
+  it('should include visual section when vision is enabled', () => {
+    const prompt = buildBrowserSystemPrompt(true);
+    expect(prompt).toContain('VISUAL IDENTIFICATION');
+    expect(prompt).toContain('analyze_screenshot');
+    expect(prompt).toContain('click_at');
+  });
+
+  it('should exclude visual section when vision is disabled', () => {
+    const prompt = buildBrowserSystemPrompt(false);
+    expect(prompt).not.toContain('VISUAL IDENTIFICATION');
+    expect(prompt).not.toContain('analyze_screenshot');
+  });
+
+  it('should always include core sections regardless of vision', () => {
+    for (const visionEnabled of [true, false]) {
+      const prompt = buildBrowserSystemPrompt(visionEnabled);
+      expect(prompt).toContain('PARALLEL TOOL CALLS');
+      expect(prompt).toContain('OVERLAY/POPUP HANDLING');
+      expect(prompt).toContain('COMPLEX WEB APPS');
+      expect(prompt).toContain('TERMINAL FAILURES');
+      expect(prompt).toContain('complete_task');
+    }
+  });
+});

packages/core/src/agents/browser/browserAgentFactory.ts

@@ -0,0 +1,161 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @fileoverview Factory for creating browser agent definitions with configured tools.
+ *
+ * This factory is called when the browser agent is invoked via delegate_to_agent.
+ * It creates a BrowserManager, connects the isolated MCP client, wraps tools,
+ * and returns a fully configured LocalAgentDefinition.
+ *
+ * IMPORTANT: The MCP tools are ONLY available to the browser agent's isolated
+ * registry. They are NOT registered in the main agent's ToolRegistry.
+ */
+
+import type { Config } from '../../config/config.js';
+import { AuthType } from '../../core/contentGenerator.js';
+import type { LocalAgentDefinition } from '../types.js';
+import type { MessageBus } from '../../confirmation-bus/message-bus.js';
+import type { AnyDeclarativeTool } from '../../tools/tools.js';
+import { BrowserManager } from './browserManager.js';
+import {
+  BrowserAgentDefinition,
+  type BrowserTaskResultSchema,
+} from './browserAgentDefinition.js';
+import { createMcpDeclarativeTools } from './mcpToolWrapper.js';
+import { createAnalyzeScreenshotTool } from './analyzeScreenshot.js';
+import { debugLogger } from '../../utils/debugLogger.js';
+
+/**
+ * Creates a browser agent definition with MCP tools configured.
+ *
+ * This is called when the browser agent is invoked via delegate_to_agent.
+ * The MCP client is created fresh and tools are wrapped for the agent's
+ * isolated registry - NOT registered with the main agent.
+ *
+ * @param config Runtime configuration
+ * @param messageBus Message bus for tool invocations
+ * @param printOutput Optional callback for progress messages
+ * @returns Fully configured LocalAgentDefinition with MCP tools
+ */
+export async function createBrowserAgentDefinition(
+  config: Config,
+  messageBus: MessageBus,
+  printOutput?: (msg: string) => void,
+): Promise<{
+  definition: LocalAgentDefinition<typeof BrowserTaskResultSchema>;
+  browserManager: BrowserManager;
+}> {
+  debugLogger.log(
+    'Creating browser agent definition with isolated MCP tools...',
+  );
+
+  // Create and initialize browser manager with isolated MCP client
+  const browserManager = new BrowserManager(config);
+  await browserManager.ensureConnection();
+
+  if (printOutput) {
+    printOutput('Browser connected with isolated MCP client.');
+  }
+
+  // Create declarative tools from dynamically discovered MCP tools
+  // These tools dispatch to browserManager's isolated client
+  const mcpTools = await createMcpDeclarativeTools(browserManager, messageBus);
+  const availableToolNames = mcpTools.map((t) => t.name);
+
+  // Validate required semantic tools are available
+  const requiredSemanticTools = [
+    'click',
+    'fill',
+    'navigate_page',
+    'take_snapshot',
+  ];
+  const missingSemanticTools = requiredSemanticTools.filter(
+    (t) => !availableToolNames.includes(t),
+  );
+  if (missingSemanticTools.length > 0) {
+    debugLogger.warn(
+      `Semantic tools missing (${missingSemanticTools.join(', ')}). ` +
+        'Some browser interactions may not work correctly.',
+    );
+  }
+
+  // Only click_at is strictly required — text input can use press_key or fill.
+  const requiredVisualTools = ['click_at'];
+  const missingVisualTools = requiredVisualTools.filter(
+    (t) => !availableToolNames.includes(t),
+  );
+
+  // Check whether vision can be enabled; returns undefined if all gates pass.
+  function getVisionDisabledReason(): string | undefined {
+    const browserConfig = config.getBrowserAgentConfig();
+    if (!browserConfig.customConfig.visualModel) {
+      return 'No visualModel configured.';
+    }
+    if (missingVisualTools.length > 0) {
+      return (
+        `Visual tools missing (${missingVisualTools.join(', ')}). ` +
+        `The installed chrome-devtools-mcp version may be too old.`
+      );
+    }
+    const authType = config.getContentGeneratorConfig()?.authType;
+    const blockedAuthTypes = new Set([
+      AuthType.LOGIN_WITH_GOOGLE,
+      AuthType.LEGACY_CLOUD_SHELL,
+      AuthType.COMPUTE_ADC,
+    ]);
+    if (authType && blockedAuthTypes.has(authType)) {
+      return 'Visual agent model not available for current auth type.';
+    }
+    return undefined;
+  }
+
+  const allTools: AnyDeclarativeTool[] = [...mcpTools];
+  const visionDisabledReason = getVisionDisabledReason();
+
+  if (visionDisabledReason) {
+    debugLogger.log(`Vision disabled: ${visionDisabledReason}`);
+  } else {
+    allTools.push(
+      createAnalyzeScreenshotTool(browserManager, config, messageBus),
+    );
+  }
+
+  debugLogger.log(
+    `Created ${allTools.length} tools for browser agent: ` +
+      allTools.map((t) => t.name).join(', '),
+  );
+
+  // Create configured definition with tools
+  // BrowserAgentDefinition is a factory function - call it with config
+  const baseDefinition = BrowserAgentDefinition(config, !visionDisabledReason);
+  const definition: LocalAgentDefinition<typeof BrowserTaskResultSchema> = {
+    ...baseDefinition,
+    toolConfig: {
+      tools: allTools,
+    },
+  };
+
+  return { definition, browserManager };
+}
+
+/**
+ * Cleans up browser resources after agent execution.
+ *
+ * @param browserManager The browser manager to clean up
+ */
+export async function cleanupBrowserAgent(
+  browserManager: BrowserManager,
+): Promise<void> {
+  try {
+    await browserManager.close();
+    debugLogger.log('Browser agent cleanup complete');
+  } catch (error) {
+    debugLogger.error(
+      `Error during browser cleanup: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+}

packages/core/src/agents/browser/browserAgentInvocation.test.ts

@@ -0,0 +1,139 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { BrowserAgentInvocation } from './browserAgentInvocation.js';
+import { makeFakeConfig } from '../../test-utils/config.js';
+import type { Config } from '../../config/config.js';
+import type { MessageBus } from '../../confirmation-bus/message-bus.js';
+import type { AgentInputs } from '../types.js';
+
+// Mock dependencies before imports
+vi.mock('../../utils/debugLogger.js', () => ({
+  debugLogger: {
+    log: vi.fn(),
+    error: vi.fn(),
+  },
+}));
+
+describe('BrowserAgentInvocation', () => {
+  let mockConfig: Config;
+  let mockMessageBus: MessageBus;
+  let mockParams: AgentInputs;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    mockConfig = makeFakeConfig({
+      agents: {
+        overrides: {
+          browser_agent: {
+            enabled: true,
+          },
+        },
+        browser: {
+          headless: false,
+          sessionMode: 'isolated',
+        },
+      },
+    });
+
+    mockMessageBus = {
+      publish: vi.fn().mockResolvedValue(undefined),
+      subscribe: vi.fn(),
+      unsubscribe: vi.fn(),
+    } as unknown as MessageBus;
+
+    mockParams = {
+      task: 'Navigate to example.com and click the button',
+    };
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('constructor', () => {
+    it('should create invocation with params', () => {
+      const invocation = new BrowserAgentInvocation(
+        mockConfig,
+        mockParams,
+        mockMessageBus,
+      );
+
+      expect(invocation.params).toEqual(mockParams);
+    });
+
+    it('should use browser_agent as default tool name', () => {
+      const invocation = new BrowserAgentInvocation(
+        mockConfig,
+        mockParams,
+        mockMessageBus,
+      );
+
+      expect(invocation['_toolName']).toBe('browser_agent');
+    });
+
+    it('should use custom tool name if provided', () => {
+      const invocation = new BrowserAgentInvocation(
+        mockConfig,
+        mockParams,
+        mockMessageBus,
+        'custom_name',
+        'Custom Display Name',
+      );
+
+      expect(invocation['_toolName']).toBe('custom_name');
+      expect(invocation['_toolDisplayName']).toBe('Custom Display Name');
+    });
+  });
+
+  describe('getDescription', () => {
+    it('should return description with input summary', () => {
+      const invocation = new BrowserAgentInvocation(
+        mockConfig,
+        mockParams,
+        mockMessageBus,
+      );
+
+      const description = invocation.getDescription();
+
+      expect(description).toContain('browser agent');
+      expect(description).toContain('task');
+    });
+
+    it('should truncate long input values', () => {
+      const longParams = {
+        task: 'A'.repeat(100),
+      };
+
+      const invocation = new BrowserAgentInvocation(
+        mockConfig,
+        longParams,
+        mockMessageBus,
+      );
+
+      const description = invocation.getDescription();
+
+      // Should be truncated to max length
+      expect(description.length).toBeLessThanOrEqual(200);
+    });
+  });
+
+  describe('toolLocations', () => {
+    it('should return empty array by default', () => {
+      const invocation = new BrowserAgentInvocation(
+        mockConfig,
+        mockParams,
+        mockMessageBus,
+      );
+
+      const locations = invocation.toolLocations();
+
+      expect(locations).toEqual([]);
+    });
+  });
+});

packages/core/src/agents/browser/browserAgentInvocation.ts

@@ -0,0 +1,171 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @fileoverview Browser agent invocation that handles async tool setup.
+ *
+ * Unlike regular LocalSubagentInvocation, this invocation:
+ * 1. Uses browserAgentFactory to create definition with MCP tools
+ * 2. Cleans up browser resources after execution
+ *
+ * The MCP tools are only available in the browser agent's isolated registry.
+ */
+
+import type { Config } from '../../config/config.js';
+import { LocalAgentExecutor } from '../local-executor.js';
+import type { AnsiOutput } from '../../utils/terminalSerializer.js';
+import { BaseToolInvocation, type ToolResult } from '../../tools/tools.js';
+import { ToolErrorType } from '../../tools/tool-error.js';
+import type { AgentInputs, SubagentActivityEvent } from '../types.js';
+import type { MessageBus } from '../../confirmation-bus/message-bus.js';
+import {
+  createBrowserAgentDefinition,
+  cleanupBrowserAgent,
+} from './browserAgentFactory.js';
+
+const INPUT_PREVIEW_MAX_LENGTH = 50;
+const DESCRIPTION_MAX_LENGTH = 200;
+
+/**
+ * Browser agent invocation with async tool setup.
+ *
+ * This invocation handles the browser agent's special requirements:
+ * - MCP connection and tool wrapping at invocation time
+ * - Browser cleanup after execution
+ */
+export class BrowserAgentInvocation extends BaseToolInvocation<
+  AgentInputs,
+  ToolResult
+> {
+  constructor(
+    private readonly config: Config,
+    params: AgentInputs,
+    messageBus: MessageBus,
+    _toolName?: string,
+    _toolDisplayName?: string,
+  ) {
+    // Note: BrowserAgentDefinition is a factory function, so we use hardcoded names
+    super(
+      params,
+      messageBus,
+      _toolName ?? 'browser_agent',
+      _toolDisplayName ?? 'Browser Agent',
+    );
+  }
+
+  /**
+   * Returns a concise, human-readable description of the invocation.
+   */
+  getDescription(): string {
+    const inputSummary = Object.entries(this.params)
+      .map(
+        ([key, value]) =>
+          `${key}: ${String(value).slice(0, INPUT_PREVIEW_MAX_LENGTH)}`,
+      )
+      .join(', ');
+
+    const description = `Running browser agent with inputs: { ${inputSummary} }`;
+    return description.slice(0, DESCRIPTION_MAX_LENGTH);
+  }
+
+  /**
+   * Executes the browser agent.
+   *
+   * This method:
+   * 1. Creates browser manager and MCP connection
+   * 2. Wraps MCP tools for the isolated registry
+   * 3. Runs the agent via LocalAgentExecutor
+   * 4. Cleans up browser resources
+   */
+  async execute(
+    signal: AbortSignal,
+    updateOutput?: (output: string | AnsiOutput) => void,
+  ): Promise<ToolResult> {
+    let browserManager;
+
+    try {
+      if (updateOutput) {
+        updateOutput('🌐 Starting browser agent...\n');
+      }
+
+      // Create definition with MCP tools
+      const printOutput = updateOutput
+        ? (msg: string) => updateOutput(`🌐 ${msg}\n`)
+        : undefined;
+
+      const result = await createBrowserAgentDefinition(
+        this.config,
+        this.messageBus,
+        printOutput,
+      );
+      const { definition } = result;
+      browserManager = result.browserManager;
+
+      if (updateOutput) {
+        updateOutput(
+          `🌐 Browser connected. Tools: ${definition.toolConfig?.tools.length ?? 0}\n`,
+        );
+      }
+
+      // Create activity callback for streaming output
+      const onActivity = (activity: SubagentActivityEvent): void => {
+        if (!updateOutput) return;
+
+        if (
+          activity.type === 'THOUGHT_CHUNK' &&
+          typeof activity.data['text'] === 'string'
+        ) {
+          updateOutput(`🌐💭 ${activity.data['text']}`);
+        }
+      };
+
+      // Create and run executor with the configured definition
+      const executor = await LocalAgentExecutor.create(
+        definition,
+        this.config,
+        onActivity,
+      );
+
+      const output = await executor.run(this.params, signal);
+
+      const resultContent = `Browser agent finished.
+Termination Reason: ${output.terminate_reason}
+Result:
+${output.result}`;
+
+      const displayContent = `
+Browser Agent Finished
+
+Termination Reason: ${output.terminate_reason}
+
+Result:
+${output.result}
+`;
+
+      return {
+        llmContent: [{ text: resultContent }],
+        returnDisplay: displayContent,
+      };
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+
+      return {
+        llmContent: `Browser agent failed. Error: ${errorMessage}`,
+        returnDisplay: `Browser Agent Failed\nError: ${errorMessage}`,
+        error: {
+          message: errorMessage,
+          type: ToolErrorType.EXECUTION_FAILED,
+        },
+      };
+    } finally {
+      // Always cleanup browser resources
+      if (browserManager) {
+        await cleanupBrowserAgent(browserManager);
+      }
+    }
+  }
+}

packages/core/src/agents/browser/browserManager.test.ts

@@ -0,0 +1,414 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { BrowserManager } from './browserManager.js';
+import { makeFakeConfig } from '../../test-utils/config.js';
+import type { Config } from '../../config/config.js';
+
+// Mock the MCP SDK
+vi.mock('@modelcontextprotocol/sdk/client/index.js', () => ({
+  Client: vi.fn().mockImplementation(() => ({
+    connect: vi.fn().mockResolvedValue(undefined),
+    close: vi.fn().mockResolvedValue(undefined),
+    listTools: vi.fn().mockResolvedValue({
+      tools: [
+        { name: 'take_snapshot', description: 'Take a snapshot' },
+        { name: 'click', description: 'Click an element' },
+        { name: 'click_at', description: 'Click at coordinates' },
+        { name: 'take_screenshot', description: 'Take a screenshot' },
+      ],
+    }),
+    callTool: vi.fn().mockResolvedValue({
+      content: [{ type: 'text', text: 'Tool result' }],
+    }),
+  })),
+}));
+
+vi.mock('@modelcontextprotocol/sdk/client/stdio.js', () => ({
+  StdioClientTransport: vi.fn().mockImplementation(() => ({
+    close: vi.fn().mockResolvedValue(undefined),
+    stderr: null,
+  })),
+}));
+
+vi.mock('../../utils/debugLogger.js', () => ({
+  debugLogger: {
+    log: vi.fn(),
+    error: vi.fn(),
+  },
+}));
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+
+describe('BrowserManager', () => {
+  let mockConfig: Config;
+
+  beforeEach(() => {
+    vi.resetAllMocks();
+
+    // Setup mock config
+    mockConfig = makeFakeConfig({
+      agents: {
+        overrides: {
+          browser_agent: {
+            enabled: true,
+          },
+        },
+        browser: {
+          headless: false,
+        },
+      },
+    });
+
+    // Re-setup Client mock after reset
+    vi.mocked(Client).mockImplementation(
+      () =>
+        ({
+          connect: vi.fn().mockResolvedValue(undefined),
+          close: vi.fn().mockResolvedValue(undefined),
+          listTools: vi.fn().mockResolvedValue({
+            tools: [
+              { name: 'take_snapshot', description: 'Take a snapshot' },
+              { name: 'click', description: 'Click an element' },
+              { name: 'click_at', description: 'Click at coordinates' },
+              { name: 'take_screenshot', description: 'Take a screenshot' },
+            ],
+          }),
+          callTool: vi.fn().mockResolvedValue({
+            content: [{ type: 'text', text: 'Tool result' }],
+          }),
+        }) as unknown as InstanceType<typeof Client>,
+    );
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('getRawMcpClient', () => {
+    it('should ensure connection and return raw MCP client', async () => {
+      const manager = new BrowserManager(mockConfig);
+      const client = await manager.getRawMcpClient();
+
+      expect(client).toBeDefined();
+      expect(Client).toHaveBeenCalled();
+    });
+
+    it('should return cached client if already connected', async () => {
+      const manager = new BrowserManager(mockConfig);
+
+      // First call
+      const client1 = await manager.getRawMcpClient();
+
+      // Second call should use cache
+      const client2 = await manager.getRawMcpClient();
+
+      expect(client1).toBe(client2);
+      // Client constructor should only be called once
+      expect(Client).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe('getDiscoveredTools', () => {
+    it('should return tools discovered from MCP server including visual tools', async () => {
+      const manager = new BrowserManager(mockConfig);
+      const tools = await manager.getDiscoveredTools();
+
+      expect(tools).toHaveLength(4);
+      expect(tools.map((t) => t.name)).toContain('take_snapshot');
+      expect(tools.map((t) => t.name)).toContain('click');
+      expect(tools.map((t) => t.name)).toContain('click_at');
+      expect(tools.map((t) => t.name)).toContain('take_screenshot');
+    });
+  });
+
+  describe('callTool', () => {
+    it('should call tool on MCP client and return result', async () => {
+      const manager = new BrowserManager(mockConfig);
+      const result = await manager.callTool('take_snapshot', { verbose: true });
+
+      expect(result).toEqual({
+        content: [{ type: 'text', text: 'Tool result' }],
+        isError: false,
+      });
+    });
+  });
+
+  describe('MCP connection', () => {
+    it('should spawn npx chrome-devtools-mcp with --experimental-vision (persistent mode by default)', async () => {
+      const manager = new BrowserManager(mockConfig);
+      await manager.ensureConnection();
+
+      // Verify StdioClientTransport was created with correct args
+      expect(StdioClientTransport).toHaveBeenCalledWith(
+        expect.objectContaining({
+          command: 'npx',
+          args: expect.arrayContaining([
+            '-y',
+            expect.stringMatching(/chrome-devtools-mcp@/),
+            '--experimental-vision',
+          ]),
+        }),
+      );
+      // Persistent mode should NOT include --isolated or --autoConnect
+      const args = vi.mocked(StdioClientTransport).mock.calls[0]?.[0]
+        ?.args as string[];
+      expect(args).not.toContain('--isolated');
+      expect(args).not.toContain('--autoConnect');
+      // Persistent mode should set the default --userDataDir under ~/.gemini
+      expect(args).toContain('--userDataDir');
+      const userDataDirIndex = args.indexOf('--userDataDir');
+      expect(args[userDataDirIndex + 1]).toMatch(/cli-browser-profile$/);
+    });
+
+    it('should pass headless flag when configured', async () => {
+      const headlessConfig = makeFakeConfig({
+        agents: {
+          overrides: {
+            browser_agent: {
+              enabled: true,
+            },
+          },
+          browser: {
+            headless: true,
+          },
+        },
+      });
+
+      const manager = new BrowserManager(headlessConfig);
+      await manager.ensureConnection();
+
+      expect(StdioClientTransport).toHaveBeenCalledWith(
+        expect.objectContaining({
+          command: 'npx',
+          args: expect.arrayContaining(['--headless']),
+        }),
+      );
+    });
+
+    it('should pass profilePath as --userDataDir when configured', async () => {
+      const profileConfig = makeFakeConfig({
+        agents: {
+          overrides: {
+            browser_agent: {
+              enabled: true,
+            },
+          },
+          browser: {
+            profilePath: '/path/to/profile',
+          },
+        },
+      });
+
+      const manager = new BrowserManager(profileConfig);
+      await manager.ensureConnection();
+
+      expect(StdioClientTransport).toHaveBeenCalledWith(
+        expect.objectContaining({
+          command: 'npx',
+          args: expect.arrayContaining(['--userDataDir', '/path/to/profile']),
+        }),
+      );
+    });
+
+    it('should pass --isolated when sessionMode is isolated', async () => {
+      const isolatedConfig = makeFakeConfig({
+        agents: {
+          overrides: {
+            browser_agent: {
+              enabled: true,
+            },
+          },
+          browser: {
+            sessionMode: 'isolated',
+          },
+        },
+      });
+
+      const manager = new BrowserManager(isolatedConfig);
+      await manager.ensureConnection();
+
+      const args = vi.mocked(StdioClientTransport).mock.calls[0]?.[0]
+        ?.args as string[];
+      expect(args).toContain('--isolated');
+      expect(args).not.toContain('--autoConnect');
+    });
+
+    it('should pass --autoConnect when sessionMode is existing', async () => {
+      const existingConfig = makeFakeConfig({
+        agents: {
+          overrides: {
+            browser_agent: {
+              enabled: true,
+            },
+          },
+          browser: {
+            sessionMode: 'existing',
+          },
+        },
+      });
+
+      const manager = new BrowserManager(existingConfig);
+      await manager.ensureConnection();
+
+      const args = vi.mocked(StdioClientTransport).mock.calls[0]?.[0]
+        ?.args as string[];
+      expect(args).toContain('--autoConnect');
+      expect(args).not.toContain('--isolated');
+    });
+
+    it('should throw actionable error when existing mode connection fails', async () => {
+      // Make the Client mock's connect method reject
+      vi.mocked(Client).mockImplementation(
+        () =>
+          ({
+            connect: vi.fn().mockRejectedValue(new Error('Connection refused')),
+            close: vi.fn().mockResolvedValue(undefined),
+            listTools: vi.fn(),
+            callTool: vi.fn(),
+          }) as unknown as InstanceType<typeof Client>,
+      );
+
+      const existingConfig = makeFakeConfig({
+        agents: {
+          overrides: {
+            browser_agent: {
+              enabled: true,
+            },
+          },
+          browser: {
+            sessionMode: 'existing',
+          },
+        },
+      });
+
+      const manager = new BrowserManager(existingConfig);
+
+      await expect(manager.ensureConnection()).rejects.toThrow(
+        /Failed to connect to existing Chrome instance/,
+      );
+      // Create a fresh manager to verify the error message includes remediation steps
+      const manager2 = new BrowserManager(existingConfig);
+      await expect(manager2.ensureConnection()).rejects.toThrow(
+        /chrome:\/\/inspect\/#remote-debugging/,
+      );
+    });
+
+    it('should throw profile-lock remediation when persistent mode hits "already running"', async () => {
+      vi.mocked(Client).mockImplementation(
+        () =>
+          ({
+            connect: vi
+              .fn()
+              .mockRejectedValue(
+                new Error(
+                  'Could not connect to Chrome. The browser is already running for the current profile.',
+                ),
+              ),
+            close: vi.fn().mockResolvedValue(undefined),
+            listTools: vi.fn(),
+            callTool: vi.fn(),
+          }) as unknown as InstanceType<typeof Client>,
+      );
+
+      // Default config = persistent mode
+      const manager = new BrowserManager(mockConfig);
+
+      await expect(manager.ensureConnection()).rejects.toThrow(
+        /Close all Chrome windows using this profile/,
+      );
+      const manager2 = new BrowserManager(mockConfig);
+      await expect(manager2.ensureConnection()).rejects.toThrow(
+        /Set sessionMode to "isolated"/,
+      );
+    });
+
+    it('should throw timeout-specific remediation for persistent mode', async () => {
+      vi.mocked(Client).mockImplementation(
+        () =>
+          ({
+            connect: vi
+              .fn()
+              .mockRejectedValue(
+                new Error('Timed out connecting to chrome-devtools-mcp'),
+              ),
+            close: vi.fn().mockResolvedValue(undefined),
+            listTools: vi.fn(),
+            callTool: vi.fn(),
+          }) as unknown as InstanceType<typeof Client>,
+      );
+
+      const manager = new BrowserManager(mockConfig);
+
+      await expect(manager.ensureConnection()).rejects.toThrow(
+        /Chrome is not installed/,
+      );
+    });
+
+    it('should include sessionMode in generic fallback error', async () => {
+      vi.mocked(Client).mockImplementation(
+        () =>
+          ({
+            connect: vi
+              .fn()
+              .mockRejectedValue(new Error('Some unexpected error')),
+            close: vi.fn().mockResolvedValue(undefined),
+            listTools: vi.fn(),
+            callTool: vi.fn(),
+          }) as unknown as InstanceType<typeof Client>,
+      );
+
+      const manager = new BrowserManager(mockConfig);
+
+      await expect(manager.ensureConnection()).rejects.toThrow(
+        /sessionMode: persistent/,
+      );
+    });
+  });
+
+  describe('MCP isolation', () => {
+    it('should use raw MCP SDK Client, not McpClient wrapper', async () => {
+      const manager = new BrowserManager(mockConfig);
+      await manager.ensureConnection();
+
+      // Verify we're using the raw Client from MCP SDK
+      expect(Client).toHaveBeenCalledWith(
+        expect.objectContaining({
+          name: 'gemini-cli-browser-agent',
+        }),
+        expect.any(Object),
+      );
+    });
+
+    it('should not use McpClientManager from config', async () => {
+      // Spy on config method to verify isolation
+      const getMcpClientManagerSpy = vi.spyOn(
+        mockConfig,
+        'getMcpClientManager',
+      );
+
+      const manager = new BrowserManager(mockConfig);
+      await manager.ensureConnection();
+
+      // Config's getMcpClientManager should NOT be called
+      // This ensures isolation from main registry
+      expect(getMcpClientManagerSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('close', () => {
+    it('should close MCP connections', async () => {
+      const manager = new BrowserManager(mockConfig);
+      const client = await manager.getRawMcpClient();
+
+      await manager.close();
+
+      expect(client.close).toHaveBeenCalled();
+    });
+  });
+});

packages/core/src/agents/browser/browserManager.ts

@@ -0,0 +1,436 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @fileoverview Manages browser lifecycle for the Browser Agent.
+ *
+ * Handles:
+ * - Browser management via chrome-devtools-mcp with --isolated mode
+ * - CDP connection via raw MCP SDK Client (NOT registered in main registry)
+ * - Visual tools via --experimental-vision flag
+ *
+ * IMPORTANT: The MCP client here is ISOLATED from the main agent's tool registry.
+ * Tools discovered from chrome-devtools-mcp are NOT registered in the main registry.
+ * They are wrapped as DeclarativeTools and passed directly to the browser agent.
+ */
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import type { Tool as McpTool } from '@modelcontextprotocol/sdk/types.js';
+import { debugLogger } from '../../utils/debugLogger.js';
+import type { Config } from '../../config/config.js';
+import { Storage } from '../../config/storage.js';
+import * as path from 'node:path';
+
+// Pin chrome-devtools-mcp version for reproducibility.
+const CHROME_DEVTOOLS_MCP_VERSION = '0.17.1';
+
+// Default browser profile directory name within ~/.gemini/
+const BROWSER_PROFILE_DIR = 'cli-browser-profile';
+
+// Default timeout for MCP operations
+const MCP_TIMEOUT_MS = 60_000;
+
+/**
+ * Content item from an MCP tool call response.
+ * Can be text or image (for take_screenshot).
+ */
+export interface McpContentItem {
+  type: 'text' | 'image';
+  text?: string;
+  /** Base64-encoded image data (for type='image') */
+  data?: string;
+  /** MIME type of the image (e.g., 'image/png') */
+  mimeType?: string;
+}
+
+/**
+ * Result from an MCP tool call.
+ */
+export interface McpToolCallResult {
+  content?: McpContentItem[];
+  isError?: boolean;
+}
+
+/**
+ * Manages browser lifecycle and ISOLATED MCP client for the Browser Agent.
+ *
+ * The browser is launched and managed by chrome-devtools-mcp in --isolated mode.
+ * Visual tools (click_at, etc.) are enabled via --experimental-vision flag.
+ *
+ * Key isolation property: The MCP client here does NOT register tools
+ * in the main ToolRegistry. Tools are kept local to the browser agent.
+ */
+export class BrowserManager {
+  // Raw MCP SDK Client - NOT the wrapper McpClient
+  private rawMcpClient: Client | undefined;
+  private mcpTransport: StdioClientTransport | undefined;
+  private discoveredTools: McpTool[] = [];
+
+  constructor(private config: Config) {}
+
+  /**
+   * Gets the raw MCP SDK Client for direct tool calls.
+   * This client is ISOLATED from the main tool registry.
+   */
+  async getRawMcpClient(): Promise<Client> {
+    if (this.rawMcpClient) {
+      return this.rawMcpClient;
+    }
+    await this.ensureConnection();
+    if (!this.rawMcpClient) {
+      throw new Error('Failed to initialize chrome-devtools MCP client');
+    }
+    return this.rawMcpClient;
+  }
+
+  /**
+   * Gets the tool definitions discovered from the MCP server.
+   * These are dynamically fetched from chrome-devtools-mcp.
+   */
+  async getDiscoveredTools(): Promise<McpTool[]> {
+    await this.ensureConnection();
+    return this.discoveredTools;
+  }
+
+  /**
+   * Calls a tool on the MCP server.
+   *
+   * @param toolName The name of the tool to call
+   * @param args Arguments to pass to the tool
+   * @param signal Optional AbortSignal to cancel the call
+   * @returns The result from the MCP server
+   */
+  async callTool(
+    toolName: string,
+    args: Record<string, unknown>,
+    signal?: AbortSignal,
+  ): Promise<McpToolCallResult> {
+    if (signal?.aborted) {
+      throw signal.reason ?? new Error('Operation cancelled');
+    }
+
+    const client = await this.getRawMcpClient();
+    const callPromise = client.callTool(
+      { name: toolName, arguments: args },
+      undefined,
+      { timeout: MCP_TIMEOUT_MS },
+    );
+
+    // If no signal, just await directly
+    if (!signal) {
+      return this.toResult(await callPromise);
+    }
+
+    // Race the call against the abort signal
+    let onAbort: (() => void) | undefined;
+    try {
+      const result = await Promise.race([
+        callPromise,
+        new Promise<never>((_resolve, reject) => {
+          onAbort = () =>
+            reject(signal.reason ?? new Error('Operation cancelled'));
+          signal.addEventListener('abort', onAbort, { once: true });
+        }),
+      ]);
+      return this.toResult(result);
+    } finally {
+      if (onAbort) {
+        signal.removeEventListener('abort', onAbort);
+      }
+    }
+  }
+
+  /**
+   * Safely maps a raw MCP SDK callTool response to our typed McpToolCallResult
+   * without using unsafe type assertions.
+   */
+  private toResult(
+    raw: Awaited<ReturnType<Client['callTool']>>,
+  ): McpToolCallResult {
+    return {
+      content: Array.isArray(raw.content)
+        ? raw.content.map(
+            (item: {
+              type?: string;
+              text?: string;
+              data?: string;
+              mimeType?: string;
+            }) => ({
+              type: item.type === 'image' ? 'image' : 'text',
+              text: item.text,
+              data: item.data,
+              mimeType: item.mimeType,
+            }),
+          )
+        : undefined,
+      isError: raw.isError === true,
+    };
+  }
+
+  /**
+   * Ensures browser and MCP client are connected.
+   */
+  async ensureConnection(): Promise<void> {
+    if (this.rawMcpClient) {
+      return;
+    }
+    await this.connectMcp();
+  }
+
+  /**
+   * Closes browser and cleans up connections.
+   * The browser process is managed by chrome-devtools-mcp, so closing
+   * the transport will terminate the browser.
+   */
+  async close(): Promise<void> {
+    // Close MCP client first
+    if (this.rawMcpClient) {
+      try {
+        await this.rawMcpClient.close();
+      } catch (error) {
+        debugLogger.error(
+          `Error closing MCP client: ${error instanceof Error ? error.message : String(error)}`,
+        );
+      }
+      this.rawMcpClient = undefined;
+    }
+
+    // Close transport (this terminates the npx process and browser)
+    if (this.mcpTransport) {
+      try {
+        await this.mcpTransport.close();
+      } catch (error) {
+        debugLogger.error(
+          `Error closing MCP transport: ${error instanceof Error ? error.message : String(error)}`,
+        );
+      }
+      this.mcpTransport = undefined;
+    }
+
+    this.discoveredTools = [];
+  }
+
+  /**
+   * Connects to chrome-devtools-mcp which manages the browser process.
+   *
+   * Spawns npx chrome-devtools-mcp with:
+   * - --isolated: Manages its own browser instance
+   * - --experimental-vision: Enables visual tools (click_at, etc.)
+   *
+   * IMPORTANT: This does NOT use McpClientManager and does NOT register
+   * tools in the main ToolRegistry. The connection is isolated to this
+   * BrowserManager instance.
+   */
+  private async connectMcp(): Promise<void> {
+    debugLogger.log('Connecting isolated MCP client to chrome-devtools-mcp...');
+
+    // Create raw MCP SDK Client (not the wrapper McpClient)
+    this.rawMcpClient = new Client(
+      {
+        name: 'gemini-cli-browser-agent',
+        version: '1.0.0',
+      },
+      {
+        capabilities: {},
+      },
+    );
+
+    // Build args for chrome-devtools-mcp
+    const browserConfig = this.config.getBrowserAgentConfig();
+    const sessionMode = browserConfig.customConfig.sessionMode ?? 'persistent';
+
+    const mcpArgs = [
+      '-y',
+      `chrome-devtools-mcp@${CHROME_DEVTOOLS_MCP_VERSION}`,
+      '--experimental-vision',
+    ];
+
+    // Session mode determines how the browser is managed:
+    // - "isolated": Temp profile, cleaned up after session (--isolated)
+    // - "persistent": Persistent profile at ~/.gemini/cli-browser-profile/ (default)
+    // - "existing": Connect to already-running Chrome (--autoConnect, requires
+    //   remote debugging enabled at chrome://inspect/#remote-debugging)
+    if (sessionMode === 'isolated') {
+      mcpArgs.push('--isolated');
+    } else if (sessionMode === 'existing') {
+      mcpArgs.push('--autoConnect');
+    }
+
+    // Add optional settings from config
+    if (browserConfig.customConfig.headless) {
+      mcpArgs.push('--headless');
+    }
+    if (browserConfig.customConfig.profilePath) {
+      mcpArgs.push('--userDataDir', browserConfig.customConfig.profilePath);
+    } else if (sessionMode === 'persistent') {
+      // Default persistent profile lives under ~/.gemini/cli-browser-profile
+      const defaultProfilePath = path.join(
+        Storage.getGlobalGeminiDir(),
+        BROWSER_PROFILE_DIR,
+      );
+      mcpArgs.push('--userDataDir', defaultProfilePath);
+    }
+
+    debugLogger.log(
+      `Launching chrome-devtools-mcp (${sessionMode} mode) with args: ${mcpArgs.join(' ')}`,
+    );
+
+    // Create stdio transport to npx chrome-devtools-mcp.
+    // stderr is piped (not inherited) to prevent MCP server banners and
+    // warnings from corrupting the UI in alternate buffer mode.
+    this.mcpTransport = new StdioClientTransport({
+      command: 'npx',
+      args: mcpArgs,
+      stderr: 'pipe',
+    });
+
+    // Forward piped stderr to debugLogger so it's visible with --debug.
+    const stderrStream = this.mcpTransport.stderr;
+    if (stderrStream) {
+      stderrStream.on('data', (chunk: Buffer) => {
+        debugLogger.log(
+          `[chrome-devtools-mcp stderr] ${chunk.toString().trimEnd()}`,
+        );
+      });
+    }
+
+    this.mcpTransport.onclose = () => {
+      debugLogger.error(
+        'chrome-devtools-mcp transport closed unexpectedly. ' +
+          'The MCP server process may have crashed.',
+      );
+      this.rawMcpClient = undefined;
+    };
+    this.mcpTransport.onerror = (error: Error) => {
+      debugLogger.error(
+        `chrome-devtools-mcp transport error: ${error.message}`,
+      );
+    };
+
+    // Connect to MCP server — use a shorter timeout for 'existing' mode
+    // since it should connect quickly if remote debugging is enabled.
+    const connectTimeoutMs =
+      sessionMode === 'existing' ? 15_000 : MCP_TIMEOUT_MS;
+
+    let timeoutId: ReturnType<typeof setTimeout> | undefined;
+    try {
+      await Promise.race([
+        (async () => {
+          await this.rawMcpClient!.connect(this.mcpTransport!);
+          debugLogger.log('MCP client connected to chrome-devtools-mcp');
+          await this.discoverTools();
+        })(),
+        new Promise<never>((_, reject) => {
+          timeoutId = setTimeout(
+            () =>
+              reject(
+                new Error(
+                  `Timed out connecting to chrome-devtools-mcp (${connectTimeoutMs}ms)`,
+                ),
+              ),
+            connectTimeoutMs,
+          );
+        }),
+      ]);
+    } catch (error) {
+      await this.close();
+
+      // Provide error-specific, session-mode-aware remediation
+      throw this.createConnectionError(
+        error instanceof Error ? error.message : String(error),
+        sessionMode,
+      );
+    } finally {
+      if (timeoutId !== undefined) {
+        clearTimeout(timeoutId);
+      }
+    }
+  }
+
+  /**
+   * Creates an Error with context-specific remediation based on the actual
+   * error message and the current sessionMode.
+   */
+  private createConnectionError(message: string, sessionMode: string): Error {
+    const lowerMessage = message.toLowerCase();
+
+    // "already running for the current profile" — persistent mode profile lock
+    if (lowerMessage.includes('already running')) {
+      if (sessionMode === 'persistent' || sessionMode === 'isolated') {
+        return new Error(
+          `Could not connect to Chrome: ${message}\n\n` +
+            `The Chrome profile is locked by another running instance.\n` +
+            `To fix this:\n` +
+            `  1. Close all Chrome windows using this profile, OR\n` +
+            `  2. Set sessionMode to "isolated" in settings.json to use a temporary profile, OR\n` +
+            `  3. Set profilePath in settings.json to use a different profile directory`,
+        );
+      }
+      // existing mode — shouldn't normally hit this, but handle gracefully
+      return new Error(
+        `Could not connect to Chrome: ${message}\n\n` +
+          `The Chrome profile is locked.\n` +
+          `Close other Chrome instances and try again.`,
+      );
+    }
+
+    // Timeout errors
+    if (lowerMessage.includes('timed out')) {
+      if (sessionMode === 'existing') {
+        return new Error(
+          `Timed out connecting to Chrome: ${message}\n\n` +
+            `To use sessionMode "existing", you must:\n` +
+            `  1. Open Chrome (version 144+)\n` +
+            `  2. Navigate to chrome://inspect/#remote-debugging\n` +
+            `  3. Enable remote debugging\n\n` +
+            `Alternatively, set sessionMode to "persistent" (default) in settings.json to launch a dedicated browser.`,
+        );
+      }
+      return new Error(
+        `Timed out connecting to Chrome: ${message}\n\n` +
+          `Possible causes:\n` +
+          `  1. Chrome is not installed or not in PATH\n` +
+          `  2. npx cannot download chrome-devtools-mcp (check network/proxy)\n` +
+          `  3. Chrome failed to start (try setting headless: true in settings.json)`,
+      );
+    }
+
+    // Generic "existing" mode failures (connection refused, etc.)
+    if (sessionMode === 'existing') {
+      return new Error(
+        `Failed to connect to existing Chrome instance: ${message}\n\n` +
+          `To use sessionMode "existing", you must:\n` +
+          `  1. Open Chrome (version 144+)\n` +
+          `  2. Navigate to chrome://inspect/#remote-debugging\n` +
+          `  3. Enable remote debugging\n\n` +
+          `Alternatively, set sessionMode to "persistent" (default) in settings.json to launch a dedicated browser.`,
+      );
+    }
+
+    // Generic fallback — include sessionMode for debugging context
+    return new Error(
+      `Failed to connect to Chrome (sessionMode: ${sessionMode}): ${message}`,
+    );
+  }
+
+  /**
+   * Discovers tools from the connected MCP server.
+   */
+  private async discoverTools(): Promise<void> {
+    if (!this.rawMcpClient) {
+      throw new Error('MCP client not connected');
+    }
+
+    const response = await this.rawMcpClient.listTools();
+    this.discoveredTools = response.tools;
+
+    debugLogger.log(
+      `Discovered ${this.discoveredTools.length} tools from chrome-devtools-mcp: ` +
+        this.discoveredTools.map((t) => t.name).join(', '),
+    );
+  }
+}

packages/core/src/agents/browser/mcpToolWrapper.test.ts

@@ -0,0 +1,196 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { createMcpDeclarativeTools } from './mcpToolWrapper.js';
+import type { BrowserManager, McpToolCallResult } from './browserManager.js';
+import type { MessageBus } from '../../confirmation-bus/message-bus.js';
+import type { Tool as McpTool } from '@modelcontextprotocol/sdk/types.js';
+
+describe('mcpToolWrapper', () => {
+  let mockBrowserManager: BrowserManager;
+  let mockMessageBus: MessageBus;
+  let mockMcpTools: McpTool[];
+
+  beforeEach(() => {
+    vi.resetAllMocks();
+
+    // Setup mock MCP tools discovered from server
+    mockMcpTools = [
+      {
+        name: 'take_snapshot',
+        description: 'Take a snapshot of the page accessibility tree',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            verbose: { type: 'boolean', description: 'Include details' },
+          },
+        },
+      },
+      {
+        name: 'click',
+        description: 'Click on an element by uid',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            uid: { type: 'string', description: 'Element uid' },
+          },
+          required: ['uid'],
+        },
+      },
+    ];
+
+    // Setup mock browser manager
+    mockBrowserManager = {
+      getDiscoveredTools: vi.fn().mockResolvedValue(mockMcpTools),
+      callTool: vi.fn().mockResolvedValue({
+        content: [{ type: 'text', text: 'Tool result' }],
+      } as McpToolCallResult),
+    } as unknown as BrowserManager;
+
+    // Setup mock message bus
+    mockMessageBus = {
+      publish: vi.fn().mockResolvedValue(undefined),
+      subscribe: vi.fn(),
+      unsubscribe: vi.fn(),
+    } as unknown as MessageBus;
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('createMcpDeclarativeTools', () => {
+    it('should create declarative tools from discovered MCP tools', async () => {
+      const tools = await createMcpDeclarativeTools(
+        mockBrowserManager,
+        mockMessageBus,
+      );
+
+      expect(tools).toHaveLength(3);
+      expect(tools[0].name).toBe('take_snapshot');
+      expect(tools[1].name).toBe('click');
+      expect(tools[2].name).toBe('type_text');
+    });
+
+    it('should return tools with correct description', async () => {
+      const tools = await createMcpDeclarativeTools(
+        mockBrowserManager,
+        mockMessageBus,
+      );
+
+      // Descriptions include augmented hints, so we check they contain the original
+      expect(tools[0].description).toContain(
+        'Take a snapshot of the page accessibility tree',
+      );
+      expect(tools[1].description).toContain('Click on an element by uid');
+    });
+
+    it('should return tools with proper FunctionDeclaration schema', async () => {
+      const tools = await createMcpDeclarativeTools(
+        mockBrowserManager,
+        mockMessageBus,
+      );
+
+      const schema = tools[0].schema;
+      expect(schema.name).toBe('take_snapshot');
+      expect(schema.parametersJsonSchema).toBeDefined();
+    });
+  });
+
+  describe('McpDeclarativeTool.build', () => {
+    it('should create invocation that can be executed', async () => {
+      const tools = await createMcpDeclarativeTools(
+        mockBrowserManager,
+        mockMessageBus,
+      );
+
+      const invocation = tools[0].build({ verbose: true });
+
+      expect(invocation).toBeDefined();
+      expect(invocation.params).toEqual({ verbose: true });
+    });
+
+    it('should return invocation with correct description', async () => {
+      const tools = await createMcpDeclarativeTools(
+        mockBrowserManager,
+        mockMessageBus,
+      );
+
+      const invocation = tools[0].build({});
+
+      expect(invocation.getDescription()).toContain('take_snapshot');
+    });
+  });
+
+  describe('McpToolInvocation.execute', () => {
+    it('should call browserManager.callTool with correct params', async () => {
+      const tools = await createMcpDeclarativeTools(
+        mockBrowserManager,
+        mockMessageBus,
+      );
+
+      const invocation = tools[1].build({ uid: 'elem-123' });
+      await invocation.execute(new AbortController().signal);
+
+      expect(mockBrowserManager.callTool).toHaveBeenCalledWith(
+        'click',
+        {
+          uid: 'elem-123',
+        },
+        expect.any(AbortSignal),
+      );
+    });
+
+    it('should return success result from MCP tool', async () => {
+      const tools = await createMcpDeclarativeTools(
+        mockBrowserManager,
+        mockMessageBus,
+      );
+
+      const invocation = tools[0].build({ verbose: true });
+      const result = await invocation.execute(new AbortController().signal);
+
+      expect(result.llmContent).toBe('Tool result');
+      expect(result.error).toBeUndefined();
+    });
+
+    it('should handle MCP tool errors', async () => {
+      vi.mocked(mockBrowserManager.callTool).mockResolvedValue({
+        content: [{ type: 'text', text: 'Element not found' }],
+        isError: true,
+      } as McpToolCallResult);
+
+      const tools = await createMcpDeclarativeTools(
+        mockBrowserManager,
+        mockMessageBus,
+      );
+
+      const invocation = tools[1].build({ uid: 'invalid' });
+      const result = await invocation.execute(new AbortController().signal);
+
+      expect(result.error).toBeDefined();
+      expect(result.error?.message).toBe('Element not found');
+    });
+
+    it('should handle exceptions during tool call', async () => {
+      vi.mocked(mockBrowserManager.callTool).mockRejectedValue(
+        new Error('Connection lost'),
+      );
+
+      const tools = await createMcpDeclarativeTools(
+        mockBrowserManager,
+        mockMessageBus,
+      );
+
+      const invocation = tools[0].build({});
+      const result = await invocation.execute(new AbortController().signal);
+
+      expect(result.error).toBeDefined();
+      expect(result.error?.message).toBe('Connection lost');
+    });
+  });
+});

packages/core/src/agents/browser/mcpToolWrapper.ts

@@ -0,0 +1,545 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @fileoverview Creates DeclarativeTool classes for MCP tools.
+ *
+ * These tools are ONLY registered in the browser agent's isolated ToolRegistry,
+ * NOT in the main agent's registry. They dispatch to the BrowserManager's
+ * isolated MCP client directly.
+ *
+ * Tool definitions are dynamically discovered from chrome-devtools-mcp
+ * at runtime, not hardcoded.
+ */
+
+import type { FunctionDeclaration } from '@google/genai';
+import type { Tool as McpTool } from '@modelcontextprotocol/sdk/types.js';
+import {
+  type ToolConfirmationOutcome,
+  DeclarativeTool,
+  BaseToolInvocation,
+  Kind,
+  type ToolResult,
+  type ToolInvocation,
+  type ToolCallConfirmationDetails,
+  type PolicyUpdateOptions,
+} from '../../tools/tools.js';
+import type { MessageBus } from '../../confirmation-bus/message-bus.js';
+import type { BrowserManager, McpToolCallResult } from './browserManager.js';
+import { debugLogger } from '../../utils/debugLogger.js';
+
+/**
+ * Tool invocation that dispatches to BrowserManager's isolated MCP client.
+ */
+class McpToolInvocation extends BaseToolInvocation<
+  Record<string, unknown>,
+  ToolResult
+> {
+  constructor(
+    private readonly browserManager: BrowserManager,
+    private readonly toolName: string,
+    params: Record<string, unknown>,
+    messageBus: MessageBus,
+  ) {
+    super(params, messageBus, toolName, toolName);
+  }
+
+  getDescription(): string {
+    return `Calling MCP tool: ${this.toolName}`;
+  }
+
+  protected override async getConfirmationDetails(
+    _abortSignal: AbortSignal,
+  ): Promise<ToolCallConfirmationDetails | false> {
+    if (!this.messageBus) {
+      return false;
+    }
+
+    return {
+      type: 'mcp',
+      title: `Confirm MCP Tool: ${this.toolName}`,
+      serverName: 'browser-agent',
+      toolName: this.toolName,
+      toolDisplayName: this.toolName,
+      onConfirm: async (outcome: ToolConfirmationOutcome) => {
+        await this.publishPolicyUpdate(outcome);
+      },
+    };
+  }
+
+  protected override getPolicyUpdateOptions(
+    _outcome: ToolConfirmationOutcome,
+  ): PolicyUpdateOptions | undefined {
+    return {
+      mcpName: 'browser-agent',
+    };
+  }
+
+  async execute(signal: AbortSignal): Promise<ToolResult> {
+    try {
+      const callToolPromise = this.browserManager.callTool(
+        this.toolName,
+        this.params,
+        signal,
+      );
+
+      const result: McpToolCallResult = await callToolPromise;
+
+      // Extract text content from MCP response
+      let textContent = '';
+      if (result.content && Array.isArray(result.content)) {
+        textContent = result.content
+          .filter((c) => c.type === 'text' && c.text)
+          .map((c) => c.text)
+          .join('\n');
+      }
+
+      // Post-process to add contextual hints for common error patterns
+      const processedContent = postProcessToolResult(
+        this.toolName,
+        textContent,
+      );
+
+      if (result.isError) {
+        return {
+          llmContent: `Error: ${processedContent}`,
+          returnDisplay: `Error: ${processedContent}`,
+          error: { message: textContent },
+        };
+      }
+
+      return {
+        llmContent: processedContent || 'Tool executed successfully.',
+        returnDisplay: processedContent || 'Tool executed successfully.',
+      };
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+
+      // Chrome connection errors are fatal — re-throw to terminate the agent
+      // immediately instead of returning a result the LLM would retry.
+      if (errorMsg.includes('Could not connect to Chrome')) {
+        throw error;
+      }
+
+      debugLogger.error(`MCP tool ${this.toolName} failed: ${errorMsg}`);
+      return {
+        llmContent: `Error: ${errorMsg}`,
+        returnDisplay: `Error: ${errorMsg}`,
+        error: { message: errorMsg },
+      };
+    }
+  }
+}
+
+/**
+ * Composite tool invocation that types a full string by calling press_key
+ * for each character internally, avoiding N model round-trips.
+ */
+class TypeTextInvocation extends BaseToolInvocation<
+  Record<string, unknown>,
+  ToolResult
+> {
+  constructor(
+    private readonly browserManager: BrowserManager,
+    private readonly text: string,
+    private readonly submitKey: string | undefined,
+    messageBus: MessageBus,
+  ) {
+    super({ text, submitKey }, messageBus, 'type_text', 'type_text');
+  }
+
+  getDescription(): string {
+    const preview = `"${this.text.substring(0, 50)}${this.text.length > 50 ? '...' : ''}"`;
+    return this.submitKey
+      ? `type_text: ${preview} + ${this.submitKey}`
+      : `type_text: ${preview}`;
+  }
+
+  protected override async getConfirmationDetails(
+    _abortSignal: AbortSignal,
+  ): Promise<ToolCallConfirmationDetails | false> {
+    if (!this.messageBus) {
+      return false;
+    }
+
+    return {
+      type: 'mcp',
+      title: `Confirm Tool: type_text`,
+      serverName: 'browser-agent',
+      toolName: 'type_text',
+      toolDisplayName: 'type_text',
+      onConfirm: async (outcome: ToolConfirmationOutcome) => {
+        await this.publishPolicyUpdate(outcome);
+      },
+    };
+  }
+
+  protected override getPolicyUpdateOptions(
+    _outcome: ToolConfirmationOutcome,
+  ): PolicyUpdateOptions | undefined {
+    return {
+      mcpName: 'browser-agent',
+    };
+  }
+
+  override async execute(signal: AbortSignal): Promise<ToolResult> {
+    try {
+      if (signal.aborted) {
+        return {
+          llmContent: 'Error: Operation cancelled before typing started.',
+          returnDisplay: 'Operation cancelled before typing started.',
+          error: { message: 'Operation cancelled' },
+        };
+      }
+
+      await this.typeCharByChar(signal);
+
+      // Optionally press a submit key (Enter, Tab, etc.) after typing
+      if (this.submitKey && !signal.aborted) {
+        const keyResult = await this.browserManager.callTool(
+          'press_key',
+          { key: this.submitKey },
+          signal,
+        );
+        if (keyResult.isError) {
+          const errText = this.extractErrorText(keyResult);
+          debugLogger.warn(
+            `type_text: submitKey("${this.submitKey}") failed: ${errText}`,
+          );
+        }
+      }
+
+      const summary = this.submitKey
+        ? `Successfully typed "${this.text}" and pressed ${this.submitKey}`
+        : `Successfully typed "${this.text}"`;
+
+      return {
+        llmContent: summary,
+        returnDisplay: summary,
+      };
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+
+      // Chrome connection errors are fatal
+      if (errorMsg.includes('Could not connect to Chrome')) {
+        throw error;
+      }
+
+      debugLogger.error(`type_text failed: ${errorMsg}`);
+      return {
+        llmContent: `Error: ${errorMsg}`,
+        returnDisplay: `Error: ${errorMsg}`,
+        error: { message: errorMsg },
+      };
+    }
+  }
+
+  /** Types each character via individual press_key MCP calls. */
+  private async typeCharByChar(signal: AbortSignal): Promise<void> {
+    const chars = [...this.text]; // Handle Unicode correctly
+    for (const char of chars) {
+      if (signal.aborted) return;
+
+      // Map special characters to key names
+      const key = char === ' ' ? 'Space' : char;
+      const result = await this.browserManager.callTool(
+        'press_key',
+        { key },
+        signal,
+      );
+
+      if (result.isError) {
+        debugLogger.warn(
+          `type_text: press_key("${key}") failed: ${this.extractErrorText(result)}`,
+        );
+      }
+    }
+  }
+
+  /** Extract error text from an MCP tool result. */
+  private extractErrorText(result: McpToolCallResult): string {
+    return (
+      result.content
+        ?.filter(
+          (c: { type: string; text?: string }) => c.type === 'text' && c.text,
+        )
+        .map((c: { type: string; text?: string }) => c.text)
+        .join('\n') || 'Unknown error'
+    );
+  }
+}
+
+/**
+ * DeclarativeTool wrapper for an MCP tool.
+ */
+class McpDeclarativeTool extends DeclarativeTool<
+  Record<string, unknown>,
+  ToolResult
+> {
+  constructor(
+    private readonly browserManager: BrowserManager,
+    name: string,
+    description: string,
+    parameterSchema: unknown,
+    messageBus: MessageBus,
+  ) {
+    super(
+      name,
+      name,
+      description,
+      Kind.Other,
+      parameterSchema,
+      messageBus,
+      /* isOutputMarkdown */ true,
+      /* canUpdateOutput */ false,
+    );
+  }
+
+  build(
+    params: Record<string, unknown>,
+  ): ToolInvocation<Record<string, unknown>, ToolResult> {
+    return new McpToolInvocation(
+      this.browserManager,
+      this.name,
+      params,
+      this.messageBus,
+    );
+  }
+}
+
+/**
+ * DeclarativeTool for the custom type_text composite tool.
+ */
+class TypeTextDeclarativeTool extends DeclarativeTool<
+  Record<string, unknown>,
+  ToolResult
+> {
+  constructor(
+    private readonly browserManager: BrowserManager,
+    messageBus: MessageBus,
+  ) {
+    super(
+      'type_text',
+      'type_text',
+      'Types a full text string into the currently focused element. ' +
+        'Much faster than calling press_key for each character individually. ' +
+        'Use this to enter text into form fields, search boxes, spreadsheet cells, or any focused input. ' +
+        'The element must already be focused (e.g., after a click). ' +
+        'Use submitKey to press a key after typing (e.g., submitKey="Enter" to submit a form or confirm a value, submitKey="Tab" to move to the next field).',
+      Kind.Other,
+      {
+        type: 'object',
+        properties: {
+          text: {
+            type: 'string',
+            description: 'The text to type into the focused element.',
+          },
+          submitKey: {
+            type: 'string',
+            description:
+              'Optional key to press after typing (e.g., "Enter", "Tab", "Escape"). ' +
+              'Useful for submitting form fields or moving to the next cell in a spreadsheet.',
+          },
+        },
+        required: ['text'],
+      },
+      messageBus,
+      /* isOutputMarkdown */ true,
+      /* canUpdateOutput */ false,
+    );
+  }
+
+  build(
+    params: Record<string, unknown>,
+  ): ToolInvocation<Record<string, unknown>, ToolResult> {
+    const submitKey =
+      typeof params['submitKey'] === 'string' && params['submitKey']
+        ? params['submitKey']
+        : undefined;
+    return new TypeTextInvocation(
+      this.browserManager,
+      String(params['text'] ?? ''),
+      submitKey,
+      this.messageBus,
+    );
+  }
+}
+
+/**
+ * Creates DeclarativeTool instances from dynamically discovered MCP tools,
+ * plus custom composite tools (like type_text).
+ *
+ * These tools are registered in the browser agent's isolated ToolRegistry,
+ * NOT in the main agent's registry.
+ *
+ * Tool definitions are fetched dynamically from the MCP server at runtime.
+ *
+ * @param browserManager The browser manager with isolated MCP client
+ * @param messageBus Message bus for tool invocations
+ * @returns Array of DeclarativeTools that dispatch to the isolated MCP client
+ */
+export async function createMcpDeclarativeTools(
+  browserManager: BrowserManager,
+  messageBus: MessageBus,
+): Promise<Array<McpDeclarativeTool | TypeTextDeclarativeTool>> {
+  // Get dynamically discovered tools from the MCP server
+  const mcpTools = await browserManager.getDiscoveredTools();
+
+  debugLogger.log(
+    `Creating ${mcpTools.length} declarative tools for browser agent`,
+  );
+
+  const tools: Array<McpDeclarativeTool | TypeTextDeclarativeTool> =
+    mcpTools.map((mcpTool) => {
+      const schema = convertMcpToolToFunctionDeclaration(mcpTool);
+      // Augment description with uid-context hints
+      const augmentedDescription = augmentToolDescription(
+        mcpTool.name,
+        mcpTool.description ?? '',
+      );
+      return new McpDeclarativeTool(
+        browserManager,
+        mcpTool.name,
+        augmentedDescription,
+        schema.parametersJsonSchema,
+        messageBus,
+      );
+    });
+
+  // Add custom composite tools
+  tools.push(new TypeTextDeclarativeTool(browserManager, messageBus));
+
+  debugLogger.log(
+    `Total tools registered: ${tools.length} (${mcpTools.length} MCP + 1 custom)`,
+  );
+
+  return tools;
+}
+
+/**
+ * Converts MCP tool definition to Gemini FunctionDeclaration.
+ */
+function convertMcpToolToFunctionDeclaration(
+  mcpTool: McpTool,
+): FunctionDeclaration {
+  // MCP tool inputSchema is a JSON Schema object
+  // We pass it directly as parametersJsonSchema
+  return {
+    name: mcpTool.name,
+    description: mcpTool.description ?? '',
+    parametersJsonSchema: mcpTool.inputSchema ?? {
+      type: 'object',
+      properties: {},
+    },
+  };
+}
+
+/**
+ * Augments MCP tool descriptions with usage guidance.
+ * Adds semantic hints and usage rules directly in tool descriptions
+ * so the model makes correct tool choices without system prompt overhead.
+ *
+ * Actual chrome-devtools-mcp tools:
+ *   Input: click, drag, fill, fill_form, handle_dialog, hover, press_key, upload_file
+ *   Navigation: close_page, list_pages, navigate_page, new_page, select_page, wait_for
+ *   Emulation: emulate, resize_page
+ *   Performance: performance_analyze_insight, performance_start_trace, performance_stop_trace
+ *   Network: get_network_request, list_network_requests
+ *   Debugging: evaluate_script, get_console_message, list_console_messages, take_screenshot, take_snapshot
+ *   Vision (--experimental-vision): click_at, analyze_screenshot
+ */
+function augmentToolDescription(toolName: string, description: string): string {
+  // More-specific keys MUST come before shorter keys to prevent
+  // partial matching from short-circuiting (e.g., fill_form before fill).
+  const hints: Record<string, string> = {
+    fill_form:
+      ' Fills multiple standard HTML form fields at once. Same limitations as fill — does not work on canvas/custom widgets.',
+    fill: ' Fills standard HTML form fields (<input>, <textarea>, <select>) by uid. Does NOT work on custom/canvas-based widgets (e.g., Google Sheets cells, Notion blocks). If fill times out or fails, click the element first then use press_key with individual characters instead.',
+    click_at:
+      ' Clicks at exact pixel coordinates (x, y). Use when you have specific coordinates for visual elements.',
+    click:
+      ' Use the element uid from the accessibility tree snapshot (e.g., uid="87_4"). UIDs are invalidated after this action — call take_snapshot before using another uid.',
+    hover:
+      ' Use the element uid from the accessibility tree snapshot to hover over elements.',
+    take_snapshot:
+      ' Returns the accessibility tree with uid values for each element. Call this FIRST to see available elements, and AFTER every state-changing action (click, fill, press_key) before using any uid.',
+    navigate_page:
+      ' Navigate to the specified URL. Call take_snapshot after to see the new page.',
+    new_page:
+      ' Opens a new page/tab with the specified URL. Call take_snapshot after to see the new page.',
+    press_key:
+      ' Press a SINGLE keyboard key (e.g., "Enter", "Tab", "Escape", "ArrowDown", "a", "8"). ONLY accepts one key name — do NOT pass multi-character strings like "Hello" or "A1\\nEnter". To type text, use type_text instead of calling press_key for each character.',
+  };
+
+  // Check for partial matches — order matters! More-specific keys first.
+  for (const [key, hint] of Object.entries(hints)) {
+    if (toolName.toLowerCase().includes(key)) {
+      return description + hint;
+    }
+  }
+
+  return description;
+}
+
+/**
+ * Post-processes tool results to add contextual hints for common error patterns.
+ * This helps the agent recover from overlay blocking, element not found, etc.
+ * Also strips embedded snapshots to prevent token bloat.
+ */
+export function postProcessToolResult(
+  toolName: string,
+  result: string,
+): string {
+  // Strip embedded snapshots to prevent token bloat (except for take_snapshot,
+  // whose accessibility tree the model needs for uid-based interactions).
+  let processedResult = result;
+
+  if (
+    toolName !== 'take_snapshot' &&
+    result.includes('## Latest page snapshot')
+  ) {
+    const parts = result.split('## Latest page snapshot');
+    processedResult = parts[0].trim();
+    if (parts[1]) {
+      debugLogger.log('Stripped embedded snapshot from tool response');
+    }
+  }
+
+  // Detect overlay/interactable issues
+  const overlayPatterns = [
+    'not interactable',
+    'obscured',
+    'intercept',
+    'blocked',
+    'element is not visible',
+    'element not found',
+  ];
+
+  const isOverlayIssue = overlayPatterns.some((pattern) =>
+    processedResult.toLowerCase().includes(pattern),
+  );
+
+  if (isOverlayIssue && (toolName === 'click' || toolName.includes('click'))) {
+    return (
+      processedResult +
+      '\n\n⚠️ This action may have been blocked by an overlay, popup, or tooltip. ' +
+      'Look for close/dismiss buttons (×, Close, "Got it", "Accept") in the accessibility tree and click them first.'
+    );
+  }
+
+  // Detect stale element references
+  if (
+    processedResult.toLowerCase().includes('stale') ||
+    processedResult.toLowerCase().includes('detached')
+  ) {
+    return (
+      processedResult +
+      '\n\n⚠️ The element reference is stale. Call take_snapshot to get fresh element uids.'
+    );
+  }
+
+  return processedResult;
+}

packages/core/src/agents/browser/mcpToolWrapperConfirmation.test.ts

@@ -0,0 +1,98 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { createMcpDeclarativeTools } from './mcpToolWrapper.js';
+import type { BrowserManager } from './browserManager.js';
+import type { MessageBus } from '../../confirmation-bus/message-bus.js';
+import { MessageBusType } from '../../confirmation-bus/types.js';
+import {
+  ToolConfirmationOutcome,
+  type ToolCallConfirmationDetails,
+  type PolicyUpdateOptions,
+} from '../../tools/tools.js';
+
+interface TestableConfirmation {
+  getConfirmationDetails(
+    signal: AbortSignal,
+  ): Promise<ToolCallConfirmationDetails | false>;
+  getPolicyUpdateOptions(
+    outcome: ToolConfirmationOutcome,
+  ): PolicyUpdateOptions | undefined;
+}
+
+describe('mcpToolWrapper Confirmation', () => {
+  let mockBrowserManager: BrowserManager;
+  let mockMessageBus: MessageBus;
+
+  beforeEach(() => {
+    mockBrowserManager = {
+      getDiscoveredTools: vi
+        .fn()
+        .mockResolvedValue([
+          { name: 'test_tool', description: 'desc', inputSchema: {} },
+        ]),
+      callTool: vi.fn(),
+    } as unknown as BrowserManager;
+
+    mockMessageBus = {
+      publish: vi.fn().mockResolvedValue(undefined),
+      subscribe: vi.fn(),
+      unsubscribe: vi.fn(),
+    } as unknown as MessageBus;
+  });
+
+  it('getConfirmationDetails returns specific MCP details', async () => {
+    const tools = await createMcpDeclarativeTools(
+      mockBrowserManager,
+      mockMessageBus,
+    );
+    const invocation = tools[0].build({}) as unknown as TestableConfirmation;
+
+    const details = await invocation.getConfirmationDetails(
+      new AbortController().signal,
+    );
+
+    expect(details).toEqual(
+      expect.objectContaining({
+        type: 'mcp',
+        serverName: 'browser-agent',
+        toolName: 'test_tool',
+      }),
+    );
+
+    // Verify onConfirm publishes policy update
+    const outcome = ToolConfirmationOutcome.ProceedAlways;
+
+    if (details && typeof details === 'object' && 'onConfirm' in details) {
+      await details.onConfirm(outcome);
+    }
+
+    expect(mockMessageBus.publish).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: MessageBusType.UPDATE_POLICY,
+        mcpName: 'browser-agent',
+        persist: false,
+      }),
+    );
+  });
+
+  it('getPolicyUpdateOptions returns correct options', async () => {
+    const tools = await createMcpDeclarativeTools(
+      mockBrowserManager,
+      mockMessageBus,
+    );
+    const invocation = tools[0].build({}) as unknown as TestableConfirmation;
+
+    const options = invocation.getPolicyUpdateOptions(
+      ToolConfirmationOutcome.ProceedAlways,
+    );
+
+    expect(options).toEqual({
+      mcpName: 'browser-agent',
+    });
+  });
+});

packages/core/src/agents/browser/modelAvailability.ts

@@ -0,0 +1,34 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @fileoverview Model configuration for browser agent.
+ *
+ * Provides the default visual agent model and utilities for resolving
+ * the configured model.
+ */
+
+import type { Config } from '../../config/config.js';
+import { debugLogger } from '../../utils/debugLogger.js';
+
+/**
+ * Default model for the visual agent (Computer Use capable).
+ */
+export const VISUAL_AGENT_MODEL = 'gemini-2.5-computer-use-preview-10-2025';
+
+/**
+ * Gets the visual agent model from config, falling back to default.
+ *
+ * @param config Runtime configuration
+ * @returns The model to use for visual agent
+ */
+export function getVisualAgentModel(config: Config): string {
+  const browserConfig = config.getBrowserAgentConfig();
+  const model = browserConfig.customConfig.visualModel ?? VISUAL_AGENT_MODEL;
+
+  debugLogger.log(`Visual agent model: ${model}`);
+  return model;
+}

packages/core/src/agents/registry.ts

@@ -12,6 +12,7 @@ import { loadAgentsFromDirectory } from './agentLoader.js';
 import { CodebaseInvestigatorAgent } from './codebase-investigator.js';
 import { CliHelpAgent } from './cli-help-agent.js';
 import { GeneralistAgent } from './generalist-agent.js';
+import { BrowserAgentDefinition } from './browser/browserAgentDefinition.js';
 import { A2AClientManager } from './a2a-client-manager.js';
 import { ADCHandler } from './remote-invocation.js';
 import { type z } from 'zod';
@@ -201,6 +202,13 @@ export class AgentRegistry {
     this.registerLocalAgent(CodebaseInvestigatorAgent(this.config));
     this.registerLocalAgent(CliHelpAgent(this.config));
     this.registerLocalAgent(GeneralistAgent(this.config));
+
+    // Register the browser agent if enabled in settings.
+    // Tools are configured dynamically at invocation time via browserAgentFactory.
+    const browserConfig = this.config.getBrowserAgentConfig();
+    if (browserConfig.enabled) {
+      this.registerLocalAgent(BrowserAgentDefinition(this.config));
+    }
   }
 
   private async refreshAgents(): Promise<void> {

packages/core/src/agents/subagent-tool-wrapper.ts

@@ -14,6 +14,8 @@ import type { Config } from '../config/config.js';
 import type { AgentDefinition, AgentInputs } from './types.js';
 import { LocalSubagentInvocation } from './local-invocation.js';
 import { RemoteAgentInvocation } from './remote-invocation.js';
+import { BrowserAgentInvocation } from './browser/browserAgentInvocation.js';
+import { BROWSER_AGENT_NAME } from './browser/browserAgentDefinition.js';
 import type { MessageBus } from '../confirmation-bus/message-bus.js';
 
 /**
@@ -79,6 +81,17 @@ export class SubagentToolWrapper extends BaseDeclarativeTool<
       );
     }
 
+    // Special handling for browser agent - needs async MCP setup
+    if (definition.name === BROWSER_AGENT_NAME) {
+      return new BrowserAgentInvocation(
+        this.config,
+        params,
+        effectiveMessageBus,
+        _toolName,
+        _toolDisplayName,
+      );
+    }
+
     return new LocalSubagentInvocation(
       definition,
       this.config,

packages/core/src/config/config.test.ts

@@ -1347,6 +1347,74 @@ describe('Server Config (config.ts)', () => {
       expect(mockCoreEvents.emitFeedback).not.toHaveBeenCalled();
     });
   });
+
+  describe('BrowserAgentConfig', () => {
+    it('should return default browser agent config when not provided', () => {
+      const config = new Config(baseParams);
+      const browserConfig = config.getBrowserAgentConfig();
+
+      expect(browserConfig.enabled).toBe(false);
+      expect(browserConfig.model).toBeUndefined();
+      expect(browserConfig.customConfig.sessionMode).toBe('persistent');
+      expect(browserConfig.customConfig.headless).toBe(false);
+      expect(browserConfig.customConfig.profilePath).toBeUndefined();
+      expect(browserConfig.customConfig.visualModel).toBeUndefined();
+    });
+
+    it('should return custom browser agent config from agents.overrides', () => {
+      const params: ConfigParameters = {
+        ...baseParams,
+        agents: {
+          overrides: {
+            browser_agent: {
+              enabled: true,
+              modelConfig: { model: 'custom-model' },
+            },
+          },
+          browser: {
+            sessionMode: 'existing',
+            headless: true,
+            profilePath: '/path/to/profile',
+            visualModel: 'custom-visual-model',
+          },
+        },
+      };
+      const config = new Config(params);
+      const browserConfig = config.getBrowserAgentConfig();
+
+      expect(browserConfig.enabled).toBe(true);
+      expect(browserConfig.model).toBe('custom-model');
+      expect(browserConfig.customConfig.sessionMode).toBe('existing');
+      expect(browserConfig.customConfig.headless).toBe(true);
+      expect(browserConfig.customConfig.profilePath).toBe('/path/to/profile');
+      expect(browserConfig.customConfig.visualModel).toBe(
+        'custom-visual-model',
+      );
+    });
+
+    it('should apply defaults for partial custom config', () => {
+      const params: ConfigParameters = {
+        ...baseParams,
+        agents: {
+          overrides: {
+            browser_agent: {
+              enabled: true,
+            },
+          },
+          browser: {
+            headless: true,
+          },
+        },
+      };
+      const config = new Config(params);
+      const browserConfig = config.getBrowserAgentConfig();
+
+      expect(browserConfig.enabled).toBe(true);
+      expect(browserConfig.customConfig.headless).toBe(true);
+      // Defaults for unspecified fields
+      expect(browserConfig.customConfig.sessionMode).toBe('persistent');
+    });
+  });
 });
 
 describe('setApprovalMode with folder trust', () => {

packages/core/src/config/config.ts

@@ -132,6 +132,11 @@ import { UserHintService } from './userHintService.js';
 import { WORKSPACE_POLICY_TIER } from '../policy/config.js';
 import { loadPoliciesFromToml } from '../policy/toml-loader.js';
 
+import { CheckerRunner } from '../safety/checker-runner.js';
+import { ContextBuilder } from '../safety/context-builder.js';
+import { CheckerRegistry } from '../safety/registry.js';
+import { ConsecaSafetyChecker } from '../safety/conseca/conseca.js';
+
 export interface AccessibilitySettings {
   /** @deprecated Use ui.loadingPhrases instead. */
   enableLoadingPhrases?: boolean;
@@ -193,6 +198,10 @@ export interface AgentRunConfig {
   maxTurns?: number;
 }
 
+/**
+ * Override configuration for a specific agent.
+ * Generic fields (modelConfig, runConfig, enabled) are standard across all agents.
+ */
 export interface AgentOverride {
   modelConfig?: ModelConfig;
   runConfig?: AgentRunConfig;
@@ -201,6 +210,7 @@ export interface AgentOverride {
 
 export interface AgentSettings {
   overrides?: Record<string, AgentOverride>;
+  browser?: BrowserAgentCustomConfig;
 }
 
 export interface CustomTheme {
@@ -254,6 +264,30 @@ export interface CustomTheme {
   GradientColors?: string[];
 }
 
+/**
+ * Browser agent custom configuration.
+ * Used in agents.browser
+ *
+ * IMPORTANT: Keep in sync with the browser settings schema in
+ * packages/cli/src/config/settingsSchema.ts (agents.browser.properties).
+ */
+export interface BrowserAgentCustomConfig {
+  /**
+   * Session mode:
+   * - 'persistent': Launch Chrome with a persistent profile at ~/.cache/chrome-devtools-mcp/ (default)
+   * - 'isolated': Launch Chrome with a temporary profile, cleaned up after session
+   * - 'existing': Attach to an already-running Chrome instance (requires remote debugging
+   *   enabled at chrome://inspect/#remote-debugging)
+   */
+  sessionMode?: 'isolated' | 'persistent' | 'existing';
+  /** Run browser in headless mode. Default: false */
+  headless?: boolean;
+  /** Path to Chrome profile directory for session persistence. */
+  profilePath?: string;
+  /** Model override for the visual agent. */
+  visualModel?: string;
+}
+
 /**
  * All information required in CLI to handle an extension. Defined in Core so
  * that the collection of loaded, active, and inactive extensions can be passed
@@ -513,6 +547,7 @@ export interface ConfigParameters {
     adminSkillsEnabled?: boolean;
     agents?: AgentSettings;
   }>;
+  enableConseca?: boolean;
 }
 
 export class Config {
@@ -540,6 +575,7 @@ export class Config {
   private workspaceContext: WorkspaceContext;
   private readonly debugMode: boolean;
   private readonly question: string | undefined;
+  readonly enableConseca: boolean;
 
   private readonly coreTools: string[] | undefined;
   /** @deprecated Use Policy Engine instead */
@@ -868,13 +904,35 @@ export class Config {
     this.recordResponses = params.recordResponses;
     this.fileExclusions = new FileExclusions(this);
     this.eventEmitter = params.eventEmitter;
-    this.policyEngine = new PolicyEngine({
-      ...params.policyEngineConfig,
-      approvalMode:
-        params.approvalMode ?? params.policyEngineConfig?.approvalMode,
+    this.enableConseca = params.enableConseca ?? false;
+
+    // Initialize Safety Infrastructure
+    const contextBuilder = new ContextBuilder(this);
+    const checkersPath = this.targetDir;
+    // The checkersPath  is used to resolve external checkers. Since we do not have any external checkers currently, it is set to the targetDir.
+    const checkerRegistry = new CheckerRegistry(checkersPath);
+    const checkerRunner = new CheckerRunner(contextBuilder, checkerRegistry, {
+      checkersPath,
+      timeout: 30000, // 30 seconds to allow for LLM-based checkers
     });
     this.policyUpdateConfirmationRequest =
       params.policyUpdateConfirmationRequest;
+
+    this.policyEngine = new PolicyEngine(
+      {
+        ...params.policyEngineConfig,
+        approvalMode:
+          params.approvalMode ?? params.policyEngineConfig?.approvalMode,
+      },
+      checkerRunner,
+    );
+
+    // Register Conseca if enabled
+    if (this.enableConseca) {
+      debugLogger.log('[SAFETY] Registering Conseca Safety Checker');
+      ConsecaSafetyChecker.getInstance().setConfig(this);
+    }
+
     this.messageBus = new MessageBus(this.policyEngine, this.debugMode);
     this.acknowledgedAgentsService = new AcknowledgedAgentsService();
     this.skillManager = new SkillManager();
@@ -1568,7 +1626,10 @@ export class Config {
    *
    * May change over time.
    */
-  getExcludeTools(): Set<string> | undefined {
+  getExcludeTools(
+    toolMetadata?: Map<string, Record<string, unknown>>,
+    allToolNames?: Set<string>,
+  ): Set<string> | undefined {
     // Right now this is present for backward compatibility with settings.json exclude
     const excludeToolsSet = new Set([...(this.excludeTools ?? [])]);
     for (const extension of this.getExtensionLoader().getExtensions()) {
@@ -1580,7 +1641,10 @@ export class Config {
       }
     }
 
-    const policyExclusions = this.policyEngine.getExcludedTools();
+    const policyExclusions = this.policyEngine.getExcludedTools(
+      toolMetadata,
+      allToolNames,
+    );
     for (const tool of policyExclusions) {
       excludeToolsSet.add(tool);
     }
@@ -2506,6 +2570,38 @@ export class Config {
     return this.enableHooksUI;
   }
 
+  /**
+   * Get override settings for a specific agent.
+   * Reads from agents.overrides.<agentName>.
+   */
+  getAgentOverride(agentName: string): AgentOverride | undefined {
+    return this.getAgentsSettings()?.overrides?.[agentName];
+  }
+
+  /**
+   * Get browser agent configuration.
+   * Combines generic AgentOverride fields with browser-specific customConfig.
+   * This is the canonical way to access browser agent settings.
+   */
+  getBrowserAgentConfig(): {
+    enabled: boolean;
+    model?: string;
+    customConfig: BrowserAgentCustomConfig;
+  } {
+    const override = this.getAgentOverride('browser_agent');
+    const customConfig = this.getAgentsSettings()?.browser ?? {};
+    return {
+      enabled: override?.enabled ?? false,
+      model: override?.modelConfig?.model,
+      customConfig: {
+        sessionMode: customConfig.sessionMode ?? 'persistent',
+        headless: customConfig.headless ?? false,
+        profilePath: customConfig.profilePath,
+        visualModel: customConfig.visualModel,
+      },
+    };
+  }
+
   async createToolRegistry(): Promise<ToolRegistry> {
     const registry = new ToolRegistry(this, this.messageBus);
 

packages/core/src/confirmation-bus/message-bus.test.ts

@@ -140,6 +140,29 @@ describe('MessageBus', () => {
       expect(requestHandler).toHaveBeenCalledWith(request);
     });
 
+    it('should forward toolAnnotations to policyEngine.check', async () => {
+      const checkSpy = vi.spyOn(policyEngine, 'check').mockResolvedValue({
+        decision: PolicyDecision.ALLOW,
+      });
+
+      const annotations = { readOnlyHint: true };
+      const request: ToolConfirmationRequest = {
+        type: MessageBusType.TOOL_CONFIRMATION_REQUEST,
+        toolCall: { name: 'test-tool', args: {} },
+        correlationId: '123',
+        serverName: 'test-server',
+        toolAnnotations: annotations,
+      };
+
+      await messageBus.publish(request);
+
+      expect(checkSpy).toHaveBeenCalledWith(
+        { name: 'test-tool', args: {} },
+        'test-server',
+        annotations,
+      );
+    });
+
     it('should emit other message types directly', async () => {
       const successHandler = vi.fn();
       messageBus.subscribe(

packages/core/src/confirmation-bus/message-bus.ts

@@ -55,6 +55,7 @@ export class MessageBus extends EventEmitter {
         const { decision } = await this.policyEngine.check(
           message.toolCall,
           message.serverName,
+          message.toolAnnotations,
         );
 
         switch (decision) {

packages/core/src/confirmation-bus/types.ts

@@ -34,6 +34,10 @@ export interface ToolConfirmationRequest {
   toolCall: FunctionCall;
   correlationId: string;
   serverName?: string;
+  /**
+   * Optional tool annotations (e.g., readOnlyHint, destructiveHint) from MCP.
+   */
+  toolAnnotations?: Record<string, unknown>;
   /**
    * Optional rich details for the confirmation UI (diffs, counts, etc.)
    */
@@ -95,6 +99,9 @@ export type SerializableConfirmationDetails =
       serverName: string;
       toolName: string;
       toolDisplayName: string;
+      toolArgs?: Record<string, unknown>;
+      toolDescription?: string;
+      toolParameterSchema?: unknown;
     }
   | {
       type: 'ask_user';