fix(workspaces): finalize path portability and lint fixes

.gcp/Dockerfile.maintainer

@@ -0,0 +1,54 @@
+# --- STAGE 1: Base Runtime ---
+FROM docker.io/library/node:20-slim AS base
+
+ARG CLI_VERSION_ARG
+ENV CLI_VERSION=$CLI_VERSION_ARG
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  python3 \
+  curl \
+  dnsutils \
+  less \
+  jq \
+  ca-certificates \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+# --- STAGE 2: Maintainer ---
+FROM base AS maintainer
+
+# Install "Maintainer Bloat" - tools needed for development and offloading
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  make \
+  g++ \
+  gh \
+  git \
+  unzip \
+  rsync \
+  ripgrep \
+  procps \
+  psmisc \
+  lsof \
+  socat \
+  tmux \
+  docker.io \
+  build-essential \
+  libsecret-1-dev \
+  libkrb5-dev \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+# Install global dev tools
+RUN npm install -g tsx vitest @google/gemini-cli@nightly prettier eslint typescript cross-env
+
+# Set up npm global package folder
+RUN mkdir -p /usr/local/share/npm-global \
+  && chown -R node:node /usr/local/share/npm-global
+ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
+ENV PATH=$PATH:/usr/local/share/npm-global/bin
+
+# Switch to non-root user node
+USER node
+
+# Default entrypoint
+CMD ["/bin/bash"]

.gcp/maintainer-worker.yml

@@ -0,0 +1,50 @@
+steps:
+  # Step 1: Install root dependencies
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Install Dependencies'
+    entrypoint: 'npm'
+    args: ['install']
+
+  # Step 2: Authenticate for Docker
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Authenticate docker'
+    entrypoint: 'npm'
+    args: ['run', 'auth']
+
+  # Step 3: Build workspace packages
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build packages'
+    entrypoint: 'npm'
+    args: ['run', 'build:packages']
+
+  # Step 4: Build Maintainer Image
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build Maintainer Image'
+    entrypoint: 'bash'
+    args:
+      - '-c'
+      - |-
+        IMAGE_BASE="us-docker.pkg.dev/gemini-code-dev/gemini-cli/maintainer"
+        
+        # Determine the primary tag (branch name or 'latest' for main)
+        RAW_BRANCH="${_HEAD_BRANCH:-${BRANCH_NAME}}"
+        if [ "$${RAW_BRANCH}" == "main" ]; then
+          TAG_PRIMARY="latest"
+        else
+          TAG_PRIMARY=$(echo "$${RAW_BRANCH}" | sed 's/[^a-zA-Z0-9]/-/g' | tr '[:upper:]' '[:lower:]')
+        fi
+        
+        TAG_SHA="${SHORT_SHA}"
+        
+        echo "📦 Building Maintainer Image for: $${RAW_BRANCH} -> $${TAG_PRIMARY}"
+        
+        docker build -f .gcp/Dockerfile.maintainer \
+          -t "$${IMAGE_BASE}:$${TAG_SHA}" \
+          -t "$${IMAGE_BASE}:$${TAG_PRIMARY}" .
+          
+        docker push "$${IMAGE_BASE}:$${TAG_SHA}"
+        docker push "$${IMAGE_BASE}:$${TAG_PRIMARY}"
+
+options:
+  defaultLogsBucketBehavior: 'REGIONAL_USER_OWNED_BUCKET'
+  dynamicSubstitutions: true

.gemini/skills/async-pr-review/SKILL.md

@@ -1,45 +0,0 @@
----
-name: async-pr-review
-description: Trigger this skill when the user wants to start an asynchronous PR review, run background checks on a PR, or check the status of a previously started async PR review.
----
-
-# Async PR Review
-
-This skill provides a set of tools to asynchronously review a Pull Request. It will create a background job to run the project's preflight checks, execute Gemini-powered test plans, and perform a comprehensive code review using custom prompts.
-
-This skill is designed to showcase an advanced "Agentic Asynchronous Pattern":
-1.  **Native Background Shells vs Headless Inference**: While Gemini CLI can natively spawn and detach background shell commands (using the `run_shell_command` tool with `is_background: true`), a standard bash background job cannot perform LLM inference. To conduct AI-driven code reviews and test generation in the background, the shell script *must* invoke the `gemini` executable headlessly using `-p`. This offloads the AI tasks to independent worker agents.
-2.  **Dynamic Git Scoping**: The review scripts avoid hardcoded paths. They use `git rev-parse --show-toplevel` to automatically resolve the root of the user's current project.
-3.  **Ephemeral Worktrees**: Instead of checking out branches in the user's main workspace, the skill provisions temporary git worktrees in `.gemini/tmp/async-reviews/pr-<number>`. This prevents git lock conflicts and namespace pollution.
-4.  **Agentic Evaluation (`check-async-review.sh`)**: The check script outputs clean JSON/text statuses for the main agent to parse. The interactive agent itself synthesizes the final assessment dynamically from the generated log files.
-
-## Workflow
-
-1.  **Determine Action**: Establish whether the user wants to start a new async review or check the status of an existing one.
-    *   If the user says "start an async review for PR #123" or similar, proceed to **Start Review**.
-    *   If the user says "check the status of my async review for PR #123" or similar, proceed to **Check Status**.
-
-### Start Review
-
-If the user wants to start a new async PR review:
-
-1.  Ask the user for the PR number if they haven't provided it.
-2.  Execute the `async-review.sh` script, passing the PR number as the first argument. Be sure to run it with the `is_background` flag set to true to ensure it immediately detaches.
-    ```bash
-    .gemini/skills/async-pr-review/scripts/async-review.sh <PR_NUMBER>
-    ```
-3.  Inform the user that the tasks have started successfully and they can check the status later.
-
-### Check Status
-
-If the user wants to check the status or view the final assessment of a previously started async review:
-
-1.  Ask the user for the PR number if they haven't provided it.
-2.  Execute the `check-async-review.sh` script, passing the PR number as the first argument:
-    ```bash
-    .gemini/skills/async-pr-review/scripts/check-async-review.sh <PR_NUMBER>
-    ```
-3.  **Evaluate Output**: Read the output from the script.
-    *   If the output contains `STATUS: IN_PROGRESS`, tell the user which tasks are still running.
-    *   If the output contains `STATUS: COMPLETE`, use your file reading tools (`read_file`) to retrieve the contents of `final-assessment.md`, `review.md`, `pr-diff.diff`, `npm-test.log`, and `test-execution.log` files from the `LOG_DIR` specified in the output.
-    *   **Final Assessment**: Read those files, synthesize their results, and give the user a concise recommendation on whether the PR builds successfully, passes tests, and if you recommend they approve it based on the review.

.gemini/skills/async-pr-review/scripts/async-review.sh

@@ -1,241 +0,0 @@
-#!/bin/bash
-
-notify() {
-  local title="$1"
-  local message="$2"
-  local pr="$3"
-  # Terminal escape sequence
-  printf "\e]9;%s | PR #%s | %s\a" "$title" "$pr" "$message"
-  # Native macOS notification
-  if [[ "$(uname)" == "Darwin" ]]; then
-    osascript -e "display notification \"$message\" with title \"$title\" subtitle \"PR #$pr\""
-  fi
-}
-
-pr_number=$1
-if [[ -z "$pr_number" ]]; then
-  echo "Usage: async-review <pr_number>"
-  exit 1
-fi
-
-base_dir=$(git rev-parse --show-toplevel 2>/dev/null)
-if [[ -z "$base_dir" ]]; then
-  echo "❌ Must be run from within a git repository."
-  exit 1
-fi
-
-# Use the repository's local .gemini/tmp directory for ephemeral worktrees and logs
-pr_dir="$base_dir/.gemini/tmp/async-reviews/pr-$pr_number"
-target_dir="$pr_dir/worktree"
-log_dir="$pr_dir/logs"
-
-cd "$base_dir" || exit 1
-
-mkdir -p "$log_dir"
-rm -f "$log_dir/setup.exit" "$log_dir/final-assessment.exit" "$log_dir/final-assessment.md"
-
-echo "🧹 Cleaning up previous worktree if it exists..." | tee -a "$log_dir/setup.log"
-git worktree remove -f "$target_dir" >> "$log_dir/setup.log" 2>&1 || true
-git branch -D "gemini-async-pr-$pr_number" >> "$log_dir/setup.log" 2>&1 || true
-git worktree prune >> "$log_dir/setup.log" 2>&1 || true
-
-echo "📡 Fetching PR #$pr_number..." | tee -a "$log_dir/setup.log"
-if ! git fetch origin -f "pull/$pr_number/head:gemini-async-pr-$pr_number" >> "$log_dir/setup.log" 2>&1; then
-  echo 1 > "$log_dir/setup.exit"
-  echo "❌ Fetch failed. Check $log_dir/setup.log"
-  notify "Async Review Failed" "Fetch failed." "$pr_number"
-  exit 1
-fi
-
-if [[ ! -d "$target_dir" ]]; then
-  echo "🧹 Pruning missing worktrees..." | tee -a "$log_dir/setup.log"
-  git worktree prune >> "$log_dir/setup.log" 2>&1
-  echo "🌿 Creating worktree in $target_dir..." | tee -a "$log_dir/setup.log"
-  if ! git worktree add "$target_dir" "gemini-async-pr-$pr_number" >> "$log_dir/setup.log" 2>&1; then
-    echo 1 > "$log_dir/setup.exit"
-    echo "❌ Worktree creation failed. Check $log_dir/setup.log"
-    notify "Async Review Failed" "Worktree creation failed." "$pr_number"
-    exit 1
-  fi
-else
-  echo "🌿 Worktree already exists." | tee -a "$log_dir/setup.log"
-fi
-echo 0 > "$log_dir/setup.exit"
-
-cd "$target_dir" || exit 1
-
-echo "🚀 Launching background tasks. Logs saving to: $log_dir"
-
-echo "  ↳ [1/5] Grabbing PR diff..."
-rm -f "$log_dir/pr-diff.exit"
-{ gh pr diff "$pr_number" > "$log_dir/pr-diff.diff" 2>&1; echo $? > "$log_dir/pr-diff.exit"; } &
-
-echo "  ↳ [2/5] Starting build and lint..."
-rm -f "$log_dir/build-and-lint.exit"
-{ { npm run clean && npm ci && npm run format && npm run build && npm run lint:ci && npm run typecheck; } > "$log_dir/build-and-lint.log" 2>&1; echo $? > "$log_dir/build-and-lint.exit"; } &
-
-# Dynamically resolve gemini binary (fallback to your nightly path)
-GEMINI_CMD=$(which gemini || echo "$HOME/.gcli/nightly/node_modules/.bin/gemini")
-POLICY_PATH="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/policy.toml"
-
-echo "  ↳ [3/5] Starting Gemini code review..."
-rm -f "$log_dir/review.exit"
-{ "$GEMINI_CMD" --policy "$POLICY_PATH" -p "/review-frontend $pr_number" > "$log_dir/review.md" 2>&1; echo $? > "$log_dir/review.exit"; } &
-
-echo "  ↳ [4/5] Starting automated tests (waiting for build and lint)..."
-rm -f "$log_dir/npm-test.exit"
-{ 
-  while [ ! -f "$log_dir/build-and-lint.exit" ]; do sleep 1; done
-  if [ "$(cat "$log_dir/build-and-lint.exit")" == "0" ]; then
-    gh pr checks "$pr_number" > "$log_dir/ci-checks.log" 2>&1
-    ci_status=$?
-    
-    if [ "$ci_status" -eq 0 ]; then
-      echo "CI checks passed. Skipping local npm tests." > "$log_dir/npm-test.log"
-      echo 0 > "$log_dir/npm-test.exit"
-    elif [ "$ci_status" -eq 8 ]; then
-      echo "CI checks are still pending. Skipping local npm tests to avoid duplicate work. Please check GitHub for final results." > "$log_dir/npm-test.log"
-      echo 0 > "$log_dir/npm-test.exit"
-    else
-      echo "CI checks failed. Failing checks:" > "$log_dir/npm-test.log"
-      gh pr checks "$pr_number" --json name,bucket -q '.[] | select(.bucket=="fail") | .name' >> "$log_dir/npm-test.log" 2>&1
-      
-      echo "Attempting to extract failing test files from CI logs..." >> "$log_dir/npm-test.log"
-      pr_branch=$(gh pr view "$pr_number" --json headRefName -q '.headRefName' 2>/dev/null)
-      run_id=$(gh run list --branch "$pr_branch" --workflow ci.yml --json databaseId -q '.[0].databaseId' 2>/dev/null)
-      
-      failed_files=""
-      if [[ -n "$run_id" ]]; then
-        failed_files=$(gh run view "$run_id" --log-failed 2>/dev/null | grep -o -E '(packages/[a-zA-Z0-9_-]+|integration-tests|evals)/[a-zA-Z0-9_/-]+\.test\.ts(x)?' | sort | uniq)
-      fi
-      
-      if [[ -n "$failed_files" ]]; then
-        echo "Found failing test files from CI:" >> "$log_dir/npm-test.log"
-        for f in $failed_files; do echo "  - $f" >> "$log_dir/npm-test.log"; done
-        echo "Running ONLY failing tests locally..." >> "$log_dir/npm-test.log"
-        
-        exit_code=0
-        for file in $failed_files; do
-           if [[ "$file" == packages/* ]]; then
-             ws_dir=$(echo "$file" | cut -d'/' -f1,2)
-           else
-             ws_dir=$(echo "$file" | cut -d'/' -f1)
-           fi
-           rel_file=${file#$ws_dir/}
-           
-           echo "--- Running $rel_file in workspace $ws_dir ---" >> "$log_dir/npm-test.log"
-           if ! npm run test:ci -w "$ws_dir" -- "$rel_file" >> "$log_dir/npm-test.log" 2>&1; then
-             exit_code=1
-           fi
-        done
-        echo $exit_code > "$log_dir/npm-test.exit"
-      else
-        echo "Could not extract specific failing files. Skipping full local test suite as it takes too long. Please check CI logs manually." >> "$log_dir/npm-test.log"
-        echo 1 > "$log_dir/npm-test.exit"
-      fi
-    fi
-  else
-    echo "Skipped due to build-and-lint failure" > "$log_dir/npm-test.log"
-    echo 1 > "$log_dir/npm-test.exit"
-  fi
-} &
-
-echo "  ↳ [5/5] Starting Gemini test execution (waiting for build and lint)..."
-rm -f "$log_dir/test-execution.exit"
-{ 
-  while [ ! -f "$log_dir/build-and-lint.exit" ]; do sleep 1; done
-  if [ "$(cat "$log_dir/build-and-lint.exit")" == "0" ]; then
-    "$GEMINI_CMD" --policy "$POLICY_PATH" -p "Analyze the diff for PR $pr_number using 'gh pr diff $pr_number'. Instead of running the project's automated test suite (like 'npm test'), physically exercise the newly changed code in the terminal (e.g., by writing a temporary script to call the new functions, or testing the CLI command directly). Verify the feature's behavior works as expected. IMPORTANT: Do NOT modify any source code to fix errors. Just exercise the code and log the results, reporting any failures clearly. Do not ask for user confirmation." > "$log_dir/test-execution.log" 2>&1; echo $? > "$log_dir/test-execution.exit"
-  else
-    echo "Skipped due to build-and-lint failure" > "$log_dir/test-execution.log"
-    echo 1 > "$log_dir/test-execution.exit"
-  fi
-} &
-
-echo "✅ All tasks dispatched!"
-echo "You can monitor progress with: tail -f $log_dir/*.log"
-echo "Read your review later at: $log_dir/review.md"
-
-# Polling loop to wait for all background tasks to finish
-tasks=("pr-diff" "build-and-lint" "review" "npm-test" "test-execution")
-log_files=("pr-diff.diff" "build-and-lint.log" "review.md" "npm-test.log" "test-execution.log")
-
-declare -A task_done
-for t in "${tasks[@]}"; do task_done[$t]=0; done
-
-all_done=0
-while [[ $all_done -eq 0 ]]; do
-  clear
-  echo "=================================================="
-  echo "🚀 Async PR Review Status for PR #$pr_number"
-  echo "=================================================="
-  echo ""
-  
-  all_done=1
-  for i in "${!tasks[@]}"; do
-    t="${tasks[$i]}"
-    
-    if [[ -f "$log_dir/$t.exit" ]]; then
-      exit_code=$(cat "$log_dir/$t.exit")
-      if [[ "$exit_code" == "0" ]]; then
-        echo "  ✅ $t: SUCCESS"
-      else
-        echo "  ❌ $t: FAILED (exit code $exit_code)"
-      fi
-      task_done[$t]=1
-    else
-      echo "  ⏳ $t: RUNNING"
-      all_done=0
-    fi
-  done
-  
-  echo ""
-  echo "=================================================="
-  echo "📝 Live Logs (Last 5 lines of running tasks)"
-  echo "=================================================="
-  
-  for i in "${!tasks[@]}"; do
-    t="${tasks[$i]}"
-    log_file="${log_files[$i]}"
-    
-    if [[ ${task_done[$t]} -eq 0 ]]; then
-      if [[ -f "$log_dir/$log_file" ]]; then
-        echo ""
-        echo "--- $t ---"
-        tail -n 5 "$log_dir/$log_file"
-      fi
-    fi
-  done
-  
-  if [[ $all_done -eq 0 ]]; then
-    sleep 3
-  fi
-done
-
-clear
-echo "=================================================="
-echo "🚀 Async PR Review Status for PR #$pr_number"
-echo "=================================================="
-echo ""
-for t in "${tasks[@]}"; do
-  exit_code=$(cat "$log_dir/$t.exit")
-  if [[ "$exit_code" == "0" ]]; then
-    echo "  ✅ $t: SUCCESS"
-  else
-    echo "  ❌ $t: FAILED (exit code $exit_code)"
-  fi
-done
-echo ""
-
-echo "⏳ Tasks complete! Synthesizing final assessment..."
-if ! "$GEMINI_CMD" --policy "$POLICY_PATH" -p "Read the review at $log_dir/review.md, the automated test logs at $log_dir/npm-test.log, and the manual test execution logs at $log_dir/test-execution.log. Summarize the results, state whether the build and tests passed based on $log_dir/build-and-lint.exit and $log_dir/npm-test.exit, and give a final recommendation for PR $pr_number." > "$log_dir/final-assessment.md" 2>&1; then
-  echo $? > "$log_dir/final-assessment.exit"
-  echo "❌ Final assessment synthesis failed!"
-  echo "Check $log_dir/final-assessment.md for details."
-  notify "Async Review Failed" "Final assessment synthesis failed." "$pr_number"
-  exit 1
-fi
-
-echo 0 > "$log_dir/final-assessment.exit"
-echo "✅ Final assessment complete! Check $log_dir/final-assessment.md"
-notify "Async Review Complete" "Review and test execution finished successfully." "$pr_number"

.gemini/skills/async-pr-review/scripts/check-async-review.sh

@@ -1,65 +0,0 @@
-#!/bin/bash
-pr_number=$1
-
-if [[ -z "$pr_number" ]]; then
-  echo "Usage: check-async-review <pr_number>"
-  exit 1
-fi
-
-base_dir=$(git rev-parse --show-toplevel 2>/dev/null)
-if [[ -z "$base_dir" ]]; then
-  echo "❌ Must be run from within a git repository."
-  exit 1
-fi
-
-log_dir="$base_dir/.gemini/tmp/async-reviews/pr-$pr_number/logs"
-
-if [[ ! -d "$log_dir" ]]; then
-  echo "STATUS: NOT_FOUND"
-  echo "❌ No logs found for PR #$pr_number in $log_dir"
-  exit 0
-fi
-
-tasks=(
-  "setup|setup.log"
-  "pr-diff|pr-diff.diff"
-  "build-and-lint|build-and-lint.log"
-  "review|review.md"
-  "npm-test|npm-test.log"
-  "test-execution|test-execution.log"
-  "final-assessment|final-assessment.md"
-)
-
-all_done=true
-echo "STATUS: CHECKING"
-
-for task_info in "${tasks[@]}"; do
-  IFS="|" read -r task_name log_file <<< "$task_info"
-  
-  file_path="$log_dir/$log_file"
-  exit_file="$log_dir/$task_name.exit"
-
-  if [[ -f "$exit_file" ]]; then
-    exit_code=$(cat "$exit_file")
-    if [[ "$exit_code" == "0" ]]; then
-      echo "✅ $task_name: SUCCESS"
-    else
-      echo "❌ $task_name: FAILED (exit code $exit_code)"
-      echo "   Last lines of $file_path:"
-      tail -n 3 "$file_path" | sed 's/^/      /'
-    fi
-  elif [[ -f "$file_path" ]]; then
-    echo "⏳ $task_name: RUNNING"
-    all_done=false
-  else
-    echo "➖ $task_name: NOT STARTED"
-    all_done=false
-  fi
-done
-
-if $all_done; then
-  echo "STATUS: COMPLETE"
-  echo "LOG_DIR: $log_dir"
-else
-  echo "STATUS: IN_PROGRESS"
-fi

.gemini/skills/fix-pr/README.md

@@ -0,0 +1,31 @@
+# Fix PR Skill
+
+The `fix-pr` skill enables the Gemini CLI agent to autonomously and iteratively
+fix a pull request until it is mergeable and passes all quality checks.
+
+## When to use fix-pr
+
+-   **Autonomous fixing**: Move a PR from failing to green without manual
+    intervention.
+-   **Iterative loops**: Automatically handle the "fix -> push -> wait for CI"
+    cycle.
+-   **Context preservation**: Maintain context across multiple fix attempts.
+
+## Sync vs Offload
+
+This skill is designed to be versatile:
+
+-   **Synchronous mode**: Activate the skill in your current terminal for
+    quick fixes or conflict resolution.
+-   **Offloaded mode**: Use `npm run offload <PR> fix` to launch an iterative
+    fix loop on a remote workstation, keeping your local machine free.
+
+## Objective
+
+The goal is to move a PR from its current state (failing tests, merge conflicts,
+or unaddressed comments) to a "Ready to Merge" state.
+
+## Technical details
+
+The skill uses the `gh` CLI and a specialized `wait-for-ci` utility to monitor
+remote status. It is governed by the project's standard security policies.

.gemini/skills/fix-pr/SKILL.md

@@ -0,0 +1,60 @@
+# Fix PR Skill
+
+This skill enables the agent to autonomously and iteratively fix a Pull Request until it is mergeable and passes all quality checks. It is designed to be run in a dedicated, non-blocking environment (like an offloaded remote session).
+
+## Objective
+
+The goal is to move a PR from its current state (failing tests, merge conflicts, or unaddressed comments) to a "Ready to Merge" state.
+
+## Iterative Fix Loop
+
+The agent must follow this loop until the PR is green and mergeable:
+
+### 1. Synchronization & Merge Conflicts
+- Fetch latest main: `git fetch origin main`.
+- Attempt to merge: `git merge origin/main`.
+- **If conflicts occur**: 
+    - Use `git status` to identify conflicted files.
+    - Resolve the conflict markers (`<<<<<<<`, `=======`, `>>>>>>>`) based on the project's architectural direction.
+    - `git add` and `git commit` the resolution.
+
+### 2. CI Failure Analysis
+- Check current status: `gh pr checks`.
+- **If CI is failing**:
+    - Download failing logs: `gh run view --log-failed`.
+    - Analyze the specific error (lint, typecheck, or test failure).
+    - Reproduce the failure locally (e.g., `npm run lint`, `npm test -- <path>`).
+    - Apply a targeted fix.
+
+### 3. Comment Resolution
+- Fetch all comments: Use `scripts/fetch-pr-info.js` or `gh pr view --json reviews,comments`.
+- Analyze:
+    - **Line-level comments**: Fix the specific logic requested.
+    - **Review rejections**: Address the high-level architectural concerns.
+    - **General comments**: Respond or implement requested changes.
+- For each fixed item, summarize the change in a commit message.
+
+### 4. Verification & Push
+- Verify the fix locally: `npm run build` and relevant tests.
+- **If local verification fails**: Re-analyze and apply a new fix.
+- **If local verification passes**:
+    - `git add .`
+    - `git commit -m "fix: address <issue/comment>"`
+    - `git push origin HEAD`
+
+### 5. Wait for CI
+- Run the blocker tool: `npx tsx .gemini/skills/fix-pr/scripts/wait-for-ci.ts`.
+- **If CI passes**: Move to final check.
+- **If CI fails**: Repeat the loop from step 2.
+
+## Final Check
+The PR is considered "Fix Complete" when:
+1. `gh pr checks` returns success for all required jobs.
+2. There are no outstanding merge conflicts with `main`.
+3. All critical review comments have been addressed via code changes.
+
+## Best Practices
+- **Reason about failures**: Don't just guess. Read the stack traces and log files.
+- **Incremental commits**: Make small, focused commits for different fixes.
+- **Verify before pushing**: Always run the build/test locally before pushing to CI to save time.
+- **Be Autonomous**: In an offloaded session, you have full permission to iterate until successful.

.gemini/skills/fix-pr/scripts/wait-for-ci.ts

@@ -0,0 +1,41 @@
+/**
+ * CI Waiter Utility for Fix PR Skill
+ * Blocks until GitHub checks for the current branch are complete.
+ */
+import { spawnSync } from 'child_process';
+
+async function wait(ms: number) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+async function main() {
+  console.log('🔍 Waiting for GitHub Checks to complete...');
+  
+  let attempts = 0;
+  const maxAttempts = 30; // 15 minutes total
+
+  while (attempts < maxAttempts) {
+    const checkStatus = spawnSync('gh', ['pr', 'checks'], { shell: true });
+    const output = checkStatus.stdout.toString();
+    
+    if (output.includes('fail')) {
+      console.log('❌ CI Failed.');
+      process.exit(1);
+    } else if (output.includes('pending')) {
+      console.log(`⏳ CI still pending... (check ${attempts + 1}/${maxAttempts})`);
+      await wait(30000); // 30 seconds
+    } else if (output.trim() === '') {
+        console.log('⚠️ No checks found yet, waiting...');
+        await wait(10000);
+    } else {
+      console.log('✅ CI Passed!');
+      process.exit(0);
+    }
+    attempts++;
+  }
+
+  console.error('⏰ Timeout waiting for CI.');
+  process.exit(1);
+}
+
+main().catch(console.error);

.gemini/skills/review-pr/README.md

@@ -0,0 +1,34 @@
+# Review PR Skill
+
+The `review-pr` skill enables the Gemini CLI agent to conduct high-fidelity,
+behavioral code reviews that go beyond simple static analysis.
+
+## When to use review-pr
+
+-   **Deep verification**: Verify that a feature actually works by executing
+    it in a live environment.
+-   **Infrastructure awareness**: Leverage build and CI results to focus on
+    empirical proof of functionality.
+-   **Interactive collaboration**: Discuss findings and explore edge cases
+    with the agent in real-time.
+
+## Sync vs Offload
+
+This skill supports two primary modes:
+
+-   **Synchronous mode**: Activate the skill locally for quick, high-level
+    analysis of a peer's PR.
+-   **Offloaded mode**: Use `npm run offload <PR> review` to conduct a
+    full-scale behavioral review on a remote workstation with parallelized
+    infrastructure validation.
+
+## Objective
+
+Conduct a thorough review that involves physically proving the feature works
+through terminal scripts and command execution.
+
+## Technical details
+
+The skill assumes the infrastructure (build and CI) is already being validated
+and focuses on empirical proofs. It uses the `extract-failures.ts` utility to
+automatically identify regressions in CI logs.

.gemini/skills/review-pr/SKILL.md

@@ -0,0 +1,67 @@
+# Review PR Skill
+
+This skill enables the agent to conduct a high-fidelity, behavioral code review
+for a Pull Request. It is designed to be run in a dedicated, workspace remote
+session where parallel infrastructure validation (build, CI check) is already 
+underway.
+
+## Objective
+
+Conduct a thorough review that goes beyond static analysis. The agent must
+**physically prove** the feature works and that all regressions are caught by 
+exercising the code in a live terminal.
+
+## Workflow: Verify then Synthesize
+
+The agent must follow these steps to conduct the review:
+
+### 1. Context Acquisition
+- Read the PR description: `gh pr view <PR_NUMBER>`.
+- Read the intent from the description and map it against the diff.
+- Run `/review-frontend <PR_NUMBER>` to get an initial static analysis report.
+
+### 2. Infrastructure Validation
+- Trust the parallel worker results in `.gemini/logs/workspace-<PR_NUMBER>/`.
+- Read `build.log` to ensure the environment is stable for testing.
+- Read `ci-status.exit`. 
+- **If CI is failing**: Use the extractor to identify failing tests:
+  `npx tsx .gemini/skills/review-pr/scripts/extract-failures.ts <PR_NUMBER>`
+- Reproduce the failing tests locally and analyze the output.
+
+### 3. Behavioral Verification (The "Proof")
+- Do NOT just trust that tests pass. 
+- Physically exercise the new code in the terminal.
+- Examples of "Proof":
+    - If it's a new CLI command, run it with various flags.
+    - If it's a new service, write a small `.ts` script to call the functions.
+    - If it's a UI component, verify the Ink layout renders correctly.
+- Log these proof steps and results in your conversation.
+
+### 4. Synthesis
+- Combine all data points:
+    - **Static Analysis** (Code quality, style).
+    - **Infrastructure** (Build status, CI status).
+    - **Behavioral Proof** (Empirical verification).
+- Check for merge conflicts with `main`.
+
+## Final Assessment
+
+Provide a final recommendation with four sections:
+
+1.  **Summary**: High-level verdict (Approve / Needs Work / Reject).
+2.  **Verified Behavior**: Describe the scripts/commands you ran to prove the
+    feature works.
+3.  **Findings**: List Critical issues, Improvements, and Nitpicks.
+4.  **Actionable URL**: Explicitly print the PR URL: `gh pr view --web`.
+
+### Approval Protocol
+
+After presenting the synthesis, the agent MUST determine the all-up recommendation and ask the user for confirmation:
+
+*   "Based on the verification, I recommend **[APPROVE / COMMENT / REJECT]**. Would you like me to post this review to GitHub?"
+*   If the user agrees, execute the appropriate `gh pr review` command (e.g., `gh pr review <PR_NUMBER> --approve --body "<Summary>"`).
+
+## Best Practices
+- **Be Skeptical**: Just because CI is green doesn't mean the feature is complete. Look for missing edge cases.
+- **Collaborate**: If you find a bug during verification, tell the user immediately in the main window.
+- **Don't Fix**: Your role is to **review**, not to fix. If the PR is failing, summarize the causes and request changes.

.gemini/skills/review-pr/scripts/extract-failures.ts

@@ -0,0 +1,59 @@
+/**
+ * CI Failure Extraction Utility
+ * 
+ * Analyzes remote CI logs to identify specific failing test files.
+ * Used by the review-pr and fix-pr skills to minimize local repro noise.
+ */
+import { spawnSync } from 'child_process';
+
+async function main() {
+  const prNumber = process.argv[2];
+  if (!prNumber) {
+    console.error('Usage: npx tsx extract-failures.ts <PR_NUMBER>');
+    process.exit(1);
+  }
+
+  console.log(`🔍 Investigating CI failures for PR #${prNumber}...`);
+
+  // 1. Get branch name
+  const branchView = spawnSync('gh', ['pr', 'view', prNumber, '--json', 'headRefName', '-q', '.headRefName'], { shell: true });
+  const branchName = branchView.stdout.toString().trim();
+
+  // 2. Get latest CI run ID
+  const runList = spawnSync('gh', ['run', 'list', '--branch', branchName, '--workflow', 'ci.yml', '--json', 'databaseId', '-q', '.[0].databaseId'], { shell: true });
+  const runId = runList.stdout.toString().trim();
+
+  if (!runId) {
+    console.log('⚠️ No recent CI runs found for this branch.');
+    process.exit(0);
+  }
+
+  // 3. Extract failing files from logs
+  // Pattern matches common test locations in the monorepo
+  const logView = spawnSync('gh', ['run', 'view', runId, '--log-failed'], { shell: true });
+  const logOutput = logView.stdout.toString();
+  
+  const testPattern = /(packages\/[a-zA-Z0-9_-]+|integration-tests|evals)\/[a-zA-Z0-9_\/-]+\.test\.ts(x)?/g;
+  const matches = logOutput.match(testPattern);
+
+  if (!matches || matches.length === 0) {
+    console.log('✅ No specific failing test files detected in logs.');
+    process.exit(0);
+  }
+
+  const uniqueFiles = Array.from(new Set(matches)).sort();
+  console.log('\n❌ Found failing test files:');
+  uniqueFiles.forEach(f => console.log(`  - ${f}`));
+
+  console.log('\n👉 Recommendation: Run these tests locally using:');
+  uniqueFiles.forEach(file => {
+    let wsDir = file.split('/')[0];
+    if (wsDir === 'packages') {
+      wsDir = file.split('/').slice(0, 2).join('/');
+    }
+    const relFile = file.replace(`${wsDir}/`, '');
+    console.log(`  npm run test:ci -w ${wsDir} -- ${relFile}`);
+  });
+}
+
+main().catch(console.error);

.github/workflows/offload-image-update.yml

@@ -0,0 +1,41 @@
+name: Offload Golden Image Update
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.gemini/skills/offload/scripts/provision-worker.sh'
+      - '.gemini/skills/offload/scripts/fleet.ts'
+  workflow_dispatch:
+
+jobs:
+  update-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install Dependencies
+        run: npm install
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WIP }}
+          service_account: ${{ secrets.GCP_SA }}
+
+      - name: Setup GCloud SDK
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Build New Golden Image
+        run: npm run offload:fleet create-image

CONTRIBUTING.md

@@ -43,16 +43,14 @@ The process for contributing code is as follows:
 
 1.  **Find an issue** that you want to work on. If an issue is tagged as
     `🔒Maintainers only`, this means it is reserved for project maintainers. We
-    will not accept pull requests related to these issues. In the near future,
-    we will explicitly mark issues looking for contributions using the
-    `help-wanted` label. If you believe an issue is a good candidate for
-    community contribution, please leave a comment on the issue. A maintainer
-    will review it and apply the `help-wanted` label if appropriate. Only
-    maintainers should attempt to add the `help-wanted` label to an issue.
-2.  **Fork the repository** and create a new branch.
-3.  **Make your changes** in the `packages/` directory.
-4.  **Ensure all checks pass** by running `npm run preflight`.
-5.  **Open a pull request** with your changes.
+    will not accept pull requests related to these issues.
+2.  **Maintainer Setup**: If you are a team maintainer, please follow the
+    [Maintainer Onboarding Guide](./MAINTAINER_ONBOARDING.md) to set up your
+    high-performance remote offload environment.
+3.  **Fork the repository** and create a new branch.
+4.  **Make your changes** in the `packages/` directory.
+5.  **Ensure all checks pass** by running `npm run preflight`.
+6.  **Open a pull request** with your changes.
 
 ### Code reviews
 

MAINTAINER_ONBOARDING.md

@@ -0,0 +1,75 @@
+# Gemini Workspaces: Maintainer Onboarding
+
+Gemini Workspaces allow you to delegate heavy tasks (PR reviews, agentic fixes,
+full builds) to a high-performance GCP worker. It uses a **Unified Data Disk**
+architecture to ensure your work persists even if the VM is deleted or
+recreated.
+
+## 1. Local Prerequisites
+
+Before starting, ensure you have:
+
+- **GCloud CLI**: Authenticated (`gcloud auth login`).
+- **GitHub CLI**: Authenticated (`gh auth login`).
+- **Project Access**: A GCP Project ID where you have `Editor` or
+  `Compute Admin` roles.
+
+## 2. Initialization
+
+Run the setup script using the unified workspaces entry point:
+
+```bash
+npx tsx scripts/workspaces.ts setup
+```
+
+**What happens during setup:**
+
+1.  **Auth Discovery**: It will detect your `GEMINI_API_KEY` (from `~/.env`) and
+    `GH_TOKEN`.
+2.  **Project Choice**: You will be prompted for your GCP Project and Zone.
+3.  **Infrastructure Check**: It verifies if your worker
+    (`gcli-workspace-<user>`) exists.
+4.  **SSH Magic**: It generates a local `.gemini/workspaces/ssh_config` for
+    seamless access.
+
+## 3. Provisioning
+
+If the setup informs you that the worker was not found, provision it:
+
+```bash
+npx tsx scripts/workspaces.ts fleet provision
+```
+
+_This creates a VM with a 10GB Boot Disk and a 200GB Data Disk. Initialization
+takes ~1 minute._
+
+## 4. Finalizing Remote Setup
+
+Run the setup script one last time to clone the repo and sync credentials:
+
+```bash
+npx tsx scripts/workspaces.ts setup
+```
+
+_When you see "ALL SYSTEMS GO!", your workspace is ready._
+
+## 5. Daily Usage
+
+Once initialized, you can launch tasks directly through `npm` or the entry
+point:
+
+- **Review a PR**: `workspace <PR_NUMBER> review`
+- **Launch a Shell**: `workspace:shell <ID>`
+- **Check Status**: `workspace:status`
+- **Cleanup All**: `workspace:clean-all`
+- **Kill Task**: `workspace:kill <PR> <action>`
+- **Stop Worker**: `npx tsx scripts/workspaces.ts fleet stop` (Recommended when
+  finished to save cost).
+
+## Troubleshooting
+
+- **Permission Denied (Docker)**: The orchestrator handles this by using
+  `sudo docker` internally.
+- **Dubious Ownership**: The system automatically adds `/mnt/disks/data/main` to
+  Git's safe directory list.
+- **Missing tsx**: Always prefer `npx tsx` when running scripts manually.

extensions/workspaces/docs/FUTURE_STATE.md

@@ -0,0 +1,35 @@
+# Future State: Gemini Workspaces Platform
+
+This document outlines the long-term architectural evolution of the Workspaces feature (formerly "Workspace").
+
+## 🎯 Vision
+Transform Workspaces into a first-class platform capability that allows developers to seamlessly move intensive workloads (AI reasoning, complex builds, parallel testing) to any compute environment (Cloud or Local).
+
+## 🗺️ Evolutionary Roadmap
+
+### Phase 1: Generalization & Renaming (Current)
+- **Goal**: Make the feature useful for any repository, not just Gemini CLI.
+- **Action**: Rename to "Workspaces."
+- **Action**: Implement dynamic repository detection via Git.
+- **Action**: Isolate all state into `.gemini/workspaces/`.
+
+### Phase 2: Pluggable Compute Extensions
+- **Goal**: Decouple the infrastructure logic from the core CLI.
+- **Action**: Move `WorkerProviders` into a dedicated **Workspaces Extension**.
+- **Action**: Support multiple providers (GCP, AWS, Local Docker).
+- **Action**: Define a standard API for Workspace Providers.
+
+### Phase 3: Core Integration
+- **Goal**: Standardize the user experience.
+- **Action**: Move the high-level `gemini workspace` command into the core `gemini` binary.
+- **Action**: Implement automated "Environment Hand-off" where the local agent can automatically spin up a remote workspace when it detects a heavy task.
+
+### Phase 4: Public Marketplace
+- **Goal**: Community adoption.
+- **Action**: Publish the official GCP Workspace Extension.
+- **Action**: Provide a "Zero-Config" public base image for standard Node/TS development.
+
+## 🏗️ Architectural Principles
+1. **BYOC (Bring Your Own Cloud)**: Users connect their own infrastructure.
+2. **Nested Persistence**: Keep the environment in the container, but manage the lifecycle with the host.
+3. **Repo-Agnostic**: One set of tools should work for any project.

extensions/workspaces/docs/GEMINI.md

@@ -0,0 +1,28 @@
+# Architectural Mandate: High-Performance Workspace System
+
+## Infrastructure Strategy
+- **Base OS**: Always use **Container-Optimized OS (COS)** (`cos-stable` family). It is security-hardened and has Docker pre-installed.
+- **Provisioning**: Use the **Cloud-Init (`user-data`)** pattern. 
+    - *Note*: Avoid `gcloud compute instances create-with-container` on standard Linux images as it uses a deprecated startup agent. On COS, use native `user-data` for cleanest execution.
+- **Performance**: Provision with a minimum of **200GB PD-Balanced** disk to ensure high I/O throughput for Node.js builds and to satisfy GCP disk performance requirements.
+
+## Container Isolation
+- **Image**: `us-docker.pkg.dev/gemini-code-dev/gemini-cli/maintainer:latest`.
+- **Identity**: The container must be named **`maintainer-worker`**.
+- **Mounts**: Standardize on these host-to-container mappings:
+    - `~/dev` -> `/home/node/dev` (Persistence for worktrees)
+    - `~/.gemini` -> `/home/node/.gemini` (Shared credentials)
+    - `~/.workspace` -> `/home/node/.workspace` (Shared scripts/logs)
+- **Runtime**: The container runs as a persistent service (`--restart always`) acting as a "Remote Workstation" rather than an ephemeral task.
+
+## Orchestration Logic
+- **Worker Provider Abstraction**: Infrastructure is managed via a `WorkerProvider` interface (e.g., `GceCosProvider`). This decouples the orchestration logic from the underlying platform.
+- **Robust Connectivity**: The system uses a dual-path connectivity strategy:
+    1. **Fast-Path SSH**: Primary connection via a standard SSH alias (`gcli-worker`) for high-performance synchronization and interaction.
+    2. **IAP Fallback**: Automatic fallback to `gcloud compute ssh --tunnel-through-iap` for users off-VPC or when direct DNS resolution fails.
+- **Context Execution**: Use `docker exec -it maintainer-worker ...` for interactive tasks and `tmux` sessions. This provides persistence against connection drops while keeping the host OS "invisible."
+- **Path Resolution**: Both Host and Container must share identical tilde (`~`) paths to avoid mapping confusion in automation scripts.
+
+## Maintenance
+- **Rebuilds**: If the environment drifts or the image updates, delete the VM and re-run the `provision` action.
+- **Status**: The Mission Control dashboard derives state by scanning host `tmux` sessions and container filesystem logs.

extensions/workspaces/docs/NETWORK_RESEARCH.md

@@ -0,0 +1,49 @@
+# Network Architecture & Troubleshooting Research
+
+This document captures the empirical research and final configuration settled upon for the Gemini CLI Workspace system, specifically addressing the challenges of connecting from corporate environments to private GCP workers.
+
+## 🔍 The Challenge
+The goal was to achieve **Direct internal SSH** access to GCE workers that have **no public IP addresses**, allowing for high-performance file synchronization (`rsync`) and interactive sessions without the overhead of `gcloud` wrappers.
+
+## 🧪 What Was Tested
+
+### 1. Standard Internal DNS (`<instance>.<zone>.c.<project>.internal`)
+- **Result**: ❌ FAILED
+- **Observation**: Standard GCE internal DNS suffixes often fail to resolve or route correctly from local workstations in certain corporate environments, even when VPN/Peering is active.
+
+### 2. IAP Tunneling (`gcloud compute ssh --tunnel-through-iap`)
+- **Result**: ⚠️ INCONSISTENT
+- **Observation**: While IAP is the standard fallback for private VMs, it failed with "failed to connect to backend" (4003) when the underlying VPC network lacked proper configuration or when firewall rules were misaligned with the specific network interface.
+
+### 3. Custom "Auto" Networks
+- **Result**: ❌ FAILED
+- **Observation**: Creating a fresh VPC with default "auto" settings was insufficient. The "magic" corporate routing paths did not automatically extend to these new, isolated networks.
+
+## ✅ The Final State (The "Magic" Configuration)
+
+Through comparison with the working `gemini-cli-team-quota` project and empirical testing in a sandbox, we settled on the following requirements:
+
+### 1. Hostname Construction
+The system **MUST** use the following specific hostname pattern for direct internal reachability:
+`nic0.<instance>.<zone>.c.<project>.internal.gcpnode.com`
+
+### 2. VPC Configuration
+The VPC (e.g., `iap-vpc`) must be a **Custom Mode** network with the following properties:
+- **Private Google Access**: MUST be enabled on the subnetwork. This allows the private VM to communicate with Google services (like Artifact Registry) without a public IP.
+- **Firewall Rule**: An ingress rule allowing `tcp:22` from `0.0.0.0/0`.
+    - *Note*: While `0.0.0.0/0` seems broad, in this context it is typically restricted by the corporate-level gateway/peering that provides the `internal.gcpnode.com` route.
+
+### 3. Worker Provider Abstraction
+To manage this complexity, we implemented a `WorkerProvider` architecture:
+- **`BaseProvider`**: Defines a common interface for `exec`, `sync`, and `provision`.
+- **`GceCosProvider`**: Encapsulates the GCE-specific "magic" (hostname construction, IAP fallbacks, COS startup scripts).
+
+## 🛠️ Why This Works
+This configuration aligns with the **Google Corporate Direct-Access** pattern. By using the `nic0` prefix and the `.gcpnode.com` suffix, the connection is routed through internal corporate proxies that recognize the authenticated developer identity and permit the direct SSH handshake to the private IP.
+
+## 📜 Technical Metadata Summary
+- **Network**: `iap-vpc` (Custom)
+- **Subnet**: `iap-subnet` (Private Google Access: Enabled)
+- **Identity**: OS Login (`enable-oslogin=TRUE`)
+- **Image**: Container-Optimized OS (COS)
+- **Connectivity**: Direct SSH via `nic0` -> Automatic Fallback to IAP.

extensions/workspaces/docs/NEXT_MISSION.md

@@ -0,0 +1,60 @@
+# Mission: GCE Container-First Refactor 🚀
+
+## Current State
+- **Architecture**: Persistent GCE VM (`gcli-workspace-mattkorwel`) with Fast-Path SSH (`gcli-worker`).
+- **Logic**: Decoupled scripts in `~/.workspace/scripts`, using Git Worktrees for concurrency.
+- **Auth**: Scoped GitHub PATs mirrored via setup.
+
+## The Goal (Container-OS Transition)
+Shift from a "Manual VM" to an "Invisible VM" (Container-Optimized OS) that runs our Sandbox Docker image directly.
+
+## Planned Changes
+1. **Multi-Stage Dockerfile**: ✅ VERIFIED
+   - Optimize `.gcp/Dockerfile.maintainer` to include `tsx`, `vitest`, `gh`, and system dependencies (`libsecret`, `build-essential`).
+   - *Verified locally: Node v20, GH CLI, Git, TSX, and Vitest are functional with required headers.*
+2. **Dedicated Pipeline**:
+   - Use `.gcp/maintainer-worker.yml` for isolated builds.
+   - **Tagging Strategy**: 
+     - `latest`: Automatically updated on every merge to `main`.
+     - `branch-name`: Created on-demand for PRs via `/gcbrun` comment.
+3. **Setup Script (`setup.ts`)**:
+   - Refactor `provision` to use `gcloud compute instances create-with-container`.
+   - Point to the new `maintainer` image in Artifact Registry.
+4. **Orchestrator (`orchestrator.ts`)**:
+   - Update SSH logic to include the `--container` flag.
+
+## GCP Console Setup (Two Triggers)
+
+### Trigger 1: Production Maintainer Image (Automatic)
+1. **Event**: Push to branch.
+2. **Branch**: `^main$`.
+3. **Configuration**: Point to `.gcp/maintainer-worker.yml`.
+4. **Purpose**: Keeps the stable "Golden Image" up to date for daily use.
+
+### Trigger 2: On-Demand Testing (Comment-Gated)
+1. **Event**: Pull request.
+2. **Base Branch**: `^main$`.
+3. **Comment Control**: Set to **"Required"** (e.g. `/gcbrun`).
+4. **Configuration**: Point to `.gcp/maintainer-worker.yml`.
+5. **Purpose**: Allows developers to test infrastructure changes before merging.
+
+## Phase 2: Refactoring setup.ts for Container-OS
+This phase is currently **ARCHIVED** in favor of the Persistent Workstation model. 
+
+### Implementation Logic (Snapshot)
+The orchestrator should launch isolated containers using this pattern:
+```bash
+docker run --rm -it \
+  --name workspace-job-id \
+  -v ~/dev/worktrees/job-id:/home/node/dev/worktree:rw \
+  -v ~/dev/main:/home/node/dev/main:ro \
+  -v ~/.gemini:/home/node/.gemini:ro \
+  -w /home/node/dev/worktree \
+  maintainer-image:latest \
+  sh -c "tsx ~/.workspace/scripts/entrypoint.ts ..."
+```
+
+## How to Resume
+1. Review the archived container-launch logic above.
+2. Update `setup.ts` to use `gcloud compute instances create-with-container`.
+3. Update `orchestrator.ts` to use `docker run` instead of standard `ssh`.

extensions/workspaces/docs/README.md

@@ -0,0 +1,141 @@
+# Workspace maintainer skill
+
+The `workspace` skill provides a high-performance, parallelized workflow for
+workspaceing intensive developer tasks to a remote workstation. It leverages a
+Node.js orchestrator to run complex validation playbooks concurrently in a
+dedicated terminal window.
+
+## Why use workspace?
+
+As a maintainer, you eventually reach the limits of how much work you can manage
+at once on a single local machine. Heavy builds, concurrent test suites, and
+multiple PRs in flight can quickly overload local resources, leading to
+performance degradation and developer friction.
+
+While manual remote management is a common workaround, it is often cumbersome
+and context-heavy. The `workspace` skill addresses these challenges by
+providing:
+
+- **Elastic compute**: Workspace resource-intensive build and lint suites to a
+  beefy remote workstation, keeping your local machine responsive.
+- **Context preservation**: The main Gemini session remains interactive and
+  focused on high-level reasoning while automated tasks provide real-time
+  feedback in a separate window.
+- **Automated orchestration**: The skill handles worktree provisioning, script
+  synchronization, and environment isolation automatically.
+- **True parallelism**: Infrastructure validation, CI checks, and behavioral
+  proofs run simultaneously, compressing a 15-minute process into 3 minutes.
+
+## Agentic skills: Sync or Workspace
+
+The `workspace` system is designed to work in synergy with specialized agentic
+skills. These skills can be run **synchronously** in your current terminal for
+quick tasks, or **workspaceed** to a remote session for complex, iterative
+loops.
+
+- **`review-pr`**: Conducts high-fidelity, behavioral code reviews. It assumes
+  the infrastructure is already validated and focuses on physical proof of
+  functionality.
+- **`fix-pr`**: An autonomous "Fix-to-Green" loop. It iteratively addresses CI
+  failures, merge conflicts, and review comments until the PR is mergeable.
+
+When you run `workspace <PR> fix`, the orchestrator provisions the remote
+environment and then launches a Gemini CLI session specifically powered by the
+`fix-pr` skill.
+
+## Architecture: The Hybrid Powerhouse
+
+The workspace system uses a **Hybrid VM + Docker** architecture designed for
+maximum performance and reliability:
+
+1.  **The GCE VM (Raw Power)**: By running on high-performance Google Compute
+    Engine instances, we workspace heavy CPU and RAM tasks (like full project
+    builds and massive test suites) from your local machine, keeping your
+    primary workstation responsive.
+2.  **The Docker Container (Consistency & Resilience)**:
+    - **Source of Truth**: The `.gcp/Dockerfile.maintainer` defines the exact
+      environment. If a tool is added there, every maintainer gets it instantly.
+    - **Zero Drift**: Containers are immutable. Every job starts in a fresh
+      state, preventing the "OS rot" that typically affects persistent VMs.
+    - **Local-to-Remote Parity**: The same image can be run locally on your Mac
+      or remotely in GCP, ensuring that "it works on my machine" translates 100%
+      to the remote worker.
+    - **Safe Multi-tenancy**: Using Git Worktrees inside an isolated container
+      environment allows multiple jobs to run in parallel without sharing state
+      or polluting the host system.
+
+## Playbooks
+
+- **`review`** (default): Build, CI check, static analysis, and behavioral
+  proofs.
+- **`fix`**: Iterative fixing of CI failures and review comments.
+- **`ready`**: Final full validation (clean install + preflight) before merge.
+- **`open`**: Provision a worktree and drop directly into a remote tmux session.
+
+## Scenario and workflows
+
+### Getting Started (Onboarding)
+
+For a complete guide on setting up your remote environment, see the
+[Maintainer Onboarding Guide](../../../MAINTAINER_ONBOARDING.md).
+
+### Persistence and Job Recovery
+
+The workspace system is designed for high reliability and persistence. Jobs use
+a nested execution model to ensure they continue running even if your local
+terminal is closed or the connection is lost.
+
+### How it Works
+
+1.  **Host-Level Persistence**: The orchestrator launches each job in a named
+    **`tmux`** session on the remote VM.
+2.  **Container Isolation**: The actual work is performed inside the persistent
+    `maintainer-worker` Docker container.
+
+### Re-attaching to a Job
+
+If you lose your connection, you can easily resume your session:
+
+- **Automatic**: Simply run the exact same command you started with (e.g.,
+  `workspace 123 review`). The system will automatically detect the existing
+  session and re-attach you.
+- **Manual**: Use `workspace:status` to find the session name, then use
+  `ssh gcli-worker` to jump into the VM and `tmux attach -t <session>` to
+  resume.
+
+## Technical details
+
+This skill uses a **Worker Provider** abstraction (`GceCosProvider`) to manage
+the remote lifecycle. It uses an isolated Gemini profile on the remote host
+(`~/.workspace/gemini-cli-config`) to ensure that verification tasks do not
+interfere with your primary configuration.
+
+### Directory structure
+
+- `scripts/providers/`: Modular worker implementations (GCE, etc.).
+- `scripts/orchestrator.ts`: Local orchestrator (syncs scripts and pops
+  terminal).
+- `scripts/worker.ts`: Remote engine (provisions worktree and runs playbooks).
+- `scripts/check.ts`: Local status poller.
+- `scripts/clean.ts`: Remote cleanup utility.
+- `SKILL.md`: Instructional body used by the Gemini CLI agent.
+
+## Contributing
+
+If you want to improve this skill:
+
+1. Modify the TypeScript scripts in `scripts/`.
+2. Update `SKILL.md` if the agent's instructions need to change.
+3. Test your changes locally using `workspace <PR>`.
+
+## Testing
+
+The orchestration logic for this skill is fully tested. To run the tests:
+
+```bash
+npx vitest .gemini/skills/workspace/tests/orchestration.test.ts
+```
+
+These tests mock the external environment (SSH, GitHub CLI, and the file system)
+to ensure that the orchestration scripts generate the correct commands and
+handle environment isolation accurately.

extensions/workspaces/docs/plan.workerabstraction.md

@@ -0,0 +1,69 @@
+# Plan: Worker Provider Abstraction for Workspace System
+
+## Objective
+
+Abstract the remote execution infrastructure (GCE COS, GCE Linux, Cloud
+Workstations) behind a common `WorkerProvider` interface. This eliminates
+infrastructure-specific prompts (like "use container mode") and makes the system
+extensible to new backends.
+
+## Architectural Changes
+
+### 1. New Provider Abstraction
+
+Create a modular provider system where each infrastructure type implements a
+standard interface.
+
+- **Base Interface**: `WorkerProvider` (methods for `exec`, `sync`, `provision`,
+  `getStatus`).
+- **Implementations**:
+  - `GceCosProvider`: Handles COS with Cloud-Init and `docker exec` wrapping.
+  - `GceLinuxProvider`: Handles standard Linux VMs with direct execution.
+  - `LocalDockerProvider`: (Future) Runs workspace tasks in a local container.
+  - `WorkstationProvider`: (Future) Integrates with Google Cloud Workstations.
+
+### 2. Auto-Discovery
+
+Modify `setup.ts` to:
+
+- Prompt for a high-level "Provider Type" (e.g., "Google Cloud (COS)", "Google
+  Cloud (Linux)").
+- Auto-detect environment details where possible (e.g., fetching internal IPs,
+  identifying container names).
+
+### 3. Clean Orchestration
+
+Refactor `orchestrator.ts` to be provider-agnostic:
+
+- It asks the provider to "Ensure Ready" (wake VM).
+- It asks the provider to "Prepare Environment" (worktree setup).
+- It asks the provider to "Launch Task" (tmux initialization).
+
+## Implementation Steps
+
+### Phase 1: Infrastructure Cleanup
+
+- Move existing procedural logic from `fleet.ts`, `setup.ts`, and
+  `orchestrator.ts` into a new `providers/` directory.
+- Create `ProviderFactory` to instantiate the correct implementation based on
+  `settings.json`.
+
+### Phase 2: Refactor Scripts
+
+- **`fleet.ts`**: Proxy all actions (`provision`, `rebuild`, `stop`) to the
+  provider.
+- **`orchestrator.ts`**: Use the provider for the entire lifecycle of a job.
+- **`status.ts`**: Use the provider's `getStatus()` method to derive state.
+
+### Phase 3: Validation
+
+- Verify that the `gcli-worker` SSH alias and IAP tunneling remain functional.
+- Ensure "Fast-Path SSH" is still the primary interactive gateway.
+
+## Verification
+
+- Run `workspace:fleet provision` and ensure it creates a COS-native worker.
+- Run `workspace:setup` and verify it no longer asks cryptic infrastructure
+  questions.
+- Launch a review and verify it uses `docker exec internally for the COS
+  provider.

extensions/workspaces/scripts/TaskRunner.ts

@@ -0,0 +1,95 @@
+/**
+ * Shared Task Runner Utility
+ * Handles parallel process execution, log streaming, and dashboard rendering.
+ */
+import { spawn } from 'child_process';
+import path from 'path';
+import fs from 'fs';
+
+export interface Task {
+  id: string;
+  name: string;
+  cmd: string;
+  dep?: string;
+  condition?: 'success' | 'fail';
+}
+
+export class TaskRunner {
+  private state: Record<string, { status: string; exitCode?: number }> = {};
+  private tasks: Task[] = [];
+  private logDir: string;
+  private header: string;
+
+  constructor(logDir: string, header: string) {
+    this.logDir = logDir;
+    this.header = header;
+    fs.mkdirSync(logDir, { recursive: true });
+  }
+
+  register(tasks: Task[]) {
+    this.tasks = tasks;
+    tasks.forEach(t => this.state[t.id] = { status: 'PENDING' });
+  }
+
+  async run() {
+    const runQueue = this.tasks.filter(t => !t.dep);
+    runQueue.forEach(t => this.execute(t));
+
+    return new Promise((resolve) => {
+      const checkInterval = setInterval(() => {
+        const allDone = this.tasks.every(t => 
+          ['SUCCESS', 'FAILED', 'SKIPPED'].includes(this.state[t.id].status)
+        );
+
+        if (allDone) {
+          clearInterval(checkInterval);
+          console.log('\n✨ All tasks complete.');
+          resolve(this.state);
+        }
+
+        // Check for dependencies
+        this.tasks.filter(t => t.dep && this.state[t.id].status === 'PENDING').forEach(t => {
+          const parent = this.state[t.dep!];
+          if (parent.status === 'SUCCESS' && (!t.condition || t.condition === 'success')) {
+            this.execute(t);
+          } else if (parent.status === 'FAILED' && t.condition === 'fail') {
+            this.execute(t);
+          } else if (['SUCCESS', 'FAILED'].includes(parent.status)) {
+            this.state[t.id].status = 'SKIPPED';
+          }
+        });
+
+        this.render();
+      }, 1500);
+    });
+  }
+
+  private execute(task: Task) {
+    this.state[task.id].status = 'RUNNING';
+    const proc = spawn(task.cmd, { shell: true, env: { ...process.env, FORCE_COLOR: '1' } });
+    
+    const logStream = fs.createWriteStream(path.join(this.logDir, `${task.id}.log`));
+    proc.stdout.pipe(logStream);
+    proc.stderr.pipe(logStream);
+
+    proc.on('close', (code) => {
+      const exitCode = code ?? 0;
+      this.state[task.id].status = exitCode === 0 ? 'SUCCESS' : 'FAILED';
+      this.state[task.id].exitCode = exitCode;
+      fs.writeFileSync(path.join(this.logDir, `${task.id}.exit`), exitCode.toString());
+    });
+  }
+
+  private render() {
+    console.clear();
+    console.log('==================================================');
+    console.log(this.header);
+    console.log('==================================================\n');
+    
+    this.tasks.forEach(t => {
+      const s = this.state[t.id];
+      const icon = s.status === 'SUCCESS' ? '✅' : s.status === 'FAILED' ? '❌' : s.status === 'RUNNING' ? '⏳' : s.status === 'SKIPPED' ? '⏭️ ' : '💤';
+      console.log(`  ${icon} ${t.name.padEnd(20)}: ${s.status}`);
+    });
+  }
+}

extensions/workspaces/scripts/attach.ts

@@ -0,0 +1,93 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import path from 'node:path';
+import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+import { ProviderFactory } from './providers/ProviderFactory.ts';
+
+
+const REPO_ROOT = process.cwd();
+
+const q = (str: string) => `'${str.replace(/'/g, "'\\''")}'`;
+
+export async function runAttach(
+  args: string[],
+  env: NodeJS.ProcessEnv = process.env,
+) {
+  const prNumber = args[0];
+  const action = args[1] || 'review';
+  const isLocal = args.includes('--local');
+
+  if (!prNumber) {
+    console.error('Usage: workspace attach <PR_NUMBER> [action] [--local]');
+    return 1;
+  }
+
+  const settingsPath = path.join(REPO_ROOT, '.gemini/workspaces/settings.json');
+  if (!fs.existsSync(settingsPath)) {
+    console.error('❌ Settings not found. Run "workspace setup" first.');
+    return 1;
+  }
+  const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+  const config = settings.workspace;
+  if (!config) {
+    console.error('❌ Deep Review configuration not found.');
+    return 1;
+  }
+
+  const { projectId, zone } = config;
+  const targetVM = `gcli-workspace-${env.USER || 'mattkorwel'}`;
+  const provider = ProviderFactory.getProvider({
+    projectId,
+    zone,
+    instanceName: targetVM,
+  });
+
+  const sessionName = `workspace-${prNumber}-${action}`;
+  const containerAttach = `sudo docker exec -it maintainer-worker sh -c ${q(`tmux attach-session -t ${sessionName}`)}`;
+  const finalSSH = provider.getRunCommand(containerAttach, {
+    interactive: true,
+  });
+
+  console.log(`🔗 Attaching to session: ${sessionName}...`);
+
+  const isWithinGemini =
+    !!env.GEMINI_CLI || !!env.GEMINI_SESSION_ID || !!env.GCLI_SESSION_ID;
+  if (isWithinGemini && !isLocal) {
+    const tempCmdPath = path.join(
+      process.env.TMPDIR || '/tmp',
+      `workspace-attach-${prNumber}.sh`,
+    );
+    fs.writeFileSync(tempCmdPath, `#!/bin/bash\n${finalSSH}\nrm "$0"`, {
+      mode: 0o755,
+    });
+
+    const appleScript = `
+      on run argv
+        tell application "iTerm"
+          tell current window
+            set newTab to (create tab with default profile)
+            tell current session of newTab
+              write text (item 1 of argv) & return
+            end tell
+          end tell
+          activate
+        end tell
+      end run
+    `;
+    spawnSync('osascript', ['-', tempCmdPath], { input: appleScript });
+    console.log(`✅ iTerm2 tab opened for ${sessionName}.`);
+    return 0;
+  }
+
+  spawnSync(finalSSH, { stdio: 'inherit', shell: true });
+  return 0;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  runAttach(process.argv.slice(2)).catch(console.error);
+}

extensions/workspaces/scripts/check.ts

@@ -0,0 +1,99 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import fs from 'node:fs';
+
+import { ProviderFactory } from './providers/ProviderFactory.ts';
+
+
+const REPO_ROOT = process.cwd();
+
+export async function runChecker(
+  args: string[],
+  env: NodeJS.ProcessEnv = process.env,
+) {
+  const prNumber = args[0];
+  if (!prNumber) {
+    console.error('Usage: npm run review:check <PR_NUMBER>');
+    return 1;
+  }
+
+  const settingsPath = path.join(REPO_ROOT, '.gemini/workspaces/settings.json');
+  if (!fs.existsSync(settingsPath)) {
+    console.error('❌ Settings not found. Run "workspace setup" first.');
+    return 1;
+  }
+  const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+  const config = settings.workspace;
+  if (!config) {
+    console.error('❌ Deep Review configuration not found.');
+    return 1;
+  }
+  const { projectId, zone, remoteWorkDir } = config;
+  const targetVM = `gcli-workspace-${env.USER || 'mattkorwel'}`;
+  const provider = ProviderFactory.getProvider({
+    projectId,
+    zone,
+    instanceName: targetVM,
+  });
+
+  console.log(
+    `🔍 Checking remote status for PR #${prNumber} on ${targetVM}...`,
+  );
+
+  const branchView = spawnSync(
+    'gh',
+    ['pr', 'view', prNumber, '--json', 'headRefName', '-q', '.headRefName'],
+    { shell: true },
+  );
+  const branchName = branchView.stdout.toString().trim();
+  const logDir = `${remoteWorkDir}/${branchName}/.gemini/logs/review-${prNumber}`;
+
+  const tasks = ['build', 'ci', 'review', 'verify'];
+  let allDone = true;
+
+  console.log('\n--- Task Status ---');
+  for (const task of tasks) {
+    const exitFile = `${logDir}/${task}.exit`;
+    const checkExit = await provider.getExecOutput(
+      `[ -f ${exitFile} ] && cat ${exitFile}`,
+      { wrapContainer: 'maintainer-worker' },
+    );
+
+    if (checkExit.status === 0 && checkExit.stdout.trim()) {
+      const code = checkExit.stdout.trim();
+      console.log(
+        `  ${code === '0' ? '✅' : '❌'} ${task.padEnd(10)}: ${code === '0' ? 'SUCCESS' : `FAILED (exit ${code})`}`,
+      );
+    } else {
+      const checkRunning = await provider.exec(`[ -f ${logDir}/${task}.log ]`, {
+        wrapContainer: 'maintainer-worker',
+      });
+      if (checkRunning === 0) {
+        console.log(`  ⏳ ${task.padEnd(10)}: RUNNING`);
+      } else {
+        console.log(`  💤 ${task.padEnd(10)}: PENDING`);
+      }
+      allDone = false;
+    }
+  }
+
+  if (allDone) {
+    console.log(
+      '\n✨ All remote tasks complete. You can now synthesize the results.',
+    );
+  } else {
+    console.log(
+      '\n⏳ Some tasks are still in progress. Check again in a few minutes.',
+    );
+  }
+  return 0;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  runChecker(process.argv.slice(2)).catch(console.error);
+}

extensions/workspaces/scripts/clean.ts

@@ -0,0 +1,131 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import path from 'node:path';
+import fs from 'node:fs';
+
+import readline from 'node:readline';
+import { ProviderFactory } from './providers/ProviderFactory.ts';
+
+
+const REPO_ROOT = process.cwd();
+
+async function confirm(question: string): Promise<boolean> {
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+  return new Promise((resolve) => {
+    rl.question(`${question} (y/n): `, (answer) => {
+      rl.close();
+      resolve(answer.trim().toLowerCase() === 'y');
+    });
+  });
+}
+
+export async function runCleanup(
+  args: string[],
+  env: NodeJS.ProcessEnv = process.env,
+) {
+  const prNumber = args[0];
+  const action = args[1];
+
+  const settingsPath = path.join(REPO_ROOT, '.gemini/workspaces/settings.json');
+  if (!fs.existsSync(settingsPath)) {
+    console.error('❌ Settings not found. Run "workspace setup" first.');
+    return 1;
+  }
+
+  const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+  const config = settings.workspace;
+  if (!config) {
+    console.error('❌ Workspace configuration not found.');
+    return 1;
+  }
+
+  const { projectId, zone } = config;
+  const targetVM = `gcli-workspace-${env.USER || 'mattkorwel'}`;
+  const provider = ProviderFactory.getProvider({
+    projectId,
+    zone,
+    instanceName: targetVM,
+  });
+
+  if (prNumber && action) {
+    const sessionName = `workspace-${prNumber}-${action}`;
+    const worktreePath = `/home/node/.workspaces/worktrees/${sessionName}`;
+
+    console.log(
+      `🧹 Surgically removing session and worktree for ${prNumber}-${action}...`,
+    );
+
+    // Kill specific tmux session inside container
+    await provider.exec(`tmux kill-session -t ${sessionName} 2>/dev/null`, {
+      wrapContainer: 'maintainer-worker',
+    });
+
+    // Remove specific worktree inside container
+    await provider.exec(
+      `cd /home/node/.workspaces/main && git worktree remove -f ${worktreePath} 2>/dev/null && git worktree prune`,
+      { wrapContainer: 'maintainer-worker' },
+    );
+
+    console.log(`✅ Cleaned up ${prNumber}-${action}.`);
+    return 0;
+  }
+
+  // --- Bulk Cleanup ---
+  console.log(
+    `⚠️  DANGER: You are about to perform a BULK cleanup on ${targetVM}.`,
+  );
+  const confirmed = await confirm(
+    '   Are you sure you want to kill ALL sessions and worktrees?',
+  );
+  if (!confirmed) {
+    console.log('❌ Cleanup cancelled.');
+    return 0;
+  }
+
+  console.log(`🧹 Starting BULK cleanup...`);
+
+  // 1. Standard Cleanup
+  console.log('   - Killing ALL remote tmux sessions...');
+  await provider.exec(`tmux kill-server`, {
+    wrapContainer: 'maintainer-worker',
+  });
+
+  console.log('   - Cleaning up Docker resources...');
+  await provider.exec(`sudo docker rm -f maintainer-worker || true`);
+  await provider.exec(`sudo docker system prune -af --volumes`);
+
+  console.log('   - Cleaning up ALL Git Worktrees...');
+  await provider.exec(
+    `cd /home/node/.workspaces/main && git worktree prune && rm -rf /home/node/.workspaces/worktrees/*`,
+    { wrapContainer: 'maintainer-worker' },
+  );
+
+  console.log('✅ Remote environment cleared.');
+
+  // 2. Full Wipe Option
+  const shouldWipe = await confirm(
+    '\nWould you like to COMPLETELY wipe the remote workspace (main clone)?',
+  );
+
+  if (shouldWipe) {
+    console.log(`🔥 Wiping /home/node/.workspaces/main...`);
+    await provider.exec(
+      `rm -rf /home/node/.workspaces/main && mkdir -p /home/node/.workspaces/main`,
+      { wrapContainer: 'maintainer-worker' },
+    );
+    console.log(
+      '✅ Remote hub wiped. You will need to run workspace setup again.',
+    );
+  }
+  return 0;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  runCleanup(process.argv.slice(2)).catch(console.error);
+}

extensions/workspaces/scripts/entrypoint.ts

@@ -0,0 +1,61 @@
+/**
+ * Deep Review Entrypoint (Remote)
+ * 
+ * This script is the single command executed by the remote tmux session.
+ * It handles environment loading and sequence orchestration.
+ */
+import { spawnSync } from 'child_process';
+import path from 'path';
+import fs from 'fs';
+
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const prNumber = process.argv[2];
+const branchName = process.argv[3];
+const policyPath = process.argv[4];
+const ISOLATED_CONFIG = process.env.GEMINI_CLI_HOME || path.join(process.env.HOME || '', '.workspaces/gemini-cli-config');
+
+async function main() {
+  if (!prNumber || !branchName || !policyPath) {
+    console.error('Usage: tsx entrypoint.ts <PR_NUMBER> <BRANCH_NAME> <POLICY_PATH>');
+    process.exit(1);
+  }
+
+  const workDir = process.cwd(); // This is remoteWorkDir as set in review.ts
+  const targetDir = path.join(workDir, branchName);
+
+  // Use global tools pre-installed in the maintainer image
+  const tsxBin = 'tsx'; 
+  const geminiBin = 'gemini';
+
+  const action = process.argv[5] || 'review';
+
+  // 1. Run the Parallel Reviewer
+  console.log('🚀 Launching Parallel Review Worker...');
+  console.log(`   - Script: ${path.join(__dirname, 'worker.ts')}`);
+  console.log(`   - Action: ${action}`);
+
+  const workerResult = spawnSync(tsxBin, [path.join(__dirname, 'worker.ts'), prNumber, branchName, policyPath, action], {
+    stdio: 'inherit',
+    env: { ...process.env, GEMINI_CLI_HOME: ISOLATED_CONFIG }
+  });
+
+  if (workerResult.status !== 0) {
+    console.error(`❌ Worker failed with exit code ${workerResult.status}.`);
+    if (workerResult.error) console.error('   Error:', workerResult.error.message);
+  }
+
+  // 2. Launch the Interactive Gemini Session (Local Nightly)
+  console.log('\n✨ Verification complete. Joining interactive session...');
+  
+  const geminiArgs = ['--policy', policyPath];
+  geminiArgs.push('-p', `Review for PR #${prNumber} is complete. Read the logs in .gemini/logs/review-${prNumber}/ and synthesize your findings.`);
+
+  process.chdir(targetDir);
+  spawnSync(geminiBin, geminiArgs, {
+    stdio: 'inherit',
+    env: { ...process.env, GEMINI_CLI_HOME: ISOLATED_CONFIG }
+  });
+}
+
+main().catch(console.error);

extensions/workspaces/scripts/fleet.ts

@@ -0,0 +1,144 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import fs from 'node:fs';
+
+import { ProviderFactory } from './providers/ProviderFactory.ts';
+
+
+const REPO_ROOT = process.cwd();
+
+const USER = process.env.USER || 'mattkorwel';
+const INSTANCE_PREFIX = `gcli-workspace-${USER}`;
+const DEFAULT_ZONE = 'us-west1-a';
+
+function getProjectId(): string {
+  const settingsPath = path.join(REPO_ROOT, '.gemini/workspaces/settings.json');
+  if (fs.existsSync(settingsPath)) {
+    try {
+      const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+      return settings.workspace?.projectId;
+    } catch {
+      // Ignore
+    }
+  }
+  return process.env.GOOGLE_CLOUD_PROJECT || '';
+}
+
+async function listWorkers() {
+  const projectId = getProjectId();
+  if (!projectId) {
+    console.error('❌ Project ID not found. Run "workspace setup" first.');
+    return;
+  }
+
+  console.log(`🔍 Listing Workspace Workers for ${USER} in ${projectId}...`);
+
+  spawnSync(
+    'gcloud',
+    [
+      'compute',
+      'instances',
+      'list',
+      '--project',
+      projectId,
+      '--filter',
+      `name~^${INSTANCE_PREFIX}`,
+      '--format',
+      'table(name,zone,status,networkInterfaces[0].networkIP:label=INTERNAL_IP,creationTimestamp)',
+    ],
+    { stdio: 'inherit' },
+  );
+}
+
+async function provisionWorker() {
+  const projectId = getProjectId();
+  if (!projectId) {
+    console.error('❌ Project ID not found. Run "workspace setup" first.');
+    return;
+  }
+
+  const provider = ProviderFactory.getProvider({
+    projectId: projectId,
+    zone: DEFAULT_ZONE,
+    instanceName: INSTANCE_PREFIX,
+  });
+
+  const status = await provider.getStatus();
+  if (status.status !== 'UNKNOWN' && status.status !== 'ERROR') {
+    console.log(
+      `✅ Worker ${INSTANCE_PREFIX} already exists and is ${status.status}.`,
+    );
+    return;
+  }
+
+  await provider.provision();
+}
+
+async function stopWorker() {
+  const projectId = getProjectId();
+  const provider = ProviderFactory.getProvider({
+    projectId: projectId,
+    zone: DEFAULT_ZONE,
+    instanceName: INSTANCE_PREFIX,
+  });
+
+  console.log(`🛑 Stopping workspace worker: ${INSTANCE_PREFIX}...`);
+  await provider.stop();
+}
+
+async function rebuildWorker() {
+  const projectId = getProjectId();
+  console.log(`🔥 Rebuilding worker ${INSTANCE_PREFIX}...`);
+
+  const knownHostsPath = path.join(REPO_ROOT, '.gemini/workspaces_known_hosts');
+  if (fs.existsSync(knownHostsPath)) {
+    console.log(`   - Clearing isolated known_hosts...`);
+    fs.unlinkSync(knownHostsPath);
+  }
+
+  spawnSync(
+    'gcloud',
+    [
+      'compute',
+      'instances',
+      'delete',
+      INSTANCE_PREFIX,
+      '--project',
+      projectId,
+      '--zone',
+      DEFAULT_ZONE,
+      '--quiet',
+    ],
+    { stdio: 'inherit' },
+  );
+  await provisionWorker();
+}
+
+async function main() {
+  const action = process.argv[2] || 'list';
+
+  switch (action) {
+    case 'list':
+      await listWorkers();
+      break;
+    case 'provision':
+      await provisionWorker();
+      break;
+    case 'rebuild':
+      await rebuildWorker();
+      break;
+    case 'stop':
+      await stopWorker();
+      break;
+    default:
+      console.error(`❌ Unknown fleet action: ${action}`);
+      process.exit(1);
+  }
+}
+
+main().catch(console.error);

extensions/workspaces/scripts/logs.ts

@@ -0,0 +1,54 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import fs from 'node:fs';
+
+
+
+const REPO_ROOT = process.cwd();
+
+export async function runLogs(args: string[]) {
+  const prNumber = args[0];
+  const action = args[1] || 'review';
+
+  if (!prNumber) {
+    console.error('Usage: workspace logs <PR_NUMBER> [action]');
+    return 1;
+  }
+
+  const settingsPath = path.join(REPO_ROOT, '.gemini/settings.json');
+  const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+  const config = settings.maintainer?.workspace;
+  const { remoteHost, remoteHome } = config;
+  const sshConfigPath = path.join(REPO_ROOT, '.gemini/workspace_ssh_config');
+
+  const jobDir = `${remoteHome}/dev/worktrees/workspace-${prNumber}-${action}`;
+  const logDir = `${jobDir}/.gemini/logs`;
+
+  console.log(`📋 Tailing latest logs for job ${prNumber}-${action}...`);
+
+  // Remote command to find the latest log file and tail it
+  const tailCmd = `
+    latest_log=$(ls -t ${logDir}/*.log 2>/dev/null | head -n 1)
+    if [ -z "$latest_log" ]; then
+      echo "❌ No logs found for this job yet."
+      exit 1
+    fi
+    echo "📄 Tailing: $latest_log"
+    tail -f "$latest_log"
+  `;
+
+  spawnSync(
+    `ssh -F ${sshConfigPath} ${remoteHost} ${JSON.stringify(tailCmd)}`,
+    { stdio: 'inherit', shell: true },
+  );
+  return 0;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  runLogs(process.argv.slice(2)).catch(console.error);
+}

extensions/workspaces/scripts/orchestrator.ts

@@ -0,0 +1,238 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import fs from 'node:fs';
+
+import { ProviderFactory } from './providers/ProviderFactory.ts';
+
+
+const REPO_ROOT = process.cwd();
+
+function q(str: string) {
+  return `'${str.replace(/'/g, "'\\''")}'`;
+}
+
+export async function runOrchestrator(
+  args: string[],
+  env: NodeJS.ProcessEnv = process.env,
+) {
+  let prNumber = args[0];
+  let action = args[1] || 'review';
+
+  // Handle "shell" mode: workspace shell [identifier]
+  const isShellMode = prNumber === 'shell';
+  if (isShellMode) {
+    prNumber = args[1] || `adhoc-${Math.floor(Math.random() * 10000)}`;
+    action = 'shell';
+  }
+
+  if (!prNumber) {
+    console.error(
+      '❌ Usage: workspace <PR_NUMBER> [action] OR workspace shell [identifier]',
+    );
+    return 1;
+  }
+
+  // 1. Load Settings
+  const settingsPath = path.join(REPO_ROOT, '.gemini/workspaces/settings.json');
+  if (!fs.existsSync(settingsPath)) {
+    console.error(
+      '❌ Workspace settings not found. Run "workspace setup" first.',
+    );
+    return 1;
+  }
+  const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+  const config = settings.workspace;
+
+  const targetVM = `gcli-workspace-${env.USER || 'mattkorwel'}`;
+  const provider = ProviderFactory.getProvider({
+    projectId: config.projectId,
+    zone: config.zone,
+    instanceName: targetVM,
+  });
+
+  // 2. Wake Worker & Verify Container
+  await provider.ensureReady();
+
+  // Retrieve the remote user to ensure we run git commands correctly
+  await provider.getExecOutput('whoami');
+
+  // Paths - Unified across host and container
+  const hostWorkspaceRoot = `/home/node/.workspaces`;
+  const hostWorkDir = `${hostWorkspaceRoot}/main`;
+  const containerWorkspaceRoot = `/home/node/.workspaces`;
+
+  const remotePolicyPath = `${containerWorkspaceRoot}/policies/workspace-policy.toml`;
+  const persistentScripts = `${containerWorkspaceRoot}/scripts`;
+  const sessionName = `workspace-${prNumber}-${action}`;
+  const remoteWorktreeDir = `${containerWorkspaceRoot}/worktrees/${sessionName}`;
+  const hostWorktreeDir = `${hostWorkspaceRoot}/worktrees/${sessionName}`;
+
+  // 3. Remote Context Setup (Executed on HOST for permission simplicity)
+  console.log(
+    `🚀 Preparing remote environment for ${action} on ${isShellMode ? 'branch/id' : '#'}${prNumber}...`,
+  );
+
+  // FIX: Use the host path to check for existence
+  const check = await provider.getExecOutput(`ls -d ${hostWorktreeDir}/.git`);
+
+  // FIX: Ensure container user (node) owns the workspaces directories
+  console.log('   - Synchronizing container permissions...');
+  await provider.exec(`sudo chown -R 1000:1000 /home/node/.workspaces`);
+  if (check.status !== 0) {
+    console.log(`   - Provisioning isolated git worktree for ${prNumber}...`);
+
+    // We run these on the host. Since setup might have left the repo root-owned, we use sudo.
+    // We use environment variables to bypass safe.directory checks on a read-only filesystem.
+    const gitEnv = `GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0=${hostWorkDir}`;
+
+    const gitFetch = isShellMode
+      ? `sudo ${gitEnv} git -C ${hostWorkDir} fetch --quiet origin`
+      : `sudo ${gitEnv} git -C ${hostWorkDir} fetch --quiet upstream pull/${prNumber}/head`;
+
+    const gitTarget = isShellMode ? 'FETCH_HEAD' : 'FETCH_HEAD';
+
+    const setupCmd = `
+      sudo mkdir -p ${hostWorkspaceRoot}/worktrees && \
+      sudo chown chronos:chronos ${hostWorkspaceRoot}/worktrees && \
+      ${gitFetch} && \
+      sudo ${gitEnv} git -C ${hostWorkDir} worktree add --quiet -f ${hostWorktreeDir} ${gitTarget} 2>&1 && \
+      sudo chown -R 1000:1000 ${hostWorkspaceRoot}
+    `;
+    const setupRes = await provider.getExecOutput(setupCmd);
+    if (setupRes.status !== 0) {
+      console.error('   ❌ Failed to provision remote worktree.');
+      console.error('   STDOUT:', setupRes.stdout);
+      console.error('   STDERR:', setupRes.stderr);
+      return 1;
+    }
+    console.log('   ✅ Worktree provisioned successfully.');
+  } else {
+    console.log('   ✅ Remote worktree ready.');
+  }
+
+  // AUTH: Dynamically retrieve credentials from host-side config/disk
+  const remoteConfigPath = `${hostWorkspaceRoot}/gemini-cli-config/.gemini/settings.json`;
+  const remoteSettingsRes = await provider.getExecOutput(
+    `cat ${remoteConfigPath}`,
+  );
+  const remoteSettingsJson = remoteSettingsRes.stdout.trim();
+
+  const apiKeyRes = await provider.getExecOutput(
+    `cat ${remoteConfigPath} | grep apiKey | cut -d '"' -f 4`,
+  );
+  const remoteApiKey = apiKeyRes.stdout.trim();
+
+  const ghTokenRes = await provider.getExecOutput(
+    `cat ${hostWorkspaceRoot}/.gh_token`,
+  );
+  const remoteGhToken = ghTokenRes.stdout.trim();
+
+  // AUTH: Inject credentials and settings directly into the worktree
+  console.log('   - Injecting remote authentication and UI context...');
+  const dotEnvContent = `
+GEMINI_API_KEY=${remoteApiKey}
+COLORTERM=truecolor
+TERM=xterm-256color
+GEMINI_AUTO_UPDATE=0
+GEMINI_SANDBOX=workspace
+GEMINI_HOST=${targetVM}
+`.trim();
+  await provider.exec(
+    `sudo docker exec maintainer-worker sh -c ${q(`echo ${q(dotEnvContent)} > ${remoteWorktreeDir}/.env`)}`,
+  );
+
+  // Also inject the settings.json into the worktree's .gemini folder for maximum reliability
+  await provider.exec(
+    `sudo docker exec maintainer-worker sh -c ${q(`mkdir -p ${remoteWorktreeDir}/.gemini && echo ${q(remoteSettingsJson)} > ${remoteWorktreeDir}/.gemini/settings.json`)}`,
+  );
+
+  // 4. Execution Logic
+  // In shell mode, we just start gemini. In action mode, we run the entrypoint.
+  const remoteWorker = isShellMode
+    ? `gemini`
+    : `tsx ${persistentScripts}/entrypoint.ts ${prNumber} . ${remotePolicyPath} ${action}`;
+
+  const authEnv = `-e GEMINI_AUTO_UPDATE=0 ${remoteApiKey ? `-e GEMINI_API_KEY=${remoteApiKey} ` : ''}${remoteGhToken ? `-e GITHUB_TOKEN=${remoteGhToken} -e GH_TOKEN=${remoteGhToken} ` : ''}`;
+
+  // PERSISTENCE: Wrap the entire execution in a tmux session inside the container
+  // We HIDE the tmux status bar to reduce visual noise
+  const tmuxStyle = `
+    tmux set -g status off;
+  `.replace(/\n/g, '');
+
+  const tmuxCmd = `tmux new-session -A -s ${sessionName} ${q(`${tmuxStyle} cd ${remoteWorktreeDir} && ${remoteWorker}; exec $SHELL`)}`;
+  const containerWrap = `sudo docker exec -it -e COLORTERM=truecolor -e TERM=xterm-256color ${authEnv}maintainer-worker sh -c ${q(tmuxCmd)}`;
+
+  const finalSSH = provider.getRunCommand(containerWrap, { interactive: true });
+
+  const isWithinGemini =
+    !!env.GEMINI_CLI || !!env.GEMINI_SESSION_ID || !!env.GCLI_SESSION_ID;
+
+  // 1.5 Handle --open override
+  const openIdx = args.indexOf('--open');
+  let terminalTarget = config.terminalTarget || 'tab';
+  if (openIdx !== -1 && args[openIdx + 1]) {
+    terminalTarget = args[openIdx + 1];
+  }
+
+  const forceMainTerminal = terminalTarget === 'foreground';
+
+  if (
+    !forceMainTerminal &&
+    isWithinGemini &&
+    env.TERM_PROGRAM === 'iTerm.app'
+  ) {
+    const tempCmdPath = path.join(
+      process.env.TMPDIR || '/tmp',
+      `workspace-ssh-${prNumber}.sh`,
+    );
+    fs.writeFileSync(tempCmdPath, `#!/bin/bash\n${finalSSH}\nrm "$0"`, {
+      mode: 0o755,
+    });
+
+    const appleScript =
+      terminalTarget === 'window'
+        ? `
+                on run argv
+                tell application "iTerm"
+                    set newWindow to (create window with default profile)
+                    tell current session of newWindow
+                    write text (quoted form of item 1 of argv) & return
+                    end tell
+                    activate
+                end tell
+                end run
+            `
+        : `
+                on run argv
+                tell application "iTerm"
+                    tell current window
+                    set newTab to (create tab with default profile)
+                    tell current session of newTab
+                        write text (quoted form of item 1 of argv) & return
+                    end tell
+                    end tell
+                    activate
+                end tell
+                end run
+            `;
+    spawnSync('osascript', ['-', tempCmdPath], { input: appleScript });
+    console.log(`✅ iTerm2 ${terminalTarget} opened for job ${prNumber}.`);
+    return 0;
+  }
+
+  // Fallback: Run in current terminal
+  console.log(`📡 Connecting to session ${sessionName}...`);
+  spawnSync(finalSSH, { stdio: 'inherit', shell: true });
+
+  return 0;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  runOrchestrator(process.argv.slice(2)).catch(console.error);
+}

extensions/workspaces/scripts/playbooks/fix.ts

@@ -0,0 +1,18 @@
+import { spawnSync } from 'child_process';
+import path from 'path';
+
+export async function runFixPlaybook(prNumber: string, targetDir: string, policyPath: string, geminiBin: string) {
+  console.log(`🚀 Workspace | FIX | PR #${prNumber}`);
+  console.log('Switching to agentic fix loop inside Gemini CLI...');
+
+  // Use the nightly gemini binary to activate the fix-pr skill and iterate
+  // Note: Gemini doesn't support --cwd, so the caller (worker.ts) must ensure we are already in targetDir
+  const result = spawnSync(geminiBin, [
+    '--policy', policyPath,
+    '-p', `Please activate the 'fix-pr' skill and use it to iteratively fix PR #${prNumber}. 
+           Ensure you handle CI failures, merge conflicts, and unaddressed review comments 
+           until the PR is fully passing and mergeable.`
+  ], { stdio: 'inherit' });
+
+  return result?.status ?? 1;
+}

extensions/workspaces/scripts/playbooks/implement.ts

@@ -0,0 +1,74 @@
+import { TaskRunner } from '../TaskRunner.js';
+import path from 'path';
+import { spawnSync } from 'child_process';
+
+import { TaskRunner } from '../TaskRunner.js';
+import path from 'path';
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+
+export async function runImplementPlaybook(issueNumber: string, workDir: string, policyPath: string, geminiBin: string) {
+  console.log(`🚀 Workspace | IMPLEMENT (Supervisor Loop) | Issue #${issueNumber}`);
+  
+  const ghView = spawnSync('gh', ['issue', 'view', issueNumber, '--json', 'title,body', '-q', '{title:.title,body:.body}'], { shell: true });
+  const meta = JSON.parse(ghView.stdout.toString());
+  const branchName = `impl/${issueNumber}-${meta.title.toLowerCase().replace(/[^a-z0-9]/g, '-')}`.slice(0, 50);
+
+  // 1. Initial Research & Test Creation
+  console.log('\n🧠 Phase 1: Research & Reproduction...');
+  spawnSync(geminiBin, [
+    '--policy', policyPath, '--cwd', workDir,
+    '-p', `Research Issue #${issueNumber}: "${meta.title}". 
+           Description: ${meta.body}.
+           ACTION: Create a NEW Vitest test file in 'tests/repro_issue_${issueNumber}.test.ts' that demonstrates the issue or feature. 
+           Ensure this test fails currently.`
+  ], { stdio: 'inherit' });
+
+  // 2. The Self-Healing Loop
+  let attempts = 0;
+  const maxAttempts = 5;
+  let success = false;
+
+  console.log('\n🛠️ Phase 2: Implementation Loop...');
+  while (attempts < maxAttempts && !success) {
+    attempts++;
+    console.log(`\n👉 Attempt ${attempts}/${maxAttempts}...`);
+
+    // Run the specific repro test
+    const testRun = spawnSync('npx', ['vitest', 'run', `tests/repro_issue_${issueNumber}.test.ts`], { cwd: workDir });
+    
+    if (testRun.status === 0) {
+      console.log('✅ Reproduction test PASSED!');
+      success = true;
+      break;
+    }
+
+    console.log('❌ Test failed. Asking Gemini to fix the implementation...');
+    const testError = testRun.stdout.toString() + testRun.stderr.toString();
+    
+    spawnSync(geminiBin, [
+      '--policy', policyPath, '--cwd', workDir,
+      '-p', `The reproduction test for Issue #${issueNumber} is still failing. 
+             ERROR OUTPUT:
+             ${testError.slice(-2000)}
+             
+             ACTION: Modify the source code to fix this error and make the test pass. 
+             Do not modify the test itself unless it has a syntax error.`
+    ], { stdio: 'inherit' });
+  }
+
+  // 3. Final Verification
+  if (success) {
+    console.log('\n🧪 Phase 3: Final Verification...');
+    const finalCheck = spawnSync('npm', ['test'], { cwd: workDir, stdio: 'inherit' });
+    if (finalCheck.status === 0) {
+      console.log('\n🎉 Implementation complete and verified!');
+      spawnSync('git', ['add', '.'], { cwd: workDir });
+      spawnSync('git', ['commit', '-m', `feat: implement issue #${issueNumber}`], { cwd: workDir });
+      return 0;
+    }
+  }
+
+  console.error('\n❌ Supervisor: Failed to reach a passing state within retry limit.');
+  return 1;
+}

extensions/workspaces/scripts/playbooks/ready.ts

@@ -0,0 +1,17 @@
+import { TaskRunner } from '../TaskRunner.ts';
+import path from 'path';
+
+export async function runReadyPlaybook(prNumber: string, targetDir: string, policyPath: string, geminiBin: string) {
+  const runner = new TaskRunner(
+    path.join(targetDir, `.gemini/logs/workspace-${prNumber}`),
+    `🚀 Workspace | READY | PR #${prNumber}`
+  );
+
+  runner.register([
+    { id: 'clean', name: 'Clean Workspace', cmd: `npm run clean && npm ci` },
+    { id: 'preflight', name: 'Full Preflight', cmd: `npm run preflight`, dep: 'clean' },
+    { id: 'conflicts', name: 'Main Conflict Check', cmd: `git fetch origin main && git merge-base --is-ancestor origin/main HEAD` }
+  ]);
+
+  return runner.run();
+}

extensions/workspaces/scripts/playbooks/review.ts

@@ -0,0 +1,17 @@
+import { TaskRunner } from '../TaskRunner.ts';
+import path from 'path';
+
+export async function runReviewPlaybook(prNumber: string, targetDir: string, policyPath: string, geminiBin: string) {
+  const runner = new TaskRunner(
+    path.join(targetDir, `.gemini/logs/workspace-${prNumber}`),
+    `🚀 Workspace | REVIEW | PR #${prNumber}`
+  );
+
+  runner.register([
+    { id: 'build', name: 'Fast Build', cmd: `cd ${targetDir} && npm ci && npm run build` },
+    { id: 'ci', name: 'CI Checks', cmd: `gh pr checks ${prNumber}` },
+    { id: 'review', name: 'Workspaceed Review', cmd: `cd ${targetDir} && ${geminiBin} --policy ${policyPath} -p "Please activate the 'review-pr' skill and use it to conduct a behavioral review of PR #${prNumber}."` }
+  ]);
+
+  return runner.run();
+}

extensions/workspaces/scripts/providers/BaseProvider.ts

@@ -0,0 +1,89 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * WorkerProvider interface defines the contract for different remote
+ * execution environments (GCE, Workstations, etc.).
+ */
+export interface WorkerProvider {
+  /**
+   * Provisions the underlying infrastructure.
+   */
+  provision(): Promise<number>;
+
+  /**
+   * Ensures the workspace is running and accessible.
+   */
+  ensureReady(): Promise<number>;
+
+  /**
+   * Performs the initial setup of the workspace (SSH, scripts, auth).
+   */
+  setup(options: SetupOptions): Promise<number>;
+
+  /**
+   * Returns the raw command string that would be used to execute a command.
+   */
+  getRunCommand(command: string, options?: ExecOptions): string;
+
+  /**
+   * Executes a command on the workspace.
+   */
+  exec(command: string, options?: ExecOptions): Promise<number>;
+
+  /**
+   * Executes a command on the workspace and returns the output.
+   */
+  getExecOutput(
+    command: string,
+    options?: ExecOptions,
+  ): Promise<{ status: number; stdout: string; stderr: string }>;
+
+  /**
+   * Synchronizes local files to the workspace.
+   */
+  sync(
+    localPath: string,
+    remotePath: string,
+    options?: SyncOptions,
+  ): Promise<number>;
+
+  /**
+   * Returns the status of the workspace.
+   */
+  getStatus(): Promise<WorkspaceStatus>;
+
+  /**
+   * Stops the workspace to save costs.
+   */
+  stop(): Promise<number>;
+}
+
+export interface SetupOptions {
+  projectId: string;
+  zone: string;
+  dnsSuffix?: string;
+  syncAuth?: boolean;
+}
+
+export interface ExecOptions {
+  interactive?: boolean;
+  cwd?: string;
+  wrapContainer?: string;
+}
+
+export interface SyncOptions {
+  delete?: boolean;
+  exclude?: string[];
+  sudo?: boolean;
+}
+
+export interface WorkspaceStatus {
+  name: string;
+  status: string;
+  internalIp?: string;
+  externalIp?: string;
+}

extensions/workspaces/scripts/providers/GceConnectionManager.ts

@@ -0,0 +1,83 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { spawnSync } from 'child_process';
+import os from 'os';
+
+/**
+ * Centralized SSH/RSYNC management for GCE Workers.
+ * Handles Magic Hostname routing with Zero-Knowledge security.
+ * STRICTLY uses Direct Internal connection (Corporate Magic).
+ */
+export class GceConnectionManager {
+  private projectId: string;
+  private zone: string;
+  private instanceName: string;
+
+  constructor(projectId: string, zone: string, instanceName: string) {
+    this.projectId = projectId;
+    this.zone = zone;
+    this.instanceName = instanceName;
+  }
+
+  getMagicRemote(): string {
+    const user = `${process.env.USER || 'node'}_google_com`;
+    const dnsSuffix = '.internal.gcpnode.com';
+    return `${user}@nic0.${this.instanceName}.${this.zone}.c.${this.projectId}${dnsSuffix}`;
+  }
+
+  getCommonArgs(): string[] {
+    return [
+      '-o', 'StrictHostKeyChecking=no',
+      '-o', 'UserKnownHostsFile=/dev/null',
+      '-o', 'LogLevel=ERROR',
+      '-o', 'ConnectTimeout=60',
+      '-o', 'ServerAliveInterval=30',
+      '-o', 'ServerAliveCountMax=3',
+      '-o', 'SendEnv=USER',
+      '-i', `${os.homedir()}/.ssh/google_compute_engine`
+    ];
+  }
+
+  getRunCommand(command: string, options: { interactive?: boolean } = {}): string {
+    const fullRemote = this.getMagicRemote();
+    return `ssh ${this.getCommonArgs().join(' ')} ${options.interactive ? '-t' : ''} ${fullRemote} ${this.quote(command)}`;
+  }
+
+  run(command: string, options: { interactive?: boolean; stdio?: 'pipe' | 'inherit' } = {}): { status: number; stdout: string; stderr: string } {
+    const sshCmd = this.getRunCommand(command, options);
+    const res = spawnSync(sshCmd, { stdio: options.stdio || 'pipe', shell: true });
+    return { 
+      status: res.status ?? 1, 
+      stdout: res.stdout?.toString() || '', 
+      stderr: res.stderr?.toString() || '' 
+    };
+  }
+
+  sync(localPath: string, remotePath: string, options: { delete?: boolean; exclude?: string[]; sudo?: boolean } = {}): number {
+    const fullRemote = this.getMagicRemote();
+    // We use --no-t and --no-perms to avoid "Operation not permitted" errors 
+    // when syncing to volumes that might have UID mismatches with the container.
+    const rsyncArgs = ['-rvz', '--quiet', '--no-t', '--no-perms', '--no-owner', '--no-group'];
+    if (options.delete) rsyncArgs.push('--delete');
+    if (options.exclude) options.exclude.forEach(ex => rsyncArgs.push(`--exclude="${ex}"`));
+    
+    // Use sudo on the remote side if requested to bypass permission errors
+    if (options.sudo) {
+        rsyncArgs.push('--rsync-path="sudo rsync"');
+    }
+
+    const sshCmd = `ssh ${this.getCommonArgs().join(' ')}`;
+    const directRsync = `rsync ${rsyncArgs.join(' ')} -e ${this.quote(sshCmd)} ${localPath} ${fullRemote}:${remotePath}`;
+    
+    const res = spawnSync(directRsync, { stdio: 'inherit', shell: true });
+    return res.status ?? 1;
+  }
+
+  private quote(str: string) {
+    return `'${str.replace(/'/g, "'\\''")}'`;
+  }
+}

extensions/workspaces/scripts/providers/GceCosProvider.ts

@@ -0,0 +1,490 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import fs from 'node:fs';
+import os from 'node:os';
+import {
+  type WorkerProvider,
+  type SetupOptions,
+  type ExecOptions,
+  type SyncOptions,
+  type WorkspaceStatus,
+} from './BaseProvider.ts';
+import { GceConnectionManager } from './GceConnectionManager.ts';
+
+export class GceCosProvider implements WorkerProvider {
+  private projectId: string;
+  private zone: string;
+  private instanceName: string;
+  private sshConfigPath: string;
+  private knownHostsPath: string;
+  private sshAlias = 'gcli-worker';
+  private conn: GceConnectionManager;
+
+  constructor(
+    projectId: string,
+    zone: string,
+    instanceName: string,
+    repoRoot: string,
+  ) {
+    this.projectId = projectId;
+    this.zone = zone;
+    this.instanceName = instanceName;
+    const workspacesDir = path.join(repoRoot, '.gemini/workspaces');
+    if (!fs.existsSync(workspacesDir))
+      fs.mkdirSync(workspacesDir, { recursive: true });
+    this.sshConfigPath = path.join(workspacesDir, 'ssh_config');
+    this.knownHostsPath = path.join(workspacesDir, 'known_hosts');
+    this.conn = new GceConnectionManager(projectId, zone, instanceName);
+  }
+
+  async provision(): Promise<number> {
+    const imageUri =
+      'us-docker.pkg.dev/gemini-code-dev/gemini-cli/maintainer:latest';
+    const region = this.zone.split('-').slice(0, 2).join('-');
+    const vpcName = 'iap-vpc';
+    const subnetName = 'iap-subnet';
+
+    console.log(
+      `🏗️  Ensuring "Magic" Network Infrastructure in ${this.projectId}...`,
+    );
+
+    const vpcCheck = spawnSync(
+      'gcloud',
+      ['compute', 'networks', 'describe', vpcName, '--project', this.projectId],
+      { stdio: 'pipe' },
+    );
+    if (vpcCheck.status !== 0) {
+      spawnSync(
+        'gcloud',
+        [
+          'compute',
+          'networks',
+          'create',
+          vpcName,
+          '--project',
+          this.projectId,
+          '--subnet-mode=custom',
+        ],
+        { stdio: 'inherit' },
+      );
+    }
+
+    const subnetCheck = spawnSync(
+      'gcloud',
+      [
+        'compute',
+        'networks',
+        'subnets',
+        'describe',
+        subnetName,
+        '--project',
+        this.projectId,
+        '--region',
+        region,
+      ],
+      { stdio: 'pipe' },
+    );
+    if (subnetCheck.status !== 0) {
+      spawnSync(
+        'gcloud',
+        [
+          'compute',
+          'networks',
+          'subnets',
+          'create',
+          subnetName,
+          '--project',
+          this.projectId,
+          '--network',
+          vpcName,
+          '--region',
+          region,
+          '--range=10.0.0.0/24',
+          '--enable-private-ip-google-access',
+        ],
+        { stdio: 'inherit' },
+      );
+    } else {
+      spawnSync(
+        'gcloud',
+        [
+          'compute',
+          'networks',
+          'subnets',
+          'update',
+          subnetName,
+          '--project',
+          this.projectId,
+          '--region',
+          region,
+          '--enable-private-ip-google-access',
+        ],
+        { stdio: 'pipe' },
+      );
+    }
+
+    const fwCheck = spawnSync(
+      'gcloud',
+      [
+        'compute',
+        'firewall-rules',
+        'describe',
+        'allow-corporate-ssh',
+        '--project',
+        this.projectId,
+      ],
+      { stdio: 'pipe' },
+    );
+    if (fwCheck.status !== 0) {
+      spawnSync(
+        'gcloud',
+        [
+          'compute',
+          'firewall-rules',
+          'create',
+          'allow-corporate-ssh',
+          '--project',
+          this.projectId,
+          '--network',
+          vpcName,
+          '--allow=tcp:22',
+          '--source-ranges=0.0.0.0/0',
+        ],
+        { stdio: 'inherit' },
+      );
+    }
+
+    console.log(
+      `🚀 Provisioning GCE COS worker: ${this.instanceName} (Unified Workspace Setup)...`,
+    );
+
+    const startupScriptContent = `#!/bin/bash
+      set -e
+      echo "🚀 Initializing Unified Workspace..."
+
+      # 1. Mount Data Disk
+      mkdir -p /mnt/disks/data
+      if ! mountpoint -q /mnt/disks/data; then
+        DATA_DISK="/dev/disk/by-id/google-data"
+        [ -e "$DATA_DISK" ] || DATA_DISK="/dev/sdb"
+        
+        while [ ! -e "$DATA_DISK" ]; do echo "Waiting for data disk..."; sleep 1; done
+        blkid "$DATA_DISK" || mkfs.ext4 -m 0 -F "$DATA_DISK"
+        mount -o discard,defaults "$DATA_DISK" /mnt/disks/data
+      fi
+
+      # 2. Prepare Stateful Directories (on the persistent disk)
+      mkdir -p /mnt/disks/data/main /mnt/disks/data/worktrees /mnt/disks/data/scripts /mnt/disks/data/config /mnt/disks/data/policies
+      chmod -R 777 /mnt/disks/data
+      
+      # 3. Handle Unified Path Symlink (/home/node/.workspaces)
+      # This ensures absolute paths match perfectly between host and container.
+      mkdir -p /home/node
+      ln -sfn /mnt/disks/data /home/node/.workspaces
+      chown -R 1000:1000 /home/node
+      
+      # Also ensure host users can find it
+      ln -sfn /mnt/disks/data /workspaces
+      chmod 777 /workspaces
+      for h in /home/*_google_com; do
+        [ -d "$h" ] || continue
+        ln -sfn /mnt/disks/data "$h/.workspaces"
+        chown -h $(basename $h):$(basename $h) "$h/.workspaces"
+      done
+
+      # 4. Container Resilience Loop
+      until docker info >/dev/null 2>&1; do echo "Waiting for docker..."; sleep 2; done
+
+      for i in {1..5}; do
+        docker pull ${imageUri} && break || (echo "Pull failed, retry $i..." && sleep 5)
+      done
+
+      if ! docker ps -a | grep -q "maintainer-worker"; then
+        docker run -d --name maintainer-worker --restart always \\
+          -v /mnt/disks/data:/home/node/.workspaces:rw \\
+          -v /mnt/disks/data/gemini-cli-config/.gemini:/home/node/.gemini:rw \\
+          -v ~/.config/gh:/home/node/.config/gh:rw \\
+          ${imageUri} /bin/bash -c "while true; do sleep 1000; done"
+      fi
+      echo "✅ Unified Workspace is active."
+    `;
+
+    const tmpScriptPath = path.join(
+      os.tmpdir(),
+      `gcli-startup-${Date.now()}.sh`,
+    );
+    fs.writeFileSync(tmpScriptPath, startupScriptContent);
+
+    const result = spawnSync(
+      'gcloud',
+      [
+        'compute',
+        'instances',
+        'create',
+        this.instanceName,
+        '--project',
+        this.projectId,
+        '--zone',
+        this.zone,
+        '--machine-type',
+        'n2-standard-8',
+        '--image-family',
+        'cos-stable',
+        '--image-project',
+        'cos-cloud',
+        '--boot-disk-size',
+        '10GB',
+        '--boot-disk-type',
+        'pd-balanced',
+        '--create-disk',
+        `name=${this.instanceName}-data,size=200,type=pd-balanced,device-name=data,auto-delete=yes`,
+        '--metadata-from-file',
+        `startup-script=${tmpScriptPath}`,
+        '--metadata',
+        'enable-oslogin=TRUE',
+        '--network-interface',
+        `network=${vpcName},subnet=${subnetName},no-address`,
+        '--scopes',
+        'https://www.googleapis.com/auth/cloud-platform',
+        '--quiet',
+      ],
+      { stdio: 'inherit' },
+    );
+
+    fs.unlinkSync(tmpScriptPath);
+
+    if (result.status === 0) {
+      console.log(
+        '⏳ Waiting for OS Login and SSH to initialize (this takes ~45s)...',
+      );
+      await new Promise((r) => setTimeout(r, 45000));
+    }
+
+    return result.status ?? 1;
+  }
+
+  async ensureReady(): Promise<number> {
+    const status = await this.getStatus();
+    if (status.status !== 'RUNNING') {
+      console.log(
+        `⚠️ Worker ${this.instanceName} is ${status.status}. Waking it up...`,
+      );
+      const res = spawnSync(
+        'gcloud',
+        [
+          'compute',
+          'instances',
+          'start',
+          this.instanceName,
+          '--project',
+          this.projectId,
+          '--zone',
+          this.zone,
+        ],
+        { stdio: 'inherit' },
+      );
+      if (res.status !== 0) return res.status ?? 1;
+
+      console.log('⏳ Waiting for boot...');
+      await new Promise((r) => setTimeout(r, 20000));
+    }
+
+    // NEW: Verify the container is actually running AND up to date
+    console.log('   - Verifying remote container health and image version...');
+    const containerCheck = await this.getExecOutput(
+      'sudo docker ps -q --filter "name=maintainer-worker"',
+    );
+
+    let needsUpdate = false;
+    if (containerCheck.status === 0 && containerCheck.stdout.trim()) {
+      // Check if the volume mounts are correct by checking for files inside .workspaces/main
+      const mountCheck = await this.getExecOutput(
+        'sudo docker exec maintainer-worker ls -A /home/node/.workspaces/main',
+      );
+      if (mountCheck.status !== 0 || !mountCheck.stdout.trim()) {
+        console.log(
+          '   ⚠️ Remote container has incorrect or empty mounts. Triggering refresh...',
+        );
+        needsUpdate = true;
+      } else {
+        // Check if the running image is stale
+        const tmuxCheck = await this.getExecOutput(
+          'sudo docker exec maintainer-worker which tmux',
+        );
+        if (tmuxCheck.status !== 0) {
+          console.log(
+            '   ⚠️ Remote container is stale (missing tmux). Triggering update...',
+          );
+          needsUpdate = true;
+        }
+      }
+    } else {
+      needsUpdate = true;
+    }
+
+    if (needsUpdate) {
+      console.log('   ⚠️ Container missing or stale. Attempting refresh...');
+      const imageUri =
+        'us-docker.pkg.dev/gemini-code-dev/gemini-cli/maintainer:latest';
+      // Ensure data mount is available before running
+      const recoverCmd = `
+          (mountpoint -q /mnt/disks/data || sudo mount /dev/disk/by-id/google-data /mnt/disks/data) && \
+          sudo docker pull ${imageUri} && \
+          (sudo docker rm -f maintainer-worker || true) && \
+          sudo docker run -d --name maintainer-worker --restart always \
+            -v /mnt/disks/data:/home/node/.workspaces:rw \
+            -v /mnt/disks/data/gemini-cli-config/.gemini:/home/node/.gemini:rw \
+            -v ~/.config/gh:/home/node/.config/gh:rw \
+            ${imageUri} /bin/bash -c "while true; do sleep 1000; done"
+        `;
+      const recoverRes = await this.exec(recoverCmd);
+      if (recoverRes !== 0) {
+        console.error(
+          '   ❌ Critical: Failed to refresh maintainer container.',
+        );
+        return 1;
+      }
+      console.log('   ✅ Container refreshed.');
+    }
+
+    return 0;
+  }
+
+  async setup(options: SetupOptions): Promise<number> {
+    const dnsSuffix = options.dnsSuffix || '.internal.gcpnode.com';
+    const internalHostname = `nic0.${this.instanceName}.${this.zone}.c.${this.projectId}${dnsSuffix.startsWith('.') ? dnsSuffix : '.' + dnsSuffix}`;
+    const user = `${process.env.USER || 'node'}_google_com`;
+
+    const sshEntry = `
+Host ${this.sshAlias}
+    HostName ${internalHostname}
+    IdentityFile ~/.ssh/google_compute_engine
+    User ${user}
+    UserKnownHostsFile /dev/null
+    CheckHostIP no
+    StrictHostKeyChecking no
+    ConnectTimeout 60
+    ServerAliveInterval 30
+`;
+
+    fs.writeFileSync(this.sshConfigPath, sshEntry);
+    console.log(`   ✅ Created project SSH config: ${this.sshConfigPath}`);
+
+    console.log(
+      '   - Verifying direct connection (may trigger corporate SSO prompt)...',
+    );
+    const res = this.conn.run('echo 1');
+    if (res.status !== 0) {
+      console.error(
+        '\n❌ All connection attempts failed. Please ensure you have "gcert" and IAP permissions.',
+      );
+      return 1;
+    }
+    console.log(
+      '   ✅ Connection verified. Waiting 10s for remote disk initialization...',
+    );
+    await new Promise((r) => setTimeout(r, 10000));
+    return 0;
+  }
+
+  getRunCommand(command: string, options: ExecOptions = {}): string {
+    let finalCmd = command;
+    if (options.wrapContainer) {
+      finalCmd = `sudo docker exec ${options.interactive ? '-it' : ''} ${options.cwd ? `-w ${options.cwd}` : ''} ${options.wrapContainer} sh -c ${this.quote(command)}`;
+    }
+    return this.conn.getRunCommand(finalCmd, {
+      interactive: options.interactive,
+    });
+  }
+
+  async exec(command: string, options: ExecOptions = {}): Promise<number> {
+    const res = await this.getExecOutput(command, options);
+    return res.status;
+  }
+
+  async getExecOutput(
+    command: string,
+    options: ExecOptions = {},
+  ): Promise<{ status: number; stdout: string; stderr: string }> {
+    let finalCmd = command;
+    if (options.wrapContainer) {
+      finalCmd = `sudo docker exec ${options.interactive ? '-it' : ''} ${options.cwd ? `-w ${options.cwd}` : ''} ${options.wrapContainer} sh -c ${this.quote(command)}`;
+    }
+
+    return this.conn.run(finalCmd, {
+      interactive: options.interactive,
+      stdio: options.interactive ? 'inherit' : 'pipe',
+    });
+  }
+
+  async sync(
+    localPath: string,
+    remotePath: string,
+    options: SyncOptions = {},
+  ): Promise<number> {
+    console.log(`📦 Syncing ${localPath} to remote:${remotePath}...`);
+    return this.conn.sync(localPath, remotePath, options);
+  }
+
+  async getStatus(): Promise<WorkspaceStatus> {
+    const res = spawnSync(
+      'gcloud',
+      [
+        'compute',
+        'instances',
+        'describe',
+        this.instanceName,
+        '--project',
+        this.projectId,
+        '--zone',
+        this.zone,
+        '--format',
+        'json(name,status,networkInterfaces[0].networkIP)',
+      ],
+      { stdio: 'pipe' },
+    );
+
+    if (res.status !== 0) {
+      return { name: this.instanceName, status: 'UNKNOWN' };
+    }
+
+    try {
+      const data = JSON.parse(res.stdout.toString());
+      return {
+        name: data.name,
+        status: data.status,
+        internalIp: data.networkInterfaces?.[0]?.networkIP,
+      };
+    } catch {
+      return { name: this.instanceName, status: 'UNKNOWN' };
+    }
+  }
+
+  async stop(): Promise<number> {
+    const res = spawnSync(
+      'gcloud',
+      [
+        'compute',
+        'instances',
+        'stop',
+        this.instanceName,
+        '--project',
+        this.projectId,
+        '--zone',
+        this.zone,
+      ],
+      { stdio: 'inherit' },
+    );
+    return res.status ?? 1;
+  }
+
+  private quote(str: string) {
+    return `'${str.replace(/'/g, "'\\''")}'`;
+  }
+}

extensions/workspaces/scripts/providers/ProviderFactory.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { GceCosProvider } from './GceCosProvider.ts';
+import type { WorkerProvider } from './BaseProvider.ts';
+
+
+
+
+const REPO_ROOT = process.cwd();
+
+export class ProviderFactory {
+  static getProvider(config: {
+    projectId: string;
+    zone: string;
+    instanceName: string;
+  }): WorkerProvider {
+    // Currently we only have GceCosProvider, but this is where we'd branch
+    return new GceCosProvider(
+      config.projectId,
+      config.zone,
+      config.instanceName,
+      REPO_ROOT,
+    );
+  }
+}

extensions/workspaces/scripts/provision-worker.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+set -e
+
+# Ensure we have a valid environment for non-interactive startup
+export USER=${USER:-ubuntu}
+export HOME=/home/$USER
+export DEBIAN_FRONTEND=noninteractive
+
+echo "🛠️ Provisioning High-Performance Gemini CLI Maintainer Worker..."
+
+# Wait for apt lock
+wait_for_apt() {
+  while sudo fuser /var/lib/dpkg/lock-frontend /var/lib/apt/lists/lock >/dev/null 2>&1 ; do
+    sleep 2
+  done
+}
+
+wait_for_apt
+
+# 1. System Essentials (Inc. libraries for native node modules)
+apt-get update && apt-get install -y \
+    curl git git-lfs tmux build-essential unzip jq gnupg cron \
+    libsecret-1-dev libkrb5-dev
+
+# 2. GitHub CLI
+if ! command -v gh &> /dev/null; then
+    curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
+    chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null
+    wait_for_apt
+    apt-get update && apt-get install gh -y
+fi
+
+# 3. Direct Node.js 20 Installation (NodeSource)
+if ! command -v node &> /dev/null; then
+    echo "Installing Node.js 20..."
+    curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+    wait_for_apt
+    apt-get install -y nodejs
+fi
+
+# 4. Global Maintenance Tooling
+echo "Installing global developer tools..."
+npm install -g tsx vitest @google/gemini-cli@nightly
+
+# 5. Pre-warm Repository (Main Hub)
+# We clone and build the main repo in the image so that new worktrees start with a warm cache
+REMOTE_WORK_DIR="$HOME/dev/main"
+mkdir -p "$HOME/dev"
+if [ ! -d "$REMOTE_WORK_DIR" ]; then
+    echo "Pre-cloning and building repository..."
+    git clone --filter=blob:none https://github.com/google-gemini/gemini-cli.git "$REMOTE_WORK_DIR"
+    cd "$REMOTE_WORK_DIR"
+    npm install --no-audit --no-fund
+    npm run build
+fi
+
+chown -R $USER:$USER $HOME/dev
+echo "✅ Provisioning Complete!"

extensions/workspaces/scripts/setup.ts

@@ -0,0 +1,383 @@
+import { spawnSync } from 'child_process';
+import path from 'path';
+import fs from 'fs';
+import os from 'os';
+
+import readline from 'readline';
+import { ProviderFactory } from './providers/ProviderFactory.ts';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = process.cwd();
+
+/**
+ * Loads and parses a local .env file from the repository root and the home directory.
+ */
+function loadDotEnv() {
+  const envPaths = [
+    path.join(REPO_ROOT, '.env'),
+    path.join(os.homedir(), '.env')
+  ];
+
+  envPaths.forEach(envPath => {
+    if (fs.existsSync(envPath)) {
+      const content = fs.readFileSync(envPath, 'utf8');
+      content.split('\n').forEach(line => {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) return;
+        
+        const match = trimmed.match(/^([^=]+)=(.*)$/);
+        if (match) {
+          const key = match[1].trim();
+          const val = match[2].trim().replace(/^["'](.*)["']$/, '$1');
+          if (!process.env[key]) process.env[key] = val;
+        }
+      });
+    }
+  });
+}
+
+async function prompt(question: string, defaultValue: string, explanation?: string, sensitive: boolean = false): Promise<string> {
+  const autoAccept = process.argv.includes('--yes') || process.argv.includes('-y');
+  if (autoAccept && defaultValue) return defaultValue;
+
+  if (explanation) {
+      console.log(`\n📖 ${explanation}`);
+  }
+
+  const displayDefault = sensitive && defaultValue ? `${defaultValue.substring(0, 4)}...${defaultValue.substring(defaultValue.length - 4)}` : defaultValue;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  
+  const promptMsg = defaultValue 
+    ? `❓ ${question} [Detected: ${displayDefault}] (Press <Enter> to keep, or type new value): `
+    : `❓ ${question} (<Enter> for none): `;
+
+  return new Promise((resolve) => {
+    rl.question(promptMsg, (answer) => {
+      rl.close();
+      resolve(answer.trim() || defaultValue);
+    });
+  });
+}
+
+async function confirm(question: string): Promise<boolean> {
+  const autoAccept = process.argv.includes('--yes') || process.argv.includes('-y');
+  if (autoAccept) return true;
+
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question(`❓ ${question} (y/n): `, (answer) => {
+      rl.close();
+      resolve(answer.trim().toLowerCase() === 'y');
+    });
+  });
+}
+
+async function createFork(upstream: string): Promise<string> {
+    console.log(`   - Creating fork for ${upstream}...`);
+    const forkRes = spawnSync('gh', ['repo', 'fork', upstream, '--clone=false'], { stdio: 'inherit' });
+    if (forkRes.status === 0) {
+        const userRes = spawnSync('gh', ['api', 'user', '-q', '.login'], { stdio: 'pipe' });
+        const user = userRes.stdout.toString().trim();
+        return `${user}/${upstream.split('/')[1]}`;
+    }
+    return upstream;
+}
+
+export async function runSetup(env: NodeJS.ProcessEnv = process.env) {
+  loadDotEnv();
+  
+  console.log(`
+================================================================================
+🚀 GEMINI WORKSPACES: HIGH-PERFORMANCE REMOTE DEVELOPMENT
+================================================================================
+Workspaces allow you to delegate heavy tasks (PR reviews, agentic fixes,
+and full builds) to a dedicated, high-performance GCP worker.
+================================================================================
+  `);
+
+  console.log('📝 PHASE 1: CONFIGURATION');
+  console.log('--------------------------------------------------------------------------------');
+
+  const settingsPath = path.join(REPO_ROOT, '.gemini/workspaces/settings.json');
+  let settings: any = {};
+  let skipConfig = false;
+
+  if (fs.existsSync(settingsPath)) {
+      try {
+          settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+          if (settings.workspace && !process.argv.includes('--reconfigure')) {
+              console.log('   ✅ Existing configuration found.');
+              const shouldSkip = await confirm('Use existing configuration and skip to execution?');
+              if (shouldSkip) {
+                  skipConfig = true;
+              }
+          }
+      } catch (e) {}
+  }
+
+  // 1. Project Identity
+  let projectId = settings.workspace?.projectId || '';
+  let zone = settings.workspace?.zone || 'us-west1-a';
+  let terminalTarget = settings.workspace?.terminalTarget || 'tab';
+  let upstreamRepo = settings.workspace?.upstreamRepo || 'google-gemini/gemini-cli';
+  let userFork = settings.workspace?.userFork || upstreamRepo;
+
+  if (!skipConfig) {
+      const defaultProject = env.GOOGLE_CLOUD_PROJECT || env.WORKSPACE_PROJECT || projectId || '';
+      projectId = await prompt('GCP Project ID', defaultProject, 
+        'The GCP Project where your workspace worker will live. Your personal project is recommended.');
+      
+      if (!projectId) {
+          console.error('❌ Project ID is required. Set GOOGLE_CLOUD_PROJECT or enter it manually.');
+          return 1;
+      }
+
+      zone = await prompt('Compute Zone', env.WORKSPACE_ZONE || zone, 
+        'The physical location of your worker. us-west1-a is the team default.');
+
+      terminalTarget = await prompt('Terminal UI Target (foreground, background, tab, window)', env.WORKSPACE_TERM_TARGET || terminalTarget,
+        'When you start a job in gemini-cli, should it run as a foreground shell, background shell (no attach), new iterm2 tab, or new iterm2 window?');
+
+      // 2. Repository Discovery (Dynamic)
+      console.log('\n🔍 Detecting repository origins...');
+      
+      const repoInfoRes = spawnSync('gh', ['repo', 'view', '--json', 'nameWithOwner,parent,isFork'], { stdio: 'pipe' });
+
+      if (repoInfoRes.status === 0) {
+          try {
+              const repoInfo = JSON.parse(repoInfoRes.stdout.toString());
+              upstreamRepo = repoInfo.isFork && repoInfo.parent ? repoInfo.parent.nameWithOwner : repoInfo.nameWithOwner;
+              
+              console.log(`   - Upstream identified: ${upstreamRepo}`);
+              console.log(`   - Searching for your forks of ${upstreamRepo}...`);
+              
+              const upstreamOwner = upstreamRepo.split('/')[0];
+              const upstreamName = upstreamRepo.split('/')[1];
+
+              const gqlQuery = `query { viewer { repositories(first: 100, isFork: true, affiliations: OWNER) { nodes { nameWithOwner parent { nameWithOwner } } } } }`;
+              const forksRes = spawnSync('gh', ['api', 'graphql', '-f', `query=${gqlQuery}`, '--jq', `.data.viewer.repositories.nodes[] | select(.parent.nameWithOwner == "${upstreamRepo}") | .nameWithOwner`], { stdio: 'pipe' });
+              const myForks = forksRes.stdout.toString().trim().split('\n').filter(Boolean);
+
+              if (myForks.length > 0) {
+                  console.log('\n🍴 Found existing forks:');
+                  myForks.forEach((name: string, i: number) => console.log(`   [${i + 1}] ${name}`));
+                  console.log(`   [c] Create a new fork`);
+                  console.log(`   [u] Use upstream directly (not recommended)`);
+
+                  const choice = await prompt('Select an option', '1');
+                  if (choice.toLowerCase() === 'c') {
+                      userFork = await createFork(upstreamRepo);
+                  } else if (choice.toLowerCase() === 'u') {
+                      userFork = upstreamRepo;
+                  } else {
+                      const idx = parseInt(choice) - 1;
+                      userFork = myForks[idx] || myForks[0];
+                  }
+              } else {
+                  const shouldFork = await confirm('No fork detected. Create a personal fork for sandboxed implementations?');
+                  userFork = shouldFork ? await createFork(upstreamRepo) : upstreamRepo;
+              }
+          } catch (e) {
+              userFork = upstreamRepo;
+          }
+      }
+      
+      console.log(`   ✅ Upstream:    ${upstreamRepo}`);
+      console.log(`   ✅ Workspace:   ${userFork}`);
+  }
+
+  // 3. Security & Auth (Always check for token if init is needed)
+  let githubToken = env.WORKSPACE_GH_TOKEN || '';
+  if (!skipConfig) {
+      if (!githubToken) {
+          const hasToken = await confirm('\nDo you already have a GitHub Personal Access Token (PAT) with "Read/Write" access to contents & PRs?');
+          if (hasToken) {
+              githubToken = await prompt('Paste Scoped Token', '');
+          } else {
+              const shouldGenToken = await confirm('Would you like to generate a new scoped token now? (Highly Recommended)');
+              if (shouldGenToken) {
+                  const baseUrl = 'https://github.com/settings/personal-access-tokens/new';
+                  const name = `Workspace-${env.USER}`;
+                  const repoParams = userFork !== upstreamRepo 
+                      ? `&repositories[]=${encodeURIComponent(upstreamRepo)}&repositories[]=${encodeURIComponent(userFork)}`
+                      : `&repositories[]=${encodeURIComponent(upstreamRepo)}`;
+
+                  const magicLink = `${baseUrl}?name=${encodeURIComponent(name)}&description=Gemini+Workspaces+Worker${repoParams}&contents=write&pull_requests=write&metadata=read`;
+                  const terminalLink = `\u001b]8;;${magicLink}\u0007${magicLink}\u001b]8;;\u0007`;
+
+                  console.log(`\n🔐 ACTION REQUIRED: Create a token with the required permissions:`);
+                  console.log(`\n${terminalLink}\n`);
+                  
+                  githubToken = await prompt('Paste Scoped Token', '');
+              }
+          }
+      } else {
+          githubToken = await prompt('GitHub Token', githubToken, 'A GitHub PAT is required for remote repository access and PR operations.', true);
+      }
+  }
+
+  // 4. Gemini API Auth Strategy
+  console.log('\n🔐 Detecting Gemini Authentication strategy...');
+  const localSettingsPath = path.join(env.HOME || '', '.gemini/settings.json');
+  let authStrategy = 'google_accounts';
+  let geminiApiKey = env.WORKSPACE_GEMINI_API_KEY || env.GEMINI_API_KEY || '';
+
+  if (fs.existsSync(localSettingsPath)) {
+      try {
+          const localSettings = JSON.parse(fs.readFileSync(localSettingsPath, 'utf8'));
+          authStrategy = localSettings.security?.auth?.selectedType || 'google_accounts';
+          if (!geminiApiKey && localSettings.security?.auth?.apiKey) {
+              geminiApiKey = localSettings.security.auth.apiKey;
+          }
+          console.log(`   - Local Auth Method: ${authStrategy}`);
+      } catch (e) {}
+  }
+
+  if (authStrategy === 'gemini-api-key') {
+      if (geminiApiKey) {
+          console.log('\n🔐 Found Gemini API Key in environment or settings.');
+          geminiApiKey = await prompt('Gemini API Key', geminiApiKey, 'Enter to use? Or paste a new one', true);
+      } else {
+          console.log('\n📖 In API Key mode, the remote worker needs your Gemini API Key to authenticate.');
+          geminiApiKey = await prompt('Gemini API Key', '', 'Paste your Gemini API Key', true);
+      }
+  } else {
+      console.log(`   - Using current auth strategy: ${authStrategy}`);
+  }
+
+  // 5. Save Confirmed State
+  const targetVM = `gcli-workspace-${env.USER || 'mattkorwel'}`;
+  if (!fs.existsSync(path.dirname(settingsPath))) fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
+  
+  settings = {
+      workspace: { 
+          projectId, zone, terminalTarget, 
+          userFork, upstreamRepo,
+          remoteHost: 'gcli-worker',
+          remoteWorkDir: '~/dev/main',
+          useContainer: true
+      }
+  };
+  fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2));
+  console.log(`\n✅ Configuration saved to ${settingsPath}`);
+
+  // Transition to Execution
+  const provider = ProviderFactory.getProvider({ projectId, zone, instanceName: targetVM });
+
+  console.log('\n🏗️  PHASE 2: INFRASTRUCTURE');
+  console.log('--------------------------------------------------------------------------------');
+  console.log(`   - Verifying access and finding worker ${targetVM}...`);
+  let status = await provider.getStatus();
+  
+  if (status.status === 'UNKNOWN' || status.status === 'ERROR') {
+    const shouldProvision = await confirm(`Worker ${targetVM} not found. Provision it now?`);
+    if (!shouldProvision) return 1;
+    
+    const provisionRes = await provider.provision();
+    if (provisionRes !== 0) return 1;
+    status = await provider.getStatus();
+  }
+
+  if (status.status !== 'RUNNING') {
+    console.log('   - Waking up worker...');
+    await provider.ensureReady();
+  }
+
+  console.log('\n🚀 PHASE 3: REMOTE INITIALIZATION');
+  console.log('--------------------------------------------------------------------------------');
+  const setupRes = await provider.setup({ projectId, zone, dnsSuffix: '.internal.gcpnode.com' });
+  if (setupRes !== 0) return setupRes;
+
+  // Use the unified path to ensure host and container match perfectly
+  const workspaceRoot = `/home/node/.workspaces`;
+  
+  const persistentScripts = `${workspaceRoot}/scripts`;
+  const remoteConfigDir = `${workspaceRoot}/gemini-cli-config/.gemini`;
+
+  console.log(`\n📦 Synchronizing Logic & Credentials...`);
+  // Ensure the directory structure exists on the host
+  await provider.exec(`sudo mkdir -p ${workspaceRoot}/main ${workspaceRoot}/worktrees ${workspaceRoot}/policies ${workspaceRoot}/scripts ${remoteConfigDir}`);
+  await provider.exec(`sudo chown -R 1000:1000 ${workspaceRoot}`);
+  await provider.exec(`sudo chmod -R 777 ${workspaceRoot}`);
+  
+  // 1. Sync Scripts & Policies
+  await provider.sync('extensions/workspaces/scripts/', `${persistentScripts}/`, { delete: true, sudo: true });
+  await provider.sync('policies/workspaces/workspace-policy.toml', `${workspaceRoot}/policies/workspace-policy.toml`, { sudo: true });
+
+  // 2. Initialize Remote Gemini Config with Auth
+  console.log('⚙️  Initializing remote Gemini configuration...');
+  
+  // NEW: Sync local theme and UI preferences
+  let localTheme = 'Shades Of Purple';
+  let useAlternateBuffer = true;
+  let useBackgroundColor = true;
+
+  if (fs.existsSync(localSettingsPath)) {
+      try {
+          const localSettings = JSON.parse(fs.readFileSync(localSettingsPath, 'utf8'));
+          localTheme = localSettings.ui?.theme || localTheme;
+          useAlternateBuffer = localSettings.ui?.useAlternateBuffer ?? useAlternateBuffer;
+          useBackgroundColor = localSettings.ui?.useBackgroundColor ?? useBackgroundColor;
+      } catch (e) {}
+  }
+
+  const remoteSettings: any = {
+    security: {
+      auth: {
+        selectedType: authStrategy
+      },
+      folderTrust: {
+        enabled: false
+      }
+    },
+    ui: {
+      theme: localTheme,
+      useAlternateBuffer,
+      useBackgroundColor,
+    },
+    general: {
+      enableAutoUpdate: false
+    }
+  };
+  
+  if (authStrategy === 'gemini-api-key' && geminiApiKey) {
+      remoteSettings.security.auth.apiKey = geminiApiKey;
+      console.log('   ✅ Configuring remote for API Key authentication.');
+  }
+
+  const tmpSettingsPath = path.join(os.tmpdir(), `remote-settings-${Date.now()}.json`);
+  fs.writeFileSync(tmpSettingsPath, JSON.stringify(remoteSettings, null, 2));
+  
+  // Ensure the remote config dir exists before syncing
+  await provider.exec(`sudo mkdir -p ${remoteConfigDir} && sudo chmod 777 ${remoteConfigDir}`);
+  await provider.sync(tmpSettingsPath, `${remoteConfigDir}/settings.json`, { sudo: true });
+  fs.unlinkSync(tmpSettingsPath);
+
+  // 3. Sync credentials for Google Accounts if needed
+  if (authStrategy === 'google_accounts' || authStrategy === 'oauth-personal') {
+      if (fs.existsSync(path.join(env.HOME || '', '.gemini/google_accounts.json'))) {
+        await provider.sync(path.join(env.HOME || '', '.gemini/google_accounts.json'), `${remoteConfigDir}/google_accounts.json`, { sudo: true });
+        console.log('   ✅ Synchronized Google Accounts credentials.');
+      }
+  }
+
+  if (githubToken) {
+    await provider.exec(`echo ${githubToken} | sudo tee ${workspaceRoot}/.gh_token > /dev/null && sudo chmod 600 ${workspaceRoot}/.gh_token`);
+    // Authenticate GH CLI on host
+    await provider.exec(`sudo -u $(whoami) gh auth login --with-token < ${workspaceRoot}/.gh_token`);
+    console.log('   ✅ Authenticated GitHub CLI on host.');
+  }
+
+  // Final Repo Sync
+  console.log(`🚀 Finalizing Remote Repository (${userFork})...`);
+  const repoUrl = `https://github.com/${userFork}.git`;
+  const cloneCmd = `sudo rm -rf ${workspaceRoot}/main && sudo git clone --quiet --filter=blob:none ${repoUrl} ${workspaceRoot}/main && sudo git -C ${workspaceRoot}/main remote add upstream https://github.com/${upstreamRepo}.git && sudo git -C ${workspaceRoot}/main fetch --quiet upstream && sudo chown -R 1000:1000 ${workspaceRoot}`;
+  await provider.exec(cloneCmd);
+
+  console.log('\n✨ ALL SYSTEMS GO! Your Gemini Workspace is ready.');
+  return 0;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  runSetup().catch(console.error);
+}

extensions/workspaces/scripts/status.ts

@@ -0,0 +1,72 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import path from 'node:path';
+import fs from 'node:fs';
+
+import { ProviderFactory } from './providers/ProviderFactory.ts';
+
+
+const REPO_ROOT = process.cwd();
+
+async function runStatus(env: NodeJS.ProcessEnv = process.env) {
+  const settingsPath = path.join(REPO_ROOT, '.gemini/workspaces/settings.json');
+  if (!fs.existsSync(settingsPath)) {
+    console.error('❌ Settings not found. Run "workspace setup" first.');
+    return 1;
+  }
+  const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+  const config = settings.workspace;
+  if (!config) {
+    console.error('❌ Deep Review configuration not found.');
+    return 1;
+  }
+
+  const { projectId, zone } = config;
+  const targetVM = `gcli-workspace-${env.USER || 'mattkorwel'}`;
+  const provider = ProviderFactory.getProvider({
+    projectId,
+    zone,
+    instanceName: targetVM,
+  });
+
+  console.log(`\n🛰️  Workspace Mission Control: ${targetVM}`);
+  console.log(
+    `--------------------------------------------------------------------------------`,
+  );
+
+  const status = await provider.getStatus();
+  console.log(`   - VM State:   ${status.status}`);
+  console.log(`   - Internal IP: ${status.internalIp || 'N/A'}`);
+
+  if (status.status === 'RUNNING') {
+    console.log(`\n🧵 Active Sessions (tmux):`);
+    // We fetch the list of sessions from INSIDE the container
+    const tmuxRes = await provider.getExecOutput(
+      'tmux list-sessions -F "#S" 2>/dev/null',
+      { wrapContainer: 'maintainer-worker' },
+    );
+
+    if (tmuxRes.status === 0 && tmuxRes.stdout.trim()) {
+      const sessions = tmuxRes.stdout.trim().split('\n');
+      sessions.forEach((s) => {
+        if (s.startsWith('workspace-')) {
+          console.log(`     ✅ ${s}`);
+        } else {
+          console.log(`     🔹 ${s} (Non-workspace)`);
+        }
+      });
+    } else {
+      console.log('     - No active sessions');
+    }
+  }
+
+  console.log(
+    `--------------------------------------------------------------------------------\n`,
+  );
+  return 0;
+}
+
+runStatus().catch(console.error);

extensions/workspaces/scripts/worker.ts

@@ -0,0 +1,74 @@
+/**
+ * Universal Workspace Worker (Remote)
+ * 
+ * Stateful orchestrator for complex development loops.
+ */
+import { spawnSync } from 'child_process';
+import path from 'path';
+import fs from 'fs';
+import { runReviewPlaybook } from './playbooks/review.ts';
+import { runFixPlaybook } from './playbooks/fix.ts';
+import { runReadyPlaybook } from './playbooks/ready.ts';
+
+export async function runWorker(args: string[]) {
+  const prNumberOrIssue = args[0];
+  const branchName = args[1];
+  const policyPath = args[2];
+  const action = args[3] || 'review';
+
+  if (!prNumberOrIssue || !policyPath) {
+    console.error('Usage: tsx worker.ts <ID> <BRANCH_NAME> <POLICY_PATH> [action]');
+    return 1;
+  }
+
+  const workDir = process.cwd();
+  
+  // For 'implement', the ID is an issue number and we might not have a branch yet
+  const isImplement = action === 'implement';
+  const targetDir = isImplement ? workDir : path.join(workDir, branchName);
+
+  // 1. Provision Environment
+  if (!isImplement && !fs.existsSync(targetDir)) {
+    console.log(`🌿 Provisioning PR #${prNumberOrIssue} into ${branchName}...`);
+    const cloneCmd = `git clone --filter=blob:none https://github.com/google-gemini/gemini-cli.git ${targetDir}`;
+    spawnSync(cloneCmd, { stdio: 'inherit', shell: true });
+    
+    process.chdir(targetDir);
+    spawnSync('gh', ['pr', 'checkout', prNumberOrIssue], { stdio: 'inherit' });
+  } else if (!isImplement) {
+    process.chdir(targetDir);
+  }
+
+  // Use global gemini command pre-installed in the maintainer image
+  const geminiBin = 'gemini';
+
+  // 2. Dispatch to Playbook
+  switch (action) {
+    case 'review':
+      return runReviewPlaybook(prNumberOrIssue, targetDir, policyPath, geminiBin);
+    
+    case 'fix':
+      // The 'fix' playbook now handles its own internal loop
+      return runFixPlaybook(prNumberOrIssue, targetDir, policyPath, geminiBin);
+    
+    case 'ready':
+      return runReadyPlaybook(prNumberOrIssue, targetDir, policyPath, geminiBin);
+    
+    case 'implement':
+      // Lazy-load implement playbook (to be created)
+      const { runImplementPlaybook } = await import('./playbooks/implement.ts');
+      return runImplementPlaybook(prNumberOrIssue, workDir, policyPath, geminiBin);
+      
+    case 'open':
+      console.log(`🚀 Dropping into manual session...`);
+      return 0;
+      
+    default:
+      console.error(`❌ Unknown action: ${action}`);
+      return 1;
+  }
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  runWorker(process.argv.slice(2)).catch(console.error);
+}

extensions/workspaces/skills/workspaces/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: workspaces
+description: Expertise in managing and utilizing Gemini Workspaces for high-performance remote development tasks.
+---
+
+# Gemini Workspaces Skill
+
+This skill enables the agent to utilize **Gemini Workspaces**—a high-performance, persistent remote development platform. It allows the agent to move intensive tasks (PR reviews, complex repairs, full builds) from the local environment to a dedicated cloud worker.
+
+## 🛠️ Key Capabilities
+1. **Persistent Execution**: Jobs run in remote `tmux` sessions. Disconnecting or crashing the local terminal does not stop the remote work.
+2. **Parallel Infrastructure**: The agent can launch a heavy task (like a full build or CI run) in a workspace while continuing to assist the user locally.
+3. **Behavioral Fidelity**: Remote workers have full tool access (Git, Node, Docker, etc.) and high-performance compute, allowing the agent to provide behavioral proofs of its work.
+
+## 📋 Instructions for the Agent
+
+### When to use Workspaces
+- **Intensive Tasks**: Full preflight runs, large-scale refactors, or deep PR reviews.
+- **Persistent Logic**: When a task is expected to take longer than a few minutes and needs to survive local connection drops.
+- **Environment Isolation**: When you need a clean, high-performance environment to verify a fix without polluting the user's local machine.
+
+### How to use Workspaces
+1. **Setup**: If the user hasn't initialized their environment, you MUST run the setup script using npx tsx and the absolute path. Do NOT use npm scripts.
+   ```bash
+   npx tsx ${extensionPath}/extensions/workspaces/scripts/setup.ts
+   ```
+2. **Launch**: Start a playbook for a specific PR/issue:
+   ```bash
+   npx tsx ${extensionPath}/extensions/workspaces/scripts/orchestrator.ts <PR_NUMBER> [action]
+   ```
+   - Actions: `review` (default), `fix`, `ready`.
+3. **Check Status**: See global state and active sessions:
+   ```bash
+   npx tsx ${extensionPath}/extensions/workspaces/scripts/status.ts
+   ```
+   Or deep-dive into specific PR logs:
+   ```bash
+   npx tsx ${extensionPath}/extensions/workspaces/scripts/check.ts <PR_NUMBER>
+   ```
+4. **Cleanup**: 
+   - **Bulk**: Clear all sessions/worktrees:
+     ```bash
+     npx tsx ${extensionPath}/extensions/workspaces/scripts/clean.ts --all
+     ```
+   - **Surgical**: Kill a specific PR task:
+     ```bash
+     npx tsx ${extensionPath}/extensions/workspaces/scripts/clean.ts <PR_NUMBER> <action>
+     ```
+5. **Fleet**: Manage VM lifecycle:
+   ```bash
+   npx tsx ${extensionPath}/extensions/workspaces/scripts/fleet.ts [stop|provision|list]
+   ```
+6. **Attach/Logs**: 
+   ```bash
+   npx tsx ${extensionPath}/extensions/workspaces/scripts/attach.ts <PR_NUMBER>
+   npx tsx ${extensionPath}/extensions/workspaces/scripts/logs.ts <PR_NUMBER>
+   ```
+
+## ⚠️ Important Constraints
+- **NO NPM**: Do NOT attempt to use `npm run` or `npm workspace`. Those commands are deprecated in favor of running the extension scripts directly.
+- **npx tsx**: Always use `npx tsx` followed by the absolute path provided in `${extensionPath}`.
+- **Absolute Paths**: Always use absolute paths (e.g., `/mnt/disks/data/...`) when orchestrating remote commands.

gemini-extension.json

@@ -0,0 +1,11 @@
+{
+  "name": "workspaces",
+  "version": "0.1.0",
+  "description": "High-performance remote development workspaces for Gemini CLI.",
+  "author": "Google Gemini Team",
+  "license": "Apache-2.0",
+  "skills": [
+    "extensions/workspaces/skills/workspaces/SKILL.md"
+  ],
+  "contextFileName": "extensions/workspaces/docs/GEMINI.md"
+}

packages/cli/src/config/config.ts

@@ -125,12 +125,19 @@ export async function parseArguments(
     .usage(
       'Usage: gemini [options] [command]\n\nGemini CLI - Defaults to interactive mode. Use -p/--prompt for non-interactive (headless) mode.',
     )
-    .option('debug', {
-      alias: 'd',
-      type: 'boolean',
-      description: 'Run in debug mode (open debug console with F12)',
-      default: false,
-    })
+  if (settings.experimental?.extensionManagement) {
+    yargsInstance.command(extensionsCommand);
+  }
+
+  if (settings.skills?.enabled ?? true) {
+    yargsInstance.command(skillsCommand);
+  }
+  // Register hooks command if hooks are enabled
+  if (settings.hooksConfig.enabled) {
+    yargsInstance.command(hooksCommand);
+  }
+
+  yargsInstance
     .command('$0 [query..]', 'Launch Gemini CLI', (yargsInstance) =>
       yargsInstance
         .positional('query', {
@@ -300,56 +307,6 @@ export async function parseArguments(
           description: 'Suppress the security warning when using --raw-output.',
         }),
     )
-    // Register MCP subcommands
-    .command(mcpCommand)
-    // Ensure validation flows through .fail() for clean UX
-    .fail((msg, err) => {
-      if (err) throw err;
-      throw new Error(msg);
-    })
-    .check((argv) => {
-      // The 'query' positional can be a string (for one arg) or string[] (for multiple).
-      // This guard safely checks if any positional argument was provided.
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
-      const query = argv['query'] as string | string[] | undefined;
-      const hasPositionalQuery = Array.isArray(query)
-        ? query.length > 0
-        : !!query;
-
-      if (argv['prompt'] && hasPositionalQuery) {
-        return 'Cannot use both a positional prompt and the --prompt (-p) flag together';
-      }
-      if (argv['prompt'] && argv['promptInteractive']) {
-        return 'Cannot use both --prompt (-p) and --prompt-interactive (-i) together';
-      }
-      if (argv['yolo'] && argv['approvalMode']) {
-        return 'Cannot use both --yolo (-y) and --approval-mode together. Use --approval-mode=yolo instead.';
-      }
-      if (
-        argv['outputFormat'] &&
-        !['text', 'json', 'stream-json'].includes(
-          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
-          argv['outputFormat'] as string,
-        )
-      ) {
-        return `Invalid values:\n  Argument: output-format, Given: "${argv['outputFormat']}", Choices: "text", "json", "stream-json"`;
-      }
-      return true;
-    });
-
-  if (settings.experimental?.extensionManagement) {
-    yargsInstance.command(extensionsCommand);
-  }
-
-  if (settings.skills?.enabled ?? true) {
-    yargsInstance.command(skillsCommand);
-  }
-  // Register hooks command if hooks are enabled
-  if (settings.hooksConfig.enabled) {
-    yargsInstance.command(hooksCommand);
-  }
-
-  yargsInstance
     .version(await getVersion()) // This will enable the --version flag based on package.json
     .alias('v', 'version')
     .help()

policies/workspaces/workspace-policy.toml

@@ -29,12 +29,36 @@ toolName = "codebase_investigator"
 decision = "allow"
 priority = 100
 
+# --- SKILLS ---
+[[rule]]
+toolName = "activate_skill"
+decision = "allow"
+priority = 100
+[rule.toolParameters]
+name = "review-pr"
+
+[[rule]]
+toolName = "activate_skill"
+decision = "allow"
+priority = 100
+[rule.toolParameters]
+name = "fix-pr"
+
+[[rule]]
+toolName = "activate_skill"
+decision = "allow"
+priority = 100
+[rule.toolParameters]
+name = "pr-address-comments"
+
 # --- SHELL COMMANDS ---
 
-# Git (Safe/Read-only)
+# Git (Safe/Read-only + Local State)
 [[rule]]
 toolName = "run_shell_command"
 commandPrefix = [
+  "git checkout",
+  "git merge",
   "git blame",
   "git show",
   "git grep",
@@ -59,10 +83,11 @@ commandPrefix = [
 decision = "allow"
 priority = 100
 
-# GitHub CLI (Read-only)
+# GitHub CLI (State Changing & Read-only)
 [[rule]]
 toolName = "run_shell_command"
 commandPrefix = [
+  "gh pr comment",
   "gh workflow list",
   "gh auth status",
   "gh checkout view",

scripts/tests/vitest.config.ts

@@ -10,7 +10,10 @@ export default defineConfig({
   test: {
     globals: true,
     environment: 'node',
-    include: ['scripts/tests/**/*.test.{js,ts}'],
+    include: [
+      'scripts/tests/**/*.test.{js,ts}',
+      '.gemini/skills/**/tests/*.test.ts',
+    ],
     setupFiles: ['scripts/tests/test-setup.ts'],
     coverage: {
       provider: 'v8',