Merge branch 'main' into debug-fix

Co-authored-by: Gal Zahavi <38544478+galz10@users.noreply.github.com>
Co-authored-by: David Pierce <davidapierce@google.com>
Co-authored-by: Keith Schaab <keithsc@google.com>
Co-authored-by: Keith Schaab <keith.schaab@gmail.com>
Co-authored-by: Emily Hedlund <ehedlund@google.com>

.gemini/settings.json

@@ -2,7 +2,8 @@
   "experimental": {
     "extensionReloading": true,
     "modelSteering": true,
-    "autoMemory": true
+    "autoMemory": true,
+    "gemma": true
   },
   "general": {
     "devtools": true

.github/workflows/gemini-cli-bot-brain.yml

@@ -0,0 +1,45 @@
+name: '🧠 Gemini CLI Bot: Brain'
+
+on:
+  schedule:
+    - cron: '0 0 * * *' # Every 24 hours
+  workflow_dispatch:
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.ref }}'
+  cancel-in-progress: true
+
+permissions:
+  contents: 'write'
+  issues: 'write'
+  pull-requests: 'write'
+
+jobs:
+  brain:
+    name: 'Brain (Reasoning Layer)'
+    runs-on: 'ubuntu-latest'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build Gemini CLI'
+        run: 'npm run bundle'
+
+      - name: 'Download Previous Metrics'
+        uses: 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093' # ratchet:actions/download-artifact@v4
+        with:
+          name: 'metrics-before'
+          path: 'tools/gemini-cli-bot/history/'
+        continue-on-error: true

.github/workflows/gemini-cli-bot-pulse.yml

@@ -0,0 +1,59 @@
+name: '🔄 Gemini CLI Bot: Pulse'
+
+on:
+  schedule:
+    - cron: '*/30 * * * *' # Every 30 minutes
+  workflow_dispatch:
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.ref }}'
+  cancel-in-progress: true
+
+permissions:
+  contents: 'write'
+  issues: 'write'
+  pull-requests: 'write'
+
+jobs:
+  pulse:
+    name: 'Pulse (Reflex Layer)'
+    runs-on: 'ubuntu-latest'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Collect Metrics'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: 'npm run metrics'
+
+      - name: 'Archive Metrics'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'metrics-before'
+          path: 'metrics-before.csv'
+
+      - name: 'Run Reflex Processes'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          if [ -d "tools/gemini-cli-bot/processes/scripts" ] && [ "$(ls -A tools/gemini-cli-bot/processes/scripts)" ]; then
+            for script in tools/gemini-cli-bot/processes/scripts/*.ts; do
+              echo "Running reflex script: $script"
+              npx tsx "$script"
+            done
+          else
+            echo "No reflex scripts found."
+          fi

README.md

@@ -371,6 +371,8 @@ for planned features and priorities.
 
 ## 📖 Resources
 
+- **[Free Course](https://learn.deeplearning.ai/courses/gemini-cli-code-and-create-with-an-open-source-agent/information)** -
+  Learn the basics.
 - **[Official Roadmap](./ROADMAP.md)** - See what's coming next.
 - **[Changelog](https://www.geminicli.com/docs/changelogs)** - See recent
   notable updates.

docs/cli/settings.md

@@ -163,6 +163,7 @@ they appear in the UI.
 
 | UI Label                                             | Setting                                         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Default |
 | ---------------------------------------------------- | ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| Gemma Models                                         | `experimental.gemma`                            | Enable access to Gemma 4 models (experimental).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `false` |
 | Enable Git Worktrees                                 | `experimental.worktrees`                        | Enable automated Git worktree management for parallel work.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false` |
 | Use OSC 52 Paste                                     | `experimental.useOSC52Paste`                    | Use OSC 52 for pasting. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it).                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `false` |
 | Use OSC 52 Copy                                      | `experimental.useOSC52Copy`                     | Use OSC 52 for copying. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it).                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `false` |

docs/cli/trusted-folders.md

@@ -117,6 +117,10 @@ the following methods:
 These methods will trust the current workspace for the duration of the session
 without prompting.
 
+For detailed instructions on managing folder trust within CI/CD workflows,
+review the
+[Gemini CLI trust guidance for GitHub Actions](https://github.com/google-github-actions/run-gemini-cli/blob/main/docs/trust-guidance.md).
+
 ## Overriding the trust file location
 
 By default, trust settings are saved to `~/.gemini/trustedFolders.json`. If you

docs/reference/configuration.md

@@ -563,6 +563,18 @@ their corresponding top-level category object in your `settings.json` file.
           "model": "gemini-2.5-flash-lite"
         }
       },
+      "gemma-4-31b-it": {
+        "extends": "chat-base-3",
+        "modelConfig": {
+          "model": "gemma-4-31b-it"
+        }
+      },
+      "gemma-4-26b-a4b-it": {
+        "extends": "chat-base-3",
+        "modelConfig": {
+          "model": "gemma-4-26b-a4b-it"
+        }
+      },
       "gemini-2.5-flash-base": {
         "extends": "base",
         "modelConfig": {
@@ -834,6 +846,28 @@ their corresponding top-level category object in your `settings.json` file.
           "multimodalToolUse": false
         }
       },
+      "gemma-4-31b-it": {
+        "displayName": "gemma-4-31b-it",
+        "tier": "custom",
+        "family": "gemma-4",
+        "isPreview": false,
+        "isVisible": true,
+        "features": {
+          "thinking": true,
+          "multimodalToolUse": false
+        }
+      },
+      "gemma-4-26b-a4b-it": {
+        "displayName": "gemma-4-26b-a4b-it",
+        "tier": "custom",
+        "family": "gemma-4",
+        "isPreview": false,
+        "isVisible": true,
+        "features": {
+          "thinking": true,
+          "multimodalToolUse": false
+        }
+      },
       "auto": {
         "tier": "auto",
         "isPreview": true,
@@ -904,6 +938,12 @@ their corresponding top-level category object in your `settings.json` file.
 
     ```json
     {
+      "gemma-4-31b-it": {
+        "default": "gemma-4-31b-it"
+      },
+      "gemma-4-26b-a4b-it": {
+        "default": "gemma-4-26b-a4b-it"
+      },
       "gemini-3.1-pro-preview": {
         "default": "gemini-3.1-pro-preview",
         "contexts": [
@@ -1467,6 +1507,12 @@ their corresponding top-level category object in your `settings.json` file.
   - **Default:** `undefined`
   - **Requires restart:** Yes
 
+- **`tools.confirmationRequired`** (array):
+  - **Description:** Tool names that always require user confirmation. Takes
+    precedence over allowed tools and core tool allowlists.
+  - **Default:** `undefined`
+  - **Requires restart:** Yes
+
 - **`tools.exclude`** (array):
   - **Description:** Tool names to exclude from discovery.
   - **Default:** `undefined`
@@ -1640,6 +1686,11 @@ their corresponding top-level category object in your `settings.json` file.
 
 #### `experimental`
 
+- **`experimental.gemma`** (boolean):
+  - **Description:** Enable access to Gemma 4 models (experimental).
+  - **Default:** `false`
+  - **Requires restart:** Yes
+
 - **`experimental.adk.agentSessionNoninteractiveEnabled`** (boolean):
   - **Description:** Enable non-interactive agent sessions.
   - **Default:** `false`

evals/hierarchical_memory.eval.ts

@@ -17,7 +17,7 @@ describe('Hierarchical Memory', () => {
     params: {
       settings: {
         security: {
-          folderTrust: { enabled: true },
+          folderTrust: { enabled: false },
         },
       },
     },
@@ -55,7 +55,7 @@ What is my favorite fruit? Tell me just the name of the fruit.`,
     params: {
       settings: {
         security: {
-          folderTrust: { enabled: true },
+          folderTrust: { enabled: false },
         },
       },
     },
@@ -96,7 +96,7 @@ Provide the answer as an XML block like this:
     params: {
       settings: {
         security: {
-          folderTrust: { enabled: true },
+          folderTrust: { enabled: false },
         },
       },
     },

evals/save_memory.eval.ts

@@ -18,6 +18,11 @@ describe('save_memory', () => {
     suiteName: 'default',
     suiteType: 'behavioral',
     name: rememberingFavoriteColor,
+    params: {
+      settings: {
+        experimental: { memoryV2: false },
+      },
+    },
 
     prompt: `remember that my favorite color is  blue.
   
@@ -40,6 +45,11 @@ describe('save_memory', () => {
     suiteName: 'default',
     suiteType: 'behavioral',
     name: rememberingCommandRestrictions,
+    params: {
+      settings: {
+        experimental: { memoryV2: false },
+      },
+    },
 
     prompt: `I don't want you to ever run npm commands.`,
     assert: async (rig, result) => {
@@ -61,6 +71,11 @@ describe('save_memory', () => {
     suiteName: 'default',
     suiteType: 'behavioral',
     name: rememberingWorkflow,
+    params: {
+      settings: {
+        experimental: { memoryV2: false },
+      },
+    },
 
     prompt: `I want you to always lint after building.`,
     assert: async (rig, result) => {
@@ -83,6 +98,11 @@ describe('save_memory', () => {
     suiteName: 'default',
     suiteType: 'behavioral',
     name: ignoringTemporaryInformation,
+    params: {
+      settings: {
+        experimental: { memoryV2: false },
+      },
+    },
 
     prompt: `I'm going to get a coffee.`,
     assert: async (rig, result) => {
@@ -108,6 +128,11 @@ describe('save_memory', () => {
     suiteName: 'default',
     suiteType: 'behavioral',
     name: rememberingPetName,
+    params: {
+      settings: {
+        experimental: { memoryV2: false },
+      },
+    },
 
     prompt: `Please remember that my dog's name is Buddy.`,
     assert: async (rig, result) => {
@@ -129,6 +154,11 @@ describe('save_memory', () => {
     suiteName: 'default',
     suiteType: 'behavioral',
     name: rememberingCommandAlias,
+    params: {
+      settings: {
+        experimental: { memoryV2: false },
+      },
+    },
 
     prompt: `When I say 'start server', you should run 'npm run dev'.`,
     assert: async (rig, result) => {
@@ -151,6 +181,11 @@ describe('save_memory', () => {
     suiteName: 'default',
     suiteType: 'behavioral',
     name: savingDbSchemaLocationAsProjectMemory,
+    params: {
+      settings: {
+        experimental: { memoryV2: false },
+      },
+    },
     prompt: `The database schema for this workspace is located in \`db/schema.sql\`.`,
     assert: async (rig, result) => {
       const wasToolCalled = await rig.waitForToolCall(
@@ -180,6 +215,11 @@ describe('save_memory', () => {
     suiteName: 'default',
     suiteType: 'behavioral',
     name: rememberingCodingStyle,
+    params: {
+      settings: {
+        experimental: { memoryV2: false },
+      },
+    },
 
     prompt: `I prefer to use tabs instead of spaces for indentation.`,
     assert: async (rig, result) => {
@@ -202,6 +242,11 @@ describe('save_memory', () => {
     suiteName: 'default',
     suiteType: 'behavioral',
     name: savingBuildArtifactLocationAsProjectMemory,
+    params: {
+      settings: {
+        experimental: { memoryV2: false },
+      },
+    },
     prompt: `In this workspace, build artifacts are stored in the \`dist/artifacts\` directory.`,
     assert: async (rig, result) => {
       const wasToolCalled = await rig.waitForToolCall(
@@ -231,6 +276,11 @@ describe('save_memory', () => {
     suiteName: 'default',
     suiteType: 'behavioral',
     name: savingMainEntryPointAsProjectMemory,
+    params: {
+      settings: {
+        experimental: { memoryV2: false },
+      },
+    },
     prompt: `The main entry point for this workspace is \`src/index.js\`.`,
     assert: async (rig, result) => {
       const wasToolCalled = await rig.waitForToolCall(
@@ -259,6 +309,11 @@ describe('save_memory', () => {
     suiteName: 'default',
     suiteType: 'behavioral',
     name: rememberingBirthday,
+    params: {
+      settings: {
+        experimental: { memoryV2: false },
+      },
+    },
 
     prompt: `My birthday is on June 15th.`,
     assert: async (rig, result) => {

evals/test-helper.ts

@@ -172,6 +172,7 @@ export async function internalEvalTest(evalCase: EvalCase) {
         timeout: evalCase.timeout,
         env: {
           GEMINI_CLI_ACTIVITY_LOG_TARGET: activityLogFile,
+          GEMINI_CLI_TRUST_WORKSPACE: 'true',
         },
       });
 

package-lock.json

@@ -449,8 +449,7 @@
       "version": "2.11.0",
       "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.11.0.tgz",
       "integrity": "sha512-sBXGT13cpmPR5BMgHE6UEEfEaShh5Ror6rfN3yEK5si7QVrtZg8LEPQb0VVhiLRUslD2yLnXtnRzG035J/mZXQ==",
-      "license": "(Apache-2.0 AND BSD-3-Clause)",
-      "peer": true
+      "license": "(Apache-2.0 AND BSD-3-Clause)"
     },
     "node_modules/@bundled-es-modules/cookie": {
       "version": "2.0.1",
@@ -992,6 +991,37 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/@eslint/config-array/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/config-array/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@eslint/config-array/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@eslint/config-helpers": {
       "version": "0.2.3",
       "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.2.3.tgz",
@@ -1039,6 +1069,24 @@
         "url": "https://opencollective.com/eslint"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/@eslint/eslintrc/node_modules/globals": {
       "version": "14.0.0",
       "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
@@ -1052,6 +1100,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@eslint/js": {
       "version": "9.29.0",
       "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.29.0.tgz",
@@ -1474,7 +1535,6 @@
       "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.13.4.tgz",
       "integrity": "sha512-GsFaMXCkMqkKIvwCQjCrwH+GHbPKBjhwo/8ZuUkWHqbI73Kky9I+pQltrlT0+MWpedCoosda53lgjYfyEPgxBg==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
         "@grpc/proto-loader": "^0.7.13",
         "@js-sdsl/ordered-map": "^4.4.2"
@@ -2152,7 +2212,6 @@
       "integrity": "sha512-t54CUOsFMappY1Jbzb7fetWeO0n6K0k/4+/ZpkS+3Joz8I4VcvY9OiEBFRYISqaI2fq5sCiPtAjRDOzVYG8m+Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@octokit/auth-token": "^6.0.0",
         "@octokit/graphql": "^9.0.2",
@@ -2333,7 +2392,6 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
       "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
       "license": "Apache-2.0",
-      "peer": true,
       "engines": {
         "node": ">=8.0.0"
       }
@@ -2383,7 +2441,6 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.5.0.tgz",
       "integrity": "sha512-ka4H8OM6+DlUhSAZpONu0cPBtPPTQKxbxVzC4CzVx5+K4JnroJVBtDzLAMx4/3CDTJXRvVFhpFjtl4SaiTNoyQ==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
@@ -2758,7 +2815,6 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.5.0.tgz",
       "integrity": "sha512-F8W52ApePshpoSrfsSk1H2yJn9aKjCrbpQF1M9Qii0GHzbfVeFUB+rc3X4aggyZD8x9Gu3Slua+s6krmq6Dt8g==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
         "@opentelemetry/core": "2.5.0",
         "@opentelemetry/semantic-conventions": "^1.29.0"
@@ -2792,7 +2848,6 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.5.0.tgz",
       "integrity": "sha512-BeJLtU+f5Gf905cJX9vXFQorAr6TAfK3SPvTFqP+scfIpDQEJfRaGJWta7sJgP+m4dNtBf9y3yvBKVAZZtJQVA==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
         "@opentelemetry/core": "2.5.0",
         "@opentelemetry/resources": "2.5.0"
@@ -2847,7 +2902,6 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.5.0.tgz",
       "integrity": "sha512-VzRf8LzotASEyNDUxTdaJ9IRJ1/h692WyArDBInf5puLCjxbICD6XkHgpuudis56EndyS7LYFmtTMny6UABNdQ==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
         "@opentelemetry/core": "2.5.0",
         "@opentelemetry/resources": "2.5.0",
@@ -3741,6 +3795,37 @@
         "path-browserify": "^1.0.1"
       }
     },
+    "node_modules/@ts-morph/common/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@ts-morph/common/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@ts-morph/common/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@types/body-parser": {
       "version": "1.19.6",
       "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
@@ -4054,7 +4139,6 @@
       "integrity": "sha512-6mDvHUFSjyT2B2yeNx2nUgMxh9LtOWvkhIU3uePn2I2oyNymUAX1NIsdgviM4CH+JSrp2D2hsMvJOkxY+0wNRA==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "csstype": "^3.0.2"
       }
@@ -4328,7 +4412,6 @@
       "integrity": "sha512-/Zb/xaIDfxeJnvishjGdcR4jmr7S+bda8PKNhRGdljDM+elXhlvN0FyPSsMnLmJUrVG9aPO6dof80wjMawsASg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.58.2",
         "@typescript-eslint/types": "8.58.2",
@@ -4903,6 +4986,13 @@
         "win32"
       ]
     },
+    "node_modules/@vscode/vsce/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@vscode/vsce/node_modules/hosted-git-info": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-4.1.0.tgz",
@@ -4942,6 +5032,30 @@
         "node": ">=4"
       }
     },
+    "node_modules/@vscode/vsce/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/@vscode/vsce/node_modules/minimatch/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/@vscode/vsce/node_modules/yallist": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
@@ -5073,7 +5187,6 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -6440,6 +6553,13 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/config-chain": {
       "version": "1.1.13",
       "resolved": "https://registry.npmjs.org/config-chain/-/config-chain-1.1.13.tgz",
@@ -6955,6 +7075,23 @@
         "sprintf-js": "~1.0.2"
       }
     },
+    "node_modules/depcheck/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/depcheck/node_modules/brace-expansion": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
     "node_modules/depcheck/node_modules/camelcase": {
       "version": "6.3.0",
       "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
@@ -7014,6 +7151,22 @@
         "node": ">=6"
       }
     },
+    "node_modules/depcheck/node_modules/minimatch": {
+      "version": "7.4.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-7.4.9.tgz",
+      "integrity": "sha512-Brg/fp/iAVDOQoHxkuN5bEYhyQlZhxddI78yWsCbeEwTHXQjlNLtiJDUsp1GIptVqMI7/gkJMz4vVAc01mpoBw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/depcheck/node_modules/resolve-from": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
@@ -7151,8 +7304,7 @@
       "version": "0.0.1581282",
       "resolved": "https://registry.npmjs.org/devtools-protocol/-/devtools-protocol-0.0.1581282.tgz",
       "integrity": "sha512-nv7iKtNZQshSW2hKzYNr46nM/Cfh5SEvE2oV0/SEGgc9XupIY5ggf84Cz8eJIkBce7S3bmTAauFD6aysMpnqsQ==",
-      "license": "BSD-3-Clause",
-      "peer": true
+      "license": "BSD-3-Clause"
     },
     "node_modules/dezalgo": {
       "version": "1.0.4",
@@ -7737,7 +7889,6 @@
       "integrity": "sha512-GsGizj2Y1rCWDu6XoEekL3RLilp0voSePurjZIkxL3wlm5o5EC9VpgaP7lrCvjnkuLvzFBQWB3vWB3K5KQTveQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -7906,6 +8057,24 @@
         "eslint": "^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 || ^9"
       }
     },
+    "node_modules/eslint-plugin-import/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint-plugin-import/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/eslint-plugin-import/node_modules/debug": {
       "version": "3.2.7",
       "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
@@ -7916,6 +8085,19 @@
         "ms": "^2.1.1"
       }
     },
+    "node_modules/eslint-plugin-import/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/eslint-plugin-import/node_modules/semver": {
       "version": "6.3.1",
       "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
@@ -7972,6 +8154,37 @@
         "eslint": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0"
       }
     },
+    "node_modules/eslint-plugin-react/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint-plugin-react/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/eslint-plugin-react/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/eslint-plugin-react/node_modules/resolve": {
       "version": "2.0.0-next.5",
       "resolved": "https://registry.npmjs.org/resolve/-/resolve-2.0.0-next.5.tgz",
@@ -8030,6 +8243,37 @@
         "url": "https://opencollective.com/eslint"
       }
     },
+    "node_modules/eslint/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/eslint/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/espree": {
       "version": "10.4.0",
       "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
@@ -8255,7 +8499,6 @@
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
       "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "accepts": "^2.0.0",
         "body-parser": "^2.2.1",
@@ -9522,7 +9765,6 @@
       "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.12.tgz",
       "integrity": "sha512-p1JfQMKaceuCbpJKAPKVqyqviZdS0eUxH9v82oWo1kb9xjQ5wA6iP3FNVAPDFlz5/p7d45lO+BpSk1tuSZMF4Q==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=16.9.0"
       }
@@ -9782,7 +10024,6 @@
       "resolved": "https://registry.npmjs.org/@jrichman/ink/-/ink-6.6.9.tgz",
       "integrity": "sha512-RL9sSiLQZECnjbmBwjIHOp8yVGdWF7C/uifg7ISv/e+F3nLNsfl7FdUFQs8iZARFMJAYxMFpxW6OW+HSt9drwQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "ansi-escapes": "^7.0.0",
         "ansi-styles": "^6.2.3",
@@ -11673,12 +11914,12 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.2"
+        "brace-expansion": "^5.0.5"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -11859,6 +12100,37 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/multimatch/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/multimatch/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/multimatch/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/mute-stream": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/mute-stream/-/mute-stream-2.0.0.tgz",
@@ -12099,6 +12371,24 @@
         "node": ">=4"
       }
     },
+    "node_modules/npm-run-all/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/npm-run-all/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/npm-run-all/node_modules/chalk": {
       "version": "2.4.2",
       "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
@@ -12148,6 +12438,19 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/npm-run-all/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/npm-run-all/node_modules/normalize-package-data": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz",
@@ -13496,7 +13799,6 @@
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.4.tgz",
       "integrity": "sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -13507,7 +13809,6 @@
       "integrity": "sha512-ePrwPfxAnB+7hgnEr8vpKxL9cmnp7F322t8oqcPshbIQQhDKgFDW4tjhF2wjVbdXF9O/nyuy3sQWd9JGpiLPvA==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "shell-quote": "^1.6.1",
         "ws": "^7"
@@ -15516,6 +15817,39 @@
         "node": ">=18"
       }
     },
+    "node_modules/test-exclude/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/test-exclude/node_modules/brace-expansion": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/test-exclude/node_modules/minimatch": {
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/text-decoder": {
       "version": "1.2.7",
       "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.7.tgz",
@@ -15627,7 +15961,6 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -15850,8 +16183,7 @@
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD",
-      "peer": true
+      "license": "0BSD"
     },
     "node_modules/tsx": {
       "version": "4.20.3",
@@ -15859,7 +16191,6 @@
       "integrity": "sha512-qjbnuR9Tr+FJOMBqJCW5ehvIo/buZq7vH7qD7JziU98h6l3qGy0a/yPFjwO+y0/T7GFpNgNAvEcPPVfyT8rrPQ==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "~0.25.0",
         "get-tsconfig": "^4.7.5"
@@ -16025,7 +16356,6 @@
       "integrity": "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==",
       "devOptional": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -16093,7 +16423,6 @@
       "integrity": "sha512-6sMvZePQrnZH2/cJkwRpkT7DxoAWh+g6+GFRK6bV3YQo7ogi3SX5rgF6099r5Q53Ma5qeT7LGmOmuIutF4t3lA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.35.0",
         "@typescript-eslint/types": "8.35.0",
@@ -16279,6 +16608,23 @@
         "url": "https://opencollective.com/typescript-eslint"
       }
     },
+    "node_modules/typescript-eslint/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/typescript-eslint/node_modules/brace-expansion": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
     "node_modules/typescript-eslint/node_modules/ignore": {
       "version": "7.0.5",
       "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
@@ -16289,6 +16635,22 @@
         "node": ">= 4"
       }
     },
+    "node_modules/typescript-eslint/node_modules/minimatch": {
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/uc.micro": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-2.1.0.tgz",
@@ -16480,7 +16842,6 @@
       "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.2.tgz",
       "integrity": "sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.27.0",
         "fdir": "^6.5.0",
@@ -17051,7 +17412,6 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -17064,7 +17424,6 @@
       "resolved": "https://registry.npmjs.org/vitest/-/vitest-3.2.4.tgz",
       "integrity": "sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/chai": "^5.2.2",
         "@vitest/expect": "3.2.4",
@@ -17703,7 +18062,6 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
       "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
@@ -18139,7 +18497,6 @@
       "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.3.tgz",
       "integrity": "sha512-Iq8QQQ/7X3Sac15oB6p0FmUg/klxQvXLeileoqrTRGJYLV+/9tubbr9ipz0GKHjmXVsgFPo/+W+2cA8eNcR+XA==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
         "@grpc/proto-loader": "^0.8.0",
         "@js-sdsl/ordered-map": "^4.4.2"
@@ -18258,7 +18615,6 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },

package.json

@@ -63,6 +63,7 @@
     "lint:all": "node scripts/lint.js",
     "format": "prettier --experimental-cli --write .",
     "typecheck": "npm run typecheck --workspaces --if-present && tsc -b evals/tsconfig.json integration-tests/tsconfig.json memory-tests/tsconfig.json",
+    "metrics": "tsx tools/gemini-cli-bot/metrics/index.ts",
     "preflight": "npm run clean && npm ci && npm run format && npm run build && npm run lint:ci && npm run typecheck && npm run test:ci",
     "prepare": "husky && npm run bundle",
     "prepare:package": "node scripts/prepare-package.js",
@@ -81,8 +82,7 @@
     "glob": "^12.0.0",
     "node-domexception": "npm:empty@^0.10.1",
     "prebuild-install": "npm:nop@1.0.0",
-    "cross-spawn": "^7.0.6",
-    "minimatch": "^10.2.2"
+    "cross-spawn": "^7.0.6"
   },
   "bin": {
     "gemini": "bundle/gemini.js"

packages/a2a-server/src/utils/testing_utils.ts

@@ -112,6 +112,7 @@ export function createMockConfig(
     }),
     isContextManagementEnabled: vi.fn().mockReturnValue(false),
     getContextManagementConfig: vi.fn().mockReturnValue({ enabled: false }),
+    getExperimentalGemma: vi.fn().mockReturnValue(false),
     ...overrides,
   } as unknown as Config;
 

packages/cli/src/config/config.test.ts

@@ -3055,6 +3055,18 @@ describe('loadCliConfig gemmaModelRouter', () => {
     expect(gemmaSettings.classifier?.model).toBe('custom-gemma');
   });
 
+  it('should load experimental.gemma setting from merged settings', async () => {
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
+      experimental: {
+        gemma: true,
+      },
+    });
+    const config = await loadCliConfig(settings, 'test-session', argv);
+    expect(config.getExperimentalGemma()).toBe(true);
+  });
+
   it('should handle partial gemmaModelRouter settings', async () => {
     process.argv = ['node', 'script.js'];
     const argv = await parseArguments(createTestMergedSettings());

packages/cli/src/config/config.ts

@@ -1011,6 +1011,7 @@ export async function loadCliConfig(
     experimentalJitContext,
     experimentalMemoryV2: settings.experimental?.memoryV2,
     experimentalAutoMemory: settings.experimental?.autoMemory,
+    experimentalGemma: settings.experimental?.gemma,
     contextManagement,
     modelSteering: settings.experimental?.modelSteering,
     topicUpdateNarration:

packages/cli/src/config/settingsSchema.ts

@@ -1667,6 +1667,19 @@ const SETTINGS_SCHEMA = {
         showInDialog: false,
         items: { type: 'string' },
       },
+      confirmationRequired: {
+        type: 'array',
+        label: 'Confirmation Required',
+        category: 'Advanced',
+        requiresRestart: true,
+        default: undefined as string[] | undefined,
+        description: oneLine`
+          Tool names that always require user confirmation.
+          Takes precedence over allowed tools and core tool allowlists.
+        `,
+        showInDialog: false,
+        items: { type: 'string' },
+      },
       exclude: {
         type: 'array',
         label: 'Exclude Tools',
@@ -2039,6 +2052,15 @@ const SETTINGS_SCHEMA = {
     description: 'Setting to enable experimental features',
     showInDialog: false,
     properties: {
+      gemma: {
+        type: 'boolean',
+        label: 'Gemma Models',
+        category: 'Experimental',
+        requiresRestart: true,
+        default: false,
+        description: 'Enable access to Gemma 4 models (experimental).',
+        showInDialog: true,
+      },
       adk: {
         type: 'object',
         label: 'ADK',

packages/cli/src/gemini_cleanup.test.tsx

@@ -306,6 +306,7 @@ describe('gemini.tsx main function cleanup', () => {
       getMessageBus: () => ({ subscribe: vi.fn() }),
       getEnableHooks: vi.fn(() => true),
       getHookSystem: vi.fn(() => undefined),
+      getExperimentalGemma: vi.fn(() => false),
       initialize: vi.fn(),
       storage: { initialize: vi.fn().mockResolvedValue(undefined) },
       getContentGeneratorConfig: vi.fn(),

packages/cli/src/services/prompt-processors/shellProcessor.test.ts

@@ -89,6 +89,7 @@ describe('ShellProcessor', () => {
       getPolicyEngine: vi.fn().mockReturnValue({
         check: mockPolicyEngineCheck,
       }),
+      getExperimentalGemma: vi.fn().mockReturnValue(false),
       get config() {
         return this as unknown as Config;
       },

packages/cli/src/test-utils/mockConfig.ts

@@ -168,6 +168,7 @@ export const createMockConfig = (overrides: Partial<Config> = {}): Config =>
     getAdminSkillsEnabled: vi.fn().mockReturnValue(false),
     getDisabledSkills: vi.fn().mockReturnValue([]),
     getExperimentalJitContext: vi.fn().mockReturnValue(false),
+    getExperimentalGemma: vi.fn().mockReturnValue(false),
     getMemoryBoundaryMarkers: vi.fn().mockReturnValue(['.git']),
     getTerminalBackground: vi.fn().mockReturnValue(undefined),
     getEmbeddingModel: vi.fn().mockReturnValue('embedding-model'),

packages/cli/src/ui/components/ModelDialog.test.tsx

@@ -65,6 +65,7 @@ describe('<ModelDialog />', () => {
     getGemini31FlashLiteLaunchedSync: () => boolean;
     getProModelNoAccess: () => Promise<boolean>;
     getProModelNoAccessSync: () => boolean;
+    getExperimentalGemma: () => boolean;
     getLastRetrievedQuota: () =>
       | {
           buckets: Array<{
@@ -85,6 +86,7 @@ describe('<ModelDialog />', () => {
     getGemini31FlashLiteLaunchedSync: mockGetGemini31FlashLiteLaunchedSync,
     getProModelNoAccess: mockGetProModelNoAccess,
     getProModelNoAccessSync: mockGetProModelNoAccessSync,
+    getExperimentalGemma: () => false,
     getLastRetrievedQuota: () => ({ buckets: [] }),
     getSessionId: () => 'test-session-id',
   };

packages/cli/src/ui/components/ModelDialog.tsx

@@ -19,6 +19,8 @@ import {
   DEFAULT_GEMINI_FLASH_MODEL,
   DEFAULT_GEMINI_FLASH_LITE_MODEL,
   DEFAULT_GEMINI_MODEL_AUTO,
+  GEMMA_4_31B_IT_MODEL,
+  GEMMA_4_26B_A4B_IT_MODEL,
   ModelSlashCommandEvent,
   logModelSlashCommand,
   getDisplayString,
@@ -222,7 +224,9 @@ export function ModelDialog({ onClose }: ModelDialogProps): React.JSX.Element {
     }
 
     // --- LEGACY PATH ---
-    const list = [
+    const showGemmaModels = config?.getExperimentalGemma() ?? false;
+
+    const options = [
       {
         value: DEFAULT_GEMINI_MODEL,
         title: getDisplayString(DEFAULT_GEMINI_MODEL),
@@ -240,6 +244,21 @@ export function ModelDialog({ onClose }: ModelDialogProps): React.JSX.Element {
       },
     ];
 
+    if (showGemmaModels) {
+      options.push(
+        {
+          value: GEMMA_4_31B_IT_MODEL,
+          title: getDisplayString(GEMMA_4_31B_IT_MODEL),
+          key: GEMMA_4_31B_IT_MODEL,
+        },
+        {
+          value: GEMMA_4_26B_A4B_IT_MODEL,
+          title: getDisplayString(GEMMA_4_26B_A4B_IT_MODEL),
+          key: GEMMA_4_26B_A4B_IT_MODEL,
+        },
+      );
+    }
+
     if (shouldShowPreviewModels) {
       const previewProModel = useGemini31
         ? PREVIEW_GEMINI_3_1_MODEL
@@ -270,15 +289,15 @@ export function ModelDialog({ onClose }: ModelDialogProps): React.JSX.Element {
         });
       }
 
-      list.unshift(...previewOptions);
+      options.unshift(...previewOptions);
     }
 
     if (!hasAccessToProModel) {
       // Filter out all Pro models for free tier
-      return list.filter((option) => !isProModel(option.value));
+      return options.filter((option) => !isProModel(option.value));
     }
 
-    return list;
+    return options;
   }, [
     shouldShowPreviewModels,
     useGemini31,

packages/cli/src/ui/components/SessionBrowser.test.tsx

@@ -86,6 +86,7 @@ const createMockConfig = (overrides: Partial<Config> = {}): Config =>
       getProjectTempDir: () => '/tmp/test',
     },
     getSessionId: () => 'default-session-id',
+    getExperimentalGemma: () => false,
     ...overrides,
   }) as Config;
 

packages/cli/src/ui/components/__snapshots__/InputPrompt.test.tsx.snap

@@ -168,6 +168,13 @@ exports[`InputPrompt > mouse interaction > should toggle paste expansion on doub
 "
 `;
 
+exports[`InputPrompt > mouse interaction > should toggle paste expansion on double-click 4`] = `
+"▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
+ > [Pasted Text: 10 lines]                                                                          
+▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
+"
+`;
+
 exports[`InputPrompt > multiline rendering > should correctly render multiline input including blank lines 1`] = `
 "────────────────────────────────────────────────────────────────────────────────────────────────────
  > hello

packages/cli/src/ui/components/messages/HintMessage.test.tsx

@@ -0,0 +1,56 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { renderWithProviders } from '../../../test-utils/render.js';
+import { HintMessage } from './HintMessage.js';
+import { describe, it, expect, vi } from 'vitest';
+import { makeFakeConfig } from '@google/gemini-cli-core';
+
+describe('HintMessage', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.restoreAllMocks();
+  });
+
+  it('renders normal hint message with correct prefix', async () => {
+    const { lastFrame, unmount } = await renderWithProviders(
+      <HintMessage text="Try this instead" />,
+      { width: 80 },
+    );
+    const output = lastFrame();
+
+    expect(output).toContain('💡');
+    expect(output).toContain('Steering Hint: Try this instead');
+    unmount();
+  });
+
+  describe('with NO_COLOR set', () => {
+    beforeEach(() => {
+      vi.stubEnv('NO_COLOR', '1');
+    });
+
+    it('uses margins instead of background blocks when NO_COLOR is set', async () => {
+      const { lastFrame, unmount } = await renderWithProviders(
+        <HintMessage text="Try this instead" />,
+        { width: 80, config: makeFakeConfig({ useBackgroundColor: true }) },
+      );
+      const output = lastFrame();
+
+      // In NO_COLOR mode, the block characters (▄/▀) should NOT be present.
+      expect(output).not.toContain('▄');
+      expect(output).not.toContain('▀');
+
+      const lines = output.split('\n').filter((l) => l.trim() !== '');
+      expect(lines).toHaveLength(1);
+      expect(lines[0]).toContain('💡');
+      expect(lines[0]).toContain('Steering Hint: Try this instead');
+
+      expect(output).toMatchSnapshot();
+
+      unmount();
+    });
+  });
+});

packages/cli/src/ui/components/messages/HintMessage.tsx

@@ -19,7 +19,9 @@ export const HintMessage: React.FC<HintMessageProps> = ({ text }) => {
   const prefix = '💡 ';
   const prefixWidth = prefix.length;
   const config = useConfig();
-  const useBackgroundColor = config.getUseBackgroundColor();
+  const useBackgroundColorSetting = config.getUseBackgroundColor();
+  const useBackgroundColor =
+    useBackgroundColorSetting && !!theme.background.message;
 
   return (
     <HalfLinePaddedBox

packages/cli/src/ui/components/messages/UserMessage.test.tsx

@@ -7,6 +7,7 @@
 import { renderWithProviders } from '../../../test-utils/render.js';
 import { UserMessage } from './UserMessage.js';
 import { describe, it, expect, vi } from 'vitest';
+import { makeFakeConfig } from '@google/gemini-cli-core';
 
 // Mock the commandUtils to control isSlashCommand behavior
 vi.mock('../../utils/commandUtils.js', () => ({
@@ -14,6 +15,11 @@ vi.mock('../../utils/commandUtils.js', () => ({
 }));
 
 describe('UserMessage', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.restoreAllMocks();
+  });
+
   it('renders normal user message with correct prefix', async () => {
     const { lastFrame, unmount } = await renderWithProviders(
       <UserMessage text="Hello Gemini" width={80} />,
@@ -60,4 +66,32 @@ describe('UserMessage', () => {
     expect(output).toMatchSnapshot();
     unmount();
   });
+
+  describe('with NO_COLOR set', () => {
+    beforeEach(() => {
+      vi.stubEnv('NO_COLOR', '1');
+    });
+
+    it('uses margins instead of background blocks when NO_COLOR is set', async () => {
+      const { lastFrame, unmount } = await renderWithProviders(
+        <UserMessage text="Hello Gemini" width={80} />,
+        { width: 80, config: makeFakeConfig({ useBackgroundColor: true }) },
+      );
+      const output = lastFrame();
+
+      // In NO_COLOR mode, the block characters (▄/▀) should NOT be present.
+      expect(output).not.toContain('▄');
+      expect(output).not.toContain('▀');
+
+      // There should be empty lines above and below the message due to marginY={1}.
+      // lastFrame() returns the full buffer, so we can check for leading/trailing newlines or empty lines.
+      const lines = output.split('\n').filter((l) => l.trim() !== '');
+      expect(lines).toHaveLength(1);
+      expect(lines[0]).toContain('> Hello Gemini');
+
+      expect(output).toMatchSnapshot();
+
+      unmount();
+    });
+  });
 });

packages/cli/src/ui/components/messages/UserMessage.tsx

@@ -27,7 +27,9 @@ export const UserMessage: React.FC<UserMessageProps> = ({ text, width }) => {
   const prefixWidth = prefix.length;
   const isSlashCommand = checkIsSlashCommand(text);
   const config = useConfig();
-  const useBackgroundColor = config.getUseBackgroundColor();
+  const useBackgroundColorSetting = config.getUseBackgroundColor();
+  const useBackgroundColor =
+    useBackgroundColorSetting && !!theme.background.message;
 
   const textColor = isSlashCommand ? theme.text.accent : theme.text.primary;
 

packages/cli/src/ui/components/messages/UserShellMessage.test.tsx

@@ -0,0 +1,54 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { renderWithProviders } from '../../../test-utils/render.js';
+import { UserShellMessage } from './UserShellMessage.js';
+import { describe, it, expect, vi } from 'vitest';
+import { makeFakeConfig } from '@google/gemini-cli-core';
+
+describe('UserShellMessage', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.restoreAllMocks();
+  });
+
+  it('renders normal shell message with correct prefix', async () => {
+    const { lastFrame, unmount } = await renderWithProviders(
+      <UserShellMessage text="ls -la" width={80} />,
+      { width: 80 },
+    );
+    const output = lastFrame();
+
+    expect(output).toContain('$ ls -la');
+    unmount();
+  });
+
+  describe('with NO_COLOR set', () => {
+    beforeEach(() => {
+      vi.stubEnv('NO_COLOR', '1');
+    });
+
+    it('uses margins instead of background blocks when NO_COLOR is set', async () => {
+      const { lastFrame, unmount } = await renderWithProviders(
+        <UserShellMessage text="ls -la" width={80} />,
+        { width: 80, config: makeFakeConfig({ useBackgroundColor: true }) },
+      );
+      const output = lastFrame();
+
+      // In NO_COLOR mode, the block characters (▄/▀) should NOT be present.
+      expect(output).not.toContain('▄');
+      expect(output).not.toContain('▀');
+
+      const lines = output.split('\n').filter((l) => l.trim() !== '');
+      expect(lines).toHaveLength(1);
+      expect(lines[0]).toContain('$ ls -la');
+
+      expect(output).toMatchSnapshot();
+
+      unmount();
+    });
+  });
+});

packages/cli/src/ui/components/messages/UserShellMessage.tsx

@@ -20,7 +20,9 @@ export const UserShellMessage: React.FC<UserShellMessageProps> = ({
   width,
 }) => {
   const config = useConfig();
-  const useBackgroundColor = config.getUseBackgroundColor();
+  const useBackgroundColorSetting = config.getUseBackgroundColor();
+  const useBackgroundColor =
+    useBackgroundColorSetting && !!theme.background.message;
 
   // Remove leading '!' if present, as App.tsx adds it for the processor.
   const commandToDisplay = text.startsWith('!') ? text.substring(1) : text;

packages/cli/src/ui/components/messages/__snapshots__/HintMessage.test.tsx.snap

@@ -0,0 +1,7 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`HintMessage > with NO_COLOR set > uses margins instead of background blocks when NO_COLOR is set 1`] = `
+"
+💡 Steering Hint: Try this instead
+"
+`;

packages/cli/src/ui/components/messages/__snapshots__/UserMessage.test.tsx.snap

@@ -28,3 +28,9 @@ exports[`UserMessage > transforms image paths in user message 1`] = `
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
 "
 `;
+
+exports[`UserMessage > with NO_COLOR set > uses margins instead of background blocks when NO_COLOR is set 1`] = `
+"
+> Hello Gemini
+"
+`;

packages/cli/src/ui/components/messages/__snapshots__/UserShellMessage.test.tsx.snap

@@ -0,0 +1,7 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`UserShellMessage > with NO_COLOR set > uses margins instead of background blocks when NO_COLOR is set 1`] = `
+"
+$ ls -la
+"
+`;

packages/cli/src/utils/sessionCleanup.test.ts

@@ -69,6 +69,7 @@ describe('Session Cleanup (Refactored)', () => {
       },
       getSessionId: () => 'current123',
       getDebugMode: () => false,
+      getExperimentalGemma: () => false,
       initialize: async () => {},
       ...overrides,
     } as unknown as Config;

packages/cli/src/utils/userStartupWarnings.ts

@@ -96,7 +96,9 @@ const folderTrustCheck: WarningCheck = {
 
     if (isHeadlessMode()) {
       throw new FatalUntrustedWorkspaceError(
-        'Gemini CLI is not running in a trusted directory. To proceed, either use `--skip-trust`, set the `GEMINI_CLI_TRUST_WORKSPACE=true` environment variable, or trust this directory in interactive mode.',
+        'Gemini CLI is not running in a trusted directory. To proceed, either use `--skip-trust`, ' +
+          'set the `GEMINI_CLI_TRUST_WORKSPACE=true` environment variable, or trust this directory in interactive mode. ' +
+          'For more details, see https://geminicli.com/docs/cli/trusted-folders/#headless-and-automated-environments',
       );
     }
 

packages/core/index.ts

@@ -12,6 +12,8 @@ export {
   DEFAULT_GEMINI_FLASH_MODEL,
   DEFAULT_GEMINI_FLASH_LITE_MODEL,
   DEFAULT_GEMINI_EMBEDDING_MODEL,
+  GEMMA_4_31B_IT_MODEL,
+  GEMMA_4_26B_A4B_IT_MODEL,
 } from './src/config/models.js';
 export {
   serializeTerminalToObject,

packages/core/src/config/config.test.ts

@@ -960,8 +960,11 @@ describe('Server Config (config.ts)', () => {
       });
 
       await config.refreshAuth(AuthType.LOGIN_WITH_GOOGLE);
+      await config.getExperimentsAsync();
 
-      expect(config.getModel()).toBe(PREVIEW_GEMINI_FLASH_MODEL);
+      await vi.waitFor(() => {
+        expect(config.getModel()).toBe(PREVIEW_GEMINI_FLASH_MODEL);
+      });
     });
 
     it('should NOT switch to flash model if user has Pro access and model is auto', async () => {
@@ -3642,6 +3645,47 @@ describe('Config JIT Initialization', () => {
       expect(config.isAutoMemoryEnabled()).toBe(true);
     });
 
+    it('should return true when experimentalGemma is true', () => {
+      const params: ConfigParameters = {
+        sessionId: 'test-session',
+        targetDir: '/tmp/test',
+        debugMode: false,
+        model: 'test-model',
+        cwd: '/tmp/test',
+        experimentalGemma: true,
+      };
+
+      config = new Config(params);
+      expect(config.getExperimentalGemma()).toBe(true);
+    });
+
+    it('should return false when experimentalGemma is false', () => {
+      const params: ConfigParameters = {
+        sessionId: 'test-session',
+        targetDir: '/tmp/test',
+        debugMode: false,
+        model: 'test-model',
+        cwd: '/tmp/test',
+        experimentalGemma: false,
+      };
+
+      config = new Config(params);
+      expect(config.getExperimentalGemma()).toBe(false);
+    });
+
+    it('should return false when experimentalGemma is not provided', () => {
+      const params: ConfigParameters = {
+        sessionId: 'test-session',
+        targetDir: '/tmp/test',
+        debugMode: false,
+        model: 'test-model',
+        cwd: '/tmp/test',
+      };
+
+      config = new Config(params);
+      expect(config.getExperimentalGemma()).toBe(false);
+    });
+
     it('should be independent of experimentalMemoryV2', () => {
       const params: ConfigParameters = {
         sessionId: 'test-session',

packages/core/src/config/config.ts

@@ -711,6 +711,7 @@ export interface ConfigParameters {
   autoDistillation?: boolean;
   experimentalMemoryV2?: boolean;
   experimentalAutoMemory?: boolean;
+  experimentalGemma?: boolean;
   experimentalContextManagementConfig?: string;
   experimentalAgentHistoryTruncation?: boolean;
   experimentalAgentHistoryTruncationThreshold?: number;
@@ -956,6 +957,7 @@ export class Config implements McpContext, AgentLoopContext {
   private readonly experimentalJitContext: boolean;
   private readonly experimentalMemoryV2: boolean;
   private readonly experimentalAutoMemory: boolean;
+  private readonly experimentalGemma: boolean;
   private readonly experimentalContextManagementConfig?: string;
   private readonly memoryBoundaryMarkers: readonly string[];
   private readonly topicUpdateNarration: boolean;
@@ -1174,6 +1176,7 @@ export class Config implements McpContext, AgentLoopContext {
     this.experimentalJitContext = params.experimentalJitContext ?? true;
     this.experimentalMemoryV2 = params.experimentalMemoryV2 ?? true;
     this.experimentalAutoMemory = params.experimentalAutoMemory ?? false;
+    this.experimentalGemma = params.experimentalGemma ?? false;
     this.experimentalContextManagementConfig =
       params.experimentalContextManagementConfig;
     this.memoryBoundaryMarkers = params.memoryBoundaryMarkers ?? ['.git'];
@@ -1590,8 +1593,12 @@ export class Config implements McpContext, AgentLoopContext {
         return undefined;
       });
 
-    // Fetch experiments and update timeouts before continuing initialization
-    const experiments = await this.experimentsPromise;
+    const [experiments] = await Promise.all([
+      this.experimentsPromise,
+      quotaPromise.catch((e) => {
+        debugLogger.error('Failed to fetch user quota', e);
+      }),
+    ]);
 
     const requestTimeoutMs = this.getRequestTimeoutMs();
     if (requestTimeoutMs !== undefined) {
@@ -1601,8 +1608,6 @@ export class Config implements McpContext, AgentLoopContext {
     // Initialize BaseLlmClient now that the ContentGenerator and experiments are available
     this.baseLlmClient = new BaseLlmClient(this.contentGenerator, this);
 
-    await quotaPromise;
-
     const authType = this.contentGeneratorConfig.authType;
     if (
       authType === AuthType.USE_GEMINI ||
@@ -1623,16 +1628,21 @@ export class Config implements McpContext, AgentLoopContext {
     const adminControlsEnabled =
       experiments?.flags[ExperimentFlags.ENABLE_ADMIN_CONTROLS]?.boolValue ??
       false;
-    const adminControls = await fetchAdminControls(
-      codeAssistServer,
-      this.getRemoteAdminSettings(),
-      adminControlsEnabled,
-      (newSettings: AdminControlsSettings) => {
-        this.setRemoteAdminSettings(newSettings);
-        coreEvents.emitAdminSettingsChanged();
-      },
-    );
-    this.setRemoteAdminSettings(adminControls);
+
+    try {
+      const adminControls = await fetchAdminControls(
+        codeAssistServer,
+        this.getRemoteAdminSettings(),
+        adminControlsEnabled,
+        (newSettings: AdminControlsSettings) => {
+          this.setRemoteAdminSettings(newSettings);
+          coreEvents.emitAdminSettingsChanged();
+        },
+      );
+      this.setRemoteAdminSettings(adminControls);
+    } catch (e) {
+      debugLogger.error('Failed to fetch admin controls', e);
+    }
 
     if ((await this.getProModelNoAccess()) && isAutoModel(this.model)) {
       this.setModel(PREVIEW_GEMINI_FLASH_MODEL);
@@ -2514,6 +2524,10 @@ export class Config implements McpContext, AgentLoopContext {
     return this.experimentalAutoMemory;
   }
 
+  getExperimentalGemma(): boolean {
+    return this.experimentalGemma;
+  }
+
   getExperimentalContextManagementConfig(): string | undefined {
     return this.experimentalContextManagementConfig;
   }

packages/core/src/config/defaultModelConfigs.ts

@@ -89,6 +89,19 @@ export const DEFAULT_MODEL_CONFIGS: ModelConfigServiceConfig = {
         model: 'gemini-2.5-flash-lite',
       },
     },
+    'gemma-4-31b-it': {
+      extends: 'chat-base-3',
+      modelConfig: {
+        model: 'gemma-4-31b-it',
+      },
+    },
+    'gemma-4-26b-a4b-it': {
+      extends: 'chat-base-3',
+      modelConfig: {
+        model: 'gemma-4-26b-a4b-it',
+      },
+    },
+
     // Bases for the internal model configs.
     'gemini-2.5-flash-base': {
       extends: 'base',
@@ -317,6 +330,23 @@ export const DEFAULT_MODEL_CONFIGS: ModelConfigServiceConfig = {
       isVisible: true,
       features: { thinking: false, multimodalToolUse: false },
     },
+    'gemma-4-31b-it': {
+      displayName: 'gemma-4-31b-it',
+      tier: 'custom',
+      family: 'gemma-4',
+      isPreview: false,
+      isVisible: true,
+      features: { thinking: true, multimodalToolUse: false },
+    },
+    'gemma-4-26b-a4b-it': {
+      displayName: 'gemma-4-26b-a4b-it',
+      tier: 'custom',
+      family: 'gemma-4',
+      isPreview: false,
+      isVisible: true,
+      features: { thinking: true, multimodalToolUse: false },
+    },
+
     // Aliases
     auto: {
       tier: 'auto',
@@ -362,6 +392,13 @@ export const DEFAULT_MODEL_CONFIGS: ModelConfigServiceConfig = {
     },
   },
   modelIdResolutions: {
+    'gemma-4-31b-it': {
+      default: 'gemma-4-31b-it',
+    },
+    'gemma-4-26b-a4b-it': {
+      default: 'gemma-4-26b-a4b-it',
+    },
+
     'gemini-3.1-pro-preview': {
       default: 'gemini-3.1-pro-preview',
       contexts: [

packages/core/src/config/models.test.ts

@@ -32,6 +32,8 @@ import {
   PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL,
   isPreviewModel,
   isProModel,
+  GEMMA_4_31B_IT_MODEL,
+  GEMMA_4_26B_A4B_IT_MODEL,
 } from './models.js';
 import type { Config } from './config.js';
 import { ModelConfigService } from '../services/modelConfigService.js';
@@ -356,6 +358,10 @@ describe('getDisplayString', () => {
 
   it('should return the model name as is for other models', () => {
     expect(getDisplayString('custom-model')).toBe('custom-model');
+    expect(getDisplayString(GEMMA_4_31B_IT_MODEL)).toBe(GEMMA_4_31B_IT_MODEL);
+    expect(getDisplayString(GEMMA_4_26B_A4B_IT_MODEL)).toBe(
+      GEMMA_4_26B_A4B_IT_MODEL,
+    );
     expect(getDisplayString(DEFAULT_GEMINI_FLASH_LITE_MODEL)).toBe(
       DEFAULT_GEMINI_FLASH_LITE_MODEL,
     );
@@ -573,6 +579,17 @@ describe('isActiveModel', () => {
     expect(isActiveModel(DEFAULT_GEMINI_FLASH_MODEL)).toBe(true);
   });
 
+  it('should return true for Gemma 4 models only when experimentalGemma is true', () => {
+    expect(isActiveModel(GEMMA_4_31B_IT_MODEL)).toBe(false);
+    expect(isActiveModel(GEMMA_4_26B_A4B_IT_MODEL)).toBe(false);
+    expect(isActiveModel(GEMMA_4_31B_IT_MODEL, false, false, false, true)).toBe(
+      true,
+    );
+    expect(
+      isActiveModel(GEMMA_4_26B_A4B_IT_MODEL, false, false, false, true),
+    ).toBe(true);
+  });
+
   it('should return false for Gemini 3.1 models when Gemini 3.1 is not launched', () => {
     expect(isActiveModel(PREVIEW_GEMINI_3_1_MODEL)).toBe(false);
     expect(isActiveModel(PREVIEW_GEMINI_3_1_FLASH_LITE_MODEL)).toBe(false);

packages/core/src/config/models.ts

@@ -61,6 +61,9 @@ export const DEFAULT_GEMINI_MODEL = 'gemini-2.5-pro';
 export const DEFAULT_GEMINI_FLASH_MODEL = 'gemini-2.5-flash';
 export const DEFAULT_GEMINI_FLASH_LITE_MODEL = 'gemini-2.5-flash-lite';
 
+export const GEMMA_4_31B_IT_MODEL = 'gemma-4-31b-it';
+export const GEMMA_4_26B_A4B_IT_MODEL = 'gemma-4-26b-a4b-it';
+
 export const VALID_GEMINI_MODELS = new Set([
   PREVIEW_GEMINI_MODEL,
   PREVIEW_GEMINI_3_1_MODEL,
@@ -70,6 +73,9 @@ export const VALID_GEMINI_MODELS = new Set([
   DEFAULT_GEMINI_MODEL,
   DEFAULT_GEMINI_FLASH_MODEL,
   DEFAULT_GEMINI_FLASH_LITE_MODEL,
+
+  GEMMA_4_31B_IT_MODEL,
+  GEMMA_4_26B_A4B_IT_MODEL,
 ]);
 
 export const PREVIEW_GEMINI_MODEL_AUTO = 'auto-gemini-3';
@@ -257,6 +263,10 @@ export function getDisplayString(
       return 'Auto (Gemini 3)';
     case DEFAULT_GEMINI_MODEL_AUTO:
       return 'Auto (Gemini 2.5)';
+    case GEMMA_4_31B_IT_MODEL:
+      return GEMMA_4_31B_IT_MODEL;
+    case GEMMA_4_26B_A4B_IT_MODEL:
+      return GEMMA_4_26B_A4B_IT_MODEL;
     case GEMINI_MODEL_ALIAS_PRO:
       return PREVIEW_GEMINI_MODEL;
     case GEMINI_MODEL_ALIAS_FLASH:
@@ -438,10 +448,14 @@ export function isActiveModel(
   useGemini3_1: boolean = false,
   useGemini3_1FlashLite: boolean = false,
   useCustomToolModel: boolean = false,
+  experimentalGemma: boolean = false,
 ): boolean {
   if (!VALID_GEMINI_MODELS.has(model)) {
     return false;
   }
+  if (model === GEMMA_4_31B_IT_MODEL || model === GEMMA_4_26B_A4B_IT_MODEL) {
+    return experimentalGemma;
+  }
   if (model === PREVIEW_GEMINI_3_1_FLASH_LITE_MODEL) {
     return useGemini3_1FlashLite;
   }

packages/core/src/core/tokenLimits.ts

@@ -10,17 +10,23 @@ import {
   DEFAULT_GEMINI_MODEL,
   PREVIEW_GEMINI_FLASH_MODEL,
   PREVIEW_GEMINI_MODEL,
+  GEMMA_4_31B_IT_MODEL,
+  GEMMA_4_26B_A4B_IT_MODEL,
 } from '../config/models.js';
 
 type Model = string;
 type TokenCount = number;
 
 export const DEFAULT_TOKEN_LIMIT = 1_048_576;
+export const GEMMA_4_TOKEN_LIMIT = 256_000;
 
 export function tokenLimit(model: Model): TokenCount {
   // Add other models as they become relevant or if specified by config
   // Pulled from https://ai.google.dev/gemini-api/docs/models
   switch (model) {
+    case GEMMA_4_31B_IT_MODEL:
+    case GEMMA_4_26B_A4B_IT_MODEL:
+      return GEMMA_4_TOKEN_LIMIT;
     case PREVIEW_GEMINI_MODEL:
     case PREVIEW_GEMINI_FLASH_MODEL:
     case DEFAULT_GEMINI_MODEL:

packages/core/src/policy/config.ts

@@ -74,7 +74,9 @@ export const ADMIN_POLICY_TIER = 5;
 
 export const MCP_EXCLUDED_PRIORITY = USER_POLICY_TIER + 0.9;
 export const EXCLUDE_TOOLS_FLAG_PRIORITY = USER_POLICY_TIER + 0.4;
+export const CONFIRMATION_REQUIRED_PRIORITY = USER_POLICY_TIER + 0.35;
 export const ALLOWED_TOOLS_FLAG_PRIORITY = USER_POLICY_TIER + 0.3;
+export const CORE_TOOLS_FLAG_PRIORITY = USER_POLICY_TIER + 0.25;
 export const TRUSTED_MCP_SERVER_PRIORITY = USER_POLICY_TIER + 0.2;
 export const ALLOWED_MCP_SERVER_PRIORITY = USER_POLICY_TIER + 0.1;
 
@@ -434,10 +436,21 @@ export async function createPolicyEngineConfig(
     }
   }
 
-  // Tools that are explicitly allowed in the settings.
-  // Priority: ALLOWED_TOOLS_FLAG_PRIORITY (user tier - explicit temporary allows)
-  if (settings.tools?.allowed) {
-    for (const tool of settings.tools.allowed) {
+  const nonPlanModes = [
+    ApprovalMode.DEFAULT,
+    ApprovalMode.AUTO_EDIT,
+    ApprovalMode.YOLO,
+  ];
+
+  const mapToolsToRules = (
+    tools: string[],
+    priority: number,
+    source: string,
+    modes?: ApprovalMode[],
+    addDefaultDenyForTools = false,
+  ) => {
+    const toolsWithNarrowing = new Set<string>();
+    for (const tool of tools) {
       // Check for legacy format: toolName(args)
       const match = tool.match(/^([a-zA-Z0-9_-]+)\((.*)\)$/);
       if (match) {
@@ -449,15 +462,17 @@ export async function createPolicyEngineConfig(
 
         // Treat args as a command prefix for shell tool
         if (toolName === SHELL_TOOL_NAME) {
+          toolsWithNarrowing.add(toolName);
           const patterns = buildArgsPatterns(undefined, args);
           for (const pattern of patterns) {
             if (pattern) {
               rules.push({
                 toolName,
                 decision: PolicyDecision.ALLOW,
-                priority: ALLOWED_TOOLS_FLAG_PRIORITY,
+                priority,
                 argsPattern: new RegExp(pattern),
-                source: 'Settings (Tools Allowed)',
+                source,
+                modes,
               });
             }
           }
@@ -467,8 +482,9 @@ export async function createPolicyEngineConfig(
           rules.push({
             toolName,
             decision: PolicyDecision.ALLOW,
-            priority: ALLOWED_TOOLS_FLAG_PRIORITY,
-            source: 'Settings (Tools Allowed)',
+            priority,
+            source,
+            modes,
           });
         }
       } else {
@@ -479,11 +495,70 @@ export async function createPolicyEngineConfig(
         rules.push({
           toolName,
           decision: PolicyDecision.ALLOW,
-          priority: ALLOWED_TOOLS_FLAG_PRIORITY,
-          source: 'Settings (Tools Allowed)',
+          priority,
+          source,
+          modes,
         });
       }
     }
+
+    if (addDefaultDenyForTools) {
+      for (const toolName of toolsWithNarrowing) {
+        rules.push({
+          toolName,
+          decision: PolicyDecision.DENY,
+          priority: priority - 0.01,
+          source: `${source} (Narrowing Enforcement)`,
+          modes,
+        });
+      }
+    }
+  };
+
+  // Tools that are explicitly allowed in the settings.
+  // Priority: ALLOWED_TOOLS_FLAG_PRIORITY (user tier - explicit temporary allows)
+  if (settings.tools?.allowed) {
+    mapToolsToRules(
+      settings.tools.allowed,
+      ALLOWED_TOOLS_FLAG_PRIORITY,
+      'Settings (Tools Allowed)',
+      undefined,
+      true,
+    );
+  }
+
+  // Tools that explicitly require confirmation in the settings.
+  // Priority: CONFIRMATION_REQUIRED_PRIORITY (overrides allowed and core)
+  if (settings.tools?.confirmationRequired) {
+    for (const tool of settings.tools.confirmationRequired) {
+      rules.push({
+        toolName: SHELL_TOOL_NAMES.includes(tool) ? SHELL_TOOL_NAME : tool,
+        decision: PolicyDecision.ASK_USER,
+        priority: CONFIRMATION_REQUIRED_PRIORITY,
+        source: 'Settings (Confirmation Required)',
+      });
+    }
+  }
+
+  // Core tools that are restricted in the settings.
+  // Priority: CORE_TOOLS_FLAG_PRIORITY (user tier - core tool allowlist)
+  if (settings.tools?.core) {
+    mapToolsToRules(
+      settings.tools.core,
+      CORE_TOOLS_FLAG_PRIORITY,
+      'Settings (Core Tools)',
+      nonPlanModes,
+    );
+
+    // If core tools are restricted, we should add a default DENY rule for everything else
+    // at a slightly lower priority than the explicit allows.
+    rules.push({
+      toolName: '*',
+      decision: PolicyDecision.DENY,
+      priority: CORE_TOOLS_FLAG_PRIORITY - 0.01,
+      source: 'Settings (Core Tools Allowlist Enforcement)',
+      modes: nonPlanModes,
+    });
   }
 
   // MCP servers that are trusted in the settings.
@@ -501,6 +576,7 @@ export async function createPolicyEngineConfig(
           decision: PolicyDecision.ALLOW,
           priority: TRUSTED_MCP_SERVER_PRIORITY,
           source: 'Settings (MCP Trusted)',
+          modes: nonPlanModes,
         });
       }
     }
@@ -519,6 +595,7 @@ export async function createPolicyEngineConfig(
         decision: PolicyDecision.ALLOW,
         priority: ALLOWED_MCP_SERVER_PRIORITY,
         source: 'Settings (MCP Allowed)',
+        modes: nonPlanModes,
       });
     }
   }

packages/core/src/policy/core-tools-mapping.test.ts

@@ -0,0 +1,76 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect } from 'vitest';
+import { createPolicyEngineConfig } from './config.js';
+import { PolicyEngine } from './policy-engine.js';
+import { PolicyDecision, ApprovalMode } from './types.js';
+
+describe('PolicyEngine - Core Tools Mapping', () => {
+  it('should allow tools explicitly listed in settings.tools.core', async () => {
+    const settings = {
+      tools: {
+        core: ['run_shell_command(ls)', 'run_shell_command(git status)'],
+      },
+    };
+
+    const config = await createPolicyEngineConfig(
+      settings,
+      ApprovalMode.DEFAULT,
+      undefined,
+      true, // interactive
+    );
+
+    const engine = new PolicyEngine(config);
+
+    // Test simple tool name
+    const result1 = await engine.check(
+      { name: 'run_shell_command', args: { command: 'ls' } },
+      undefined,
+    );
+    expect(result1.decision).toBe(PolicyDecision.ALLOW);
+
+    // Test tool name with args
+    const result2 = await engine.check(
+      { name: 'run_shell_command', args: { command: 'git status' } },
+      undefined,
+    );
+    expect(result2.decision).toBe(PolicyDecision.ALLOW);
+
+    // Test tool not in core list
+    const result3 = await engine.check(
+      { name: 'run_shell_command', args: { command: 'npm test' } },
+      undefined,
+    );
+    // Should be DENIED because of strict allowlist
+    expect(result3.decision).toBe(PolicyDecision.DENY);
+  });
+
+  it('should allow tools in tools.core even if they are restricted by default policies', async () => {
+    // By default run_shell_command is ASK_USER.
+    // Putting it in tools.core should make it ALLOW.
+    const settings = {
+      tools: {
+        core: ['run_shell_command'],
+      },
+    };
+
+    const config = await createPolicyEngineConfig(
+      settings,
+      ApprovalMode.DEFAULT,
+      undefined,
+      true,
+    );
+
+    const engine = new PolicyEngine(config);
+
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'any command' } },
+      undefined,
+    );
+    expect(result.decision).toBe(PolicyDecision.ALLOW);
+  });
+});

packages/core/src/policy/policy-engine.test.ts

@@ -43,6 +43,35 @@ vi.mock('../utils/shell-utils.js', async (importOriginal) => {
       }
       return [command];
     }),
+    parseCommandDetails: vi.fn().mockImplementation((command: string) => {
+      // Basic mock implementation for PolicyEngine test needs
+      const commands = command.includes('&&')
+        ? command.split('&&').map((c) => c.trim())
+        : [command.trim()];
+
+      // Detect $(...) or `...` and add as sub-commands for recursion tests
+      const subCommands = [...commands];
+      for (const cmd of commands) {
+        const subMatch = cmd.match(/\$\((.*)\)/) || cmd.match(/`(.*)`/);
+        if (subMatch?.[1]) {
+          subCommands.push(subMatch[1].trim());
+        }
+      }
+
+      return {
+        details: subCommands.map((c, i) => ({
+          name: c.split(' ')[0],
+          text: c,
+          startIndex: i === 0 ? 0 : -1, // Simple root indication
+        })),
+        hasError: false,
+      };
+    }),
+    stripShellWrapper: vi.fn().mockImplementation((command: string) => {
+      // Simple mock for stripping wrappers
+      const match = command.match(/^(?:bash|sh|zsh)\s+-c\s+["'](.*)["']$/i);
+      return match ? match[1] : command;
+    }),
     hasRedirection: vi.fn().mockImplementation(
       (command: string) =>
         // Simple mock: true if '>' is present, unless it looks like "-> arrow"
@@ -1862,7 +1891,6 @@ describe('PolicyEngine', () => {
     });
 
     it('should return ASK_USER in non-YOLO mode if shell command parsing fails', async () => {
-      const { splitCommands } = await import('../utils/shell-utils.js');
       const rules: PolicyRule[] = [
         {
           toolName: 'run_shell_command',
@@ -1877,7 +1905,11 @@ describe('PolicyEngine', () => {
       });
 
       // Simulate parsing failure
-      vi.mocked(splitCommands).mockReturnValueOnce([]);
+      const { parseCommandDetails } = await import('../utils/shell-utils.js');
+      vi.mocked(parseCommandDetails).mockReturnValueOnce({
+        details: [],
+        hasError: true,
+      });
 
       const result = await engine.check(
         { name: 'run_shell_command', args: { command: 'complex command' } },

packages/core/src/policy/policy-engine.ts

@@ -7,8 +7,10 @@
 import { type FunctionCall } from '@google/genai';
 import {
   SHELL_TOOL_NAMES,
+  REDIRECTION_NAMES,
   initializeShellParsers,
-  splitCommands,
+  parseCommandDetails,
+  stripShellWrapper,
   hasRedirection,
   extractStringFromParseEntry,
 } from '../utils/shell-utils.js';
@@ -359,7 +361,8 @@ export class PolicyEngine {
     }
 
     await initializeShellParsers();
-    const subCommands = splitCommands(command);
+    const parsed = parseCommandDetails(command);
+    const subCommands = parsed?.details ?? [];
 
     if (subCommands.length === 0) {
       // If the matched rule says DENY, we should respect it immediately even if parsing fails.
@@ -380,115 +383,109 @@ export class PolicyEngine {
       );
 
       // Parsing logic failed, we can't trust it. Use default decision ASK_USER (or DENY in non-interactive).
-      // We return the rule that matched so the evaluation loop terminates.
       return {
         decision: this.defaultDecision,
         rule,
       };
     }
 
-    // If there are multiple parts, or if we just want to validate the single part against DENY rules
-    if (subCommands.length > 0) {
-      debugLogger.debug(
-        `[PolicyEngine.check] Validating shell command: ${subCommands.length} parts`,
-      );
+    debugLogger.debug(
+      `[PolicyEngine.check] Validating shell command: ${subCommands.length} parts`,
+    );
 
-      if (ruleDecision === PolicyDecision.DENY) {
-        return { decision: PolicyDecision.DENY, rule };
-      }
+    if (ruleDecision === PolicyDecision.DENY) {
+      return { decision: PolicyDecision.DENY, rule };
+    }
 
-      // Start optimistically. If all parts are ALLOW, the whole is ALLOW.
-      // We will downgrade if any part is ASK_USER or DENY.
-      let aggregateDecision = PolicyDecision.ALLOW;
-      let responsibleRule: PolicyRule | undefined;
+    // Start with the decision from the rule or heuristics.
+    // If the tool call was already downgraded (e.g. by heuristics), we start there.
+    let aggregateDecision = ruleDecision;
 
-      // Check for redirection on the full command string
-      if (this.shouldDowngradeForRedirection(command, allowRedirection)) {
+    // If heuristics downgraded the decision, we don't blame the rule.
+    let responsibleRule: PolicyRule | undefined =
+      rule && ruleDecision === rule.decision ? rule : undefined;
+
+    // Check for redirection on the full command string.
+    // Redirection always downgrades ALLOW to ASK_USER (it never upgrades).
+    if (this.shouldDowngradeForRedirection(command, allowRedirection)) {
+      if (aggregateDecision === PolicyDecision.ALLOW) {
         debugLogger.debug(
           `[PolicyEngine.check] Downgrading ALLOW to ASK_USER for redirected command: ${command}`,
         );
         aggregateDecision = PolicyDecision.ASK_USER;
         responsibleRule = undefined; // Inherent policy
       }
+    }
 
-      for (const rawSubCmd of subCommands) {
-        const subCmd = rawSubCmd.trim();
-        // Prevent infinite recursion for the root command
-        if (subCmd === command) {
-          if (this.shouldDowngradeForRedirection(subCmd, allowRedirection)) {
-            debugLogger.debug(
-              `[PolicyEngine.check] Downgrading ALLOW to ASK_USER for redirected command: ${subCmd}`,
-            );
-            // Redirection always downgrades ALLOW to ASK_USER
-            if (aggregateDecision === PolicyDecision.ALLOW) {
-              aggregateDecision = PolicyDecision.ASK_USER;
-              responsibleRule = undefined; // Inherent policy
-            }
+    for (const detail of subCommands) {
+      if (REDIRECTION_NAMES.has(detail.name)) {
+        continue;
+      }
+
+      const subCmd = detail.text.trim();
+      const isAtomic =
+        subCmd === command ||
+        (detail.startIndex === 0 && detail.text.length === command.length);
+
+      // Recursive check for shell wrappers (bash -c, etc.)
+      const stripped = stripShellWrapper(subCmd);
+      if (stripped !== subCmd) {
+        const wrapperResult = await this.check(
+          { name: toolName, args: { command: stripped, dir_path } },
+          serverName,
+          toolAnnotations,
+          subagent,
+          true,
+        );
+
+        if (wrapperResult.decision === PolicyDecision.DENY)
+          return wrapperResult;
+        if (wrapperResult.decision === PolicyDecision.ASK_USER) {
+          if (aggregateDecision === PolicyDecision.ALLOW) {
+            responsibleRule = wrapperResult.rule;
           } else {
-            // Atomic command matching the rule.
-            if (
-              ruleDecision === PolicyDecision.ASK_USER &&
-              aggregateDecision === PolicyDecision.ALLOW
-            ) {
-              aggregateDecision = PolicyDecision.ASK_USER;
-              responsibleRule = rule;
-            }
+            responsibleRule ??= wrapperResult.rule;
           }
-          continue;
+          aggregateDecision = PolicyDecision.ASK_USER;
         }
+      }
 
+      if (!isAtomic) {
         const subResult = await this.check(
           { name: toolName, args: { command: subCmd, dir_path } },
           serverName,
           toolAnnotations,
           subagent,
+          true,
         );
 
-        // subResult.decision is already filtered through applyNonInteractiveMode by this.check()
-        const subDecision = subResult.decision;
+        if (subResult.decision === PolicyDecision.DENY) return subResult;
 
-        // If any part is DENIED, the whole command is DENY
-        if (subDecision === PolicyDecision.DENY) {
-          return {
-            decision: PolicyDecision.DENY,
-            rule: subResult.rule,
-          };
-        }
-
-        // If any part requires ASK_USER, the whole command requires ASK_USER
-        if (subDecision === PolicyDecision.ASK_USER) {
-          aggregateDecision = PolicyDecision.ASK_USER;
-          if (!responsibleRule) {
+        if (subResult.decision === PolicyDecision.ASK_USER) {
+          if (aggregateDecision === PolicyDecision.ALLOW) {
             responsibleRule = subResult.rule;
+          } else {
+            responsibleRule ??= subResult.rule;
           }
+          aggregateDecision = PolicyDecision.ASK_USER;
         }
 
-        // Check for redirection in allowed sub-commands
+        // Downgrade if sub-command has redirection
         if (
-          subDecision === PolicyDecision.ALLOW &&
+          subResult.decision === PolicyDecision.ALLOW &&
           this.shouldDowngradeForRedirection(subCmd, allowRedirection)
         ) {
-          debugLogger.debug(
-            `[PolicyEngine.check] Downgrading ALLOW to ASK_USER for redirected command: ${subCmd}`,
-          );
           if (aggregateDecision === PolicyDecision.ALLOW) {
             aggregateDecision = PolicyDecision.ASK_USER;
             responsibleRule = undefined;
           }
         }
       }
-
-      return {
-        decision: aggregateDecision,
-        // If we stayed at ALLOW, we return the original rule (if any).
-        // If we downgraded, we return the responsible rule (or undefined if implicit).
-        rule: aggregateDecision === ruleDecision ? rule : responsibleRule,
-      };
     }
 
     return {
-      decision: ruleDecision,
-      rule,
+      decision: aggregateDecision,
+      rule: aggregateDecision === ruleDecision ? rule : responsibleRule,
     };
   }
 
@@ -501,6 +498,7 @@ export class PolicyEngine {
     serverName: string | undefined,
     toolAnnotations?: Record<string, unknown>,
     subagent?: string,
+    skipHeuristics = false,
   ): Promise<CheckResult> {
     // Case 1: Metadata injection is the primary and safest way to identify an MCP server.
     // If we have explicit `_serverName` metadata (usually injected by tool-registry for active tools), use it.
@@ -594,6 +592,7 @@ export class PolicyEngine {
 
         let ruleDecision = rule.decision;
         if (
+          !skipHeuristics &&
           isShellCommand &&
           command &&
           !('commandPrefix' in rule) &&
@@ -615,12 +614,10 @@ export class PolicyEngine {
             subagent,
           );
           decision = shellResult.decision;
-          if (shellResult.rule) {
-            matchedRule = shellResult.rule;
-            break;
-          }
+          matchedRule = shellResult.rule;
+          break;
         } else {
-          decision = rule.decision;
+          decision = ruleDecision;
           matchedRule = rule;
           break;
         }
@@ -643,7 +640,7 @@ export class PolicyEngine {
       );
       if (toolName && SHELL_TOOL_NAMES.includes(toolName)) {
         let heuristicDecision = this.defaultDecision;
-        if (command) {
+        if (!skipHeuristics && command) {
           heuristicDecision = await this.applyShellHeuristics(
             command,
             heuristicDecision,

packages/core/src/policy/shell-safety-regression.test.ts

@@ -0,0 +1,134 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, beforeAll } from 'vitest';
+import { PolicyEngine } from './policy-engine.js';
+import { PolicyDecision, ApprovalMode } from './types.js';
+import { initializeShellParsers } from '../utils/shell-utils.js';
+import { buildArgsPatterns } from './utils.js';
+
+describe('PolicyEngine - Shell Safety Regression Suite', () => {
+  let engine: PolicyEngine;
+
+  beforeAll(async () => {
+    await initializeShellParsers();
+  });
+
+  const setupEngine = (allowedCommands: string[]) => {
+    const rules = allowedCommands.map((cmd) => ({
+      toolName: 'run_shell_command',
+      decision: PolicyDecision.ALLOW,
+      argsPattern: new RegExp(buildArgsPatterns(undefined, cmd)[0]!),
+      priority: 10,
+    }));
+
+    return new PolicyEngine({
+      rules,
+      approvalMode: ApprovalMode.DEFAULT,
+      defaultDecision: PolicyDecision.ASK_USER,
+    });
+  };
+
+  it('should block unauthorized chained command with &&', async () => {
+    engine = setupEngine(['echo']);
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo hi && ls' } },
+      undefined,
+    );
+    expect(result.decision).toBe(PolicyDecision.ASK_USER);
+  });
+
+  it('should allow authorized chained command with &&', async () => {
+    engine = setupEngine(['echo', 'ls']);
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo hi && ls' } },
+      undefined,
+    );
+    expect(result.decision).toBe(PolicyDecision.ALLOW);
+  });
+
+  it('should block unauthorized chained command with ||', async () => {
+    engine = setupEngine(['false']);
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'false || ls' } },
+      undefined,
+    );
+    expect(result.decision).toBe(PolicyDecision.ASK_USER);
+  });
+
+  it('should block unauthorized chained command with ;', async () => {
+    engine = setupEngine(['echo']);
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo hi; ls' } },
+      undefined,
+    );
+    expect(result.decision).toBe(PolicyDecision.ASK_USER);
+  });
+
+  it('should block unauthorized command in pipe |', async () => {
+    engine = setupEngine(['echo']);
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo hi | grep "hi"' } },
+      undefined,
+    );
+    expect(result.decision).toBe(PolicyDecision.ASK_USER);
+  });
+
+  it('should allow authorized command in pipe |', async () => {
+    engine = setupEngine(['echo', 'grep']);
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo hi | grep "hi"' } },
+      undefined,
+    );
+    expect(result.decision).toBe(PolicyDecision.ALLOW);
+  });
+
+  it('should block unauthorized chained command with &', async () => {
+    engine = setupEngine(['echo']);
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo hi & ls' } },
+      undefined,
+    );
+    expect(result.decision).toBe(PolicyDecision.ASK_USER);
+  });
+
+  it('should allow authorized chained command with &', async () => {
+    engine = setupEngine(['echo', 'ls']);
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo hi & ls' } },
+      undefined,
+    );
+    expect(result.decision).toBe(PolicyDecision.ALLOW);
+  });
+
+  it('should block unauthorized command in nested substitution', async () => {
+    engine = setupEngine(['echo', 'cat']);
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo $(cat $(ls))' } },
+      undefined,
+    );
+    expect(result.decision).toBe(PolicyDecision.ASK_USER);
+  });
+
+  it('should allow authorized command in nested substitution', async () => {
+    engine = setupEngine(['echo', 'cat', 'ls']);
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo $(cat $(ls))' } },
+      undefined,
+    );
+    expect(result.decision).toBe(PolicyDecision.ALLOW);
+  });
+
+  it('should block command redirection if not explicitly allowed', async () => {
+    engine = setupEngine(['echo']);
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo hi > /tmp/test' } },
+      undefined,
+    );
+    // Inherent policy: redirection downgrades to ASK_USER
+    expect(result.decision).toBe(PolicyDecision.ASK_USER);
+  });
+});

packages/core/src/policy/shell-safety.test.ts

@@ -59,6 +59,30 @@ vi.mock('../utils/shell-utils.js', async (importOriginal) => {
   return {
     ...actual,
     initializeShellParsers: vi.fn(),
+    parseCommandDetails: (command: string) => {
+      if (Object.prototype.hasOwnProperty.call(commandMap, command)) {
+        const subcommands = commandMap[command];
+        return {
+          details: subcommands.map((text) => ({
+            name: text.split(' ')[0],
+            text,
+            startIndex: command.indexOf(text),
+          })),
+          hasError: subcommands.length === 0 && command.includes('&&&'),
+        };
+      }
+      return {
+        details: [
+          {
+            name: command.split(' ')[0],
+            text: command,
+            startIndex: 0,
+          },
+        ],
+        hasError: false,
+      };
+    },
+    stripShellWrapper: (command: string) => command,
     splitCommands: (command: string) => {
       if (Object.prototype.hasOwnProperty.call(commandMap, command)) {
         return commandMap[command];

packages/core/src/policy/shell-substitution.test.ts

@@ -0,0 +1,97 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { expect, describe, it, beforeAll, vi } from 'vitest';
+import { PolicyEngine } from './policy-engine.js';
+import { PolicyDecision } from './types.js';
+import { initializeShellParsers } from '../utils/shell-utils.js';
+
+// Mock node:os to ensure shell-utils logic always thinks it's on a POSIX-like system.
+// This ensures that internal calls to getShellConfiguration() and isWindows()
+// within the shell-utils module return 'bash' configuration, even on Windows CI.
+vi.mock('node:os', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:os')>();
+  return {
+    ...actual,
+    default: {
+      ...actual,
+      platform: () => 'linux',
+    },
+    platform: () => 'linux',
+  };
+});
+
+// Mock shell-utils to ensure consistent behavior across platforms (especially Windows CI)
+// We want to test PolicyEngine logic with Bash syntax rules.
+vi.mock('../utils/shell-utils.js', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('../utils/shell-utils.js')>();
+  return {
+    ...actual,
+    getShellConfiguration: () => ({
+      executable: 'bash',
+      argsPrefix: ['-c'],
+      shell: 'bash',
+    }),
+  };
+});
+
+describe('PolicyEngine Command Substitution Validation', () => {
+  beforeAll(async () => {
+    await initializeShellParsers();
+  });
+
+  const setupEngine = (blockedCmd: string) =>
+    new PolicyEngine({
+      defaultDecision: PolicyDecision.ALLOW,
+      rules: [
+        {
+          toolName: 'run_shell_command',
+          argsPattern: new RegExp(`"command":"${blockedCmd}"`),
+          decision: PolicyDecision.DENY,
+        },
+      ],
+    });
+
+  it('should block echo $(dangerous_cmd) when dangerous_cmd is explicitly blocked', async () => {
+    const engine = setupEngine('dangerous_cmd');
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo $(dangerous_cmd)' } },
+      'test-server',
+    );
+    expect(result.decision).toBe(PolicyDecision.DENY);
+  });
+
+  it('should block backtick substitution `dangerous_cmd`', async () => {
+    const engine = setupEngine('dangerous_cmd');
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: 'echo `dangerous_cmd`' } },
+      'test-server',
+    );
+    expect(result.decision).toBe(PolicyDecision.DENY);
+  });
+
+  it('should block commands inside subshells (dangerous_cmd)', async () => {
+    const engine = setupEngine('dangerous_cmd');
+    const result = await engine.check(
+      { name: 'run_shell_command', args: { command: '(dangerous_cmd)' } },
+      'test-server',
+    );
+    expect(result.decision).toBe(PolicyDecision.DENY);
+  });
+
+  it('should handle nested substitutions deeply', async () => {
+    const engine = setupEngine('deep_danger');
+    const result = await engine.check(
+      {
+        name: 'run_shell_command',
+        args: { command: 'echo $(ls $(deep_danger))' },
+      },
+      'test-server',
+    );
+    expect(result.decision).toBe(PolicyDecision.DENY);
+  });
+});

packages/core/src/policy/types.ts

@@ -335,8 +335,10 @@ export interface PolicySettings {
     allowed?: string[];
   };
   tools?: {
+    core?: string[];
     exclude?: string[];
     allowed?: string[];
+    confirmationRequired?: string[];
   };
   mcpServers?: Record<string, { trust?: boolean }>;
   // User provided policies that will replace the USER level policies in ~/.gemini/policies

packages/core/src/services/test-data/resolved-aliases-retry.golden.json

@@ -97,6 +97,30 @@
       "topK": 64
     }
   },
+  "gemma-4-31b-it": {
+    "model": "gemma-4-31b-it",
+    "generateContentConfig": {
+      "temperature": 1,
+      "topP": 0.95,
+      "thinkingConfig": {
+        "includeThoughts": true,
+        "thinkingLevel": "HIGH"
+      },
+      "topK": 64
+    }
+  },
+  "gemma-4-26b-a4b-it": {
+    "model": "gemma-4-26b-a4b-it",
+    "generateContentConfig": {
+      "temperature": 1,
+      "topP": 0.95,
+      "thinkingConfig": {
+        "includeThoughts": true,
+        "thinkingLevel": "HIGH"
+      },
+      "topK": 64
+    }
+  },
   "gemini-2.5-flash-base": {
     "model": "gemini-2.5-flash",
     "generateContentConfig": {

packages/core/src/services/test-data/resolved-aliases.golden.json

@@ -97,6 +97,30 @@
       "topK": 64
     }
   },
+  "gemma-4-31b-it": {
+    "model": "gemma-4-31b-it",
+    "generateContentConfig": {
+      "temperature": 1,
+      "topP": 0.95,
+      "thinkingConfig": {
+        "includeThoughts": true,
+        "thinkingLevel": "HIGH"
+      },
+      "topK": 64
+    }
+  },
+  "gemma-4-26b-a4b-it": {
+    "model": "gemma-4-26b-a4b-it",
+    "generateContentConfig": {
+      "temperature": 1,
+      "topP": 0.95,
+      "thinkingConfig": {
+        "includeThoughts": true,
+        "thinkingLevel": "HIGH"
+      },
+      "topK": 64
+    }
+  },
   "gemini-2.5-flash-base": {
     "model": "gemini-2.5-flash",
     "generateContentConfig": {

packages/core/src/tools/mcp-client.test.ts

@@ -1993,6 +1993,27 @@ describe('mcp-client', () => {
       });
     });
 
+    it('should unconditionally attach a data listener to stderr to prevent process hang', async () => {
+      const mockStderr = {
+        on: vi.fn(),
+      };
+
+      vi.spyOn(SdkClientStdioLib, 'StdioClientTransport').mockReturnValue({
+        stderr: mockStderr,
+      } as unknown as SdkClientStdioLib.StdioClientTransport);
+
+      await createTransport(
+        'test-server',
+        {
+          command: 'test-command',
+        },
+        false, // debugMode = false
+        MOCK_CONTEXT,
+      );
+
+      expect(mockStderr.on).toHaveBeenCalledWith('data', expect.any(Function));
+    });
+
     it('sets an env variable GEMINI_CLI=1 for stdio MCP servers', async () => {
       const mockedTransport = vi
         .spyOn(SdkClientStdioLib, 'StdioClientTransport')

packages/core/src/tools/mcp-client.ts

@@ -2291,31 +2291,40 @@ export async function createTransport(
       transport = new XcodeMcpBridgeFixTransport(transport);
     }
 
-    if (debugMode) {
-      // The `XcodeMcpBridgeFixTransport` wrapper hides the underlying `StdioClientTransport`,
-      // which exposes `stderr` for debug logging. We need to unwrap it to attach the listener.
+    // The `XcodeMcpBridgeFixTransport` wrapper hides the underlying `StdioClientTransport`,
+    // which exposes `stderr` for debug logging. We need to unwrap it to attach the listener.
 
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-      const underlyingTransport =
-        transport instanceof XcodeMcpBridgeFixTransport
-          ? // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
-            (transport as any).transport
-          : transport;
+    const underlyingTransport =
+      transport instanceof XcodeMcpBridgeFixTransport
+        ? // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+          (transport as unknown as { transport: unknown }).transport
+        : transport;
 
-      if (
-        underlyingTransport instanceof StdioClientTransport &&
-        underlyingTransport.stderr
-      ) {
-        underlyingTransport.stderr.on('data', (data) => {
-          // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-          const stderrStr = data.toString().trim();
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+    const streamTransport = underlyingTransport as {
+      stderr?: {
+        on: (event: string, listener: (data: unknown) => void) => void;
+      };
+    };
+
+    if (
+      streamTransport &&
+      typeof streamTransport === 'object' &&
+      'stderr' in streamTransport &&
+      streamTransport.stderr &&
+      typeof streamTransport.stderr.on === 'function'
+    ) {
+      streamTransport.stderr.on('data', (data: unknown) => {
+        if (debugMode) {
+          const stderrStr = String(data).trim();
           debugLogger.debug(
             `[DEBUG] [MCP STDERR (${mcpServerName})]: `,
             stderrStr,
           );
-        });
-      }
+        }
+      });
     }
+
     return transport;
   }
 

packages/core/src/tools/ripGrep.test.ts

@@ -1993,13 +1993,15 @@ describe('getRipgrepPath', () => {
       vi.mocked(fileExists).mockImplementation(
         async (checkPath) =>
           checkPath.includes(path.normalize('core/vendor/ripgrep')) &&
-          !checkPath.includes('tools'),
+          !checkPath.includes(path.join(path.sep, 'tools', path.sep)),
       );
 
       const resolvedPath = await getRipgrepPath();
       expect(resolvedPath).not.toBeNull();
       expect(resolvedPath).toContain(path.normalize('core/vendor/ripgrep'));
-      expect(resolvedPath).not.toContain('tools');
+      expect(resolvedPath).not.toContain(
+        path.join(path.sep, 'tools', path.sep),
+      );
     });
 
     it('should return null if binary is missing from both paths', async () => {

packages/core/src/tools/trackerTools.test.ts

@@ -37,6 +37,7 @@ describe('Tracker Tools Integration', () => {
       model: 'gemini-3-flash',
       debugMode: false,
     });
+    await config.initialize();
     messageBus = new MessageBus(null as unknown as PolicyEngine, false);
   });
 
@@ -120,8 +121,14 @@ describe('Tracker Tools Integration', () => {
     );
 
     const tasks = await config.getTrackerService().listTasks();
-    const parentId = tasks.find((t) => t.title === 'Parent Task')!.id;
-    const childId = tasks.find((t) => t.title === 'Child Task')!.id;
+    const parentTask = tasks.find((t) => t.title === 'Parent Task');
+    const childTask = tasks.find((t) => t.title === 'Child Task');
+
+    expect(parentTask).toBeDefined();
+    expect(childTask).toBeDefined();
+
+    const parentId = parentTask!.id;
+    const childId = childTask!.id;
 
     // Add Dependency
     const addDepTool = new TrackerAddDependencyTool(config, messageBus);

packages/core/src/utils/shell-utils.ts

@@ -240,11 +240,15 @@ foreach ($commandAst in $commandAsts) {
   'utf16le',
 ).toString('base64');
 
-const REDIRECTION_NAMES = new Set([
+export const REDIRECTION_NAMES = new Set([
   'redirection (<)',
   'redirection (>)',
   'heredoc (<<)',
   'herestring (<<<)',
+  'command substitution',
+  'backtick substitution',
+  'process substitution',
+  'subshell',
 ]);
 
 function createParser(): Parser | null {
@@ -360,6 +364,14 @@ function extractNameFromNode(node: Node): string | null {
       return 'heredoc (<<)';
     case 'herestring_redirect':
       return 'herestring (<<<)';
+    case 'command_substitution':
+      return 'command substitution';
+    case 'backtick_substitution':
+      return 'backtick substitution';
+    case 'process_substitution':
+      return 'process substitution';
+    case 'subshell':
+      return 'subshell';
     default:
       return null;
   }

packages/test-utils/src/test-rig.ts

@@ -680,6 +680,7 @@ export class TestRig {
         key !== 'GEMINI_DEBUG' &&
         key !== 'GEMINI_CLI_TEST_VAR' &&
         key !== 'GEMINI_CLI_INTEGRATION_TEST' &&
+        key !== 'GOOGLE_GEMINI_BASE_URL' &&
         !key.startsWith('GEMINI_CLI_ACTIVITY_LOG')
       ) {
         delete cleanEnv[key];

tools/gemini-cli-bot/README.md

@@ -0,0 +1,51 @@
+# Gemini CLI Bot (Cognitive Repository)
+
+This directory contains the foundational architecture for the `gemini-cli-bot`,
+transforming the repository into a proactive, evolutionary system.
+
+It implements a dual-layer approach to balance immediate responsiveness with
+long-term strategic optimization.
+
+## Layered Execution Model
+
+### 1. System 1: The Pulse (Reflex Layer)
+
+- **Purpose**: High-frequency, deterministic maintenance and data collection.
+- **Frequency**: 30-minute cron (`.github/workflows/gemini-cli-bot-pulse.yml`).
+- **Implementation**: Pure TypeScript/JavaScript scripts.
+- **Role**: Currently focuses on gathering repository metrics
+  (`tools/gemini-cli-bot/metrics/scripts`).
+- **Output**: Action execution and `metrics-before.csv` artifact generation.
+
+### 2. System 2: The Brain (Reasoning Layer)
+
+- **Purpose**: Strategic investigation, policy refinement, and
+  self-optimization.
+- **Frequency**: 24-hour cron (`.github/workflows/gemini-cli-bot-brain.yml`).
+- **Implementation**: Agentic Gemini CLI phases.
+- **Role**: Analyzing metric trends and running deeper repository health
+  investigations.
+
+## Directory Structure
+
+- `metrics/`: Contains the deterministic runner (`index.ts`) and individual
+  TypeScript scripts (`scripts/`) that use the GitHub CLI to track metrics like
+  open issues, PR latency, throughput, and reviewer domain expertise.
+- `processes/scripts/`: Placeholder directory for future deterministic triage
+  and routing scripts.
+- `investigations/`: Placeholder directory for agentic root-cause analysis
+  phases.
+- `critique/`: Placeholder directory for policy evaluation.
+- `history/`: Storage for downloaded metrics artifacts from previous runs.
+
+## Usage
+
+To manually collect repository metrics locally, run the following command from
+the workspace root:
+
+```bash
+npm run metrics
+```
+
+This will execute all scripts within `metrics/scripts/` and output the results
+to a `metrics-before.csv` file in the root directory.

tools/gemini-cli-bot/metrics/index.ts

@@ -0,0 +1,69 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { readdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { execSync } from 'node:child_process';
+
+const SCRIPTS_DIR = join(
+  process.cwd(),
+  'tools',
+  'gemini-cli-bot',
+  'metrics',
+  'scripts',
+);
+const OUTPUT_FILE = join(process.cwd(), 'metrics-before.csv');
+
+function processOutputLine(line: string, results: string[]) {
+  const trimmedLine = line.trim();
+  if (!trimmedLine) return;
+
+  try {
+    const parsed = JSON.parse(trimmedLine);
+    if (
+      parsed &&
+      typeof parsed === 'object' &&
+      'metric' in parsed &&
+      'value' in parsed
+    ) {
+      results.push(`${parsed.metric},${parsed.value}`);
+    } else {
+      results.push(trimmedLine);
+    }
+  } catch {
+    results.push(trimmedLine);
+  }
+}
+
+async function run() {
+  const scripts = readdirSync(SCRIPTS_DIR).filter(
+    (file) => file.endsWith('.ts') || file.endsWith('.js'),
+  );
+
+  const results: string[] = ['metric,value'];
+
+  for (const script of scripts) {
+    console.log(`Running metric script: ${script}`);
+    try {
+      const scriptPath = join(SCRIPTS_DIR, script);
+      const output = execSync(`npx tsx ${JSON.stringify(scriptPath)}`, {
+        encoding: 'utf-8',
+      });
+
+      const lines = output.trim().split('\n');
+      for (const line of lines) {
+        processOutputLine(line, results);
+      }
+    } catch (error) {
+      console.error(`Error running ${script}:`, error);
+    }
+  }
+
+  writeFileSync(OUTPUT_FILE, results.join('\n'));
+  console.log(`Saved metrics to ${OUTPUT_FILE}`);
+}
+
+run().catch(console.error);

tools/gemini-cli-bot/metrics/scripts/domain_expertise.ts

@@ -0,0 +1,157 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * @license
+ */
+
+import { GITHUB_OWNER, GITHUB_REPO, MetricOutput } from '../types.js';
+import { execSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const repoRoot = path.resolve(__dirname, '../../../../');
+
+try {
+  // 1. Fetch recent PR numbers and reviews from GitHub (so we have reviewer names/logins)
+  const query = `
+  query($owner: String!, $repo: String!) {
+    repository(owner: $owner, name: $repo) {
+      pullRequests(last: 100, states: MERGED) {
+        nodes {
+          number
+          reviews(first: 20) {
+            nodes {
+              authorAssociation
+              author { login, ... on User { name } }
+            }
+          }
+        }
+      }
+    }
+  }
+  `;
+  const output = execSync(
+    `gh api graphql -F owner=${GITHUB_OWNER} -F repo=${GITHUB_REPO} -f query='${query}'`,
+    { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] },
+  );
+  const data = JSON.parse(output).data.repository;
+
+  // 2. Map PR numbers to local commits using git log
+  const logOutput = execSync('git log -n 5000 --format="%H|%s"', {
+    cwd: repoRoot,
+    encoding: 'utf-8',
+    stdio: ['ignore', 'pipe', 'ignore'],
+  });
+  const prCommits = new Map<number, string>();
+  for (const line of logOutput.split('\n')) {
+    if (!line) continue;
+    const [hash, subject] = line.split('|');
+    const match = subject.match(/\(#(\d+)\)$/);
+    if (match) {
+      prCommits.set(parseInt(match[1], 10), hash);
+    }
+  }
+
+  let totalMaintainerReviews = 0;
+  let maintainerReviewsWithExpertise = 0;
+
+  for (const pr of data.pullRequests.nodes) {
+    if (!pr.reviews?.nodes || pr.reviews.nodes.length === 0) continue;
+
+    const commitHash = prCommits.get(pr.number);
+    if (!commitHash) continue; // Skip if we don't have the commit locally
+
+    // 3. Get exact files changed using local git diff-tree, bypassing GraphQL limits
+    const diffTreeOutput = execSync(
+      `git diff-tree --no-commit-id --name-only -r ${commitHash}`,
+      { cwd: repoRoot, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] },
+    );
+    const files = diffTreeOutput.split('\n').filter(Boolean);
+    if (files.length === 0) continue;
+
+    // Cache git log authors per path to avoid redundant child_process calls
+    const authorCache = new Map<string, string>();
+    const getAuthors = (targetPath: string) => {
+      if (authorCache.has(targetPath)) return authorCache.get(targetPath)!;
+      try {
+        const authors = execSync(
+          `git log --format="%an|%ae" -- ${JSON.stringify(targetPath)}`,
+          {
+            cwd: repoRoot,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+          },
+        ).toLowerCase();
+        authorCache.set(targetPath, authors);
+        return authors;
+      } catch {
+        authorCache.set(targetPath, '');
+        return '';
+      }
+    };
+
+    const reviewersOnPR = new Map<string, { name?: string }>();
+    for (const review of pr.reviews.nodes) {
+      if (
+        ['MEMBER', 'OWNER'].includes(review.authorAssociation) &&
+        review.author?.login
+      ) {
+        const login = review.author.login.toLowerCase();
+        if (login.endsWith('[bot]') || login.includes('bot')) continue;
+        reviewersOnPR.set(login, review.author);
+      }
+    }
+
+    for (const [login, authorInfo] of reviewersOnPR.entries()) {
+      totalMaintainerReviews++;
+      let hasExpertise = false;
+      const name = authorInfo.name ? authorInfo.name.toLowerCase() : '';
+
+      for (const file of files) {
+        // Precise check: immediate file
+        let authorsStr = getAuthors(file);
+        if (authorsStr.includes(login) || (name && authorsStr.includes(name))) {
+          hasExpertise = true;
+          break;
+        }
+
+        // Fallback: file's directory
+        const dir = path.dirname(file);
+        authorsStr = getAuthors(dir);
+        if (authorsStr.includes(login) || (name && authorsStr.includes(name))) {
+          hasExpertise = true;
+          break;
+        }
+      }
+
+      if (hasExpertise) {
+        maintainerReviewsWithExpertise++;
+      }
+    }
+  }
+
+  const ratio =
+    totalMaintainerReviews > 0
+      ? maintainerReviewsWithExpertise / totalMaintainerReviews
+      : 0;
+  const timestamp = new Date().toISOString();
+
+  process.stdout.write(
+    JSON.stringify(<MetricOutput>{
+      metric: 'domain_expertise',
+      value: Math.round(ratio * 100) / 100,
+      timestamp,
+      details: {
+        totalMaintainerReviews,
+        maintainerReviewsWithExpertise,
+      },
+    }) + '\n',
+  );
+} catch (err) {
+  process.stderr.write(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}

tools/gemini-cli-bot/metrics/scripts/latency.ts

@@ -0,0 +1,138 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * @license
+ */
+
+import { GITHUB_OWNER, GITHUB_REPO, MetricOutput } from '../types.js';
+import { execSync } from 'node:child_process';
+
+try {
+  const query = `
+  query($owner: String!, $repo: String!) {
+    repository(owner: $owner, name: $repo) {
+      pullRequests(last: 100, states: MERGED) {
+        nodes {
+          authorAssociation
+          createdAt
+          mergedAt
+        }
+      }
+      issues(last: 100, states: CLOSED) {
+        nodes {
+          authorAssociation
+          createdAt
+          closedAt
+        }
+      }
+    }
+  }
+  `;
+  const output = execSync(
+    `gh api graphql -F owner=${GITHUB_OWNER} -F repo=${GITHUB_REPO} -f query='${query}'`,
+    { encoding: 'utf-8' },
+  );
+  const data = JSON.parse(output).data.repository;
+
+  const prs = data.pullRequests.nodes.map(
+    (p: {
+      authorAssociation: string;
+      mergedAt: string;
+      createdAt: string;
+    }) => ({
+      association: p.authorAssociation,
+      latencyHours:
+        (new Date(p.mergedAt).getTime() - new Date(p.createdAt).getTime()) /
+        (1000 * 60 * 60),
+    }),
+  );
+  const issues = data.issues.nodes.map(
+    (i: {
+      authorAssociation: string;
+      closedAt: string;
+      createdAt: string;
+    }) => ({
+      association: i.authorAssociation,
+      latencyHours:
+        (new Date(i.closedAt).getTime() - new Date(i.createdAt).getTime()) /
+        (1000 * 60 * 60),
+    }),
+  );
+
+  const isMaintainer = (assoc: string) =>
+    ['MEMBER', 'OWNER', 'COLLABORATOR'].includes(assoc);
+  const calculateAvg = (
+    items: { association: string; latencyHours: number }[],
+  ) =>
+    items.length
+      ? items.reduce((a, b) => a + b.latencyHours, 0) / items.length
+      : 0;
+
+  const prMaintainers = calculateAvg(
+    prs.filter((i: { association: string; latencyHours: number }) =>
+      isMaintainer(i.association),
+    ),
+  );
+  const prCommunity = calculateAvg(
+    prs.filter(
+      (i: { association: string; latencyHours: number }) =>
+        !isMaintainer(i.association),
+    ),
+  );
+  const prOverall = calculateAvg(prs);
+
+  const issueMaintainers = calculateAvg(
+    issues.filter((i: { association: string; latencyHours: number }) =>
+      isMaintainer(i.association),
+    ),
+  );
+  const issueCommunity = calculateAvg(
+    issues.filter(
+      (i: { association: string; latencyHours: number }) =>
+        !isMaintainer(i.association),
+    ),
+  );
+  const issueOverall = calculateAvg(issues);
+
+  const timestamp = new Date().toISOString();
+
+  const metrics: MetricOutput[] = [
+    {
+      metric: 'latency_pr_overall_hours',
+      value: Math.round(prOverall * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'latency_pr_maintainers_hours',
+      value: Math.round(prMaintainers * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'latency_pr_community_hours',
+      value: Math.round(prCommunity * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'latency_issue_overall_hours',
+      value: Math.round(issueOverall * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'latency_issue_maintainers_hours',
+      value: Math.round(issueMaintainers * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'latency_issue_community_hours',
+      value: Math.round(issueCommunity * 100) / 100,
+      timestamp,
+    },
+  ];
+
+  metrics.forEach((m) => process.stdout.write(JSON.stringify(m) + '\n'));
+} catch (err) {
+  process.stderr.write(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}

tools/gemini-cli-bot/metrics/scripts/open_issues.ts

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { execSync } from 'node:child_process';
+
+try {
+  const count = execSync(
+    'gh issue list --state open --limit 1000 --json number --jq length',
+    {
+      encoding: 'utf-8',
+    },
+  ).trim();
+  console.log(`open_issues,${count}`);
+} catch {
+  // Fallback if gh fails or no issues found
+  console.log('open_issues,0');
+}

tools/gemini-cli-bot/metrics/scripts/open_prs.ts

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { execSync } from 'node:child_process';
+
+try {
+  const count = execSync(
+    'gh pr list --state open --limit 1000 --json number --jq length',
+    {
+      encoding: 'utf-8',
+    },
+  ).trim();
+  console.log(`open_prs,${count}`);
+} catch {
+  // Fallback if gh fails or no PRs found
+  console.log('open_prs,0');
+}

tools/gemini-cli-bot/metrics/scripts/review_distribution.ts

@@ -0,0 +1,82 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * @license
+ */
+
+import { GITHUB_OWNER, GITHUB_REPO, MetricOutput } from '../types.js';
+import { execSync } from 'node:child_process';
+
+try {
+  const query = `
+  query($owner: String!, $repo: String!) {
+    repository(owner: $owner, name: $repo) {
+      pullRequests(last: 100) {
+        nodes {
+          reviews(first: 50) {
+            nodes {
+              author { login }
+              authorAssociation
+            }
+          }
+        }
+      }
+    }
+  }
+  `;
+  const output = execSync(
+    `gh api graphql -F owner=${GITHUB_OWNER} -F repo=${GITHUB_REPO} -f query='${query}'`,
+    { encoding: 'utf-8' },
+  );
+  const data = JSON.parse(output).data.repository;
+
+  const reviewCounts: Record<string, number> = {};
+
+  for (const pr of data.pullRequests.nodes) {
+    if (!pr.reviews?.nodes) continue;
+    // We only count one review per author per PR to avoid counting multiple review comments as multiple reviews
+    const reviewersOnPR = new Set<string>();
+
+    for (const review of pr.reviews.nodes) {
+      if (
+        ['MEMBER', 'OWNER'].includes(review.authorAssociation) &&
+        review.author?.login
+      ) {
+        const login = review.author.login.toLowerCase();
+        if (login.endsWith('[bot]') || login.includes('bot')) {
+          continue; // Ignore bots
+        }
+        reviewersOnPR.add(review.author.login);
+      }
+    }
+
+    for (const reviewer of reviewersOnPR) {
+      reviewCounts[reviewer] = (reviewCounts[reviewer] || 0) + 1;
+    }
+  }
+
+  const counts = Object.values(reviewCounts);
+
+  let variance = 0;
+  if (counts.length > 0) {
+    const mean = counts.reduce((a, b) => a + b, 0) / counts.length;
+    variance =
+      counts.reduce((a, b) => a + Math.pow(b - mean, 2), 0) / counts.length;
+  }
+
+  const timestamp = new Date().toISOString();
+
+  process.stdout.write(
+    JSON.stringify(<MetricOutput>{
+      metric: 'review_distribution_variance',
+      value: Math.round(variance * 100) / 100,
+      timestamp,
+      details: reviewCounts,
+    }) + '\n',
+  );
+} catch (err) {
+  process.stderr.write(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}

tools/gemini-cli-bot/metrics/scripts/throughput.ts

@@ -0,0 +1,148 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * @license
+ */
+
+import { GITHUB_OWNER, GITHUB_REPO, MetricOutput } from '../types.js';
+import { execSync } from 'node:child_process';
+
+try {
+  const query = `
+  query($owner: String!, $repo: String!) {
+    repository(owner: $owner, name: $repo) {
+      pullRequests(last: 100, states: MERGED) {
+        nodes {
+          authorAssociation
+          mergedAt
+        }
+      }
+      issues(last: 100, states: CLOSED) {
+        nodes {
+          authorAssociation
+          closedAt
+        }
+      }
+    }
+  }
+  `;
+  const output = execSync(
+    `gh api graphql -F owner=${GITHUB_OWNER} -F repo=${GITHUB_REPO} -f query='${query}'`,
+    { encoding: 'utf-8' },
+  );
+  const data = JSON.parse(output).data.repository;
+
+  const prs = data.pullRequests.nodes
+    .map((p: { authorAssociation: string; mergedAt: string }) => ({
+      association: p.authorAssociation,
+      date: new Date(p.mergedAt).getTime(),
+    }))
+    .sort((a: { date: number }, b: { date: number }) => a.date - b.date);
+
+  const issues = data.issues.nodes
+    .map((i: { authorAssociation: string; closedAt: string }) => ({
+      association: i.authorAssociation,
+      date: new Date(i.closedAt).getTime(),
+    }))
+    .sort((a: { date: number }, b: { date: number }) => a.date - b.date);
+
+  const isMaintainer = (assoc: string) =>
+    ['MEMBER', 'OWNER', 'COLLABORATOR'].includes(assoc);
+
+  const calculateThroughput = (
+    items: { association: string; date: number }[],
+  ) => {
+    if (items.length < 2) return 0;
+    const first = items[0].date;
+    const last = items[items.length - 1].date;
+    const days = (last - first) / (1000 * 60 * 60 * 24);
+    return days > 0 ? items.length / days : items.length; // items per day
+  };
+
+  const prOverall = calculateThroughput(prs);
+  const prMaintainers = calculateThroughput(
+    prs.filter((i: { association: string; date: number }) =>
+      isMaintainer(i.association),
+    ),
+  );
+  const prCommunity = calculateThroughput(
+    prs.filter(
+      (i: { association: string; date: number }) =>
+        !isMaintainer(i.association),
+    ),
+  );
+
+  const issueOverall = calculateThroughput(issues);
+  const issueMaintainers = calculateThroughput(
+    issues.filter((i: { association: string; date: number }) =>
+      isMaintainer(i.association),
+    ),
+  );
+  const issueCommunity = calculateThroughput(
+    issues.filter(
+      (i: { association: string; date: number }) =>
+        !isMaintainer(i.association),
+    ),
+  );
+
+  const timestamp = new Date().toISOString();
+
+  const metrics: MetricOutput[] = [
+    {
+      metric: 'throughput_pr_overall_per_day',
+      value: Math.round(prOverall * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'throughput_pr_maintainers_per_day',
+      value: Math.round(prMaintainers * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'throughput_pr_community_per_day',
+      value: Math.round(prCommunity * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'throughput_issue_overall_per_day',
+      value: Math.round(issueOverall * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'throughput_issue_maintainers_per_day',
+      value: Math.round(issueMaintainers * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'throughput_issue_community_per_day',
+      value: Math.round(issueCommunity * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'throughput_issue_overall_days_per_issue',
+      value: issueOverall > 0 ? Math.round((1 / issueOverall) * 100) / 100 : 0,
+      timestamp,
+    },
+    {
+      metric: 'throughput_issue_maintainers_days_per_issue',
+      value:
+        issueMaintainers > 0
+          ? Math.round((1 / issueMaintainers) * 100) / 100
+          : 0,
+      timestamp,
+    },
+    {
+      metric: 'throughput_issue_community_days_per_issue',
+      value:
+        issueCommunity > 0 ? Math.round((1 / issueCommunity) * 100) / 100 : 0,
+      timestamp,
+    },
+  ];
+
+  metrics.forEach((m) => process.stdout.write(JSON.stringify(m) + '\n'));
+} catch (err) {
+  process.stderr.write(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}

tools/gemini-cli-bot/metrics/scripts/time_to_first_response.ts

@@ -0,0 +1,157 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * @license
+ */
+
+import { GITHUB_OWNER, GITHUB_REPO, MetricOutput } from '../types.js';
+import { execSync } from 'node:child_process';
+
+try {
+  const query = `
+  query($owner: String!, $repo: String!) {
+    repository(owner: $owner, name: $repo) {
+      pullRequests(last: 100) {
+        nodes {
+          authorAssociation
+          author { login }
+          createdAt
+          comments(first: 20) {
+            nodes {
+              author { login }
+              createdAt
+            }
+          }
+          reviews(first: 20) {
+            nodes {
+              author { login }
+              createdAt
+            }
+          }
+        }
+      }
+      issues(last: 100) {
+        nodes {
+          authorAssociation
+          author { login }
+          createdAt
+          comments(first: 20) {
+            nodes {
+              author { login }
+              createdAt
+            }
+          }
+        }
+      }
+    }
+  }
+  `;
+  const output = execSync(
+    `gh api graphql -F owner=${GITHUB_OWNER} -F repo=${GITHUB_REPO} -f query='${query}'`,
+    { encoding: 'utf-8' },
+  );
+  const data = JSON.parse(output).data.repository;
+
+  const getFirstResponseTime = (item: {
+    createdAt: string;
+    author: { login: string };
+    comments: { nodes: { createdAt: string; author?: { login: string } }[] };
+    reviews?: { nodes: { createdAt: string; author?: { login: string } }[] };
+  }) => {
+    const authorLogin = item.author?.login;
+    let earliestResponse: number | null = null;
+
+    const checkNodes = (
+      nodes: { createdAt: string; author?: { login: string } }[],
+    ) => {
+      for (const node of nodes) {
+        if (node.author?.login && node.author.login !== authorLogin) {
+          const login = node.author.login.toLowerCase();
+          if (login.endsWith('[bot]') || login.includes('bot')) {
+            continue; // Ignore bots
+          }
+          const time = new Date(node.createdAt).getTime();
+          if (!earliestResponse || time < earliestResponse) {
+            earliestResponse = time;
+          }
+        }
+      }
+    };
+
+    if (item.comments?.nodes) checkNodes(item.comments.nodes);
+    if (item.reviews?.nodes) checkNodes(item.reviews.nodes);
+
+    if (earliestResponse) {
+      return (
+        (earliestResponse - new Date(item.createdAt).getTime()) /
+        (1000 * 60 * 60)
+      );
+    }
+    return null; // No response yet
+  };
+  const processItems = (
+    items: {
+      authorAssociation: string;
+      createdAt: string;
+      author: { login: string };
+      comments: {
+        nodes: { createdAt: string; author?: { login: string } }[];
+      };
+      reviews?: {
+        nodes: { createdAt: string; author?: { login: string } }[];
+      };
+    }[],
+  ) => {
+    return items
+      .map((item) => ({
+        association: item.authorAssociation,
+        ttfr: getFirstResponseTime(item),
+      }))
+      .filter((i) => i.ttfr !== null) as {
+      association: string;
+      ttfr: number;
+    }[];
+  };
+  const prs = processItems(data.pullRequests.nodes);
+  const issues = processItems(data.issues.nodes);
+  const allItems = [...prs, ...issues];
+
+  const isMaintainer = (assoc: string) => ['MEMBER', 'OWNER'].includes(assoc);
+  const is1P = (assoc: string) => ['COLLABORATOR'].includes(assoc);
+
+  const calculateAvg = (items: { ttfr: number; association: string }[]) =>
+    items.length ? items.reduce((a, b) => a + b.ttfr, 0) / items.length : 0;
+
+  const maintainers = calculateAvg(
+    allItems.filter((i) => isMaintainer(i.association)),
+  );
+  const firstParty = calculateAvg(allItems.filter((i) => is1P(i.association)));
+  const overall = calculateAvg(allItems);
+
+  const timestamp = new Date().toISOString();
+
+  const metrics: MetricOutput[] = [
+    {
+      metric: 'time_to_first_response_overall_hours',
+      value: Math.round(overall * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'time_to_first_response_maintainers_hours',
+      value: Math.round(maintainers * 100) / 100,
+      timestamp,
+    },
+    {
+      metric: 'time_to_first_response_1p_hours',
+      value: Math.round(firstParty * 100) / 100,
+      timestamp,
+    },
+  ];
+
+  metrics.forEach((m) => process.stdout.write(JSON.stringify(m) + '\n'));
+} catch (err) {
+  process.stderr.write(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}

tools/gemini-cli-bot/metrics/scripts/user_touches.ts

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * @license
+ */
+
+import { GITHUB_OWNER, GITHUB_REPO, type MetricOutput } from '../types.js';
+import { execSync } from 'node:child_process';
+
+try {
+  const query = `
+  query($owner: String!, $repo: String!) {
+    repository(owner: $owner, name: $repo) {
+      pullRequests(last: 100, states: MERGED) {
+        nodes {
+          authorAssociation
+          comments { totalCount }
+          reviews { totalCount }
+        }
+      }
+      issues(last: 100, states: CLOSED) {
+        nodes {
+          authorAssociation
+          comments { totalCount }
+        }
+      }
+    }
+  }
+  `;
+  const output = execSync(
+    `gh api graphql -F owner=${GITHUB_OWNER} -F repo=${GITHUB_REPO} -f query='${query}'`,
+    { encoding: 'utf-8' },
+  );
+  const data = JSON.parse(output).data.repository;
+
+  const prs = data.pullRequests.nodes;
+  const issues = data.issues.nodes;
+
+  const allItems = [
+    ...prs.map(
+      (p: {
+        authorAssociation: string;
+        comments: { totalCount: number };
+        reviews?: { totalCount: number };
+      }) => ({
+        association: p.authorAssociation,
+        touches: p.comments.totalCount + (p.reviews ? p.reviews.totalCount : 0),
+      }),
+    ),
+    ...issues.map(
+      (i: { authorAssociation: string; comments: { totalCount: number } }) => ({
+        association: i.authorAssociation,
+        touches: i.comments.totalCount,
+      }),
+    ),
+  ];
+
+  const isMaintainer = (assoc: string) =>
+    ['MEMBER', 'OWNER', 'COLLABORATOR'].includes(assoc);
+
+  const calculateAvg = (items: { touches: number; association: string }[]) =>
+    items.length ? items.reduce((a, b) => a + b.touches, 0) / items.length : 0;
+
+  const overall = calculateAvg(allItems);
+  const maintainers = calculateAvg(
+    allItems.filter((i) => isMaintainer(i.association)),
+  );
+  const community = calculateAvg(
+    allItems.filter((i) => !isMaintainer(i.association)),
+  );
+
+  const timestamp = new Date().toISOString();
+
+  process.stdout.write(
+    JSON.stringify(<MetricOutput>{
+      metric: 'user_touches_overall',
+      value: Math.round(overall * 100) / 100,
+      timestamp,
+    }) + '\n',
+  );
+  process.stdout.write(
+    JSON.stringify(<MetricOutput>{
+      metric: 'user_touches_maintainers',
+      value: Math.round(maintainers * 100) / 100,
+      timestamp,
+    }) + '\n',
+  );
+  process.stdout.write(
+    JSON.stringify(<MetricOutput>{
+      metric: 'user_touches_community',
+      value: Math.round(community * 100) / 100,
+      timestamp,
+    }) + '\n',
+  );
+} catch (err) {
+  process.stderr.write(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}

tools/gemini-cli-bot/metrics/types.ts

@@ -0,0 +1,14 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export interface MetricOutput {
+  metric: string;
+  value: number | string;
+  timestamp: string;
+  details?: Record<string, unknown>;
+}
+
+export const GITHUB_OWNER = 'google-gemini';
+export const GITHUB_REPO = 'gemini-cli';