fix(ui): ensure autocomplete allows immediate execution and subcommand disclosure (Team Consensus)

feat: implement high-signal PR regression check for evaluations (#23937 )
feat(core): add background memory service for skill extraction (#24274 )
2026-07-24 00:30:59 -07:00 · 2026-04-02 14:22:36 -07:00 · 2026-04-02 05:14:43 +00:00 · 2026-04-02 05:05:31 +00:00 · 2026-04-02 04:33:07 +00:00 · 2026-04-02 03:15:27 +00:00
538 changed files with 27677 additions and 8318 deletions
@@ -0,0 +1,89 @@
+# --- STAGE 1: Base Runtime ---
+FROM docker.io/library/node:20-slim AS base
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  python3 \
+  python3-pip \
+  python3-venv \
+  curl \
+  dnsutils \
+  less \
+  jq \
+  ca-certificates \
+  git \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+# --- STAGE 2: Builder (Compile Main) ---
+FROM base AS builder
+WORKDIR /build
+COPY . .
+RUN npm ci --ignore-scripts
+RUN npm run bundle
+# Run the official release preparation script to move the bundle and assets into packages/cli
+RUN node scripts/prepare-npm-release.js
+
+# --- STAGE 3: Development Environment ---
+FROM base AS development
+
+WORKDIR /home/node/dev/main
+
+# Set up npm global package folder
+RUN mkdir -p /usr/local/share/npm-global \
+  && chown -R node:node /usr/local/share/npm-global
+ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
+ENV PATH=$PATH:/usr/local/share/npm-global/bin
+
+# Copy package.json to extract versions for global tools
+COPY package.json /tmp/package.json
+
+# Install Build Tools, Global Dev Tools (pinned), and Linters
+ARG ACTIONLINT_VER=1.7.7
+ARG SHELLCHECK_VER=0.11.0
+ARG YAMLLINT_VER=1.35.1
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  make \
+  g++ \
+  gh \
+  git \
+  unzip \
+  rsync \
+  ripgrep \
+  procps \
+  psmisc \
+  lsof \
+  socat \
+  tmux \
+  docker.io \
+  build-essential \
+  libsecret-1-dev \
+  libkrb5-dev \
+  file \
+  && curl -sSLo /tmp/actionlint.tar.gz https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VER}/actionlint_${ACTIONLINT_VER}_linux_amd64.tar.gz \
+  && tar -xzf /tmp/actionlint.tar.gz -C /usr/local/bin actionlint \
+  && curl -sSLo /tmp/shellcheck.tar.xz https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VER}/shellcheck-v${SHELLCHECK_VER}.linux.x86_64.tar.xz \
+  && tar -xf /tmp/shellcheck.tar.xz -C /usr/local/bin --strip-components=1 shellcheck-v${SHELLCHECK_VER}/shellcheck \
+  && pip3 install --break-system-packages yamllint==${YAMLLINT_VER} \
+  && export TSX_VER=$(node -p "require('/tmp/package.json').devDependencies.tsx") \
+  && export VITEST_VER=$(node -p "require('/tmp/package.json').devDependencies.vitest") \
+  && export PRETTIER_VER=$(node -p "require('/tmp/package.json').devDependencies.prettier") \
+  && export ESLINT_VER=$(node -p "require('/tmp/package.json').devDependencies.eslint") \
+  && export CROSS_ENV_VER=$(node -p "require('/tmp/package.json').devDependencies['cross-env']") \
+  && npm install -g tsx@$TSX_VER vitest@$VITEST_VER prettier@$PRETTIER_VER eslint@$ESLINT_VER cross-env@$CROSS_ENV_VER typescript@5.3.3 \
+  && npm install -g @google/gemini-cli@nightly && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-nightly \
+  && npm install -g @google/gemini-cli@preview && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-preview \
+  && npm install -g @google/gemini-cli@latest  && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-stable \
+  && apt-get purge -y build-essential libsecret-1-dev libkrb5-dev \
+  && apt-get autoremove -y \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /tmp/* /root/.npm
+
+# Copy the bundled CLI package to a permanent location and install it
+# We MUST not delete this source folder as 'npm install -g <folder>' 
+# often symlinks to it for local folder installs.
+COPY --from=builder /build/packages/cli /usr/local/lib/gemini-cli
+RUN npm install -g /usr/local/lib/gemini-cli
+
+USER node
+CMD ["/bin/bash"]
@@ -0,0 +1,10 @@
+node_modules
+.git
+.gemini/workspaces
+dist
+!packages/*/dist/*.tgz
+bundle
+out
+*.log
+.env
+.DS_Store
@@ -0,0 +1,58 @@
+substitutions:
+  _IMAGE_NAME: 'development'
+  _ARTIFACT_REGISTRY_REPO: 'us-docker.pkg.dev/gemini-code-dev/gemini-cli'
+
+steps:
+  # Step 1: Install root dependencies
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Install Dependencies'
+    entrypoint: 'npm'
+    args: ['install']
+
+  # Step 2: Authenticate for Docker
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Authenticate docker'
+    entrypoint: 'npm'
+    args: ['run', 'auth']
+
+  # Step 3: Build workspace packages
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build packages'
+    entrypoint: 'npm'
+    args: ['run', 'build:packages']
+
+  # Step 4: Build Development Image
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build Development Image'
+    entrypoint: 'bash'
+    env:
+      - 'RAW_BRANCH_VALUE=${BRANCH_NAME}'
+    args:
+      - '-c'
+      - |-
+        IMAGE_BASE="${_ARTIFACT_REGISTRY_REPO}/${_IMAGE_NAME}"
+
+        # Determine the primary tag (branch name or 'latest' for main)
+        # Use $$ for shell variables to avoid Cloud Build attempting premature substitution
+        RAW_BRANCH="$$RAW_BRANCH_VALUE"
+        if [ "$${RAW_BRANCH}" == "main" ]; then
+          TAG_PRIMARY="latest"
+        else
+          TAG_PRIMARY=$$(echo "$${RAW_BRANCH}" | sed 's/[^a-zA-Z0-9]/-/g' | tr '[:upper:]' '[:lower:]')
+        fi
+
+        # Use SHORT_SHA if available (Cloud Build) or fallback to latest-dev
+        TAG_SHA="$${SHORT_SHA:-latest-dev}"
+
+        echo "📦 Building Development Image for: $${RAW_BRANCH} -> $${TAG_PRIMARY} ($${TAG_SHA})"
+
+        docker build -f .gcp/Dockerfile.development \
+          -t "$${IMAGE_BASE}:$${TAG_SHA}" \
+          -t "$${IMAGE_BASE}:$${TAG_PRIMARY}" .
+
+        docker push "$${IMAGE_BASE}:$${TAG_SHA}"
+        docker push "$${IMAGE_BASE}:$${TAG_PRIMARY}"
+
+options:
+  defaultLogsBucketBehavior: 'REGIONAL_USER_OWNED_BUCKET'
+  dynamicSubstitutions: true
@@ -1,9 +1,9 @@
 {
  "experimental": {
-    "plan": true,
    "extensionReloading": true,
    "modelSteering": true,
-    "memoryManager": true
+    "memoryManager": false,
+    "topicUpdateNarration": true
  },
  "general": {
    "devtools": true
@@ -1,190 +1,194 @@
 #!/bin/bash

 notify() {
-  local title="$1"
-  local message="$2"
-  local pr="$3"
+  local title="${1}"
+  local message="${2}"
+  local pr="${3}"
  # Terminal escape sequence
-  printf "\e]9;%s | PR #%s | %s\a" "$title" "$pr" "$message"
+  printf "\e]9;%s | PR #%s | %s\a" "${title}" "${pr}" "${message}"
  # Native macOS notification
-  if [[ "$(uname)" == "Darwin" ]]; then
-    osascript -e "display notification \"$message\" with title \"$title\" subtitle \"PR #$pr\""
+  os_type="$(uname || true)"
+  if [[ "${os_type}" == "Darwin" ]]; then
+    osascript -e "display notification \"${message}\" with title \"${title}\" subtitle \"PR #${pr}\""
  fi
 }

-pr_number=$1
-if [[ -z "$pr_number" ]]; then
+pr_number="${1}"
+if [[ -z "${pr_number}" ]]; then
  echo "Usage: async-review <pr_number>"
  exit 1
 fi

-base_dir=$(git rev-parse --show-toplevel 2>/dev/null)
-if [[ -z "$base_dir" ]]; then
+base_dir="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+if [[ -z "${base_dir}" ]]; then
  echo "❌ Must be run from within a git repository."
  exit 1
 fi

 # Use the repository's local .gemini/tmp directory for ephemeral worktrees and logs
-pr_dir="$base_dir/.gemini/tmp/async-reviews/pr-$pr_number"
-target_dir="$pr_dir/worktree"
-log_dir="$pr_dir/logs"
+pr_dir="${base_dir}/.gemini/tmp/async-reviews/pr-${pr_number}"
+target_dir="${pr_dir}/worktree"
+log_dir="${pr_dir}/logs"

-cd "$base_dir" || exit 1
+cd "${base_dir}" || exit 1

-mkdir -p "$log_dir"
-rm -f "$log_dir/setup.exit" "$log_dir/final-assessment.exit" "$log_dir/final-assessment.md"
+mkdir -p "${log_dir}"
+rm -f "${log_dir}/setup.exit" "${log_dir}/final-assessment.exit" "${log_dir}/final-assessment.md"

-echo "🧹 Cleaning up previous worktree if it exists..." | tee -a "$log_dir/setup.log"
-git worktree remove -f "$target_dir" >> "$log_dir/setup.log" 2>&1 || true
-git branch -D "gemini-async-pr-$pr_number" >> "$log_dir/setup.log" 2>&1 || true
-git worktree prune >> "$log_dir/setup.log" 2>&1 || true
+echo "🧹 Cleaning up previous worktree if it exists..." | tee -a "${log_dir}/setup.log"
+git worktree remove -f "${target_dir}" >> "${log_dir}/setup.log" 2>&1 || true
+git branch -D "gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1 || true
+git worktree prune >> "${log_dir}/setup.log" 2>&1 || true

-echo "📡 Fetching PR #$pr_number..." | tee -a "$log_dir/setup.log"
-if ! git fetch origin -f "pull/$pr_number/head:gemini-async-pr-$pr_number" >> "$log_dir/setup.log" 2>&1; then
-  echo 1 > "$log_dir/setup.exit"
-  echo "❌ Fetch failed. Check $log_dir/setup.log"
-  notify "Async Review Failed" "Fetch failed." "$pr_number"
+echo "📡 Fetching PR #${pr_number}..." | tee -a "${log_dir}/setup.log"
+if ! git fetch origin -f "pull/${pr_number}/head:gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1; then
+  echo 1 > "${log_dir}/setup.exit"
+  echo "❌ Fetch failed. Check ${log_dir}/setup.log"
+  notify "Async Review Failed" "Fetch failed." "${pr_number}"
  exit 1
 fi

-if [[ ! -d "$target_dir" ]]; then
-  echo "🧹 Pruning missing worktrees..." | tee -a "$log_dir/setup.log"
-  git worktree prune >> "$log_dir/setup.log" 2>&1
-  echo "🌿 Creating worktree in $target_dir..." | tee -a "$log_dir/setup.log"
-  if ! git worktree add "$target_dir" "gemini-async-pr-$pr_number" >> "$log_dir/setup.log" 2>&1; then
-    echo 1 > "$log_dir/setup.exit"
-    echo "❌ Worktree creation failed. Check $log_dir/setup.log"
-    notify "Async Review Failed" "Worktree creation failed." "$pr_number"
+if [[ ! -d "${target_dir}" ]]; then
+  echo "🧹 Pruning missing worktrees..." | tee -a "${log_dir}/setup.log"
+  git worktree prune >> "${log_dir}/setup.log" 2>&1
+  echo "🌿 Creating worktree in ${target_dir}..." | tee -a "${log_dir}/setup.log"
+  if ! git worktree add "${target_dir}" "gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1; then
+    echo 1 > "${log_dir}/setup.exit"
+    echo "❌ Worktree creation failed. Check ${log_dir}/setup.log"
+    notify "Async Review Failed" "Worktree creation failed." "${pr_number}"
    exit 1
  fi
 else
-  echo "🌿 Worktree already exists." | tee -a "$log_dir/setup.log"
+  echo "🌿 Worktree already exists." | tee -a "${log_dir}/setup.log"
 fi
-echo 0 > "$log_dir/setup.exit"
+echo 0 > "${log_dir}/setup.exit"

-cd "$target_dir" || exit 1
+cd "${target_dir}" || exit 1

-echo "🚀 Launching background tasks. Logs saving to: $log_dir"
+echo "🚀 Launching background tasks. Logs saving to: ${log_dir}"

 echo "  ↳ [1/5] Grabbing PR diff..."
-rm -f "$log_dir/pr-diff.exit"
-{ gh pr diff "$pr_number" > "$log_dir/pr-diff.diff" 2>&1; echo $? > "$log_dir/pr-diff.exit"; } &
+rm -f "${log_dir}/pr-diff.exit"
+{ gh pr diff "${pr_number}" > "${log_dir}/pr-diff.diff" 2>&1; echo $? > "${log_dir}/pr-diff.exit"; } &

 echo "  ↳ [2/5] Starting build and lint..."
-rm -f "$log_dir/build-and-lint.exit"
-{ { npm run clean && npm ci && npm run format && npm run build && npm run lint:ci && npm run typecheck; } > "$log_dir/build-and-lint.log" 2>&1; echo $? > "$log_dir/build-and-lint.exit"; } &
+rm -f "${log_dir}/build-and-lint.exit"
+{ { npm run clean && npm ci && npm run format && npm run build && npm run lint:ci && npm run typecheck; } > "${log_dir}/build-and-lint.log" 2>&1; echo $? > "${log_dir}/build-and-lint.exit"; } &

 # Dynamically resolve gemini binary (fallback to your nightly path)
-GEMINI_CMD=$(which gemini || echo "$HOME/.gcli/nightly/node_modules/.bin/gemini")
+GEMINI_CMD="$(command -v gemini || echo "${HOME}/.gcli/nightly/node_modules/.bin/gemini")"
+# shellcheck disable=SC2312
 POLICY_PATH="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/policy.toml"

 echo "  ↳ [3/5] Starting Gemini code review..."
-rm -f "$log_dir/review.exit"
-{ "$GEMINI_CMD" --policy "$POLICY_PATH" -p "/review-frontend $pr_number" > "$log_dir/review.md" 2>&1; echo $? > "$log_dir/review.exit"; } &
+rm -f "${log_dir}/review.exit"
+{ "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "/review-frontend ${pr_number}" > "${log_dir}/review.md" 2>&1; echo $? > "${log_dir}/review.exit"; } &

 echo "  ↳ [4/5] Starting automated tests (waiting for build and lint)..."
-rm -f "$log_dir/npm-test.exit"
+rm -f "${log_dir}/npm-test.exit"
 { 
-  while [ ! -f "$log_dir/build-and-lint.exit" ]; do sleep 1; done
-  if [ "$(cat "$log_dir/build-and-lint.exit")" == "0" ]; then
-    gh pr checks "$pr_number" > "$log_dir/ci-checks.log" 2>&1
+  while [[ ! -f "${log_dir}/build-and-lint.exit" ]]; do sleep 1; done
+  read -r build_exit < "${log_dir}/build-and-lint.exit" || build_exit=""
+  if [[ "${build_exit}" == "0" ]]; then
+    gh pr checks "${pr_number}" > "${log_dir}/ci-checks.log" 2>&1
    ci_status=$?
    
-    if [ "$ci_status" -eq 0 ]; then
-      echo "CI checks passed. Skipping local npm tests." > "$log_dir/npm-test.log"
-      echo 0 > "$log_dir/npm-test.exit"
-    elif [ "$ci_status" -eq 8 ]; then
-      echo "CI checks are still pending. Skipping local npm tests to avoid duplicate work. Please check GitHub for final results." > "$log_dir/npm-test.log"
-      echo 0 > "$log_dir/npm-test.exit"
+    if [[ "${ci_status}" -eq 0 ]]; then
+      echo "CI checks passed. Skipping local npm tests." > "${log_dir}/npm-test.log"
+      echo 0 > "${log_dir}/npm-test.exit"
+    elif [[ "${ci_status}" -eq 8 ]]; then
+      echo "CI checks are still pending. Skipping local npm tests to avoid duplicate work. Please check GitHub for final results." > "${log_dir}/npm-test.log"
+      echo 0 > "${log_dir}/npm-test.exit"
    else
-      echo "CI checks failed. Failing checks:" > "$log_dir/npm-test.log"
-      gh pr checks "$pr_number" --json name,bucket -q '.[] | select(.bucket=="fail") | .name' >> "$log_dir/npm-test.log" 2>&1
+      echo "CI checks failed. Failing checks:" > "${log_dir}/npm-test.log"
+      gh pr checks "${pr_number}" --json name,bucket -q '.[] | select(.bucket=="fail") | .name' >> "${log_dir}/npm-test.log" 2>&1
      
-      echo "Attempting to extract failing test files from CI logs..." >> "$log_dir/npm-test.log"
-      pr_branch=$(gh pr view "$pr_number" --json headRefName -q '.headRefName' 2>/dev/null)
-      run_id=$(gh run list --branch "$pr_branch" --workflow ci.yml --json databaseId -q '.[0].databaseId' 2>/dev/null)
+      echo "Attempting to extract failing test files from CI logs..." >> "${log_dir}/npm-test.log"
+      pr_branch="$(gh pr view "${pr_number}" --json headRefName -q '.headRefName' 2>/dev/null || true)"
+      run_id="$(gh run list --branch "${pr_branch}" --workflow ci.yml --json databaseId -q '.[0].databaseId' 2>/dev/null || true)"
      
      failed_files=""
-      if [[ -n "$run_id" ]]; then
-        failed_files=$(gh run view "$run_id" --log-failed 2>/dev/null | grep -o -E '(packages/[a-zA-Z0-9_-]+|integration-tests|evals)/[a-zA-Z0-9_/-]+\.test\.ts(x)?' | sort | uniq)
+      if [[ -n "${run_id}" ]]; then
+        failed_files="$(gh run view "${run_id}" --log-failed 2>/dev/null | grep -o -E '(packages/[a-zA-Z0-9_-]+|integration-tests|evals)/[a-zA-Z0-9_/-]+\.test\.ts(x)?' | sort | uniq || true)"
      fi
      
-      if [[ -n "$failed_files" ]]; then
-        echo "Found failing test files from CI:" >> "$log_dir/npm-test.log"
-        for f in $failed_files; do echo "  - $f" >> "$log_dir/npm-test.log"; done
-        echo "Running ONLY failing tests locally..." >> "$log_dir/npm-test.log"
+      if [[ -n "${failed_files}" ]]; then
+        echo "Found failing test files from CI:" >> "${log_dir}/npm-test.log"
+        for f in ${failed_files}; do echo "  - ${f}" >> "${log_dir}/npm-test.log"; done
+        echo "Running ONLY failing tests locally..." >> "${log_dir}/npm-test.log"
        
        exit_code=0
-        for file in $failed_files; do
-           if [[ "$file" == packages/* ]]; then
-             ws_dir=$(echo "$file" | cut -d'/' -f1,2)
+        for file in ${failed_files}; do
+           if [[ "${file}" == packages/* ]]; then
+             ws_dir="$(echo "${file}" | cut -d'/' -f1,2)"
           else
-             ws_dir=$(echo "$file" | cut -d'/' -f1)
+             ws_dir="$(echo "${file}" | cut -d'/' -f1)"
           fi
-           rel_file=${file#$ws_dir/}
+           rel_file="${file#"${ws_dir}"/}"
           
-           echo "--- Running $rel_file in workspace $ws_dir ---" >> "$log_dir/npm-test.log"
-           if ! npm run test:ci -w "$ws_dir" -- "$rel_file" >> "$log_dir/npm-test.log" 2>&1; then
+           echo "--- Running ${rel_file} in workspace ${ws_dir} ---" >> "${log_dir}/npm-test.log"
+           if ! npm run test:ci -w "${ws_dir}" -- "${rel_file}" >> "${log_dir}/npm-test.log" 2>&1; then
             exit_code=1
           fi
        done
-        echo $exit_code > "$log_dir/npm-test.exit"
+        echo "${exit_code}" > "${log_dir}/npm-test.exit"
      else
-        echo "Could not extract specific failing files. Skipping full local test suite as it takes too long. Please check CI logs manually." >> "$log_dir/npm-test.log"
-        echo 1 > "$log_dir/npm-test.exit"
+        echo "Could not extract specific failing files. Skipping full local test suite as it takes too long. Please check CI logs manually." >> "${log_dir}/npm-test.log"
+        echo 1 > "${log_dir}/npm-test.exit"
      fi
    fi
  else
-    echo "Skipped due to build-and-lint failure" > "$log_dir/npm-test.log"
-    echo 1 > "$log_dir/npm-test.exit"
+    echo "Skipped due to build-and-lint failure" > "${log_dir}/npm-test.log"
+    echo 1 > "${log_dir}/npm-test.exit"
  fi
 } &

 echo "  ↳ [5/5] Starting Gemini test execution (waiting for build and lint)..."
-rm -f "$log_dir/test-execution.exit"
+rm -f "${log_dir}/test-execution.exit"
 { 
-  while [ ! -f "$log_dir/build-and-lint.exit" ]; do sleep 1; done
-  if [ "$(cat "$log_dir/build-and-lint.exit")" == "0" ]; then
-    "$GEMINI_CMD" --policy "$POLICY_PATH" -p "Analyze the diff for PR $pr_number using 'gh pr diff $pr_number'. Instead of running the project's automated test suite (like 'npm test'), physically exercise the newly changed code in the terminal (e.g., by writing a temporary script to call the new functions, or testing the CLI command directly). Verify the feature's behavior works as expected. IMPORTANT: Do NOT modify any source code to fix errors. Just exercise the code and log the results, reporting any failures clearly. Do not ask for user confirmation." > "$log_dir/test-execution.log" 2>&1; echo $? > "$log_dir/test-execution.exit"
+  while [[ ! -f "${log_dir}/build-and-lint.exit" ]]; do sleep 1; done
+  read -r build_exit < "${log_dir}/build-and-lint.exit" || build_exit=""
+  if [[ "${build_exit}" == "0" ]]; then
+    "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "Analyze the diff for PR ${pr_number} using 'gh pr diff ${pr_number}'. Instead of running the project's automated test suite (like 'npm test'), physically exercise the newly changed code in the terminal (e.g., by writing a temporary script to call the new functions, or testing the CLI command directly). Verify the feature's behavior works as expected. IMPORTANT: Do NOT modify any source code to fix errors. Just exercise the code and log the results, reporting any failures clearly. Do not ask for user confirmation." > "${log_dir}/test-execution.log" 2>&1; echo $? > "${log_dir}/test-execution.exit"
  else
-    echo "Skipped due to build-and-lint failure" > "$log_dir/test-execution.log"
-    echo 1 > "$log_dir/test-execution.exit"
+    echo "Skipped due to build-and-lint failure" > "${log_dir}/test-execution.log"
+    echo 1 > "${log_dir}/test-execution.exit"
  fi
 } &

 echo "✅ All tasks dispatched!"
-echo "You can monitor progress with: tail -f $log_dir/*.log"
-echo "Read your review later at: $log_dir/review.md"
+echo "You can monitor progress with: tail -f ${log_dir}/*.log"
+echo "Read your review later at: ${log_dir}/review.md"

 # Polling loop to wait for all background tasks to finish
 tasks=("pr-diff" "build-and-lint" "review" "npm-test" "test-execution")
 log_files=("pr-diff.diff" "build-and-lint.log" "review.md" "npm-test.log" "test-execution.log")

 declare -A task_done
-for t in "${tasks[@]}"; do task_done[$t]=0; done
+for t in "${tasks[@]}"; do task_done[${t}]=0; done

 all_done=0
-while [[ $all_done -eq 0 ]]; do
+while [[ "${all_done}" -eq 0 ]]; do
  clear
  echo "=================================================="
-  echo "🚀 Async PR Review Status for PR #$pr_number"
+  echo "🚀 Async PR Review Status for PR #${pr_number}"
  echo "=================================================="
  echo ""
  
  all_done=1
  for i in "${!tasks[@]}"; do
-    t="${tasks[$i]}"
+    t="${tasks[${i}]}"
    
-    if [[ -f "$log_dir/$t.exit" ]]; then
-      exit_code=$(cat "$log_dir/$t.exit")
-      if [[ "$exit_code" == "0" ]]; then
-        echo "  ✅ $t: SUCCESS"
+    if [[ -f "${log_dir}/${t}.exit" ]]; then
+      read -r task_exit < "${log_dir}/${t}.exit" || task_exit=""
+      if [[ "${task_exit}" == "0" ]]; then
+        echo "  ✅ ${t}: SUCCESS"
      else
-        echo "  ❌ $t: FAILED (exit code $exit_code)"
+        echo "  ❌ ${t}: FAILED (exit code ${task_exit})"
      fi
-      task_done[$t]=1
+      task_done[${t}]=1
    else
-      echo "  ⏳ $t: RUNNING"
+      echo "  ⏳ ${t}: RUNNING"
      all_done=0
    fi
  done
@@ -195,47 +199,47 @@ while [[ $all_done -eq 0 ]]; do
  echo "=================================================="
  
  for i in "${!tasks[@]}"; do
-    t="${tasks[$i]}"
-    log_file="${log_files[$i]}"
+    t="${tasks[${i}]}"
+    log_file="${log_files[${i}]}"
    
-    if [[ ${task_done[$t]} -eq 0 ]]; then
-      if [[ -f "$log_dir/$log_file" ]]; then
+    if [[ "${task_done[${t}]}" -eq 0 ]]; then
+      if [[ -f "${log_dir}/${log_file}" ]]; then
        echo ""
-        echo "--- $t ---"
-        tail -n 5 "$log_dir/$log_file"
+        echo "--- ${t} ---"
+        tail -n 5 "${log_dir}/${log_file}"
      fi
    fi
  done
  
-  if [[ $all_done -eq 0 ]]; then
+  if [[ "${all_done}" -eq 0 ]]; then
    sleep 3
  fi
 done

 clear
 echo "=================================================="
-echo "🚀 Async PR Review Status for PR #$pr_number"
+echo "🚀 Async PR Review Status for PR #${pr_number}"
 echo "=================================================="
 echo ""
 for t in "${tasks[@]}"; do
-  exit_code=$(cat "$log_dir/$t.exit")
-  if [[ "$exit_code" == "0" ]]; then
-    echo "  ✅ $t: SUCCESS"
+  read -r task_exit < "${log_dir}/${t}.exit" || task_exit=""
+  if [[ "${task_exit}" == "0" ]]; then
+    echo "  ✅ ${t}: SUCCESS"
  else
-    echo "  ❌ $t: FAILED (exit code $exit_code)"
+    echo "  ❌ ${t}: FAILED (exit code ${task_exit})"
  fi
 done
 echo ""

 echo "⏳ Tasks complete! Synthesizing final assessment..."
-if ! "$GEMINI_CMD" --policy "$POLICY_PATH" -p "Read the review at $log_dir/review.md, the automated test logs at $log_dir/npm-test.log, and the manual test execution logs at $log_dir/test-execution.log. Summarize the results, state whether the build and tests passed based on $log_dir/build-and-lint.exit and $log_dir/npm-test.exit, and give a final recommendation for PR $pr_number." > "$log_dir/final-assessment.md" 2>&1; then
-  echo $? > "$log_dir/final-assessment.exit"
+if ! "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "Read the review at ${log_dir}/review.md, the automated test logs at ${log_dir}/npm-test.log, and the manual test execution logs at ${log_dir}/test-execution.log. Summarize the results, state whether the build and tests passed based on ${log_dir}/build-and-lint.exit and ${log_dir}/npm-test.exit, and give a final recommendation for PR ${pr_number}." > "${log_dir}/final-assessment.md" 2>&1; then
+  echo $? > "${log_dir}/final-assessment.exit"
  echo "❌ Final assessment synthesis failed!"
-  echo "Check $log_dir/final-assessment.md for details."
-  notify "Async Review Failed" "Final assessment synthesis failed." "$pr_number"
+  echo "Check ${log_dir}/final-assessment.md for details."
+  notify "Async Review Failed" "Final assessment synthesis failed." "${pr_number}"
  exit 1
 fi

-echo 0 > "$log_dir/final-assessment.exit"
-echo "✅ Final assessment complete! Check $log_dir/final-assessment.md"
-notify "Async Review Complete" "Review and test execution finished successfully." "$pr_number"
+echo 0 > "${log_dir}/final-assessment.exit"
+echo "✅ Final assessment complete! Check ${log_dir}/final-assessment.md"
+notify "Async Review Complete" "Review and test execution finished successfully." "${pr_number}"
@@ -1,22 +1,22 @@
 #!/bin/bash
-pr_number=$1
+pr_number="${1}"

-if [[ -z "$pr_number" ]]; then
+if [[ -z "${pr_number}" ]]; then
  echo "Usage: check-async-review <pr_number>"
  exit 1
 fi

-base_dir=$(git rev-parse --show-toplevel 2>/dev/null)
-if [[ -z "$base_dir" ]]; then
+base_dir="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+if [[ -z "${base_dir}" ]]; then
  echo "❌ Must be run from within a git repository."
  exit 1
 fi

-log_dir="$base_dir/.gemini/tmp/async-reviews/pr-$pr_number/logs"
+log_dir="${base_dir}/.gemini/tmp/async-reviews/pr-${pr_number}/logs"

-if [[ ! -d "$log_dir" ]]; then
+if [[ ! -d "${log_dir}" ]]; then
  echo "STATUS: NOT_FOUND"
-  echo "❌ No logs found for PR #$pr_number in $log_dir"
+  echo "❌ No logs found for PR #${pr_number} in ${log_dir}"
  exit 0
 fi

@@ -34,32 +34,32 @@ all_done=true
 echo "STATUS: CHECKING"

 for task_info in "${tasks[@]}"; do
-  IFS="|" read -r task_name log_file <<< "$task_info"
+  IFS="|" read -r task_name log_file <<< "${task_info}"
  
-  file_path="$log_dir/$log_file"
-  exit_file="$log_dir/$task_name.exit"
+  file_path="${log_dir}/${log_file}"
+  exit_file="${log_dir}/${task_name}.exit"

-  if [[ -f "$exit_file" ]]; then
-    exit_code=$(cat "$exit_file")
-    if [[ "$exit_code" == "0" ]]; then
-      echo "✅ $task_name: SUCCESS"
+  if [[ -f "${exit_file}" ]]; then
+    read -r exit_code < "${exit_file}" || exit_code=""
+    if [[ "${exit_code}" == "0" ]]; then
+      echo "✅ ${task_name}: SUCCESS"
    else
-      echo "❌ $task_name: FAILED (exit code $exit_code)"
-      echo "   Last lines of $file_path:"
-      tail -n 3 "$file_path" | sed 's/^/      /'
+      echo "❌ ${task_name}: FAILED (exit code ${exit_code})"
+      echo "   Last lines of ${file_path}:"
+      tail -n 3 "${file_path}" | sed 's/^/      /' || true
    fi
-  elif [[ -f "$file_path" ]]; then
-    echo "⏳ $task_name: RUNNING"
+  elif [[ -f "${file_path}" ]]; then
+    echo "⏳ ${task_name}: RUNNING"
    all_done=false
  else
-    echo "➖ $task_name: NOT STARTED"
+    echo "➖ ${task_name}: NOT STARTED"
    all_done=false
  fi
 done

-if $all_done; then
+if [[ "${all_done}" == "true" ]]; then
  echo "STATUS: COMPLETE"
-  echo "LOG_DIR: $log_dir"
+  echo "LOG_DIR: ${log_dir}"
 else
  echo "STATUS: IN_PROGRESS"
-fi
+fi
@@ -65,8 +65,6 @@ accessible.
 - **UI and code:** Use **bold** for UI elements and `code font` for filenames,
  snippets, commands, and API elements. Focus on the task when discussing
  interaction.
- **Links:** Use descriptive anchor text; avoid "click here." Ensure the link
-  makes sense out of context.
 - **Accessibility:** Use semantic HTML elements correctly (headings, lists, 
  tables).
 - **Media:** Use lowercase hyphenated filenames. Provide descriptive alt text
@@ -100,6 +98,18 @@ accessible.
 > This is an example of a multi-line note that will be preserved
 > by Prettier.

+### Links
+- **Accessibility:** Use descriptive anchor text; avoid "click here." Ensure the
+  link makes sense out of context, such as when being read by a screen reader.
+- **Use relative links in docs:** Use relative links in documentation (`/docs/`)
+  to ensure portability. Use paths relative to the current file's directory
+  (for example, `../tools/` from `docs/cli/`). Do not include the `/docs/`
+  section of a path, but do verify that the resulting relative link exists. This
+  does not apply to meta files such as README.MD and CONTRIBUTING.MD.
+- **When changing headings, check for deep links:** If a user is changing a
+  heading, check for deep links to that heading in other pages and update
+  accordingly.
+
 ### Structure
 - **BLUF:** Start with an introduction explaining what to expect.
 - **Experimental features:** If a feature is clearly noted as experimental,
@@ -157,7 +167,6 @@ documentation.
 - **Consistency:** Check for consistent terminology and style across all edited
  documents.

-
 ## Phase 4: Verification and finalization
 Perform a final quality check to ensure that all changes are correctly formatted
 and that all links are functional.
@@ -0,0 +1,69 @@
+---
+name: review-duplication
+description: Use this skill during code reviews to proactively investigate the codebase for duplicated functionality, reinvented wheels, or failure to reuse existing project best practices and shared utilities.
+---
+
+# Review Duplication
+
+## Overview
+
+This skill provides a structured workflow for investigating a codebase during a code review to identify duplicated logic, reinvented utilities, and missed opportunities to reuse established patterns. By executing this workflow, you ensure that new code integrates seamlessly with the existing project architecture.
+
+## Workflow: Investigating for Duplication
+
+When reviewing code, perform the following steps before finalizing your review:
+
+### 1. Extract Core Logic
+Analyze the new code to identify the core algorithms, utility functions, generic data structures, or UI components being introduced. Look beyond the specific business logic to see the underlying mechanics.
+
+### 2. Hypothesize Existing Locations & Trace Dependencies
+Think about where this type of code *would* live if it already existed in the project. Provide absolute paths from the repo root to disambiguate.
+- **Utilities:** `packages/core/src/utils/`, `packages/cli/src/utils/`
+- **UI Components:** `packages/cli/src/ui/components/`, `packages/cli/src/ui/`
+- **Services:** `packages/core/src/services/`, `packages/cli/src/services/`
+- **Configuration:** `packages/core/src/config/`, `packages/cli/src/config/`
+- **Core Logic:** Call out `packages/core/` if functionality does not appear React UI specific.
+
+**Trace Third-Party Dependencies:** If the PR introduces a new import for a utility library (e.g., `lodash.merge`, `date-fns`), trace how and where the project currently uses that library. There is likely an existing wrapper or shared utility.
+
+**Check Package Files:** Before flagging a custom implementation of a complex algorithm, check `package.json` to see if a standard library (like `lodash` or `uuid`) is already installed that provides this functionality.
+
+### 3. Investigate the Codebase (Sub-Agent Delegation)
+Delegate the heavy lifting of codebase investigation to specialized sub-agents. They are optimized to perform deep searches and semantic mapping without bloating your session history.
+
+To ensure a comprehensive review, you MUST formulate highly specific objectives for the sub-agents, providing them with the "scents" you discovered in Step 1.
+
+- **Codebase Investigator:** Use the `codebase_investigator` as your primary researcher. When delegating, formulate an objective that asks specific, investigative questions about the codebase, explicitly including these search vectors:
+  - **Structural Similarity:** Ask if existing code uses the same underlying APIs (e.g., "Does any existing code use `Intl.DateTimeFormat` or `setTimeout` for similar purposes?").
+  - **Naming Conventions:** Ask if there are existing symbols with similar naming patterns (e.g., "Are there existing symbols with naming patterns like `*Format*` or `*Debounce*`?").
+  - **Comments & Documentation:** Ask if keywords from the PR's comments or JSDoc exist in describing similar behavior elsewhere.
+  - **Architectural Fit:** Ask where this type of logic is currently centralized (e.g., "Where is centralized date formatting logic located?").
+  - **Refactoring Guidance:** Crucially, ask the sub-agent to explain *how* the new code could be refactored to use any existing logic it finds.
+- **Generalist Agent:** Use the `generalist` for detailed, turn-intensive comparisons. For example: "Review the implementation of `MyNewComponent` in the PR and compare it semantically against all components in `packages/ui/src`. Are there any existing components that could be extended or used instead?"
+- **Retain Fast Path for Simple Searches:** For extremely simple, unambiguous checks (e.g., "Does `package.json` include `lodash`?"), perform a direct search to save time. Default to delegation for any open-ended "investigations."
+
+### 4. Evaluate Best Practices
+Check if the new code aligns with the project's established conventions.
+- **Error Handling:** Does it use the project's standard error classes or logging mechanisms?
+- **State Management:** Does it bypass established stores or contexts?
+- **Styling:** Does it hardcode colors or spacing instead of using theme variables?
+If the PR introduces a new pattern, compare it against the documented standards and explicitly confirm if an existing project pattern should have been used instead.
+
+### 5. Formulate Constructive Feedback
+If you discover that the PR duplicates existing functionality or ignores a best practice:
+- Provide a clear review comment.
+- **Identify the Source:** Explicitly mention the absolute or project-relative file path and the specific symbol (function, component, class) that should be reused.
+- **Implementation Guidance:** Provide a brief code snippet or a clear explanation showing **how** to integrate the existing code to fulfill the task's requirements.
+- **Explain the Value:** Briefly explain why reusing the existing code is beneficial (e.g., maintainability, consistency, built-in edge case handling).
+
+Example comment:
+> "It looks like this PR introduces a new `formatDate` utility. We already have a robust, tested `formatDate` function in `src/utils/dateHelpers.ts`. 
+>
+> You can replace your implementation by importing it like this:
+> ```typescript
+> import { formatDate } from '../utils/dateHelpers';
+> 
+> // Then use it here:
+> const displayDate = formatDate(userDate, 'MMM Do, YYYY');
+> ```
+> Reusing this ensures that the date formatting remains consistent with the rest of the application and handles timezone conversions correctly."
@@ -22,6 +22,3 @@ Makefile eol=lf
 *.eot binary
 *.ttf binary
 *.otf binary
-
-# Configure GitHub to treat Markdoc files as Markdown
-*.mdoc linguist-language=Markdown
@@ -175,7 +175,9 @@ runs:
          --dry-run="${INPUTS_DRY_RUN}" \
          --workspace="${INPUTS_CORE_PACKAGE_NAME}" \
          --no-tag
-        npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} false
+        if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+          npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} false
+        fi

    - name: '🔗 Install latest core package'
      working-directory: '${{ inputs.working-directory }}'
@@ -193,7 +195,7 @@ runs:
        INPUTS_A2A_PACKAGE_NAME: '${{ inputs.a2a-package-name }}'

    - name: '📦 Prepare bundled CLI for npm release'
-      if: "inputs.npm-registry-url != 'https://npm.pkg.github.com/' && inputs.npm-tag != 'latest'"
+      if: "inputs.npm-registry-url != 'https://npm.pkg.github.com/'"
      working-directory: '${{ inputs.working-directory }}'
      shell: 'bash'
      run: |
@@ -248,7 +250,9 @@ runs:
          --dry-run="${INPUTS_DRY_RUN}" \
          --workspace="${INPUTS_A2A_PACKAGE_NAME}" \
          --no-tag
-        npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} false
+          if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+            npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} false
+          fi

    - name: '🔬 Verify NPM release by version'
      uses: './.github/actions/verify-release'
@@ -287,8 +291,25 @@ runs:
        INPUTS_PREVIOUS_TAG: '${{ inputs.previous-tag }}'
      shell: 'bash'
      run: |
+        rm -f gemini-cli-bundle.zip
+        (cd bundle && chmod +x gemini.js && zip -r ../gemini-cli-bundle.zip .)
+
+        echo "Testing the generated bundle archive..."
+        rm -rf test-bundle
+        mkdir -p test-bundle
+        unzip -q gemini-cli-bundle.zip -d test-bundle
+
+        # Verify it runs and outputs a version
+        BUNDLE_VERSION=$(node test-bundle/gemini.js --version | xargs)
+        echo "Bundle version output: ${BUNDLE_VERSION}"
+        if [[ -z "${BUNDLE_VERSION}" ]]; then
+          echo "Error: Bundle failed to execute or return version."
+          exit 1
+        fi
+        rm -rf test-bundle
+
        gh release create "${INPUTS_RELEASE_TAG}" \
-          bundle/gemini.js \
+          gemini-cli-bundle.zip \
          --target "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}" \
          --title "Release ${INPUTS_RELEASE_TAG}" \
          --notes-start-tag "${INPUTS_PREVIOUS_TAG}" \
@@ -18,6 +18,13 @@ runs:
      env:
        JSON_INPUTS: '${{ toJSON(inputs) }}'
      run: 'echo "$JSON_INPUTS"'
+    - name: 'Install system dependencies'
+      if: "runner.os == 'Linux'"
+      run: |
+        sudo apt-get update -qq && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq bubblewrap
+        # Ubuntu 24.04+ requires this to allow bwrap to function in CI
+        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+      shell: 'bash'
    - name: 'Run Tests'
      env:
        GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'
@@ -334,8 +334,20 @@ jobs:
        if: "${{ steps.check_evals.outputs.should_run == 'true' }}"
        env:
          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_MODEL: 'gemini-3-pro-preview'
+          # Disable Vitest internal retries to avoid double-retrying;
+          # custom retry logic is handled in evals/test-helper.ts
+          VITEST_RETRY: 0
        run: 'npm run test:always_passing_evals'

+      - name: 'Upload Reliability Logs'
+        if: "always() && steps.check_evals.outputs.should_run == 'true'"
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'eval-logs-${{ github.run_id }}-${{ github.run_attempt }}'
+          path: 'evals/logs/api-reliability.jsonl'
+          retention-days: 7
+
  e2e:
    name: 'E2E'
    if: |
@@ -1,69 +0,0 @@
-name: 'Evals: PR Guidance'
-
-on:
-  pull_request:
-    paths:
-      - 'packages/core/src/**/*.ts'
-      - '!**/*.test.ts'
-      - '!**/*.test.tsx'
-
-permissions:
-  pull-requests: 'write'
-  contents: 'read'
-
-jobs:
-  provide-guidance:
-    name: 'Model Steering Guidance'
-    runs-on: 'ubuntu-latest'
-    if: "github.repository == 'google-gemini/gemini-cli'"
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: 'Set up Node.js'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4.4.0
-        with:
-          node-version-file: '.nvmrc'
-          cache: 'npm'
-
-      - name: 'Detect Steering Changes'
-        id: 'detect'
-        run: |
-          STEERING_DETECTED=$(node scripts/changed_prompt.js --steering-only)
-          echo "STEERING_DETECTED=$STEERING_DETECTED" >> "$GITHUB_OUTPUT"
-
-      - name: 'Analyze PR Content'
-        if: "steps.detect.outputs.STEERING_DETECTED == 'true'"
-        id: 'analysis'
-        env:
-          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-        run: |
-          # Check for behavioral eval changes
-          EVAL_CHANGES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep "^evals/" || true)
-          if [ -z "$EVAL_CHANGES" ]; then
-            echo "MISSING_EVALS=true" >> "$GITHUB_OUTPUT"
-          fi
-
-          # Check if user is a maintainer (has write/admin access)
-          USER_PERMISSION=$(gh api repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission --jq '.permission')
-          if [[ "$USER_PERMISSION" == "admin" || "$USER_PERMISSION" == "write" ]]; then
-            echo "IS_MAINTAINER=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: 'Post Guidance Comment'
-        if: "steps.detect.outputs.STEERING_DETECTED == 'true'"
-        uses: 'thollander/actions-comment-pull-request@65f9e5c9a1f2cd378bd74b2e057c9736982a8e74' # ratchet:thollander/actions-comment-pull-request@v3
-        with:
-          comment-tag: 'eval-guidance-bot'
-          message: |
-            ### 🧠 Model Steering Guidance
-
-            This PR modifies files that affect the model's behavior (prompts, tools, or instructions).
-
-            ${{ steps.analysis.outputs.MISSING_EVALS == 'true' && '- ⚠️ **Consider adding Evals:** No behavioral evaluations (`evals/*.eval.ts`) were added or updated in this PR. Consider adding a test case to verify the new behavior and prevent regressions.' || '' }}
-            ${{ steps.analysis.outputs.IS_MAINTAINER == 'true' && '- 🚀 **Maintainer Reminder:** Please ensure that these changes do not regress results on benchmark evals before merging.' || '' }}
-
-            ---
-            *This is an automated guidance message triggered by steering logic signatures.*
@@ -0,0 +1,137 @@
+name: 'Evals: PR Evaluation & Regression'
+
+on:
+  pull_request:
+    types: ['opened', 'synchronize', 'reopened', 'ready_for_review']
+    paths:
+      - 'packages/core/src/prompts/**'
+      - 'packages/core/src/tools/**'
+      - 'packages/core/src/agents/**'
+      - 'evals/**'
+      - '!**/*.test.ts'
+      - '!**/*.test.tsx'
+  workflow_dispatch:
+
+# Prevents multiple runs for the same PR simultaneously (saves tokens)
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: 'write'
+  contents: 'read'
+  actions: 'read'
+
+jobs:
+  pr-evaluation:
+    name: 'Evaluate Steering & Regressions'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli' && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository))"
+    # External contributors' PRs will wait for approval in this environment
+    environment: |-
+      ${{ (github.event.pull_request.head.repo.full_name == github.repository) && 'internal' || 'external-evals' }}
+    env:
+      # CENTRALIZED MODEL LIST
+      MODEL_LIST: 'gemini-3-flash-preview'
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4.4.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Detect Steering Changes'
+        id: 'detect'
+        run: |
+          SHOULD_RUN=$(node scripts/changed_prompt.js)
+          STEERING_DETECTED=$(node scripts/changed_prompt.js --steering-only)
+          echo "SHOULD_RUN=$SHOULD_RUN" >> "$GITHUB_OUTPUT"
+          echo "STEERING_DETECTED=$STEERING_DETECTED" >> "$GITHUB_OUTPUT"
+
+      - name: 'Analyze PR Content (Guidance)'
+        if: "steps.detect.outputs.STEERING_DETECTED == 'true'"
+        id: 'analysis'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          # Check for behavioral eval changes
+          EVAL_CHANGES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep "^evals/" || true)
+          if [ -z "$EVAL_CHANGES" ]; then
+            echo "MISSING_EVALS=true" >> "$GITHUB_OUTPUT"
+          fi
+
+          # Check if user is a maintainer
+          USER_PERMISSION=$(gh api repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission --jq '.permission')
+          if [[ "$USER_PERMISSION" == "admin" || "$USER_PERMISSION" == "write" ]]; then
+            echo "IS_MAINTAINER=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: 'Execute Regression Check'
+        if: "steps.detect.outputs.SHOULD_RUN == 'true'"
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          MODEL_LIST: '${{ env.MODEL_LIST }}'
+        run: |
+          # Run the regression check loop. The script saves the report to a file.
+          node scripts/run_eval_regression.js
+
+          # Use the generated report file if it exists
+          if [[ -f eval_regression_report.md ]]; then
+            echo "REPORT_FILE=eval_regression_report.md" >> "$GITHUB_ENV"
+          fi
+
+      - name: 'Post or Update PR Comment'
+        if: "always() && steps.detect.outputs.STEERING_DETECTED == 'true'"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          # 1. Build the full comment body
+          {
+            if [[ -f eval_regression_report.md ]]; then
+              cat eval_regression_report.md
+              echo ""
+            fi
+            echo "### 🧠 Model Steering Guidance"
+            echo ""
+            echo "This PR modifies files that affect the model's behavior (prompts, tools, or instructions)."
+            echo ""
+
+            if [[ "${{ steps.analysis.outputs.MISSING_EVALS }}" == "true" ]]; then
+              echo "- ⚠️ **Consider adding Evals:** No behavioral evaluations (\`evals/*.eval.ts\`) were added or updated in this PR. Consider [adding a test case](https://github.com/google-gemini/gemini-cli/blob/main/evals/README.md#creating-an-evaluation) to verify the new behavior and prevent regressions."
+            fi
+
+            if [[ "${{ steps.analysis.outputs.IS_MAINTAINER }}" == "true" ]]; then
+              echo "- 🚀 **Maintainer Reminder:** Please ensure that these changes do not regress results on benchmark evals before merging."
+            fi
+
+            echo ""
+            echo "---"
+            echo "*This is an automated guidance message triggered by steering logic signatures.*"
+            echo "<!-- eval-pr-report -->"
+          } > full_comment.md
+
+          # 2. Find if a comment with our unique tag already exists
+          # We extract the numeric ID from the URL to ensure compatibility with the REST API
+          COMMENT_ID=$(gh pr view ${{ github.event.pull_request.number }} --json comments --jq '.comments[] | select(.body | contains("<!-- eval-pr-report -->")) | .url' | grep -oE "[0-9]+$" | head -n 1)
+
+          # 3. Update or Create the comment
+          if [ -n "$COMMENT_ID" ]; then
+            echo "Updating existing comment $COMMENT_ID via API..."
+            gh api -X PATCH "repos/${{ github.repository }}/issues/comments/$COMMENT_ID" -F body=@full_comment.md
+          else
+            echo "Creating new PR comment..."
+            gh pr comment ${{ github.event.pull_request.number }} --body-file full_comment.md
+          fi
@@ -61,6 +61,8 @@ jobs:
          GEMINI_MODEL: '${{ matrix.model }}'
          RUN_EVALS: "${{ github.event.inputs.run_all != 'false' }}"
          TEST_NAME_PATTERN: '${{ github.event.inputs.test_name_pattern }}'
+          # Disable Vitest internal retries to avoid double-retrying;
+          # custom retry logic is handled in evals/test-helper.ts
          VITEST_RETRY: 0
        run: |
          CMD="npm run test:all_evals"
@@ -346,9 +346,11 @@ npm run lint

 - Please adhere to the coding style, patterns, and conventions used throughout
  the existing codebase.
- Consult [GEMINI.md](../GEMINI.md) (typically found in the project root) for
-  specific instructions related to AI-assisted development, including
-  conventions for React, comments, and Git usage.
+- Consult
+  [GEMINI.md](https://github.com/google-gemini/gemini-cli/blob/main/GEMINI.md)
+  (typically found in the project root) for specific instructions related to
+  AI-assisted development, including conventions for React, comments, and Git
+  usage.
 - **Imports:** Pay special attention to import paths. The project uses ESLint to
  enforce restrictions on relative imports between packages.

@@ -505,8 +507,9 @@ code.

 ### Documentation structure

-Our documentation is organized using [sidebar.json](/docs/sidebar.json) as the
-table of contents. When adding new documentation:
+Our documentation is organized using
+[sidebar.json](https://github.com/google-gemini/gemini-cli/blob/main/docs/sidebar.json)
+as the table of contents. When adding new documentation:

 1. Create your markdown file **in the appropriate directory** under `/docs`.
 2. Add an entry to `sidebar.json` in the relevant section.
@@ -30,7 +30,7 @@ Learn all about Gemini CLI in our [documentation](https://geminicli.com/docs/).
 ## 📦 Installation

 See
-[Gemini CLI installation, execution, and releases](https://geminicli.com/docs/get-started/installation/)
+[Gemini CLI installation, execution, and releases](https://www.geminicli.com/docs/get-started/installation)
 for recommended system specifications and a detailed installation guide.

 ### Quick Install
@@ -71,9 +71,9 @@ conda activate gemini_env
 npm install -g @google/gemini-cli
 ```

-## Release Cadence and Tags
+## Release Channels

-See [Releases](./docs/releases.md) for more details.
+See [Releases](https://www.geminicli.com/docs/changelogs) for more details.

 ### Preview

@@ -209,7 +209,7 @@ gemini
 ```

 For Google Workspace accounts and other authentication methods, see the
-[authentication guide](./docs/get-started/authentication.md).
+[authentication guide](https://www.geminicli.com/docs/get-started/authentication).

 ## 🚀 Getting Started

@@ -278,59 +278,64 @@ gemini

 ### Getting Started

- [**Quickstart Guide**](./docs/get-started/index.md) - Get up and running
-  quickly.
- [**Authentication Setup**](./docs/get-started/authentication.md) - Detailed
-  auth configuration.
- [**Configuration Guide**](./docs/reference/configuration.md) - Settings and
-  customization.
- [**Keyboard Shortcuts**](./docs/reference/keyboard-shortcuts.md) -
+- [**Quickstart Guide**](https://www.geminicli.com/docs/get-started) - Get up
+  and running quickly.
+- [**Authentication Setup**](https://www.geminicli.com/docs/get-started/authentication) -
+  Detailed auth configuration.
+- [**Configuration Guide**](https://www.geminicli.com/docs/reference/configuration) -
+  Settings and customization.
+- [**Keyboard Shortcuts**](https://www.geminicli.com/docs/reference/keyboard-shortcuts) -
  Productivity tips.

 ### Core Features

- [**Commands Reference**](./docs/reference/commands.md) - All slash commands
-  (`/help`, `/chat`, etc).
- [**Custom Commands**](./docs/cli/custom-commands.md) - Create your own
-  reusable commands.
- [**Context Files (GEMINI.md)**](./docs/cli/gemini-md.md) - Provide persistent
-  context to Gemini CLI.
- [**Checkpointing**](./docs/cli/checkpointing.md) - Save and resume
-  conversations.
- [**Token Caching**](./docs/cli/token-caching.md) - Optimize token usage.
+- [**Commands Reference**](https://www.geminicli.com/docs/reference/commands) -
+  All slash commands (`/help`, `/chat`, etc).
+- [**Custom Commands**](https://www.geminicli.com/docs/cli/custom-commands) -
+  Create your own reusable commands.
+- [**Context Files (GEMINI.md)**](https://www.geminicli.com/docs/cli/gemini-md) -
+  Provide persistent context to Gemini CLI.
+- [**Checkpointing**](https://www.geminicli.com/docs/cli/checkpointing) - Save
+  and resume conversations.
+- [**Token Caching**](https://www.geminicli.com/docs/cli/token-caching) -
+  Optimize token usage.

 ### Tools & Extensions

- [**Built-in Tools Overview**](./docs/reference/tools.md)
-  - [File System Operations](./docs/tools/file-system.md)
-  - [Shell Commands](./docs/tools/shell.md)
-  - [Web Fetch & Search](./docs/tools/web-fetch.md)
- [**MCP Server Integration**](./docs/tools/mcp-server.md) - Extend with custom
-  tools.
- [**Custom Extensions**](./docs/extensions/index.md) - Build and share your own
-  commands.
+- [**Built-in Tools Overview**](https://www.geminicli.com/docs/reference/tools)
+  - [File System Operations](https://www.geminicli.com/docs/tools/file-system)
+  - [Shell Commands](https://www.geminicli.com/docs/tools/shell)
+  - [Web Fetch & Search](https://www.geminicli.com/docs/tools/web-fetch)
+- [**MCP Server Integration**](https://www.geminicli.com/docs/tools/mcp-server) -
+  Extend with custom tools.
+- [**Custom Extensions**](https://geminicli.com/docs/extensions/writing-extensions) -
+  Build and share your own commands.

 ### Advanced Topics

- [**Headless Mode (Scripting)**](./docs/cli/headless.md) - Use Gemini CLI in
-  automated workflows.
- [**IDE Integration**](./docs/ide-integration/index.md) - VS Code companion.
- [**Sandboxing & Security**](./docs/cli/sandbox.md) - Safe execution
-  environments.
- [**Trusted Folders**](./docs/cli/trusted-folders.md) - Control execution
-  policies by folder.
- [**Enterprise Guide**](./docs/cli/enterprise.md) - Deploy and manage in a
-  corporate environment.
- [**Telemetry & Monitoring**](./docs/cli/telemetry.md) - Usage tracking.
- [**Tools reference**](./docs/reference/tools.md) - Built-in tools overview.
- [**Local development**](./docs/local-development.md) - Local development
-  tooling.
+- [**Headless Mode (Scripting)**](https://www.geminicli.com/docs/cli/headless) -
+  Use Gemini CLI in automated workflows.
+- [**IDE Integration**](https://www.geminicli.com/docs/ide-integration) - VS
+  Code companion.
+- [**Sandboxing & Security**](https://www.geminicli.com/docs/cli/sandbox) - Safe
+  execution environments.
+- [**Trusted Folders**](https://www.geminicli.com/docs/cli/trusted-folders) -
+  Control execution policies by folder.
+- [**Enterprise Guide**](https://www.geminicli.com/docs/cli/enterprise) - Deploy
+  and manage in a corporate environment.
+- [**Telemetry & Monitoring**](https://www.geminicli.com/docs/cli/telemetry) -
+  Usage tracking.
+- [**Tools reference**](https://www.geminicli.com/docs/reference/tools) -
+  Built-in tools overview.
+- [**Local development**](https://www.geminicli.com/docs/local-development) -
+  Local development tooling.

 ### Troubleshooting & Support

- [**Troubleshooting Guide**](./docs/resources/troubleshooting.md) - Common
-  issues and solutions.
- [**FAQ**](./docs/resources/faq.md) - Frequently asked questions.
+- [**Troubleshooting Guide**](https://www.geminicli.com/docs/resources/troubleshooting) -
+  Common issues and solutions.
+- [**FAQ**](https://www.geminicli.com/docs/resources/faq) - Frequently asked
+  questions.
 - Use `/bug` command to report issues directly from the CLI.

 ### Using MCP Servers
@@ -344,8 +349,9 @@ custom tools:
 > @database Run a query to find inactive users
 ```

-See the [MCP Server Integration guide](./docs/tools/mcp-server.md) for setup
-instructions.
+See the
+[MCP Server Integration guide](https://www.geminicli.com/docs/tools/mcp-server)
+for setup instructions.

 ## 🤝 Contributing

@@ -366,7 +372,8 @@ for planned features and priorities.
 ## 📖 Resources

 - **[Official Roadmap](./ROADMAP.md)** - See what's coming next.
- **[Changelog](./docs/changelogs/index.md)** - See recent notable updates.
+- **[Changelog](https://www.geminicli.com/docs/changelogs)** - See recent
+  notable updates.
 - **[NPM Package](https://www.npmjs.com/package/@google/gemini-cli)** - Package
  registry.
 - **[GitHub Issues](https://github.com/google-gemini/gemini-cli/issues)** -
@@ -376,13 +383,14 @@ for planned features and priorities.

 ### Uninstall

-See the [Uninstall Guide](./docs/resources/uninstall.md) for removal
-instructions.
+See the [Uninstall Guide](https://www.geminicli.com/docs/resources/uninstall)
+for removal instructions.

 ## 📄 Legal

 - **License**: [Apache License 2.0](LICENSE)
- **Terms of Service**: [Terms & Privacy](./docs/resources/tos-privacy.md)
+- **Terms of Service**:
+  [Terms & Privacy](https://www.geminicli.com/docs/resources/tos-privacy)
 - **Security**: [Security Policy](SECURITY.md)

 ---
@@ -1,6 +1,6 @@
-# Latest stable release: v0.35.0
+# Latest stable release: v0.35.3

-Released: March 24, 2026
+Released: March 28, 2026

 For most users, our latest stable release is the recommended release. Install
 the latest stable version with:
@@ -29,6 +29,14 @@ npm install -g @google/gemini-cli

 ## What's Changed

+- fix(patch): cherry-pick 765fb67 to release/v0.35.2-pr-24055 [CONFLICTS] by
+  @gemini-cli-robot in
+  [#24063](https://github.com/google-gemini/gemini-cli/pull/24063)
+- fix(core): allow disabling environment variable redaction by @galz10 in
+  [#23927](https://github.com/google-gemini/gemini-cli/pull/23927)
+- fix(a2a-server): A2A server should execute ask policies in interactive mode by
+  @keith.schaab in
+  [#23831](https://github.com/google-gemini/gemini-cli/pull/23831)
 - feat(cli): customizable keyboard shortcuts by @scidomino in
  [#21945](https://github.com/google-gemini/gemini-cli/pull/21945)
 - feat(core): Thread `AgentLoopContext` through core. by @joshualitt in
@@ -380,4 +388,4 @@ npm install -g @google/gemini-cli
  [#23585](https://github.com/google-gemini/gemini-cli/pull/23585)

 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.34.0...v0.35.0
+https://github.com/google-gemini/gemini-cli/compare/v0.34.0...v0.35.3
@@ -1,6 +1,6 @@
-# Preview release: v0.36.0-preview.3
+# Preview release: v0.36.0-preview.8

-Released: March 25, 2026
+Released: April 01, 2026

 Our preview release includes the latest, new, and experimental features. This
 release may not be as stable as our [latest weekly release](latest.md).
@@ -31,6 +31,17 @@ npm install -g @google/gemini-cli@preview

 ## What's Changed

+- fix(patch): cherry-pick 765fb67 to release/v0.36.0-preview.5-pr-24055 to patch
+  version v0.36.0-preview.5 and create version 0.36.0-preview.6 by
+  @gemini-cli-robot in
+  [#24061](https://github.com/google-gemini/gemini-cli/pull/24061)
+- fix(a2a-server): A2A server should execute ask policies in interactive mode by
+  @kschaab in [#23831](https://github.com/google-gemini/gemini-cli/pull/23831)
+- docs(core): document agent_card_json string literal options for remote agents
+  by @adamfweidman in
+  [#23797](https://github.com/google-gemini/gemini-cli/pull/23797)
+- feat(core): support inline agentCardJson for remote agents by @adamfweidman in
+  [#23743](https://github.com/google-gemini/gemini-cli/pull/23743)
 - fix(patch): cherry-pick 055ff92 to release/v0.36.0-preview.0-pr-23672 to patch
  version v0.36.0-preview.0 and create version 0.36.0-preview.1 by
  @gemini-cli-robot in
@@ -379,4 +390,4 @@ npm install -g @google/gemini-cli@preview
  [#23666](https://github.com/google-gemini/gemini-cli/pull/23666)

 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.35.0-preview.5...v0.36.0-preview.3
+https://github.com/google-gemini/gemini-cli/compare/v0.35.0-preview.5...v0.36.0-preview.8
@@ -0,0 +1,126 @@
+# ACP Mode
+
+ACP (Agent Client Protocol) mode is a special operational mode of Gemini CLI
+designed for programmatic control, primarily for IDE and other developer tool
+integrations. It uses a JSON-RPC protocol over stdio to communicate between
+Gemini CLI agent and a client.
+
+To start Gemini CLI in ACP mode, use the `--acp` flag:
+
+```bash
+gemini --acp
+```
+
+## Agent Client Protocol (ACP)
+
+ACP is an open protocol that standardizes how AI coding agents communicate with
+code editors and IDEs. It addresses the challenge of fragmented distribution,
+where agents traditionally needed custom integrations for each client. With ACP,
+developers can implement their agent once, and it becomes compatible with any
+ACP-compliant editor.
+
+For a comprehensive introduction to ACP, including its architecture and
+benefits, refer to the official
+[ACP Introduction](https://agentclientprotocol.com/get-started/introduction)
+documentation.
+
+### Existing integrations using ACP
+
+The ACP Agent Registry simplifies the distribution and management of
+ACP-compatible agents across various IDEs. Gemini CLI is an ACP-compatible agent
+and can be found in this registry.
+
+For more general information about the registry, and how to use it with specific
+IDEs like JetBrains and Zed, refer to the
+[IDE Integration](../ide-integration/index.md) documentation.
+
+You can also find more information on the official
+[ACP Agent Registry](https://agentclientprotocol.com/get-started/registry) page.
+
+## Architecture and protocol basics
+
+ACP mode establishes a client-server relationship between your tool (the client)
+and Gemini CLI (the server).
+
+- **Communication:** The entire communication happens over standard input/output
+  (stdio) using the JSON-RPC 2.0 protocol.
+- **Client's role:** The client is responsible for sending requests (e.g.,
+  prompts) and handling responses and notifications from Gemini CLI.
+- **Gemini CLI's role:** In ACP mode, Gemini CLI listens for incoming JSON-RPC
+  requests, processes them, and sends back responses.
+
+The core of the ACP implementation can be found in
+`packages/cli/src/acp/acpClient.ts`.
+
+### Extending with MCP
+
+ACP can be used with the Model Context Protocol (MCP). This lets an ACP client
+(like an IDE) expose its own functionality as "tools" that the Gemini model can
+use.
+
+1.  The client implements an **MCP server** that advertises its tools.
+2.  During the ACP `initialize` handshake, the client provides the connection
+    details for its MCP server.
+3.  Gemini CLI connects to the MCP server, discovers the available tools, and
+    makes them available to the AI model.
+4.  When the model decides to use one of these tools, Gemini CLI sends a tool
+    call request to the MCP server.
+
+This mechanism lets for a powerful, two-way integration where the agent can
+leverage the IDE's capabilities to perform tasks. The MCP client logic is in
+`packages/core/src/tools/mcp-client.ts`.
+
+## Capabilities and supported methods
+
+The ACP protocol exposes a number of methods for ACP clients (e.g. IDEs) to
+control Gemini CLI.
+
+### Core methods
+
+- `initialize`: Establishes the initial connection and lets the client to
+  register its MCP server.
+- `authenticate`: Authenticates the user.
+- `newSession`: Starts a new chat session.
+- `loadSession`: Loads a previous session.
+- `prompt`: Sends a prompt to the agent.
+- `cancel`: Cancels an ongoing prompt.
+
+### Session control
+
+- `setSessionMode`: Allows changing the approval level for tool calls (e.g., to
+  `auto-approve`).
+- `unstable_setSessionModel`: Changes the model for the current session.
+
+### File system proxy
+
+ACP includes a proxied file system service. This means that when the agent needs
+to read or write files, it does so through the ACP client. This is a security
+feature that ensures the agent only has access to the files that the client (and
+by extension, the user) has explicitly allowed.
+
+## Debugging and telemetry
+
+You can get insights into the ACP communication and the agent's behavior through
+debugging logs and telemetry.
+
+### Debugging logs
+
+To enable general debugging logs, start Gemini CLI with the `--debug` flag:
+
+```bash
+gemini --acp --debug
+```
+
+### Telemetry
+
+For more detailed telemetry, you can use the following environment variables to
+capture telemetry data to a file:
+
+- `GEMINI_TELEMETRY_ENABLED=true`
+- `GEMINI_TELEMETRY_TARGET=local`
+- `GEMINI_TELEMETRY_OUTFILE=/path/to/your/log.json`
+
+This will write a JSON log file containing detailed information about all the
+events happening within the agent, including ACP requests and responses. The
+integration test `integration-tests/acp-telemetry.test.ts` provides a working
+example of how to set this up.
@@ -52,7 +52,7 @@ These commands are available within the interactive REPL.
 | `--prompt-interactive`           | `-i`  | string  | -         | Execute prompt and continue in interactive mode                                                                                                                        |
 | `--worktree`                     | `-w`  | string  | -         | Start Gemini in a new git worktree. If no name is provided, one is generated automatically. Requires `experimental.worktrees: true` in settings.                       |
 | `--sandbox`                      | `-s`  | boolean | `false`   | Run in a sandboxed environment for safer execution                                                                                                                     |
-| `--approval-mode`                | -     | string  | `default` | Approval mode for tool execution. Choices: `default`, `auto_edit`, `yolo`                                                                                              |
+| `--approval-mode`                | -     | string  | `default` | Approval mode for tool execution. Choices: `default`, `auto_edit`, `yolo`, `plan`                                                                                      |
 | `--yolo`                         | `-y`  | boolean | `false`   | **Deprecated.** Auto-approve all actions. Use `--approval-mode=yolo` instead.                                                                                          |
 | `--experimental-acp`             | -     | boolean | -         | Start in ACP (Agent Code Pilot) mode. **Experimental feature.**                                                                                                        |
 | `--experimental-zed-integration` | -     | boolean | -         | Run in Zed editor integration mode. **Experimental feature.**                                                                                                          |
@@ -15,14 +15,14 @@ CLI works in the background.

 ## Requirements

-Currently, system notifications are only supported on macOS.
-
 ### Terminal support

 The CLI uses the OSC 9 terminal escape sequence to trigger system notifications.
-This is supported by several modern terminal emulators. If your terminal does
-not support OSC 9 notifications, Gemini CLI falls back to a system alert sound
-to get your attention.
+This is supported by several modern terminal emulators including iTerm2,
+WezTerm, Ghostty, and Kitty. If your terminal does not support OSC 9
+notifications, Gemini CLI falls back to a terminal bell (BEL) to get your
+attention. Most terminals respond to BEL with a taskbar flash or system alert
+sound.

 ## Enable notifications

@@ -39,7 +39,9 @@ To start Plan Mode while using Gemini CLI:
  the rotation when Gemini CLI is actively processing or showing confirmation
  dialogs.

- **Command:** Type `/plan` in the input box.
+- **Command:** Type `/plan [goal]` in the input box. The `[goal]` is optional;
+  for example, `/plan implement authentication` will switch to Plan Mode and
+  immediately submit the prompt to the model.

 - **Natural Language:** Ask Gemini CLI to "start a plan for...". Gemini CLI
  calls the
@@ -54,19 +56,21 @@ Gemini CLI takes action.

 1.  **Provide a goal:** Start by describing what you want to achieve. Gemini CLI
    will then enter Plan Mode (if it's not already) to research the task.
-2.  **Review research and provide input:** As Gemini CLI analyzes your codebase,
-    it may ask you questions or present different implementation options using
-    [`ask_user`](../tools/ask-user.md). Provide your preferences to help guide
-    the design.
-3.  **Review the plan:** Once Gemini CLI has a proposed strategy, it creates a
-    detailed implementation plan as a Markdown file in your plans directory.
+2.  **Discuss and agree on strategy:** As Gemini CLI analyzes your codebase, it
+    will discuss its findings and proposed strategy with you to ensure
+    alignment. It may ask you questions or present different implementation
+    options using [`ask_user`](../tools/ask-user.md). **Gemini CLI will stop and
+    wait for your confirmation** before drafting the formal plan. You should
+    reach an informal agreement on the approach before proceeding.
+3.  **Review the plan:** Once you've agreed on the strategy, Gemini CLI creates
+    a detailed implementation plan as a Markdown file in your plans directory.
    - **View:** You can open and read this file to understand the proposed
      changes.
    - **Edit:** Press `Ctrl+X` to open the plan directly in your configured
      external editor.

 4.  **Approve or iterate:** Gemini CLI will present the finalized plan for your
-    approval.
+    formal approval.
    - **Approve:** If you're satisfied with the plan, approve it to start the
      implementation immediately: **Yes, automatically accept edits** or **Yes,
      manually accept edits**.
@@ -119,6 +123,7 @@ These are the only allowed tools:
  [`glob`](../tools/file-system.md#4-glob-findfiles)
 - **Search:** [`grep_search`](../tools/file-system.md#5-grep_search-searchtext),
  [`google_web_search`](../tools/web-search.md),
+  [`web_fetch`](../tools/web-fetch.md) (requires explicit confirmation),
  [`get_internal_docs`](../tools/internal-docs.md)
 - **Research Subagents:**
  [`codebase_investigator`](../core/subagents.md#codebase-investigator),
@@ -29,7 +29,8 @@ they appear in the UI.
 | Vim Mode                | `general.vimMode`                  | Enable Vim keybindings                                                                                                                                                                                                                                        | `false`     |
 | Default Approval Mode   | `general.defaultApprovalMode`      | The default approval mode for tool execution. 'default' prompts for approval, 'auto_edit' auto-approves edit tools, and 'plan' is read-only mode. YOLO mode (auto-approve all actions) can only be enabled via command line (--yolo or --approval-mode=yolo). | `"default"` |
 | Enable Auto Update      | `general.enableAutoUpdate`         | Enable automatic updates.                                                                                                                                                                                                                                     | `true`      |
-| Enable Notifications    | `general.enableNotifications`      | Enable run-event notifications for action-required prompts and session completion. Currently macOS only.                                                                                                                                                      | `false`     |
+| Enable Notifications    | `general.enableNotifications`      | Enable run-event notifications for action-required prompts and session completion.                                                                                                                                                                            | `false`     |
+| Enable Plan Mode        | `general.plan.enabled`             | Enable Plan Mode for read-only safety during planning.                                                                                                                                                                                                        | `true`      |
 | Plan Directory          | `general.plan.directory`           | The directory where planning artifacts are stored. If not specified, defaults to the system temporary directory. A custom directory requires a policy to allow write access in Plan Mode.                                                                     | `undefined` |
 | Plan Model Routing      | `general.plan.modelRouting`        | Automatically switch between Pro and Flash models based on Plan Mode status. Uses Pro for the planning phase and Flash for the implementation phase.                                                                                                          | `true`      |
 | Retry Fetch Errors      | `general.retryFetchErrors`         | Retry on "exception TypeError: fetch failed sending request" errors.                                                                                                                                                                                          | `true`      |
@@ -46,38 +47,39 @@ they appear in the UI.

 ### UI

-| UI Label                             | Setting                                | Description                                                                                                                                                       | Default  |
-| ------------------------------------ | -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
-| Auto Theme Switching                 | `ui.autoThemeSwitching`                | Automatically switch between default light and dark themes based on terminal background color.                                                                    | `true`   |
-| Terminal Background Polling Interval | `ui.terminalBackgroundPollingInterval` | Interval in seconds to poll the terminal background color.                                                                                                        | `60`     |
-| Hide Window Title                    | `ui.hideWindowTitle`                   | Hide the window title bar                                                                                                                                         | `false`  |
-| Inline Thinking                      | `ui.inlineThinkingMode`                | Display model thinking inline: off or full.                                                                                                                       | `"off"`  |
-| Show Thoughts in Title               | `ui.showStatusInTitle`                 | Show Gemini CLI model thoughts in the terminal window title during the working phase                                                                              | `false`  |
-| Dynamic Window Title                 | `ui.dynamicWindowTitle`                | Update the terminal window title with current status icons (Ready: ◇, Action Required: ✋, Working: ✦)                                                            | `true`   |
-| Show Home Directory Warning          | `ui.showHomeDirectoryWarning`          | Show a warning when running Gemini CLI in the home directory.                                                                                                     | `true`   |
-| Show Compatibility Warnings          | `ui.showCompatibilityWarnings`         | Show warnings about terminal or OS compatibility issues.                                                                                                          | `true`   |
-| Hide Tips                            | `ui.hideTips`                          | Hide helpful tips in the UI                                                                                                                                       | `false`  |
-| Escape Pasted @ Symbols              | `ui.escapePastedAtSymbols`             | When enabled, @ symbols in pasted text are escaped to prevent unintended @path expansion.                                                                         | `false`  |
-| Show Shortcuts Hint                  | `ui.showShortcutsHint`                 | Show the "? for shortcuts" hint above the input.                                                                                                                  | `true`   |
-| Hide Banner                          | `ui.hideBanner`                        | Hide the application banner                                                                                                                                       | `false`  |
-| Hide Context Summary                 | `ui.hideContextSummary`                | Hide the context summary (GEMINI.md, MCP servers) above the input.                                                                                                | `false`  |
-| Hide CWD                             | `ui.footer.hideCWD`                    | Hide the current working directory in the footer.                                                                                                                 | `false`  |
-| Hide Sandbox Status                  | `ui.footer.hideSandboxStatus`          | Hide the sandbox status indicator in the footer.                                                                                                                  | `false`  |
-| Hide Model Info                      | `ui.footer.hideModelInfo`              | Hide the model name and context usage in the footer.                                                                                                              | `false`  |
-| Hide Context Window Percentage       | `ui.footer.hideContextPercentage`      | Hides the context window usage percentage.                                                                                                                        | `true`   |
-| Hide Footer                          | `ui.hideFooter`                        | Hide the footer from the UI                                                                                                                                       | `false`  |
-| Show Memory Usage                    | `ui.showMemoryUsage`                   | Display memory usage information in the UI                                                                                                                        | `false`  |
-| Show Line Numbers                    | `ui.showLineNumbers`                   | Show line numbers in the chat.                                                                                                                                    | `true`   |
-| Show Citations                       | `ui.showCitations`                     | Show citations for generated text in the chat.                                                                                                                    | `false`  |
-| Show Model Info In Chat              | `ui.showModelInfoInChat`               | Show the model name in the chat for each model turn.                                                                                                              | `false`  |
-| Show User Identity                   | `ui.showUserIdentity`                  | Show the signed-in user's identity (e.g. email) in the UI.                                                                                                        | `true`   |
-| Use Alternate Screen Buffer          | `ui.useAlternateBuffer`                | Use an alternate screen buffer for the UI, preserving shell history.                                                                                              | `false`  |
-| Use Background Color                 | `ui.useBackgroundColor`                | Whether to use background colors in the UI.                                                                                                                       | `true`   |
-| Incremental Rendering                | `ui.incrementalRendering`              | Enable incremental rendering for the UI. This option will reduce flickering but may cause rendering artifacts. Only supported when useAlternateBuffer is enabled. | `true`   |
-| Show Spinner                         | `ui.showSpinner`                       | Show the spinner during operations.                                                                                                                               | `true`   |
-| Loading Phrases                      | `ui.loadingPhrases`                    | What to show while the model is working: tips, witty comments, both, or nothing.                                                                                  | `"tips"` |
-| Error Verbosity                      | `ui.errorVerbosity`                    | Controls whether recoverable errors are hidden (low) or fully shown (full).                                                                                       | `"low"`  |
-| Screen Reader Mode                   | `ui.accessibility.screenReader`        | Render output in plain-text to be more screen reader accessible                                                                                                   | `false`  |
+| UI Label                             | Setting                                | Description                                                                                                                                                       | Default |
+| ------------------------------------ | -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| Auto Theme Switching                 | `ui.autoThemeSwitching`                | Automatically switch between default light and dark themes based on terminal background color.                                                                    | `true`  |
+| Terminal Background Polling Interval | `ui.terminalBackgroundPollingInterval` | Interval in seconds to poll the terminal background color.                                                                                                        | `60`    |
+| Hide Window Title                    | `ui.hideWindowTitle`                   | Hide the window title bar                                                                                                                                         | `false` |
+| Inline Thinking                      | `ui.inlineThinkingMode`                | Display model thinking inline: off or full.                                                                                                                       | `"off"` |
+| Show Thoughts in Title               | `ui.showStatusInTitle`                 | Show Gemini CLI model thoughts in the terminal window title during the working phase                                                                              | `false` |
+| Dynamic Window Title                 | `ui.dynamicWindowTitle`                | Update the terminal window title with current status icons (Ready: ◇, Action Required: ✋, Working: ✦)                                                            | `true`  |
+| Show Home Directory Warning          | `ui.showHomeDirectoryWarning`          | Show a warning when running Gemini CLI in the home directory.                                                                                                     | `true`  |
+| Show Compatibility Warnings          | `ui.showCompatibilityWarnings`         | Show warnings about terminal or OS compatibility issues.                                                                                                          | `true`  |
+| Hide Tips                            | `ui.hideTips`                          | Hide helpful tips in the UI                                                                                                                                       | `false` |
+| Escape Pasted @ Symbols              | `ui.escapePastedAtSymbols`             | When enabled, @ symbols in pasted text are escaped to prevent unintended @path expansion.                                                                         | `false` |
+| Show Shortcuts Hint                  | `ui.showShortcutsHint`                 | Show the "? for shortcuts" hint above the input.                                                                                                                  | `true`  |
+| Compact Tool Output                  | `ui.compactToolOutput`                 | Display tool outputs (like directory listings and file reads) in a compact, structured format.                                                                    | `false` |
+| Hide Banner                          | `ui.hideBanner`                        | Hide the application banner                                                                                                                                       | `false` |
+| Hide Context Summary                 | `ui.hideContextSummary`                | Hide the context summary (GEMINI.md, MCP servers) above the input.                                                                                                | `false` |
+| Hide CWD                             | `ui.footer.hideCWD`                    | Hide the current working directory in the footer.                                                                                                                 | `false` |
+| Hide Sandbox Status                  | `ui.footer.hideSandboxStatus`          | Hide the sandbox status indicator in the footer.                                                                                                                  | `false` |
+| Hide Model Info                      | `ui.footer.hideModelInfo`              | Hide the model name and context usage in the footer.                                                                                                              | `false` |
+| Hide Context Window Percentage       | `ui.footer.hideContextPercentage`      | Hides the context window usage percentage.                                                                                                                        | `true`  |
+| Hide Footer                          | `ui.hideFooter`                        | Hide the footer from the UI                                                                                                                                       | `false` |
+| Show Memory Usage                    | `ui.showMemoryUsage`                   | Display memory usage information in the UI                                                                                                                        | `false` |
+| Show Line Numbers                    | `ui.showLineNumbers`                   | Show line numbers in the chat.                                                                                                                                    | `true`  |
+| Show Citations                       | `ui.showCitations`                     | Show citations for generated text in the chat.                                                                                                                    | `false` |
+| Show Model Info In Chat              | `ui.showModelInfoInChat`               | Show the model name in the chat for each model turn.                                                                                                              | `false` |
+| Show User Identity                   | `ui.showUserIdentity`                  | Show the signed-in user's identity (e.g. email) in the UI.                                                                                                        | `true`  |
+| Use Alternate Screen Buffer          | `ui.useAlternateBuffer`                | Use an alternate screen buffer for the UI, preserving shell history.                                                                                              | `false` |
+| Use Background Color                 | `ui.useBackgroundColor`                | Whether to use background colors in the UI.                                                                                                                       | `true`  |
+| Incremental Rendering                | `ui.incrementalRendering`              | Enable incremental rendering for the UI. This option will reduce flickering but may cause rendering artifacts. Only supported when useAlternateBuffer is enabled. | `true`  |
+| Show Spinner                         | `ui.showSpinner`                       | Show the spinner during operations.                                                                                                                               | `true`  |
+| Loading Phrases                      | `ui.loadingPhrases`                    | What to show while the model is working: tips, witty comments, all, or off.                                                                                       | `"off"` |
+| Error Verbosity                      | `ui.errorVerbosity`                    | Controls whether recoverable errors are hidden (low) or fully shown (full).                                                                                       | `"low"` |
+| Screen Reader Mode                   | `ui.accessibility.screenReader`        | Render output in plain-text to be more screen reader accessible                                                                                                   | `false` |

 ### IDE

@@ -151,21 +153,20 @@ they appear in the UI.

 | UI Label                          | Setting                        | Description                                   | Default |
 | --------------------------------- | ------------------------------ | --------------------------------------------- | ------- |
-| Auto Configure Max Old Space Size | `advanced.autoConfigureMemory` | Automatically configure Node.js memory limits | `false` |
+| Auto Configure Max Old Space Size | `advanced.autoConfigureMemory` | Automatically configure Node.js memory limits | `true`  |

 ### Experimental

-| UI Label                   | Setting                                  | Description                                                                                                                                               | Default |
-| -------------------------- | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
-| Enable Tool Output Masking | `experimental.toolOutputMasking.enabled` | Enables tool output masking to save tokens.                                                                                                               | `true`  |
-| Enable Git Worktrees       | `experimental.worktrees`                 | Enable automated Git worktree management for parallel work.                                                                                               | `false` |
-| Use OSC 52 Paste           | `experimental.useOSC52Paste`             | Use OSC 52 for pasting. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it). | `false` |
-| Use OSC 52 Copy            | `experimental.useOSC52Copy`              | Use OSC 52 for copying. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it). | `false` |
-| Plan                       | `experimental.plan`                      | Enable Plan Mode.                                                                                                                                         | `true`  |
-| Model Steering             | `experimental.modelSteering`             | Enable model steering (user hints) to guide the model during tool execution.                                                                              | `false` |
-| Direct Web Fetch           | `experimental.directWebFetch`            | Enable web fetch behavior that bypasses LLM summarization.                                                                                                | `false` |
-| Memory Manager Agent       | `experimental.memoryManager`             | Replace the built-in save_memory tool with a memory manager subagent that supports adding, removing, de-duplicating, and organizing memories.             | `false` |
-| Topic & Update Narration   | `experimental.topicUpdateNarration`      | Enable the experimental Topic & Update communication model for reduced chattiness and structured progress reporting.                                      | `false` |
+| UI Label                  | Setting                             | Description                                                                                                                                               | Default |
+| ------------------------- | ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| Enable Git Worktrees      | `experimental.worktrees`            | Enable automated Git worktree management for parallel work.                                                                                               | `false` |
+| Use OSC 52 Paste          | `experimental.useOSC52Paste`        | Use OSC 52 for pasting. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it). | `false` |
+| Use OSC 52 Copy           | `experimental.useOSC52Copy`         | Use OSC 52 for copying. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it). | `false` |
+| Model Steering            | `experimental.modelSteering`        | Enable model steering (user hints) to guide the model during tool execution.                                                                              | `false` |
+| Direct Web Fetch          | `experimental.directWebFetch`       | Enable web fetch behavior that bypasses LLM summarization.                                                                                                | `false` |
+| Memory Manager Agent      | `experimental.memoryManager`        | Replace the built-in save_memory tool with a memory manager subagent that supports adding, removing, de-duplicating, and organizing memories.             | `false` |
+| Enable Context Management | `experimental.contextManagement`    | Enable logic for context management.                                                                                                                      | `false` |
+| Topic & Update Narration  | `experimental.topicUpdateNarration` | Enable the experimental Topic & Update communication model for reduced chattiness and structured progress reporting.                                      | `false` |

 ### Skills

@@ -19,6 +19,7 @@ using the `/theme` command within Gemini CLI:
  - `Holiday`
  - `Shades Of Purple`
  - `Solarized Dark`
+  - `Tokyo Night`
 - **Light themes:**
  - `ANSI Light`
  - `Ayu Light`
@@ -252,6 +253,10 @@ identify their source, for example: `shades-of-green (green-extension)`.

 <img src="/docs/assets/theme-solarized-dark.png" alt="Solarized Dark theme" width="600">

+### Tokyo Night
+
+<img src="/docs/assets/theme-tokyonight-dark.png" alt="Tokyo Night theme" width="600">
+
 ## Light themes

 ### ANSI Light
@@ -7,8 +7,8 @@ requests sent from `packages/cli`. For a general overview of Gemini CLI, see the

 ## Navigating this section

- **[Sub-agents (experimental)](./subagents.md):** Learn how to create and use
-  specialized sub-agents for complex tasks.
+- **[Sub-agents](./subagents.md):** Learn how to create and use specialized
+  sub-agents for complex tasks.
 - **[Core tools reference](../reference/tools.md):** Information on how tools
  are defined, registered, and used by the core.
 - **[Memory Import Processor](../reference/memport.md):** Documentation for the
@@ -1,20 +1,16 @@
-# Subagents (experimental)
+# Subagents

 Subagents are specialized agents that operate within your main Gemini CLI
 session. They are designed to handle specific, complex tasks—like deep codebase
 analysis, documentation lookup, or domain-specific reasoning—without cluttering
 the main agent's context or toolset.

-<!-- prettier-ignore -->
-> [!NOTE]
-> Subagents are currently an experimental feature.
-> 
-To use custom subagents, you must ensure they are enabled in your
-`settings.json` (enabled by default):
+Subagents are enabled by default. To disable them, set `enableAgents` to `false`
+in your `settings.json`:

 ```json
 {
-  "experimental": { "enableAgents": true }
+  "experimental": { "enableAgents": false }
 }
 ```

@@ -226,19 +222,65 @@ the `click_at` tool for precise, coordinate-based interactions.
 > The visual agent requires API key or Vertex AI authentication. It is
 > not available when using "Sign in with Google".

+#### Sandbox support
+
+The browser agent adjusts its behavior automatically when running inside a
+sandbox.
+
+##### macOS seatbelt (`sandbox-exec`)
+
+When the CLI runs under the macOS seatbelt sandbox, `persistent` and `isolated`
+session modes are forced to `isolated` with `headless` enabled. This avoids
+permission errors caused by seatbelt file-system restrictions on persistent
+browser profiles. If `sessionMode` is set to `existing`, no override is applied.
+
+##### Container sandboxes (Docker / Podman)
+
+Chrome is not available inside the container, so the browser agent is
+**disabled** unless `sessionMode` is set to `"existing"`. When enabled with
+`existing` mode, the agent automatically connects to Chrome on the host via the
+resolved IP of `host.docker.internal:9222` instead of using local pipe
+discovery. Port `9222` is currently hardcoded and cannot be customized.
+
+To use the browser agent in a Docker sandbox:
+
+1. Start Chrome on the host with remote debugging enabled:
+
+   ```bash
+   # Option A: Launch Chrome from the command line
+   google-chrome --remote-debugging-port=9222
+
+   # Option B: Enable in Chrome settings
+   # Navigate to chrome://inspect/#remote-debugging and enable
+   ```
+
+2. Configure `sessionMode` and allowed domains in your project's
+   `.gemini/settings.json`:
+
+   ```json
+   {
+     "agents": {
+       "overrides": {
+         "browser_agent": { "enabled": true }
+       },
+       "browser": {
+         "sessionMode": "existing",
+         "allowedDomains": ["example.com"]
+       }
+     }
+   }
+   ```
+
+3. Launch the CLI with port forwarding:
+
+   ```bash
+   GEMINI_SANDBOX=docker SANDBOX_PORTS=9222 gemini
+   ```
+
 ## Creating custom subagents

 You can create your own subagents to automate specific workflows or enforce
-specific personas. To use custom subagents, you must enable them in your
-`settings.json`:
-
-```json
-{
-  "experimental": {
-    "enableAgents": true
-  }
-}
-```
+specific personas.

 ### Agent definition files

@@ -290,6 +332,7 @@ it yourself; just report it.
 | `description`  | string | Yes      | Short description of what the agent does. This is visible to the main agent to help it decide when to call this subagent.                                                                                     |
 | `kind`         | string | No       | `local` (default) or `remote`.                                                                                                                                                                                |
 | `tools`        | array  | No       | List of tool names this agent can use. Supports wildcards: `*` (all tools), `mcp_*` (all MCP tools), `mcp_server_*` (all tools from a server). **If omitted, it inherits all tools from the parent session.** |
+| `mcpServers`   | object | No       | Configuration for inline Model Context Protocol (MCP) servers isolated to this specific agent.                                                                                                                |
 | `model`        | string | No       | Specific model to use (e.g., `gemini-3-preview`). Defaults to `inherit` (uses the main session model).                                                                                                        |
 | `temperature`  | number | No       | Model temperature (0.0 - 2.0). Defaults to `1`.                                                                                                                                                               |
 | `max_turns`    | number | No       | Maximum number of conversation turns allowed for this agent before it must return. Defaults to `30`.                                                                                                          |
@@ -317,6 +360,78 @@ Each subagent runs in its own isolated context loop. This means:
  subagents **cannot** call other subagents. If a subagent is granted the `*`
  tool wildcard, it will still be unable to see or invoke other agents.

+## Subagent tool isolation
+
+Subagent tool isolation moves Gemini CLI away from a single global tool
+registry. By providing isolated execution environments, you can ensure that
+subagents only interact with the parts of the system they are designed for. This
+prevents unintended side effects, improves reliability by avoiding state
+contamination, and enables fine-grained permission control.
+
+With this feature, you can:
+
+- **Specify tool access:** Define exactly which tools an agent can access using
+  a `tools` list in the agent definition.
+- **Define inline MCP servers:** Configure Model Context Protocol (MCP) servers
+  (which provide a standardized way to connect AI models to external tools and
+  data sources) directly in the subagent's markdown frontmatter, isolating them
+  to that specific agent.
+- **Maintain state isolation:** Ensure that subagents only interact with their
+  own set of tools and servers, preventing side effects and state contamination.
+- **Apply subagent-specific policies:** Enforce granular rules in your
+  [Policy Engine](../reference/policy-engine.md) TOML configuration based on the
+  executing subagent's name.
+
+### Configuring isolated tools and servers
+
+You can configure tool isolation for a subagent by updating its markdown
+frontmatter. This allows you to explicitly state which tools the subagent can
+use, rather than relying on the global registry.
+
+Add an `mcpServers` object to define inline MCP servers that are unique to the
+agent.
+
+**Example:**
+
+```yaml
+---
+name: my-isolated-agent
+tools:
+  - grep_search
+  - read_file
+mcpServers:
+  my-custom-server:
+    command: 'node'
+    args: ['path/to/server.js']
+---
+```
+
+### Subagent-specific policies
+
+You can enforce fine-grained control over subagents using the
+[Policy Engine's](../reference/policy-engine.md) TOML configuration. This allows
+you to grant or restrict permissions specifically for an agent, without
+affecting the rest of your CLI session.
+
+To restrict a policy rule to a specific subagent, add the `subagent` property to
+the `[[rules]]` block in your `policy.toml` file.
+
+**Example:**
+
+```toml
+[[rules]]
+name = "Allow pr-creator to push code"
+subagent = "pr-creator"
+description = "Permit pr-creator to push branches automatically."
+action = "allow"
+toolName = "run_shell_command"
+commandPrefix = "git push"
+```
+
+In this configuration, the policy rule only triggers if the executing subagent's
+name matches `pr-creator`. Rules without the `subagent` property apply
+universally to all agents.
+
 ## Managing subagents

 You can manage subagents interactively using the `/agents` command or
@@ -406,15 +521,11 @@ If you need to further tune your subagent, you can do so by selecting the model
 to optimize for with `/model` and then asking the model why it does not think
 that your subagent was called with a specific prompt and the given description.

-## Remote subagents (Agent2Agent) (experimental)
+## Remote subagents (Agent2Agent)

 Gemini CLI can also delegate tasks to remote subagents using the Agent-to-Agent
 (A2A) protocol.

-<!-- prettier-ignore -->
-> [!NOTE]
-> Remote subagents are currently an experimental feature.
-
 See the [Remote Subagents documentation](remote-agents) for detailed
 configuration, authentication, and usage instructions.

@@ -1,141 +0,0 @@
-# Gemini CLI examples
-
-Gemini CLI helps you automate common engineering tasks by combining AI reasoning
-with local system tools. This document provides examples of how to use the CLI
-for file management, code analysis, and data transformation.
-
-<!-- prettier-ignore -->
-> [!NOTE]
-> These examples demonstrate potential capabilities. Your actual
-> results can vary based on the model used and your project environment.
-
-## Rename your photographs based on content
-
-You can use Gemini CLI to automate file management tasks that require visual
-analysis. In this example, Gemini CLI renames images based on their actual
-subject matter.
-
-Scenario: You have a folder containing the following files:
-
-```bash
-photos/photo1.png
-photos/photo2.png
-photos/photo3.png
-```
-
-Give Gemini the following prompt:
-
-```cli
-Rename the photos in my "photos" directory based on their contents.
-```
-
-Result: Gemini asks for permission to rename your files.
-
-Select **Allow once** and your files are renamed:
-
-```bash
-photos/yellow_flowers.png
-photos/antique_dresser.png
-photos/green_android_robot.png
-```
-
-## Explain a repository by reading its code
-
-Gemini CLI is effective for rapid codebase exploration. The following example
-shows how to ask Gemini CLI to fetch, analyze, and summarize a remote project.
-
-Scenario: You want to understand how a popular open-source utility works by
-inspecting its code, not just its README.
-
-Give Gemini CLI the following prompt:
-
-```cli
-Clone the 'chalk' repository from https://github.com/chalk/chalk, read its key source files, and explain how it works.
-```
-
-Result: Gemini performs a sequence of actions to answer your request.
-
-1.  First, it asks for permission to run `git clone` to download the repository.
-2.  Next, it finds the important source files and asks for permission to read
-    them.
-3.  Finally, after analyzing the code, it provides a summary.
-
-Gemini CLI returns an explanation based on the actual source code:
-
-```markdown
-The `chalk` library is a popular npm package for styling terminal output with
-colors. After analyzing the source code, here's how it works:
-
- **Core functionality:** The main file sets up a chainable API. Each color or
-  modifier (like `bold` or `italic`) is a getter that appends the corresponding
-  ANSI escape code to an internal stack.
-
- **Chainable API:** When you call `chalk.red.bold('Hello')`, you are accessing
-  getters. The `red` getter adds the red color code, and the `bold` getter adds
-  the bold code.
-
- **Output generation:** When the chain is treated as a string (e.g., in
-  `console.log`), a final `toString()` method is called. This method joins all
-  the stored ANSI codes, wraps them around the input string ('Hello'), and adds
-  a reset code at the end. This produces the final, styled string that the
-  terminal can render.
-```
-
-## Combine two spreadsheets into one spreadsheet
-
-Gemini CLI can process and transform data across multiple files. Use this
-capability to merge reports or reformat data sets without manual copying.
-
-Scenario: You have two .csv files: `Revenue - 2023.csv` and
-`Revenue - 2024.csv`. Each file contains monthly revenue figures.
-
-Give Gemini CLI the following prompt:
-
-```cli
-Combine the two .csv files into a single .csv file, with each year a different column.
-```
-
-Result: Gemini CLI reads each file and then asks for permission to write a new
-file. Provide your permission and Gemini CLI provides the combined data:
-
-```csv
-Month,2023,2024
-January,0,1000
-February,0,1200
-March,0,2400
-April,900,500
-May,1000,800
-June,1000,900
-July,1200,1000
-August,1800,400
-September,2000,2000
-October,2400,3400
-November,3400,1800
-December,2100,9000
-```
-
-## Run unit tests
-
-Gemini CLI can generate boilerplate code and tests based on your existing
-implementation. This example demonstrates how to request code coverage for a
-JavaScript component.
-
-Scenario: You've written a simple login page. You wish to write unit tests to
-ensure that your login page has code coverage.
-
-Give Gemini CLI the following prompt:
-
-```cli
-Write unit tests for Login.js.
-```
-
-Result: Gemini CLI asks for permission to write a new file and creates a test
-for your login page.
-
-## Next steps
-
- Follow the [File management](../cli/tutorials/file-management.md) guide to
-  start working with your codebase.
- Follow the [Quickstart](./index.md) to start your first session.
- See the [Cheatsheet](../cli/cli-reference.md) for a quick reference of
-  available commands.
@@ -1,6 +1,6 @@
 # Gemini 3 Pro and Gemini 3 Flash on Gemini CLI

-Gemini 3 Pro and Gemini 3 Flash are available on Gemini CLI for all users!
+Learn about how you can use Gemini 3 Pro and Gemini 3 Flash on Gemini CLI.

 <!-- prettier-ignore -->
 > [!NOTE]
@@ -24,7 +24,7 @@ Once Gemini CLI is installed, run Gemini CLI from your command line:
 gemini
 ```

-For more installation options, see [Gemini CLI Installation](./installation/).
+For more installation options, see [Gemini CLI Installation](./installation.md).

 ## Authenticate

@@ -62,7 +62,133 @@ Once installed and authenticated, you can start using Gemini CLI by issuing
 commands and prompts in your terminal. Ask it to generate code, explain files,
 and more.

-To explore the power of Gemini CLI, see [Gemini CLI examples](./examples.md).
+<!-- prettier-ignore -->
+> [!NOTE]
+> These examples demonstrate potential capabilities. Your actual
+> results can vary based on the model used and your project environment.
+
+### Rename your photographs based on content
+
+You can use Gemini CLI to automate file management tasks that require visual
+analysis. In this example, Gemini CLI renames images based on their actual
+subject matter.
+
+Scenario: You have a folder containing the following files:
+
+```bash
+photos/photo1.png
+photos/photo2.png
+photos/photo3.png
+```
+
+Give Gemini the following prompt:
+
+```cli
+Rename the photos in my "photos" directory based on their contents.
+```
+
+Result: Gemini asks for permission to rename your files.
+
+Select **Allow once** and your files are renamed:
+
+```bash
+photos/yellow_flowers.png
+photos/antique_dresser.png
+photos/green_android_robot.png
+```
+
+### Explain a repository by reading its code
+
+Gemini CLI is effective for rapid codebase exploration. The following example
+shows how to ask Gemini CLI to fetch, analyze, and summarize a remote project.
+
+Scenario: You want to understand how a popular open-source utility works by
+inspecting its code, not just its README.
+
+Give Gemini CLI the following prompt:
+
+```cli
+Clone the 'chalk' repository from https://github.com/chalk/chalk, read its key source files, and explain how it works.
+```
+
+Result: Gemini performs a sequence of actions to answer your request.
+
+1.  First, it asks for permission to run `git clone` to download the repository.
+2.  Next, it finds the important source files and asks for permission to read
+    them.
+3.  Finally, after analyzing the code, it provides a summary.
+
+Gemini CLI returns an explanation based on the actual source code:
+
+```markdown
+The `chalk` library is a popular npm package for styling terminal output with
+colors. After analyzing the source code, here's how it works:
+
+- **Core functionality:** The main file sets up a chainable API. Each color or
+  modifier (like `bold` or `italic`) is a getter that appends the corresponding
+  ANSI escape code to an internal stack.
+
+- **Chainable API:** When you call `chalk.red.bold('Hello')`, you are accessing
+  getters. The `red` getter adds the red color code, and the `bold` getter adds
+  the bold code.
+
+- **Output generation:** When the chain is treated as a string (e.g., in
+  `console.log`), a final `toString()` method is called. This method joins all
+  the stored ANSI codes, wraps them around the input string ('Hello'), and adds
+  a reset code at the end. This produces the final, styled string that the
+  terminal can render.
+```
+
+### Combine two spreadsheets into one spreadsheet
+
+Gemini CLI can process and transform data across multiple files. Use this
+capability to merge reports or reformat data sets without manual copying.
+
+Scenario: You have two .csv files: `Revenue - 2023.csv` and
+`Revenue - 2024.csv`. Each file contains monthly revenue figures.
+
+Give Gemini CLI the following prompt:
+
+```cli
+Combine the two .csv files into a single .csv file, with each year a different column.
+```
+
+Result: Gemini CLI reads each file and then asks for permission to write a new
+file. Provide your permission and Gemini CLI provides the combined data:
+
+```csv
+Month,2023,2024
+January,0,1000
+February,0,1200
+March,0,2400
+April,900,500
+May,1000,800
+June,1000,900
+July,1200,1000
+August,1800,400
+September,2000,2000
+October,2400,3400
+November,3400,1800
+December,2100,9000
+```
+
+### Run unit tests
+
+Gemini CLI can generate boilerplate code and tests based on your existing
+implementation. This example demonstrates how to request code coverage for a
+JavaScript component.
+
+Scenario: You've written a simple login page. You wish to write unit tests to
+ensure that your login page has code coverage.
+
+Give Gemini CLI the following prompt:
+
+```cli
+Write unit tests for Login.js.
+```
+
+Result: Gemini CLI asks for permission to write a new file and creates a test
+for your login page.

 ## Check usage and quota

@@ -23,33 +23,34 @@ installation methods, and release types.
 We recommend most users install Gemini CLI using one of the following
 installation methods:

-{% tabs %}
-{% tabitem label="npm" %}
-Install globally with npm:
+- npm
+- Homebrew
+- MacPorts
+- Anaconda
+
+Note that Gemini CLI comes pre-installed on
+[**Cloud Shell**](https://docs.cloud.google.com/shell/docs) and
+[**Cloud Workstations**](https://cloud.google.com/workstations).
+
+### Install globally with npm

 ```bash
 npm install -g @google/gemini-cli
 ```
-{% /tabitem %}

-{% tabitem label="Homebrew" %}
-Install globally with Homebrew (macOS/Linux):
+### Install globally with Homebrew (macOS/Linux)

 ```bash
 brew install gemini-cli
 ```
-{% /tabitem %}

-{% tabitem label="MacPorts" %}
-Install globally with MacPorts (macOS):
+### Install globally with MacPorts (macOS)

 ```bash
 sudo port install gemini-cli
 ```
-{% /tabitem %}

-{% tabitem label="Anaconda" %}
-Install with Anaconda (for restricted environments):
+### Install with Anaconda (for restricted environments)

 ```bash
 # Create and activate a new environment
@@ -59,12 +60,6 @@ conda activate gemini_env
 # Install Gemini CLI globally via npm (inside the environment)
 npm install -g @google/gemini-cli
 ```
-{% /tabitem %}
-{% /tabs %}
-
-Note that Gemini CLI comes pre-installed on
-[**Cloud Shell**](https://docs.cloud.google.com/shell/docs) and
-[**Cloud Workstations**](https://cloud.google.com/workstations).

 ## Run Gemini CLI

@@ -107,7 +102,7 @@ the default way that the CLI executes tools that might have side effects.
  to run the CLI.
  ```bash
  # Run the published sandbox image
-  docker run --rm -it us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:latest
+  docker run --rm -it us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.1.1
  ```
 - **Using the `--sandbox` flag:** If you have Gemini CLI installed locally
  (using the standard installation described above), you can instruct it to run
@@ -1,157 +0,0 @@
-# Gemini CLI installation, execution, and releases
-
-This document provides an overview of Gemini CLI's system requirements,
-installation methods, and release types.
-
-## Recommended system specifications
-
- **Operating System:**
-  - macOS 15+
-  - Windows 11 24H2+
-  - Ubuntu 20.04+
- **Hardware:**
-  - "Casual" usage: 4GB+ RAM (short sessions, common tasks and edits)
-  - "Power" usage: 16GB+ RAM (long sessions, large codebases, deep context)
- **Runtime:** Node.js 20.0.0+
- **Shell:** Bash, Zsh, or PowerShell
- **Location:**
-  [Gemini Code Assist supported locations](https://developers.google.com/gemini-code-assist/resources/available-locations#americas)
- **Internet connection required**
-
-## Install Gemini CLI
-
-We recommend most users install Gemini CLI using one of the following
-installation methods:
-
-<Tabs>
-  <TabItem label="npm">
-  Install globally with npm:
-
-  ```bash
-  npm install -g @google/gemini-cli
-  ```
-  </TabItem>
-  <TabItem label="Homebrew">
-  Install globally with Homebrew (macOS/Linux):
-
-  ```bash
-  brew install gemini-cli
-  ```
-  </TabItem>
-</Tabs>
-
-Note that Gemini CLI comes pre-installed on
-[**Cloud Shell**](https://docs.cloud.google.com/shell/docs) and
-[**Cloud Workstations**](https://cloud.google.com/workstations).
-
-## Run Gemini CLI
-
-For most users, we recommend running Gemini CLI with the `gemini` command:
-
-```bash
-gemini
-```
-
-For a list of options and additional commands, see the
-[CLI cheatsheet](../cli/cli-reference.md).
-
-You can also run Gemini CLI using one of the following advanced methods:
-
- Run instantly with npx. You can run Gemini CLI without permanent installation.
- In a sandbox. This method offers increased security and isolation.
- From the source. This is recommended for contributors to the project.
-
-### Run instantly with npx
-
-```bash
-# Using npx (no installation required)
-npx @google/gemini-cli
-```
-
-You can also execute the CLI directly from the main branch on GitHub, which is
-helpful for testing features still in development:
-
-```bash
-npx https://github.com/google-gemini/gemini-cli
-```
-
-### Run in a sandbox (Docker/Podman)
-
-For security and isolation, Gemini CLI can be run inside a container. This is
-the default way that the CLI executes tools that might have side effects.
-
- **Directly from the registry:** You can run the published sandbox image
-  directly. This is useful for environments where you only have Docker and want
-  to run the CLI.
-  ```bash
-  # Run the published sandbox image
-  docker run --rm -it us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:latest
-  ```
- **Using the `--sandbox` flag:** If you have Gemini CLI installed locally
-  (using the standard installation described above), you can instruct it to run
-  inside the sandbox container.
-  ```bash
-  gemini --sandbox -y -p "your prompt here"
-  ```
-
-### Run from source (recommended for Gemini CLI contributors)
-
-Contributors to the project will want to run the CLI directly from the source
-code.
-
- **Development mode:** This method provides hot-reloading and is useful for
-  active development.
-  ```bash
-  # From the root of the repository
-  npm run start
-  ```
- **Production-like mode (linked package):** This method simulates a global
-  installation by linking your local package. It's useful for testing a local
-  build in a production workflow.
-
-  ```bash
-  # Link the local cli package to your global node_modules
-  npm link packages/cli
-
-  # Now you can run your local version using the `gemini` command
-  gemini
-  ```
-
-## Releases
-
-Gemini CLI has three release channels: nightly, preview, and stable. For most
-users, we recommend the stable release, which is the default installation.
-
-### Stable
-
-New stable releases are published each week. The stable release is the promotion
-of last week's `preview` release along with any bug fixes. The stable release
-uses `latest` tag, but omitting the tag also installs the latest stable release
-by default:
-
-```bash
-# Both commands install the latest stable release.
-npm install -g @google/gemini-cli
-npm install -g @google/gemini-cli@latest
-```
-
-### Preview
-
-New preview releases will be published each week. These releases are not fully
-vetted and may contain regressions or other outstanding issues. Try out the
-preview release by using the `preview` tag:
-
-```bash
-npm install -g @google/gemini-cli@preview
-```
-
-### Nightly
-
-Nightly releases are published every day. The nightly release includes all
-changes from the main branch at time of release. It should be assumed there are
-pending validations and issues. You can help test the latest changes by
-installing with the `nightly` tag:
-
-```bash
-npm install -g @google/gemini-cli@nightly
-```
@@ -1,15 +1,29 @@
-# IDE integration
+# IDE Integration

 Gemini CLI can integrate with your IDE to provide a more seamless and
 context-aware experience. This integration allows the CLI to understand your
 workspace better and enables powerful features like native in-editor diffing.

-Currently, the supported IDEs are [Antigravity](https://antigravity.google),
-[Visual Studio Code](https://code.visualstudio.com/), and other editors that
-support VS Code extensions. To build support for other editors, see the
-[IDE Companion Extension Spec](./ide-companion-spec.md).
+There are two primary ways to integrate Gemini CLI with an IDE:

-## Features
+1.  **VS Code companion extension**: Install the "Gemini CLI Companion"
+    extension on [Antigravity](https://antigravity.google),
+    [Visual Studio Code](https://code.visualstudio.com/), or other VS Code
+    compatible editors.
+2.  **Agent Client Protocol (ACP)**: An open protocol for interoperability
+    between AI coding agents and IDEs. This method is used for integrations with
+    tools like JetBrains and Zed, which leverage the ACP Agent Registry for easy
+    discovery and installation of compatible agents like Gemini CLI.
+
+## VS Code companion extension
+
+The **Gemini CLI Companion extension** grants Gemini CLI direct access to your
+VS Code compatible IDEs and improves your experience by providing real-time
+context such as open files, cursor positions, and text selection. The extension
+also enables a native diffing interface so you can seamlessly review and apply
+AI-generated code changes directly within your editor.
+
+### Features

 - **Workspace context:** The CLI automatically gains awareness of your workspace
  to provide more relevant and accurate responses. This context includes:
@@ -19,8 +33,8 @@ support VS Code extensions. To build support for other editors, see the
    truncated).

 - **Native diffing:** When Gemini suggests code modifications, you can view the
-  changes directly within your IDE's native diff viewer. This allows you to
-  review, edit, and accept or reject the suggested changes seamlessly.
+  changes directly within your IDE's native diff viewer. This lets you review,
+  edit, and accept or reject the suggested changes seamlessly.

 - **VS Code commands:** You can access Gemini CLI features directly from the VS
  Code Command Palette (`Cmd+Shift+P` or `Ctrl+Shift+P`):
@@ -32,18 +46,18 @@ support VS Code extensions. To build support for other editors, see the
  - `Gemini CLI: View Third-Party Notices`: Displays the third-party notices for
    the extension.

-## Installation and setup
+### Installation and setup

 There are three ways to set up the IDE integration:

-### 1. Automatic nudge (recommended)
+#### 1. Automatic nudge (recommended)

 When you run Gemini CLI inside a supported editor, it will automatically detect
 your environment and prompt you to connect. Answering "Yes" will automatically
 run the necessary setup, which includes installing the companion extension and
 enabling the connection.

-### 2. Manual installation from CLI
+#### 2. Manual installation from CLI

 If you previously dismissed the prompt or want to install the extension
 manually, you can run the following command inside Gemini CLI:
@@ -54,7 +68,7 @@ manually, you can run the following command inside Gemini CLI:

 This will find the correct extension for your IDE and install it.

-### 3. Manual installation from a marketplace
+#### 3. Manual installation from a marketplace

 You can also install the extension directly from a marketplace.

@@ -75,9 +89,9 @@ You can also install the extension directly from a marketplace.
 > After manually installing the extension, you must run `/ide enable` in the CLI
 > to activate the integration.

-## Usage
+### Usage

-### Enabling and disabling
+#### Enabling and disabling

 You can control the IDE integration from within the CLI:

@@ -93,7 +107,7 @@ You can control the IDE integration from within the CLI:
 When enabled, Gemini CLI will automatically attempt to connect to the IDE
 companion extension.

-### Checking the status
+#### Checking the status

 To check the connection status and see the context the CLI has received from the
 IDE, run:
@@ -108,9 +122,9 @@ recently opened files it is aware of.
 <!-- prettier-ignore -->
 > [!NOTE]
 > The file list is limited to 10 recently accessed files within your
-> workspace and only includes local files on disk.)
+> workspace and only includes local files on disk.

-### Working with diffs
+#### Working with diffs

 When you ask Gemini to modify a file, it can open a diff view directly in your
 editor.
@@ -135,6 +149,63 @@ accepting them.
 If you select ‘Allow for this session’ in the CLI, changes will no longer show
 up in the IDE as they will be auto-accepted.

+## Agent Client Protocol (ACP)
+
+ACP is an open protocol that standardizes how AI coding agents communicate with
+code editors and IDEs. It addresses the challenge of fragmented distribution,
+where agents traditionally needed custom integrations for each client. With ACP,
+developers can implement their agent once, and it becomes compatible with any
+ACP-compliant editor.
+
+For a comprehensive introduction to ACP, including its architecture and
+benefits, refer to the official
+[ACP Introduction](https://agentclientprotocol.com/get-started/introduction)
+documentation.
+
+### The ACP Agent Registry
+
+Gemini CLI is officially available in the **ACP Agent Registry**. This allows
+you to install and update Gemini CLI directly within supporting IDEs and
+eliminates the need for manual downloads or IDE-specific extensions.
+
+Using the registry ensures:
+
+- **Ease of use**: Discover and install agents directly within your IDE
+  settings.
+- **Latest versions**: Ensures users always have access to the most up-to-date
+  agent implementations.
+
+For more details on how the registry works, visit the official
+[ACP Agent Registry](https://agentclientprotocol.com/get-started/registry) page.
+You can learn about how specific IDEs leverage this integration in the following
+section.
+
+### IDE-specific integration
+
+Gemini CLI is an ACP-compatible agent available in the ACP Agent Registry.
+Here’s how different IDEs leverage the ACP and the registry:
+
+#### JetBrains IDEs
+
+JetBrains IDEs (like IntelliJ IDEA, PyCharm, or GoLand) offer built-in registry
+support, allowing users to find and install ACP-compatible agents directly.
+
+For more details, refer to the official
+[JetBrains AI Blog announcement](https://blog.jetbrains.com/ai/2026/01/acp-agent-registry/).
+
+#### Zed
+
+Zed, a modern code editor, also integrates with the ACP Agent Registry. This
+allows Zed users to easily browse, install, and manage ACP agents.
+
+Learn more about Zed's integration with the ACP Registry in their
+[blog post](https://zed.dev/blog/acp-registry).
+
+#### Other ACP-compatible IDEs
+
+Any other IDE that supports the ACP Agent Registry can install Gemini CLI
+directly through their in-built registry features.
+
 ## Using with sandboxing

 If you are using Gemini CLI within a sandbox, please be aware of the following:
@@ -151,10 +222,9 @@ If you are using Gemini CLI within a sandbox, please be aware of the following:

 ## Troubleshooting

-If you encounter issues with IDE integration, here are some common error
-messages and how to resolve them.
+### VS Code companion extension errors

-### Connection errors
+#### Connection errors

 - **Message:**
  `🔴 Disconnected: Failed to connect to IDE companion extension in [IDE Name]. Please ensure the extension is running. To install the extension, run /ide install.`
@@ -174,7 +244,7 @@ messages and how to resolve them.
  - **Solution:** Run `/ide enable` to try and reconnect. If the issue
    continues, open a new terminal window or restart your IDE.

-### Manual PID override
+#### Manual PID override

 If automatic IDE detection fails, or if you are running Gemini CLI in a
 standalone terminal and want to manually associate it with a specific IDE
@@ -196,7 +266,7 @@ $env:GEMINI_CLI_IDE_PID=12345
 When this variable is set, Gemini CLI will skip automatic detection and attempt
 to connect using the provided PID.

-### Configuration errors
+#### Configuration errors

 - **Message:**
  `🔴 Disconnected: Directory mismatch. Gemini CLI is running in a different location than the open workspace in [IDE Name]. Please run the CLI from one of the following directories: [List of directories]`
@@ -210,7 +280,7 @@ to connect using the provided PID.
  - **Cause:** You have no workspace open in your IDE.
  - **Solution:** Open a workspace in your IDE and restart the CLI.

-### General errors
+#### General errors

 - **Message:**
  `IDE integration is not supported in your current environment. To use this feature, run Gemini CLI in one of these supported IDEs: [List of IDEs]`
@@ -220,9 +290,14 @@ to connect using the provided PID.
    IDE, like Antigravity or VS Code.

 - **Message:**
-  `No installer is available for IDE. Please install the Gemini CLI Companion extension manually from the marketplace.`
+  `No installer is available for IDE. Please install Gemini CLI Companion extension manually from the marketplace.`
  - **Cause:** You ran `/ide install`, but the CLI does not have an automated
    installer for your specific IDE.
  - **Solution:** Open your IDE's extension marketplace, search for "Gemini CLI
    Companion", and
    [install it manually](#3-manual-installation-from-a-marketplace).
+
+### ACP integration errors
+
+For issues related to ACP integration, please refer to the debugging and
+telemetry section in the [ACP Mode](../cli/acp-mode.md) documentation.
@@ -15,12 +15,10 @@ npm install -g @google/gemini-cli
 Jump in to Gemini CLI.

 - **[Quickstart](./get-started/index.md):** Your first session with Gemini CLI.
- **[Installation](./get-started/installation/):** How to install Gemini CLI on
-  your system.
+- **[Installation](./get-started/installation.md):** How to install Gemini CLI
+  on your system.
 - **[Authentication](./get-started/authentication.md):** Setup instructions for
  personal and enterprise accounts.
- **[Examples](./get-started/examples.md):** Practical examples of Gemini CLI in
-  action.
 - **[CLI cheatsheet](./cli/cli-reference.md):** A quick reference for common
  commands and options.
 - **[Gemini 3 on Gemini CLI](./get-started/gemini-3.md):** Learn about Gemini 3
@@ -13,6 +13,7 @@
  "/docs/faq": "/docs/resources/faq",
  "/docs/get-started/configuration": "/docs/reference/configuration",
  "/docs/get-started/configuration-v1": "/docs/reference/configuration",
+  "/docs/get-started/examples": "/docs/get-started/index",
  "/docs/index": "/docs",
  "/docs/quota-and-pricing": "/docs/resources/quota-and-pricing",
  "/docs/tos-privacy": "/docs/resources/tos-privacy",
@@ -17,8 +17,6 @@ Slash commands provide meta-level control over the CLI itself.
 ### `/agents`

 - **Description:** Manage local and remote subagents.
- **Note:** This command is experimental and requires
-  `experimental.enableAgents: true` in your `settings.json`.
 - **Sub-commands:**
  - **`list`**:
    - **Description:** Lists all discovered agents, including built-in, local,
@@ -305,7 +303,7 @@ Slash commands provide meta-level control over the CLI itself.
 - **Description:** Switch to Plan Mode (read-only) and view the current plan if
  one has been generated.
  - **Note:** This feature is enabled by default. It can be disabled via the
-    `experimental.plan` setting in your configuration.
+    `general.plan.enabled` setting in your configuration.
 - **Sub-commands:**
  - **`copy`**:
    - **Description:** Copy the currently approved plan to your clipboard.
@@ -133,7 +133,7 @@ their corresponding top-level category object in your `settings.json` file.

 - **`general.enableNotifications`** (boolean):
  - **Description:** Enable run-event notifications for action-required prompts
-    and session completion. Currently macOS only.
+    and session completion.
  - **Default:** `false`

 - **`general.checkpointing.enabled`** (boolean):
@@ -141,6 +141,11 @@ their corresponding top-level category object in your `settings.json` file.
  - **Default:** `false`
  - **Requires restart:** Yes

+- **`general.plan.enabled`** (boolean):
+  - **Description:** Enable Plan Mode for read-only safety during planning.
+  - **Default:** `true`
+  - **Requires restart:** Yes
+
 - **`general.plan.directory`** (string):
  - **Description:** The directory where planning artifacts are stored. If not
    specified, defaults to the system temporary directory. A custom directory
@@ -257,6 +262,11 @@ their corresponding top-level category object in your `settings.json` file.
  - **Description:** Show the "? for shortcuts" hint above the input.
  - **Default:** `true`

+- **`ui.compactToolOutput`** (boolean):
+  - **Description:** Display tool outputs (like directory listings and file
+    reads) in a compact, structured format.
+  - **Default:** `false`
+
 - **`ui.hideBanner`** (boolean):
  - **Description:** Hide the application banner
  - **Default:** `false`
@@ -344,8 +354,8 @@ their corresponding top-level category object in your `settings.json` file.

 - **`ui.loadingPhrases`** (enum):
  - **Description:** What to show while the model is working: tips, witty
-    comments, both, or nothing.
-  - **Default:** `"tips"`
+    comments, all, or off.
+  - **Default:** `"off"`
  - **Values:** `"tips"`, `"witty"`, `"all"`, `"off"`

 - **`ui.errorVerbosity`** (enum):
@@ -670,6 +680,11 @@ their corresponding top-level category object in your `settings.json` file.
        "modelConfig": {
          "model": "gemini-3-pro-preview"
        }
+      },
+      "agent-history-provider-summarizer": {
+        "modelConfig": {
+          "model": "gemini-3-flash-preview"
+        }
      }
    }
    ```
@@ -1282,6 +1297,18 @@ their corresponding top-level category object in your `settings.json` file.
  - **Description:** Maximum number of directories to search for memory.
  - **Default:** `200`

+- **`context.memoryBoundaryMarkers`** (array):
+  - **Description:** File or directory names that mark the boundary for
+    GEMINI.md discovery. The upward traversal stops at the first directory
+    containing any of these markers. An empty array disables parent traversal.
+  - **Default:**
+
+    ```json
+    [".git"]
+    ```
+
+  - **Requires restart:** Yes
+
 - **`context.includeDirectories`** (array):
  - **Description:** Additional directories to include in the workspace context.
    Missing directories will be skipped with a warning.
@@ -1349,6 +1376,14 @@ their corresponding top-level category object in your `settings.json` file.
  - **Default:** `true`
  - **Requires restart:** Yes

+- **`tools.shell.backgroundCompletionBehavior`** (enum):
+  - **Description:** Controls what happens when a background shell command
+    finishes. 'silent' (default): quietly exits in background. 'inject':
+    automatically returns output to agent. 'notify': shows brief message in
+    chat.
+  - **Default:** `"silent"`
+  - **Values:** `"silent"`, `"inject"`, `"notify"`
+
 - **`tools.shell.pager`** (string):
  - **Description:** The pager command to use for shell output. Defaults to
    `cat`.
@@ -1530,7 +1565,7 @@ their corresponding top-level category object in your `settings.json` file.

 - **`advanced.autoConfigureMemory`** (boolean):
  - **Description:** Automatically configure Node.js memory limits
-  - **Default:** `false`
+  - **Default:** `true`
  - **Requires restart:** Yes

 - **`advanced.dnsResolutionOrder`** (string):
@@ -1552,26 +1587,9 @@ their corresponding top-level category object in your `settings.json` file.

 #### `experimental`

- **`experimental.toolOutputMasking.enabled`** (boolean):
-  - **Description:** Enables tool output masking to save tokens.
-  - **Default:** `true`
-  - **Requires restart:** Yes
-
- **`experimental.toolOutputMasking.toolProtectionThreshold`** (number):
-  - **Description:** Minimum number of tokens to protect from masking (most
-    recent tool outputs).
-  - **Default:** `50000`
-  - **Requires restart:** Yes
-
- **`experimental.toolOutputMasking.minPrunableTokensThreshold`** (number):
-  - **Description:** Minimum prunable tokens required to trigger a masking pass.
-  - **Default:** `30000`
-  - **Requires restart:** Yes
-
- **`experimental.toolOutputMasking.protectLatestTurn`** (boolean):
-  - **Description:** Ensures the absolute latest turn is never masked,
-    regardless of token count.
-  - **Default:** `true`
+- **`experimental.adk.agentSessionNoninteractiveEnabled`** (boolean):
+  - **Description:** Enable non-interactive agent sessions.
+  - **Default:** `false`
  - **Requires restart:** Yes

 - **`experimental.enableAgents`** (boolean):
@@ -1612,7 +1630,7 @@ their corresponding top-level category object in your `settings.json` file.

 - **`experimental.jitContext`** (boolean):
  - **Description:** Enable Just-In-Time (JIT) context loading.
-  - **Default:** `true`
+  - **Default:** `false`
  - **Requires restart:** Yes

 - **`experimental.useOSC52Paste`** (boolean):
@@ -1627,11 +1645,6 @@ their corresponding top-level category object in your `settings.json` file.
    configured to allow it).
  - **Default:** `false`

- **`experimental.plan`** (boolean):
-  - **Description:** Enable Plan Mode.
-  - **Default:** `true`
-  - **Requires restart:** Yes
-
 - **`experimental.taskTracker`** (boolean):
  - **Description:** Enable task tracker tools.
  - **Default:** `false`
@@ -1677,6 +1690,11 @@ their corresponding top-level category object in your `settings.json` file.
  - **Default:** `false`
  - **Requires restart:** Yes

+- **`experimental.contextManagement`** (boolean):
+  - **Description:** Enable logic for context management.
+  - **Default:** `false`
+  - **Requires restart:** Yes
+
 - **`experimental.topicUpdateNarration`** (boolean):
  - **Description:** Enable the experimental Topic & Update communication model
    for reduced chattiness and structured progress reporting.
@@ -1768,6 +1786,69 @@ their corresponding top-level category object in your `settings.json` file.
    prioritize available tools dynamically.
  - **Default:** `[]`

+#### `contextManagement`
+
+- **`contextManagement.historyWindow.maxTokens`** (number):
+  - **Description:** The number of tokens to allow before triggering
+    compression.
+  - **Default:** `150000`
+  - **Requires restart:** Yes
+
+- **`contextManagement.historyWindow.retainedTokens`** (number):
+  - **Description:** The number of tokens to always retain.
+  - **Default:** `40000`
+  - **Requires restart:** Yes
+
+- **`contextManagement.messageLimits.normalMaxTokens`** (number):
+  - **Description:** The target number of tokens to budget for a normal
+    conversation turn.
+  - **Default:** `2500`
+  - **Requires restart:** Yes
+
+- **`contextManagement.messageLimits.retainedMaxTokens`** (number):
+  - **Description:** The maximum number of tokens a single conversation turn can
+    consume before truncation.
+  - **Default:** `12000`
+  - **Requires restart:** Yes
+
+- **`contextManagement.messageLimits.normalizationHeadRatio`** (number):
+  - **Description:** The ratio of tokens to retain from the beginning of a
+    truncated message (0.0 to 1.0).
+  - **Default:** `0.25`
+  - **Requires restart:** Yes
+
+- **`contextManagement.tools.distillation.maxOutputTokens`** (number):
+  - **Description:** Maximum tokens to show to the model when truncating large
+    tool outputs.
+  - **Default:** `10000`
+  - **Requires restart:** Yes
+
+- **`contextManagement.tools.distillation.summarizationThresholdTokens`**
+  (number):
+  - **Description:** Threshold above which truncated tool outputs will be
+    summarized by an LLM.
+  - **Default:** `20000`
+  - **Requires restart:** Yes
+
+- **`contextManagement.tools.outputMasking.protectionThresholdTokens`**
+  (number):
+  - **Description:** Minimum number of tokens to protect from masking (most
+    recent tool outputs).
+  - **Default:** `50000`
+  - **Requires restart:** Yes
+
+- **`contextManagement.tools.outputMasking.minPrunableThresholdTokens`**
+  (number):
+  - **Description:** Minimum prunable tokens required to trigger a masking pass.
+  - **Default:** `30000`
+  - **Requires restart:** Yes
+
+- **`contextManagement.tools.outputMasking.protectLatestTurn`** (boolean):
+  - **Description:** Ensures the absolute latest turn is never masked,
+    regardless of token count.
+  - **Default:** `true`
+  - **Requires restart:** Yes
+
 #### `admin`

 - **`admin.secureModeEnabled`** (boolean):
@@ -2160,37 +2241,14 @@ You can customize this behavior in your `settings.json` file:
 Arguments passed directly when running the CLI can override other configurations
 for that specific session.

- **`--model <model_name>`** (**`-m <model_name>`**):
-  - Specifies the Gemini model to use for this session.
-  - Example: `npm start -- --model gemini-3-pro-preview`
- **`--prompt <your_prompt>`** (**`-p <your_prompt>`**):
-  - **Deprecated:** Use positional arguments instead.
-  - Used to pass a prompt directly to the command. This invokes Gemini CLI in a
-    non-interactive mode.
- **`--prompt-interactive <your_prompt>`** (**`-i <your_prompt>`**):
-  - Starts an interactive session with the provided prompt as the initial input.
-  - The prompt is processed within the interactive session, not before it.
-  - Cannot be used when piping input from stdin.
-  - Example: `gemini -i "explain this code"`
- **`--output-format <format>`**:
-  - **Description:** Specifies the format of the CLI output for non-interactive
-    mode.
-  - **Values:**
-    - `text`: (Default) The standard human-readable output.
-    - `json`: A machine-readable JSON output.
-    - `stream-json`: A streaming JSON output that emits real-time events.
-  - **Note:** For structured output and scripting, use the
-    `--output-format json` or `--output-format stream-json` flag.
- **`--sandbox`** (**`-s`**):
-  - Enables sandbox mode for this session.
- **`--debug`** (**`-d`**):
-  - Enables debug mode for this session, providing more verbose output. Open the
-    debug console with F12 to see the additional logging.
-
- **`--help`** (or **`-h`**):
-  - Displays help information about command-line arguments.
- **`--yolo`**:
-  - Enables YOLO mode, which automatically approves all tool calls.
+- **`--acp`**:
+  - Starts the agent in Agent Communication Protocol (ACP) mode.
+- **`--allowed-mcp-server-names`**:
+  - A comma-separated list of MCP server names to allow for the session.
+- **`--allowed-tools <tool1,tool2,...>`**:
+  - A comma-separated list of tool names that will bypass the confirmation
+    dialog.
+  - Example: `gemini --allowed-tools "ShellTool(git status)"`
 - **`--approval-mode <mode>`**:
  - Sets the approval mode for tool calls. Available modes:
    - `default`: Prompt for approval on each tool call (default behavior)
@@ -2204,35 +2262,24 @@ for that specific session.
  - Cannot be used together with `--yolo`. Use `--approval-mode=yolo` instead of
    `--yolo` for the new unified approach.
  - Example: `gemini --approval-mode auto_edit`
- **`--allowed-tools <tool1,tool2,...>`**:
-  - A comma-separated list of tool names that will bypass the confirmation
-    dialog.
-  - Example: `gemini --allowed-tools "ShellTool(git status)"`
- **`--extensions <extension_name ...>`** (**`-e <extension_name ...>`**):
-  - Specifies a list of extensions to use for the session. If not provided, all
-    available extensions are used.
-  - Use the special term `gemini -e none` to disable all extensions.
-  - Example: `gemini -e my-extension -e my-other-extension`
- **`--list-extensions`** (**`-l`**):
-  - Lists all available extensions and exits.
- **`--resume [session_id]`** (**`-r [session_id]`**):
-  - Resume a previous chat session. Use "latest" for the most recent session,
-    provide a session index number, or provide a full session UUID.
-  - If no session_id is provided, defaults to "latest".
-  - Example: `gemini --resume 5` or `gemini --resume latest` or
-    `gemini --resume a1b2c3d4-e5f6-7890-abcd-ef1234567890` or `gemini --resume`
-  - See [Session Management](../cli/session-management.md) for more details.
- **`--list-sessions`**:
-  - List all available chat sessions for the current project and exit.
-  - Shows session indices, dates, message counts, and preview of first user
-    message.
-  - Example: `gemini --list-sessions`
+- **`--debug`** (**`-d`**):
+  - Enables debug mode for this session, providing more verbose output. Open the
+    debug console with F12 to see the additional logging.
 - **`--delete-session <identifier>`**:
  - Delete a specific chat session by its index number or full session UUID.
  - Use `--list-sessions` first to see available sessions, their indices, and
    UUIDs.
  - Example: `gemini --delete-session 3` or
    `gemini --delete-session a1b2c3d4-e5f6-7890-abcd-ef1234567890`
+- **`--extensions <extension_name ...>`** (**`-e <extension_name ...>`**):
+  - Specifies a list of extensions to use for the session. If not provided, all
+    available extensions are used.
+  - Use the special term `gemini -e none` to disable all extensions.
+  - Example: `gemini -e my-extension -e my-other-extension`
+- **`--fake-responses`**:
+  - Path to a file with fake model responses for testing.
+- **`--help`** (or **`-h`**):
+  - Displays help information about command-line arguments.
 - **`--include-directories <dir1,dir2,...>`**:
  - Includes additional directories in the workspace for multi-directory
    support.
@@ -2240,19 +2287,52 @@ for that specific session.
  - 5 directories can be added at maximum.
  - Example: `--include-directories /path/to/project1,/path/to/project2` or
    `--include-directories /path/to/project1 --include-directories /path/to/project2`
+- **`--list-extensions`** (**`-l`**):
+  - Lists all available extensions and exits.
+- **`--list-sessions`**:
+  - List all available chat sessions for the current project and exit.
+  - Shows session indices, dates, message counts, and preview of first user
+    message.
+  - Example: `gemini --list-sessions`
+- **`--model <model_name>`** (**`-m <model_name>`**):
+  - Specifies the Gemini model to use for this session.
+  - Example: `npm start -- --model gemini-3-pro-preview`
+- **`--output-format <format>`**:
+  - **Description:** Specifies the format of the CLI output for non-interactive
+    mode.
+  - **Values:**
+    - `text`: (Default) The standard human-readable output.
+    - `json`: A machine-readable JSON output.
+    - `stream-json`: A streaming JSON output that emits real-time events.
+  - **Note:** For structured output and scripting, use the
+    `--output-format json` or `--output-format stream-json` flag.
+- **`--prompt <your_prompt>`** (**`-p <your_prompt>`**):
+  - **Deprecated:** Use positional arguments instead.
+  - Used to pass a prompt directly to the command. This invokes Gemini CLI in a
+    non-interactive mode.
+- **`--prompt-interactive <your_prompt>`** (**`-i <your_prompt>`**):
+  - Starts an interactive session with the provided prompt as the initial input.
+  - The prompt is processed within the interactive session, not before it.
+  - Cannot be used when piping input from stdin.
+  - Example: `gemini -i "explain this code"`
+- **`--record-responses`**:
+  - Path to a file to record model responses for testing.
+- **`--resume [session_id]`** (**`-r [session_id]`**):
+  - Resume a previous chat session. Use "latest" for the most recent session,
+    provide a session index number, or provide a full session UUID.
+  - If no session_id is provided, defaults to "latest".
+  - Example: `gemini --resume 5` or `gemini --resume latest` or
+    `gemini --resume a1b2c3d4-e5f6-7890-abcd-ef1234567890` or `gemini --resume`
+  - See [Session Management](../cli/session-management.md) for more details.
+- **`--sandbox`** (**`-s`**):
+  - Enables sandbox mode for this session.
 - **`--screen-reader`**:
  - Enables screen reader mode, which adjusts the TUI for better compatibility
    with screen readers.
 - **`--version`**:
  - Displays the version of the CLI.
- **`--experimental-acp`**:
-  - Starts the agent in ACP mode.
- **`--allowed-mcp-server-names`**:
-  - Allowed MCP server names.
- **`--fake-responses`**:
-  - Path to a file with fake model responses for testing.
- **`--record-responses`**:
-  - Path to a file to record model responses for testing.
+- **`--yolo`**:
+  - Enables YOLO mode, which automatically approves all tool calls.

 ## Context files (hierarchical instructional context)

@@ -86,12 +86,13 @@ available combinations.

 #### Text Input

-| Command                    | Action                                                     | Keys                                                                                |
-| -------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------- |
-| `input.submit`             | Submit the current prompt.                                 | `Enter`                                                                             |
-| `input.newline`            | Insert a newline without submitting.                       | `Ctrl+Enter`<br />`Cmd/Win+Enter`<br />`Alt+Enter`<br />`Shift+Enter`<br />`Ctrl+J` |
-| `input.openExternalEditor` | Open the current prompt or the plan in an external editor. | `Ctrl+X`                                                                            |
-| `input.paste`              | Paste from the clipboard.                                  | `Ctrl+V`<br />`Cmd/Win+V`<br />`Alt+V`                                              |
+| Command                    | Action                                                                    | Keys                                                                                |
+| -------------------------- | ------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
+| `input.submit`             | Submit the current prompt.                                                | `Enter`                                                                             |
+| `input.queueMessage`       | Queue the current prompt to be processed after the current task finishes. | `Tab`                                                                               |
+| `input.newline`            | Insert a newline without submitting.                                      | `Ctrl+Enter`<br />`Cmd/Win+Enter`<br />`Alt+Enter`<br />`Shift+Enter`<br />`Ctrl+J` |
+| `input.openExternalEditor` | Open the current prompt or the plan in an external editor.                | `Ctrl+X`                                                                            |
+| `input.paste`              | Paste from the clipboard.                                                 | `Ctrl+V`<br />`Cmd/Win+V`<br />`Alt+V`                                              |

 #### App Controls

@@ -126,6 +127,13 @@ available combinations.
 | `background.unfocusList`    | Move focus from background shell list to Gemini.                   | `Tab`       |
 | `background.unfocusWarning` | Show warning when trying to move focus away from background shell. | `Tab`       |

+#### Extension Controls
+
+| Command            | Action                                      | Keys |
+| ------------------ | ------------------------------------------- | ---- |
+| `extension.update` | Update the current extension if available.  | `I`  |
+| `extension.link`   | Link the current extension to a local path. | `L`  |
+
 <!-- KEYBINDINGS-AUTOGEN:END -->

 ## Customizing Keybindings
@@ -29,13 +29,12 @@ To create your first policy:
    ```toml
    [[rule]]
    toolName = "run_shell_command"
-    commandPrefix = "git status"
-    decision = "allow"
+    commandPrefix = "rm -rf"
+    decision = "deny"
    priority = 100
    ```
 3.  **Run a command** that triggers the policy (e.g., ask Gemini CLI to
-    `git status`). The tool will now execute automatically without prompting for
-    confirmation.
+    `rm -rf /`). The tool will now be blocked automatically.

 ## Core concepts

@@ -143,25 +142,26 @@ engine transforms this into a final priority using the following formula:

 This system guarantees that:

- Admin policies always override User, Workspace, and Default policies.
+- Admin policies always override User, Workspace, and Default policies (defined
+  in policy TOML files).
 - User policies override Workspace and Default policies.
 - Workspace policies override Default policies.
 - You can still order rules within a single tier with fine-grained control.

 For example:

- A `priority: 50` rule in a Default policy file becomes `1.050`.
- A `priority: 10` rule in a Workspace policy policy file becomes `2.010`.
- A `priority: 100` rule in a User policy file becomes `3.100`.
- A `priority: 20` rule in an Admin policy file becomes `4.020`.
+- A `priority: 50` rule in a Default policy TOML becomes `1.050`.
+- A `priority: 10` rule in a Workspace policy TOML becomes `2.010`.
+- A `priority: 100` rule in a User policy TOML becomes `3.100`.
+- A `priority: 20` rule in an Admin policy TOML becomes `4.020`.

 ### Approval modes

 Approval modes allow the policy engine to apply different sets of rules based on
-the CLI's operational mode. A rule can be associated with one or more modes
-(e.g., `yolo`, `autoEdit`, `plan`). The rule will only be active if the CLI is
-running in one of its specified modes. If a rule has no modes specified, it is
-always active.
+the CLI's operational mode. A rule in a TOML policy file can be associated with
+one or more modes (e.g., `yolo`, `autoEdit`, `plan`). The rule will only be
+active if the CLI is running in one of its specified modes. If a rule has no
+modes specified, it is always active.

 - `default`: The standard interactive mode where most write tools require
  confirmation.
@@ -179,8 +179,8 @@ outcome.

 A rule matches a tool call if all of its conditions are met:

-1.  **Tool name**: The `toolName` in the rule must match the name of the tool
-    being called.
+1.  **Tool name**: The `toolName` in the TOML rule must match the name of the
+    tool being called.
    - **Wildcards**: You can use wildcards like `*`, `mcp_server_*`, or
      `mcp_*_toolName` to match multiple tools. See [Tool Name](#tool-name) for
      details.
@@ -264,7 +264,7 @@ toolName = "run_shell_command"

 # (Optional) The name of a subagent. If provided, the rule only applies to tool
 # calls made by this specific subagent.
-subagent = "generalist"
+subagent = "codebase_investigator"

 # (Optional) The name of an MCP server. Can be combined with toolName
 # to form a composite FQN internally like "mcp_mcpName_toolName".
@@ -419,20 +419,6 @@ decision = "ask_user"
 priority = 10
 ```

-**4. Targeting a tool name across all servers**
-
-Use `mcpName = "*"` with a specific `toolName` to target that operation
-regardless of which server provides it.
-
-```toml
-# Allow the `search` tool across all connected MCP servers
-[[rule]]
-mcpName = "*"
-toolName = "search"
-decision = "allow"
-priority = 50
-```
-
 ## Default policies

 The Gemini CLI ships with a set of default policies to provide a safe
@@ -115,10 +115,10 @@ each tool.

 ### Web

-| Tool                                          | Kind     | Description                                                                                                                                                                                                 |
-| :-------------------------------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [`google_web_search`](../tools/web-search.md) | `Search` | Performs a Google Search to find up-to-date information.                                                                                                                                                    |
-| [`web_fetch`](../tools/web-fetch.md)          | `Fetch`  | Retrieves and processes content from specific URLs. **Warning:** This tool can access local and private network addresses (e.g., localhost), which may pose a security risk if used with untrusted prompts. |
+| Tool                                          | Kind     | Description                                                                                                                                                                                                                                                              |
+| :-------------------------------------------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [`google_web_search`](../tools/web-search.md) | `Search` | Performs a Google Search to find up-to-date information.                                                                                                                                                                                                                 |
+| [`web_fetch`](../tools/web-fetch.md)          | `Fetch`  | Retrieves and processes content from specific URLs. **Warning:** This tool can access local and private network addresses (e.g., localhost), which may pose a security risk if used with untrusted prompts. In Plan Mode, this tool requires explicit user confirmation. |

 ## Under the hood

@@ -12,6 +12,21 @@ quota for your needs, see the [Plans page](https://geminicli.com/plans/).
 This article outlines the specific quotas and pricing applicable to Gemini CLI
 when using different authentication methods.

+The following table summarizes the available quotas and their respective limits:
+
+| Authentication method | Tier / Subscription             | Maximum requests per user per day |
+| :-------------------- | :------------------------------ | :-------------------------------- |
+| **Google account**    | Gemini Code Assist (Individual) | 1,000 requests                    |
+|                       | Google AI Pro                   | 1,500 requests                    |
+|                       | Google AI Ultra                 | 2,000 requests                    |
+| **Gemini API key**    | Free tier (Unpaid)              | 250 requests                      |
+|                       | Pay-as-you-go (Paid)            | Varies                            |
+| **Vertex AI**         | Express mode (Free)             | Varies                            |
+|                       | Pay-as-you-go (Paid)            | Varies                            |
+| **Google Workspace**  | Code Assist Standard            | 1,500 requests                    |
+|                       | Code Assist Enterprise          | 2,000 requests                    |
+|                       | Workspace AI Ultra              | 2,000 requests                    |
+
 Generally, there are three categories to choose from:

 - Free Usage: Ideal for experimentation and light use.
@@ -20,6 +35,9 @@ Generally, there are three categories to choose from:
 - Pay-As-You-Go: The most flexible option for professional use, long-running
  tasks, or when you need full control over your usage.

+Requests are limited per user per minute and are subject to the availability of
+the service in times of high demand.
+
 ## Free usage

 Access to Gemini CLI begins with a generous free tier, perfect for
@@ -33,8 +51,7 @@ authorization type.
 For users who authenticate by using their Google account to access Gemini Code
 Assist for individuals. This includes:

- 1000 model requests / user / day
- 60 model requests / user / minute
+- 1000 maximum model requests / user / day
 - Model requests will be made across the Gemini model family as determined by
  Gemini CLI.

@@ -46,8 +63,7 @@ Learn more at
 If you are using a Gemini API key, you can also benefit from a free tier. This
 includes:

- 250 model requests / user / day
- 10 model requests / user / minute
+- 250 maximum model requests / user / day
 - Model requests to Flash model only.

 Learn more at
@@ -59,7 +75,7 @@ Vertex AI offers an Express Mode without the need to enable billing. This
 includes:

 - 90 days before you need to enable billing.
- Quotas and models are variable and specific to your account.
+- Quotas and models are specific to your account and their limits vary.

 Learn more at
 [Vertex AI Express Mode Limits](https://cloud.google.com/vertex-ai/generative-ai/docs/start/express-mode/overview#quotas).
@@ -112,11 +128,9 @@ Standard/Plus and AI Expanded, are not supported._

  This includes the following request limits:
  - Gemini Code Assist Standard edition:
-    - 1500 model requests / user / day
-    - 120 model requests / user / minute
+    - 1500 maximum model requests / user / day
  - Gemini Code Assist Enterprise edition:
-    - 2000 model requests / user / day
-    - 120 model requests / user / minute
+    - 2000 maximum model requests / user / day
  - Model requests will be made across the Gemini model family as determined by
    Gemini CLI.

@@ -12,7 +12,6 @@
            "label": "Authentication",
            "slug": "docs/get-started/authentication"
          },
-          { "label": "Examples", "slug": "docs/get-started/examples" },
          { "label": "CLI cheatsheet", "slug": "docs/cli/cli-reference" },
          {
            "label": "Gemini 3 on Gemini CLI",
@@ -112,7 +111,17 @@
              { "label": "Reference", "slug": "docs/hooks/reference" }
            ]
          },
-          { "label": "IDE integration", "slug": "docs/ide-integration" },
+          {
+            "label": "IDE integration",
+            "collapsed": true,
+            "items": [
+              { "label": "Overview", "slug": "docs/ide-integration" },
+              {
+                "label": "Developer guide: ACP mode",
+                "slug": "docs/cli/acp-mode"
+              }
+            ]
+          },
          { "label": "MCP servers", "slug": "docs/tools/mcp-server" },
          { "label": "Model routing", "slug": "docs/cli/model-routing" },
          { "label": "Model selection", "slug": "docs/cli/model" },
@@ -129,12 +138,10 @@
          { "label": "Plan mode", "slug": "docs/cli/plan-mode" },
          {
            "label": "Subagents",
-            "badge": "🔬",
            "slug": "docs/core/subagents"
          },
          {
            "label": "Remote subagents",
-            "badge": "🔬",
            "slug": "docs/core/remote-agents"
          },
          { "label": "Rewind", "slug": "docs/cli/rewind" },
@@ -32,7 +32,9 @@ and planning.
 ## 2. `exit_plan_mode` (ExitPlanMode)

 `exit_plan_mode` signals that the planning phase is complete. It presents the
-finalized plan to the user and requests approval to start the implementation.
+finalized plan to the user and requests formal approval to start the
+implementation. The agent MUST reach an informal agreement with the user in the
+chat regarding the proposed strategy BEFORE calling this tool.

 - **Tool name:** `exit_plan_mode`
 - **Display name:** Exit Plan Mode
@@ -44,7 +46,7 @@ finalized plan to the user and requests approval to start the implementation.
 - **Behavior:**
  - Validates that the `plan_path` is within the allowed directory and that the
    file exists and has content.
-  - Presents the plan to the user for review.
+  - Presents the plan to the user for formal review.
  - If the user approves the plan:
    - Switches the CLI's approval mode to the user's chosen approval mode (
      `DEFAULT` or `AUTO_EDIT`).
@@ -56,5 +58,5 @@ finalized plan to the user and requests approval to start the implementation.
  - On approval: A message indicating the plan was approved and the new approval
    mode.
  - On rejection: A message containing the user's feedback.
- **Confirmation:** Yes. Shows the finalized plan and asks for user approval to
-  proceed with implementation.
+- **Confirmation:** Yes. Shows the finalized plan and asks for user formal
+  approval to proceed with implementation.
@@ -17,6 +17,9 @@ specific operations like summarization or extraction.
 ## Technical behavior

 - **Confirmation:** Triggers a confirmation dialog showing the converted URLs.
+- **Plan Mode:** In [Plan Mode](../cli/plan-mode.md), `web_fetch` is available
+  but always requires explicit user confirmation (`ask_user`) due to security
+  implications of accessing external or private network addresses.
 - **Processing:** Uses the Gemini API's `urlContext` for retrieval.
 - **Fallback:** If API access fails, the tool attempts to fetch raw content
  directly from your local machine.
@@ -13,7 +13,7 @@ import { wasmLoader } from 'esbuild-plugin-wasm';
 let esbuild;
 try {
  esbuild = (await import('esbuild')).default;
-} catch (_error) {
+} catch {
  console.error('esbuild not available - cannot build bundle');
  process.exit(1);
 }
@@ -41,6 +41,11 @@ const commonRestrictedSyntaxRules = [
    message:
      'Do not use typeof to check object properties. Define a TypeScript interface and a type guard function instead.',
  },
+  {
+    selector: 'CatchClause > Identifier[name=/^_/]',
+    message:
+      'Do not use underscored identifiers in catch blocks. If the error is unused, use "catch {}". If it is used, remove the underscore.',
+  },
 ];

 export default tseslint.config(
@@ -129,7 +134,7 @@ export default tseslint.config(
        {
          argsIgnorePattern: '^_',
          varsIgnorePattern: '^_',
-          caughtErrorsIgnorePattern: '^_',
+          caughtErrors: 'all',
        },
      ],
      // Prevent async errors from bypassing catch handlers
@@ -336,7 +341,7 @@ export default tseslint.config(
        {
          argsIgnorePattern: '^_',
          varsIgnorePattern: '^_',
-          caughtErrorsIgnorePattern: '^_',
+          caughtErrors: 'all',
        },
      ],
    },
@@ -360,7 +365,7 @@ export default tseslint.config(
        {
          argsIgnorePattern: '^_',
          varsIgnorePattern: '^_',
-          caughtErrorsIgnorePattern: '^_',
+          caughtErrors: 'all',
        },
      ],
    },
@@ -422,7 +427,7 @@ export default tseslint.config(
        {
          argsIgnorePattern: '^_',
          varsIgnorePattern: '^_',
-          caughtErrorsIgnorePattern: '^_',
+          caughtErrors: 'all',
        },
      ],
    },
@@ -212,6 +212,56 @@ The nightly workflow executes the full evaluation suite multiple times
 (currently 3 attempts) to account for non-determinism. These results are
 aggregated into a **Nightly Summary** attached to the workflow run.

+## Regression Check Scripts
+
+The project includes several scripts to automate high-signal regression checking
+in Pull Requests. These can also be run locally for debugging.
+
+- **`scripts/get_trustworthy_evals.js`**: Analyzes nightly history to identify
+  stable tests (80%+ aggregate pass rate).
+- **`scripts/run_regression_check.js`**: Runs a specific set of tests using the
+  "Best-of-4" logic and "Dynamic Baseline Verification".
+- **`scripts/run_eval_regression.js`**: The main orchestrator that loops through
+  models and generates the final PR report.
+
+### Running Regression Checks Locally
+
+You can simulate the PR regression check locally to verify your changes before
+pushing:
+
+```bash
+# Run the full regression loop for a specific model
+MODEL_LIST=gemini-3-flash-preview node scripts/run_eval_regression.js
+```
+
+To debug a specific failing test with the same logic used in CI:
+
+```bash
+# 1. Get the Vitest pattern for trustworthy tests
+OUTPUT=$(node scripts/get_trustworthy_evals.js "gemini-3-flash-preview")
+
+# 2. Run the regression logic for those tests
+node scripts/run_regression_check.js "gemini-3-flash-preview" "$OUTPUT"
+```
+
+### The Regression Quality Bar
+
+Because LLMs are non-deterministic, the PR regression check uses a high-signal
+probabilistic approach rather than a 100% pass requirement:
+
+1.  **Trustworthiness (60/80 Filter):** Only tests with a proven track record
+    are run. A test must score at least **60% (2/3)** every single night and
+    maintain an **80% aggregate** pass rate over the last 6 days.
+2.  **The 50% Pass Rule:** In a PR, a test is considered a **Pass** if the model
+    correctly performs the behavior at least half the time (**2 successes** out
+    of up to 4 attempts).
+3.  **Dynamic Baseline Verification:** If a test fails in a PR (e.g., 0/3), the
+    system automatically checks the `main` branch. If it fails there too, it is
+    marked as **Pre-existing** and cleared for the PR, ensuring you are only
+    blocked by regressions caused by your specific changes.
+
+## Fixing Evaluations
+
 #### How to interpret the report:

 - **Pass Rate (%)**: Each cell represents the percentage of successful runs for
@@ -15,7 +15,9 @@ import {
 describe('plan_mode', () => {
  const TEST_PREFIX = 'Plan Mode: ';
  const settings = {
-    experimental: { plan: true },
+    general: {
+      plan: { enabled: true },
+    },
  };

  const getWriteTargets = (logs: any[]) =>
@@ -172,7 +174,8 @@ describe('plan_mode', () => {
    params: {
      settings,
    },
-    prompt: 'Create a plan for a new login feature.',
+    prompt:
+      'I agree with the strategy to use a JWT-based login. Create a plan for a new login feature.',
    assert: async (rig, result) => {
      await rig.waitForTelemetryReady();
      const toolLogs = rig.readToolLogs();
@@ -209,7 +212,7 @@ describe('plan_mode', () => {
        'import { sum } from "./mathUtils";\nconsole.log(sum(1, 2));',
    },
    prompt:
-      'I want to refactor our math utilities. Move the `sum` function from `src/mathUtils.ts` to a new file `src/basicMath.ts` and update `src/main.ts` to use the new file. Please create a detailed implementation plan first, then execute it.',
+      'I want to refactor our math utilities. I agree with the strategy to move the `sum` function from `src/mathUtils.ts` to a new file `src/basicMath.ts` and update `src/main.ts`. Please create a detailed implementation plan first, then execute it.',
    assert: async (rig, result) => {
      const enterPlanCalled = await rig.waitForToolCall('enter_plan_mode');
      expect(
@@ -281,4 +284,80 @@ describe('plan_mode', () => {
      assertModelHasOutput(result);
    },
  });
+
+  evalTest('ALWAYS_PASSES', {
+    name: 'should transition from plan mode to normal execution and create a plan file from scratch',
+    params: {
+      settings,
+    },
+    prompt:
+      'Enter plan mode and plan to create a new module called foo. The plan should be saved as foo-plan.md. Then, exit plan mode.',
+    assert: async (rig, result) => {
+      const enterPlanCalled = await rig.waitForToolCall('enter_plan_mode');
+      expect(
+        enterPlanCalled,
+        'Expected enter_plan_mode tool to be called',
+      ).toBe(true);
+
+      const exitPlanCalled = await rig.waitForToolCall('exit_plan_mode');
+      expect(exitPlanCalled, 'Expected exit_plan_mode tool to be called').toBe(
+        true,
+      );
+
+      await rig.waitForTelemetryReady();
+      const toolLogs = rig.readToolLogs();
+
+      // Check if the plan file was written successfully
+      const planWrite = toolLogs.find(
+        (log) =>
+          log.toolRequest.name === 'write_file' &&
+          log.toolRequest.args.includes('foo-plan.md'),
+      );
+
+      expect(
+        planWrite,
+        'Expected write_file to be called for foo-plan.md',
+      ).toBeDefined();
+
+      expect(
+        planWrite?.toolRequest.success,
+        `Expected write_file to succeed, but got error: ${planWrite?.toolRequest.error}`,
+      ).toBe(true);
+
+      assertModelHasOutput(result);
+    },
+  });
+
+  evalTest('USUALLY_PASSES', {
+    name: 'should not exit plan mode or draft before informal agreement',
+    approvalMode: ApprovalMode.PLAN,
+    params: {
+      settings,
+    },
+    prompt: 'I need to build a new login feature. Please plan it.',
+    assert: async (rig, result) => {
+      await rig.waitForTelemetryReady();
+      const toolLogs = rig.readToolLogs();
+
+      const exitPlanCall = toolLogs.find(
+        (log) => log.toolRequest.name === 'exit_plan_mode',
+      );
+      expect(
+        exitPlanCall,
+        'Should NOT call exit_plan_mode before informal agreement',
+      ).toBeUndefined();
+
+      const planWrite = toolLogs.find(
+        (log) =>
+          log.toolRequest.name === 'write_file' &&
+          log.toolRequest.args.includes('/plans/'),
+      );
+      expect(
+        planWrite,
+        'Should NOT draft the plan file before informal agreement',
+      ).toBeUndefined();
+
+      assertModelHasOutput(result);
+    },
+  });
 });
@@ -13,8 +13,21 @@ import { evalTest, TEST_AGENTS } from './test-helper.js';

 const INDEX_TS = 'export const add = (a: number, b: number) => a + b;\n';

+// A minimal package.json is used to provide a realistic workspace anchor.
+// This prevents the agent from making incorrect assumptions about the environment
+// and helps it properly navigate or act as if it is in a standard Node.js project.
+const MOCK_PACKAGE_JSON = JSON.stringify(
+  {
+    name: 'subagent-eval-project',
+    version: '1.0.0',
+    type: 'module',
+  },
+  null,
+  2,
+);
+
 function readProjectFile(
-  rig: { testDir?: string },
+  rig: { testDir: string | null },
  relativePath: string,
 ): string {
  return fs.readFileSync(path.join(rig.testDir!, relativePath), 'utf8');
@@ -117,15 +130,7 @@ describe('subagent eval test cases', () => {
    files: {
      ...TEST_AGENTS.TESTING_AGENT.asFile(),
      'index.ts': INDEX_TS,
-      'package.json': JSON.stringify(
-        {
-          name: 'subagent-eval-project',
-          version: '1.0.0',
-          type: 'module',
-        },
-        null,
-        2,
-      ),
+      'package.json': MOCK_PACKAGE_JSON,
    },
    assert: async (rig, _result) => {
      const toolLogs = rig.readToolLogs() as Array<{
@@ -164,15 +169,7 @@ describe('subagent eval test cases', () => {
      ...TEST_AGENTS.TESTING_AGENT.asFile(),
      'index.ts': INDEX_TS,
      'README.md': 'TODO: update the README.\n',
-      'package.json': JSON.stringify(
-        {
-          name: 'subagent-eval-project',
-          version: '1.0.0',
-          type: 'module',
-        },
-        null,
-        2,
-      ),
+      'package.json': MOCK_PACKAGE_JSON,
    },
    assert: async (rig, _result) => {
      const toolLogs = rig.readToolLogs() as Array<{
@@ -190,4 +187,105 @@ describe('subagent eval test cases', () => {
      );
    },
  });
+
+  /**
+   * Checks that the main agent can correctly select the appropriate subagent
+   * from a large pool of available subagents (10 total).
+   */
+  evalTest('USUALLY_PASSES', {
+    name: 'should select the correct subagent from a pool of 10 different agents',
+    prompt: 'Please add a new SQL table migration for a user profile.',
+    files: {
+      ...TEST_AGENTS.DOCS_AGENT.asFile(),
+      ...TEST_AGENTS.TESTING_AGENT.asFile(),
+      ...TEST_AGENTS.DATABASE_AGENT.asFile(),
+      ...TEST_AGENTS.CSS_AGENT.asFile(),
+      ...TEST_AGENTS.I18N_AGENT.asFile(),
+      ...TEST_AGENTS.SECURITY_AGENT.asFile(),
+      ...TEST_AGENTS.DEVOPS_AGENT.asFile(),
+      ...TEST_AGENTS.ANALYTICS_AGENT.asFile(),
+      ...TEST_AGENTS.ACCESSIBILITY_AGENT.asFile(),
+      ...TEST_AGENTS.MOBILE_AGENT.asFile(),
+      'package.json': MOCK_PACKAGE_JSON,
+    },
+    assert: async (rig, _result) => {
+      const toolLogs = rig.readToolLogs() as Array<{
+        toolRequest: { name: string };
+      }>;
+      await rig.expectToolCallSuccess(['database-agent']);
+
+      // Ensure the generalist and other irrelevant specialists were not invoked
+      const uncalledAgents = [
+        'generalist',
+        TEST_AGENTS.DOCS_AGENT.name,
+        TEST_AGENTS.TESTING_AGENT.name,
+        TEST_AGENTS.CSS_AGENT.name,
+        TEST_AGENTS.I18N_AGENT.name,
+        TEST_AGENTS.SECURITY_AGENT.name,
+        TEST_AGENTS.DEVOPS_AGENT.name,
+        TEST_AGENTS.ANALYTICS_AGENT.name,
+        TEST_AGENTS.ACCESSIBILITY_AGENT.name,
+        TEST_AGENTS.MOBILE_AGENT.name,
+      ];
+
+      for (const agentName of uncalledAgents) {
+        expect(toolLogs.some((l) => l.toolRequest.name === agentName)).toBe(
+          false,
+        );
+      }
+    },
+  });
+
+  /**
+   * Checks that the main agent can correctly select the appropriate subagent
+   * from a large pool of available subagents, even when many irrelevant MCP tools are present.
+   *
+   * This test includes stress tests the subagent delegation with ~80 tools.
+   */
+  evalTest('USUALLY_PASSES', {
+    name: 'should select the correct subagent from a pool of 10 different agents with MCP tools present',
+    prompt: 'Please add a new SQL table migration for a user profile.',
+    setup: async (rig) => {
+      rig.addTestMcpServer('workspace-server', 'google-workspace');
+    },
+    files: {
+      ...TEST_AGENTS.DOCS_AGENT.asFile(),
+      ...TEST_AGENTS.TESTING_AGENT.asFile(),
+      ...TEST_AGENTS.DATABASE_AGENT.asFile(),
+      ...TEST_AGENTS.CSS_AGENT.asFile(),
+      ...TEST_AGENTS.I18N_AGENT.asFile(),
+      ...TEST_AGENTS.SECURITY_AGENT.asFile(),
+      ...TEST_AGENTS.DEVOPS_AGENT.asFile(),
+      ...TEST_AGENTS.ANALYTICS_AGENT.asFile(),
+      ...TEST_AGENTS.ACCESSIBILITY_AGENT.asFile(),
+      ...TEST_AGENTS.MOBILE_AGENT.asFile(),
+      'package.json': MOCK_PACKAGE_JSON,
+    },
+    assert: async (rig, _result) => {
+      const toolLogs = rig.readToolLogs() as Array<{
+        toolRequest: { name: string };
+      }>;
+      await rig.expectToolCallSuccess(['database-agent']);
+
+      // Ensure the generalist and other irrelevant specialists were not invoked
+      const uncalledAgents = [
+        'generalist',
+        TEST_AGENTS.DOCS_AGENT.name,
+        TEST_AGENTS.TESTING_AGENT.name,
+        TEST_AGENTS.CSS_AGENT.name,
+        TEST_AGENTS.I18N_AGENT.name,
+        TEST_AGENTS.SECURITY_AGENT.name,
+        TEST_AGENTS.DEVOPS_AGENT.name,
+        TEST_AGENTS.ANALYTICS_AGENT.name,
+        TEST_AGENTS.ACCESSIBILITY_AGENT.name,
+        TEST_AGENTS.MOBILE_AGENT.name,
+      ];
+
+      for (const agentName of uncalledAgents) {
+        expect(toolLogs.some((l) => l.toolRequest.name === agentName)).toBe(
+          false,
+        );
+      }
+    },
+  });
 });
@@ -0,0 +1,207 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+import { internalEvalTest } from './test-helper.js';
+import { TestRig } from '@google/gemini-cli-test-utils';
+
+// Mock TestRig to control API success/failure
+vi.mock('@google/gemini-cli-test-utils', () => {
+  return {
+    TestRig: vi.fn().mockImplementation(() => ({
+      setup: vi.fn(),
+      run: vi.fn(),
+      cleanup: vi.fn(),
+      readToolLogs: vi.fn().mockReturnValue([]),
+      _lastRunStderr: '',
+    })),
+  };
+});
+
+describe('evalTest reliability logic', () => {
+  const LOG_DIR = path.resolve(process.cwd(), 'evals/logs');
+  const RELIABILITY_LOG = path.join(LOG_DIR, 'api-reliability.jsonl');
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    if (fs.existsSync(RELIABILITY_LOG)) {
+      fs.unlinkSync(RELIABILITY_LOG);
+    }
+  });
+
+  afterEach(() => {
+    if (fs.existsSync(RELIABILITY_LOG)) {
+      fs.unlinkSync(RELIABILITY_LOG);
+    }
+  });
+
+  it('should retry 3 times on 500 INTERNAL error and then SKIP', async () => {
+    const mockRig = new TestRig() as any;
+    (TestRig as any).mockReturnValue(mockRig);
+
+    // Simulate permanent 500 error
+    mockRig.run.mockRejectedValue(new Error('status: INTERNAL - API Down'));
+
+    // Execute the test function directly
+    await internalEvalTest({
+      name: 'test-api-failure',
+      prompt: 'do something',
+      assert: async () => {},
+    });
+
+    // Verify retries: 1 initial + 3 retries = 4 setups/runs
+    expect(mockRig.run).toHaveBeenCalledTimes(4);
+
+    // Verify log content
+    const logContent = fs
+      .readFileSync(RELIABILITY_LOG, 'utf-8')
+      .trim()
+      .split('\n');
+    expect(logContent.length).toBe(4);
+
+    const entries = logContent.map((line) => JSON.parse(line));
+    expect(entries[0].status).toBe('RETRY');
+    expect(entries[0].attempt).toBe(0);
+    expect(entries[3].status).toBe('SKIP');
+    expect(entries[3].attempt).toBe(3);
+    expect(entries[3].testName).toBe('test-api-failure');
+  });
+
+  it('should fail immediately on non-500 errors (like assertion failures)', async () => {
+    const mockRig = new TestRig() as any;
+    (TestRig as any).mockReturnValue(mockRig);
+
+    // Simulate a real logic error/bug
+    mockRig.run.mockResolvedValue('Success');
+    const assertError = new Error('Assertion failed: expected foo to be bar');
+
+    // Expect the test function to throw immediately
+    await expect(
+      internalEvalTest({
+        name: 'test-logic-failure',
+        prompt: 'do something',
+        assert: async () => {
+          throw assertError;
+        },
+      }),
+    ).rejects.toThrow('Assertion failed');
+
+    // Verify NO retries: only 1 attempt
+    expect(mockRig.run).toHaveBeenCalledTimes(1);
+
+    // Verify NO reliability log was created (it's not an API error)
+    expect(fs.existsSync(RELIABILITY_LOG)).toBe(false);
+  });
+
+  it('should recover if a retry succeeds', async () => {
+    const mockRig = new TestRig() as any;
+    (TestRig as any).mockReturnValue(mockRig);
+
+    // Fail once, then succeed
+    mockRig.run
+      .mockRejectedValueOnce(new Error('status: INTERNAL'))
+      .mockResolvedValueOnce('Success');
+
+    await internalEvalTest({
+      name: 'test-recovery',
+      prompt: 'do something',
+      assert: async () => {},
+    });
+
+    // Ran twice: initial (fail) + retry 1 (success)
+    expect(mockRig.run).toHaveBeenCalledTimes(2);
+
+    // Log should only have the one RETRY entry
+    const logContent = fs
+      .readFileSync(RELIABILITY_LOG, 'utf-8')
+      .trim()
+      .split('\n');
+    expect(logContent.length).toBe(1);
+    expect(JSON.parse(logContent[0]).status).toBe('RETRY');
+  });
+
+  it('should retry 3 times on 503 UNAVAILABLE error and then SKIP', async () => {
+    const mockRig = new TestRig() as any;
+    (TestRig as any).mockReturnValue(mockRig);
+
+    // Simulate permanent 503 error
+    mockRig.run.mockRejectedValue(
+      new Error('status: UNAVAILABLE - Service Busy'),
+    );
+
+    await internalEvalTest({
+      name: 'test-api-503',
+      prompt: 'do something',
+      assert: async () => {},
+    });
+
+    expect(mockRig.run).toHaveBeenCalledTimes(4);
+
+    const logContent = fs
+      .readFileSync(RELIABILITY_LOG, 'utf-8')
+      .trim()
+      .split('\n');
+    const entries = logContent.map((line) => JSON.parse(line));
+    expect(entries[0].errorCode).toBe('503');
+    expect(entries[3].status).toBe('SKIP');
+  });
+
+  it('should throw if an absolute path is used in files', async () => {
+    const mockRig = new TestRig() as any;
+    (TestRig as any).mockReturnValue(mockRig);
+    mockRig.testDir = path.resolve(process.cwd(), 'test-dir-tmp');
+    if (!fs.existsSync(mockRig.testDir)) {
+      fs.mkdirSync(mockRig.testDir, { recursive: true });
+    }
+
+    try {
+      await expect(
+        internalEvalTest({
+          name: 'test-absolute-path',
+          prompt: 'do something',
+          files: {
+            '/etc/passwd': 'hacked',
+          },
+          assert: async () => {},
+        }),
+      ).rejects.toThrow('Invalid file path in test case: /etc/passwd');
+    } finally {
+      if (fs.existsSync(mockRig.testDir)) {
+        fs.rmSync(mockRig.testDir, { recursive: true, force: true });
+      }
+    }
+  });
+
+  it('should throw if directory traversal is detected in files', async () => {
+    const mockRig = new TestRig() as any;
+    (TestRig as any).mockReturnValue(mockRig);
+    mockRig.testDir = path.resolve(process.cwd(), 'test-dir-tmp');
+
+    // Create a mock test-dir
+    if (!fs.existsSync(mockRig.testDir)) {
+      fs.mkdirSync(mockRig.testDir, { recursive: true });
+    }
+
+    try {
+      await expect(
+        internalEvalTest({
+          name: 'test-traversal',
+          prompt: 'do something',
+          files: {
+            '../sensitive.txt': 'hacked',
+          },
+          assert: async () => {},
+        }),
+      ).rejects.toThrow('Invalid file path in test case: ../sensitive.txt');
+    } finally {
+      if (fs.existsSync(mockRig.testDir)) {
+        fs.rmSync(mockRig.testDir, { recursive: true, force: true });
+      }
+    }
+  });
+});
@@ -39,87 +39,38 @@ export * from '@google/gemini-cli-test-utils';
 export type EvalPolicy = 'ALWAYS_PASSES' | 'USUALLY_PASSES';

 export function evalTest(policy: EvalPolicy, evalCase: EvalCase) {
-  const fn = async () => {
+  runEval(
+    policy,
+    evalCase.name,
+    () => internalEvalTest(evalCase),
+    evalCase.timeout,
+  );
+}
+
+export async function internalEvalTest(evalCase: EvalCase) {
+  const maxRetries = 3;
+  let attempt = 0;
+
+  while (attempt <= maxRetries) {
    const rig = new TestRig();
    const { logDir, sanitizedName } = await prepareLogDir(evalCase.name);
    const activityLogFile = path.join(logDir, `${sanitizedName}.jsonl`);
    const logFile = path.join(logDir, `${sanitizedName}.log`);
    let isSuccess = false;
+
    try {
      rig.setup(evalCase.name, evalCase.params);

-      // Symlink node modules to reduce the amount of time needed to
-      // bootstrap test projects.
-      symlinkNodeModules(rig.testDir || '');
+      if (evalCase.setup) {
+        await evalCase.setup(rig);
+      }

      if (evalCase.files) {
-        const acknowledgedAgents: Record<string, Record<string, string>> = {};
-        const projectRoot = fs.realpathSync(rig.testDir!);
-
-        for (const [filePath, content] of Object.entries(evalCase.files)) {
-          const fullPath = path.join(rig.testDir!, filePath);
-          fs.mkdirSync(path.dirname(fullPath), { recursive: true });
-          fs.writeFileSync(fullPath, content);
-
-          // If it's an agent file, calculate hash for acknowledgement
-          if (
-            filePath.startsWith('.gemini/agents/') &&
-            filePath.endsWith('.md')
-          ) {
-            const hash = crypto
-              .createHash('sha256')
-              .update(content)
-              .digest('hex');
-
-            try {
-              const agentDefs = await parseAgentMarkdown(fullPath, content);
-              if (agentDefs.length > 0) {
-                const agentName = agentDefs[0].name;
-                if (!acknowledgedAgents[projectRoot]) {
-                  acknowledgedAgents[projectRoot] = {};
-                }
-                acknowledgedAgents[projectRoot][agentName] = hash;
-              }
-            } catch (error) {
-              console.warn(
-                `Failed to parse agent for test acknowledgement: ${filePath}`,
-                error,
-              );
-            }
-          }
-        }
-
-        // Write acknowledged_agents.json to the home directory
-        if (Object.keys(acknowledgedAgents).length > 0) {
-          const ackPath = path.join(
-            rig.homeDir!,
-            '.gemini',
-            'acknowledgments',
-            'agents.json',
-          );
-          fs.mkdirSync(path.dirname(ackPath), { recursive: true });
-          fs.writeFileSync(
-            ackPath,
-            JSON.stringify(acknowledgedAgents, null, 2),
-          );
-        }
-
-        const execOptions = { cwd: rig.testDir!, stdio: 'inherit' as const };
-        execSync('git init', execOptions);
-        execSync('git config user.email "test@example.com"', execOptions);
-        execSync('git config user.name "Test User"', execOptions);
-
-        // Temporarily disable the interactive editor and git pager
-        // to avoid hanging the tests. It seems the the agent isn't
-        // consistently honoring the instructions to avoid interactive
-        // commands.
-        execSync('git config core.editor "true"', execOptions);
-        execSync('git config core.pager "cat"', execOptions);
-        execSync('git config commit.gpgsign false', execOptions);
-        execSync('git add .', execOptions);
-        execSync('git commit --allow-empty -m "Initial commit"', execOptions);
+        await setupTestFiles(rig, evalCase.files);
      }

+      symlinkNodeModules(rig.testDir || '');
+
      // If messages are provided, write a session file so --resume can load it.
      let sessionId: string | undefined;
      if (evalCase.messages) {
@@ -188,6 +139,37 @@ export function evalTest(policy: EvalPolicy, evalCase: EvalCase) {

      await evalCase.assert(rig, result);
      isSuccess = true;
+      return; // Success! Exit the retry loop.
+    } catch (error: unknown) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = getApiErrorCode(errorMessage);
+
+      if (errorCode) {
+        const status = attempt < maxRetries ? 'RETRY' : 'SKIP';
+        logReliabilityEvent(
+          evalCase.name,
+          attempt,
+          status,
+          errorCode,
+          errorMessage,
+        );
+
+        if (attempt < maxRetries) {
+          attempt++;
+          console.warn(
+            `[Eval] Attempt ${attempt} failed with ${errorCode} Error. Retrying...`,
+          );
+          continue; // Retry
+        }
+
+        console.warn(
+          `[Eval] '${evalCase.name}' failed after ${maxRetries} retries due to persistent API errors. Skipping failure to avoid blocking PR.`,
+        );
+        return; // Gracefully exit without failing the test
+      }
+
+      throw error; // Real failure
    } finally {
      if (isSuccess) {
        await fs.promises.unlink(activityLogFile).catch((err) => {
@@ -206,9 +188,131 @@ export function evalTest(policy: EvalPolicy, evalCase: EvalCase) {
      );
      await rig.cleanup();
    }
+  }
+}
+
+function getApiErrorCode(message: string): '500' | '503' | undefined {
+  if (
+    message.includes('status: UNAVAILABLE') ||
+    message.includes('code: 503') ||
+    message.includes('Service Unavailable')
+  ) {
+    return '503';
+  }
+  if (
+    message.includes('status: INTERNAL') ||
+    message.includes('code: 500') ||
+    message.includes('Internal error encountered')
+  ) {
+    return '500';
+  }
+  return undefined;
+}
+
+/**
+ * Log reliability event for later harvesting.
+ *
+ * Note: Uses synchronous file I/O to ensure the log is persisted even if the
+ * test process is abruptly terminated by a timeout or CI crash. Performance
+ * impact is negligible compared to long-running evaluation tests.
+ */
+function logReliabilityEvent(
+  testName: string,
+  attempt: number,
+  status: 'RETRY' | 'SKIP',
+  errorCode: '500' | '503',
+  errorMessage: string,
+) {
+  const reliabilityLog = {
+    timestamp: new Date().toISOString(),
+    testName,
+    model: process.env.GEMINI_MODEL || 'unknown',
+    attempt,
+    status,
+    errorCode,
+    error: errorMessage,
  };

-  runEval(policy, evalCase.name, fn, evalCase.timeout);
+  try {
+    const relDir = path.resolve(process.cwd(), 'evals/logs');
+    fs.mkdirSync(relDir, { recursive: true });
+    fs.appendFileSync(
+      path.join(relDir, 'api-reliability.jsonl'),
+      JSON.stringify(reliabilityLog) + '\n',
+    );
+  } catch (logError) {
+    console.error('Failed to write reliability log:', logError);
+  }
+}
+
+/**
+ * Helper to setup test files and git repository.
+ *
+ * Note: While this is an async function (due to parseAgentMarkdown), it
+ * intentionally uses synchronous filesystem and child_process operations
+ * for simplicity and to ensure sequential environment preparation.
+ */
+async function setupTestFiles(rig: TestRig, files: Record<string, string>) {
+  const acknowledgedAgents: Record<string, Record<string, string>> = {};
+  const projectRoot = fs.realpathSync(rig.testDir!);
+
+  for (const [filePath, content] of Object.entries(files)) {
+    if (filePath.includes('..') || path.isAbsolute(filePath)) {
+      throw new Error(`Invalid file path in test case: ${filePath}`);
+    }
+    const fullPath = path.join(projectRoot, filePath);
+    if (!fullPath.startsWith(projectRoot)) {
+      throw new Error(`Path traversal detected: ${filePath}`);
+    }
+
+    fs.mkdirSync(path.dirname(fullPath), { recursive: true });
+    fs.writeFileSync(fullPath, content);
+
+    if (filePath.startsWith('.gemini/agents/') && filePath.endsWith('.md')) {
+      const hash = crypto.createHash('sha256').update(content).digest('hex');
+      try {
+        const agentDefs = await parseAgentMarkdown(fullPath, content);
+        if (agentDefs.length > 0) {
+          const agentName = agentDefs[0].name;
+          if (!acknowledgedAgents[projectRoot]) {
+            acknowledgedAgents[projectRoot] = {};
+          }
+          acknowledgedAgents[projectRoot][agentName] = hash;
+        }
+      } catch (error) {
+        console.warn(
+          `Failed to parse agent for test acknowledgement: ${filePath}`,
+          error,
+        );
+      }
+    }
+  }
+
+  if (Object.keys(acknowledgedAgents).length > 0) {
+    const ackPath = path.join(
+      rig.homeDir!,
+      '.gemini',
+      'acknowledgments',
+      'agents.json',
+    );
+    fs.mkdirSync(path.dirname(ackPath), { recursive: true });
+    fs.writeFileSync(ackPath, JSON.stringify(acknowledgedAgents, null, 2));
+  }
+
+  const execOptions = { cwd: rig.testDir!, stdio: 'inherit' as const };
+  execSync('git init --initial-branch=main', execOptions);
+  execSync('git config user.email "test@example.com"', execOptions);
+  execSync('git config user.name "Test User"', execOptions);
+
+  // Temporarily disable the interactive editor and git pager
+  // to avoid hanging the tests. It seems the the agent isn't
+  // consistently honoring the instructions to avoid interactive
+  // commands.
+  execSync('git config core.editor "true"', execOptions);
+  execSync('git config core.pager "cat"', execOptions);
+  execSync('git config commit.gpgsign false', execOptions);
+  execSync('git add .', execOptions);
+  execSync('git commit --allow-empty -m "Initial commit"', execOptions);
 }

 /**
@@ -271,6 +375,7 @@ export interface EvalCase {
  prompt: string;
  timeout?: number;
  files?: Record<string, string>;
+  setup?: (rig: TestRig) => Promise<void> | void;
  /** Conversation history to pre-load via --resume. Each entry is a message object with type, content, etc. */
  messages?: Record<string, unknown>[];
  /** Session ID for the resumed session. Auto-generated if not provided. */
@@ -113,4 +113,21 @@ describe('tracker_mode', () => {
      assertModelHasOutput(result);
    },
  });
+
+  evalTest('USUALLY_PASSES', {
+    name: 'should correctly identify the task tracker storage location from the system prompt',
+    params: {
+      settings: { experimental: { taskTracker: true } },
+    },
+    prompt:
+      'Where is my task tracker storage located? Please provide the absolute path in your response.',
+    assert: async (rig, result) => {
+      // The rig sets GEMINI_CLI_HOME to rig.homeDir
+      const homeDir = rig.homeDir!;
+      // The response should contain the dynamic path which includes the home directory
+      // and follows the .gemini/tmp/.../tracker structure.
+      expect(result).toContain(homeDir);
+      expect(result).toMatch(/\.gemini\/tmp\/.*\/tracker/);
+    },
+  });
 });
@@ -0,0 +1,116 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect } from 'vitest';
+import { evalTest } from './test-helper.js';
+
+describe('update_topic_behavior', () => {
+  // Constants for tool names and params for robustness
+  const UPDATE_TOPIC_TOOL_NAME = 'update_topic';
+
+  /**
+   * Verifies the desired behavior of the update_topic tool. update_topic is used by the
+   * agent to share periodic, concise updates about what the agent is working on, independent
+   * of the regular model output and/or thoughts. This tool is expected to be called at least
+   * at the start and end of the session, and typically at least once in the middle, but no
+   * more than 1/4 turns.
+   */
+  evalTest('USUALLY_PASSES', {
+    name: 'update_topic should be used at start, end and middle for complex tasks',
+    prompt: `Create a simple users REST API using Express. 
+1. Initialize a new npm project and install express.
+2. Create src/app.ts as the main entry point.
+3. Create src/routes/userRoutes.ts for user routes.
+4. Create src/controllers/userController.ts for user logic.
+5. Implement GET /users, POST /users, and GET /users/:id using an in-memory array.
+6. Add a 'start' script to package.json.
+7. Finally, run a quick grep to verify the routes are in src/app.ts.`,
+    files: {
+      'package.json': JSON.stringify(
+        {
+          name: 'users-api',
+          version: '1.0.0',
+          private: true,
+        },
+        null,
+        2,
+      ),
+      '.gemini/settings.json': JSON.stringify({
+        experimental: {
+          topicUpdateNarration: true,
+        },
+      }),
+    },
+    assert: async (rig, result) => {
+      const toolLogs = rig.readToolLogs();
+      const topicCalls = toolLogs.filter(
+        (l) => l.toolRequest.name === UPDATE_TOPIC_TOOL_NAME,
+      );
+
+      // 1. Assert that update_topic is called at least 3 times (start, middle, end)
+      expect(
+        topicCalls.length,
+        `Expected at least 3 update_topic calls, but found ${topicCalls.length}`,
+      ).toBeGreaterThanOrEqual(3);
+
+      // 2. Assert update_topic is called at the very beginning (first tool call)
+      expect(
+        toolLogs[0].toolRequest.name,
+        'First tool call should be update_topic',
+      ).toBe(UPDATE_TOPIC_TOOL_NAME);
+
+      // 3. Assert update_topic is called near the end
+      const lastTopicCallIndex = toolLogs
+        .map((l) => l.toolRequest.name)
+        .lastIndexOf(UPDATE_TOPIC_TOOL_NAME);
+      expect(
+        lastTopicCallIndex,
+        'Expected update_topic to be used near the end of the task',
+      ).toBeGreaterThanOrEqual(toolLogs.length * 0.7);
+
+      // 4. Assert there is at least one update_topic call in the middle (between start and end phases)
+      const middleTopicCalls = topicCalls.slice(1, -1);
+
+      expect(
+        middleTopicCalls.length,
+        'Expected at least one update_topic call in the middle of the task',
+      ).toBeGreaterThanOrEqual(1);
+
+      // 5. Turn Ratio Assertion: update_topic should be <= 1/2 of total turns.
+      // We only enforce this for tasks that take more than 5 turns, as shorter tasks
+      // naturally have a higher ratio when following the "start, middle, end" rule.
+      const uniquePromptIds = new Set(
+        toolLogs
+          .map((l) => l.toolRequest.prompt_id)
+          .filter((id) => id !== undefined),
+      );
+      const totalTurns = uniquePromptIds.size;
+
+      if (totalTurns > 5) {
+        const topicTurns = new Set(
+          topicCalls
+            .map((l) => l.toolRequest.prompt_id)
+            .filter((id) => id !== undefined),
+        );
+        const topicTurnCount = topicTurns.size;
+
+        const ratio = topicTurnCount / totalTurns;
+
+        expect(
+          ratio,
+          `update_topic was used in ${topicTurnCount} out of ${totalTurns} turns (${(ratio * 100).toFixed(1)}%). Expected <= 50%.`,
+        ).toBeLessThanOrEqual(0.5);
+
+        // Ideal ratio is closer to 1/5 (20%). We log high usage as a warning.
+        if (ratio > 0.25) {
+          console.warn(
+            `[Efficiency Warning] update_topic usage is high: ${(ratio * 100).toFixed(1)}% (Goal: ~20%)`,
+          );
+        }
+      }
+    },
+  });
+});
@@ -16,10 +16,6 @@ export default defineConfig({
  },
  test: {
    testTimeout: 300000, // 5 minutes
-    // Retry in CI but not nightly to avoid blocking on API error.
-    retry: process.env['VITEST_RETRY']
-      ? parseInt(process.env['VITEST_RETRY'], 10)
-      : 3,
    reporters: ['default', 'json'],
    outputFile: {
      json: 'evals/logs/report.json',
@@ -1 +1 @@
-{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"text":"Part 1. "}],"role":"model"},"index":0}]},{"usageMetadata":{"promptTokenCount":100,"candidatesTokenCount":10,"totalTokenCount":110}},{"candidates":[{"content":{"parts":[{"text":"Part 2."}],"role":"model"},"index":0}],"finishReason":"STOP"}]}
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"text":"Part 1. "}],"role":"model"},"index":0}]},{"usageMetadata":{"promptTokenCount":100,"candidatesTokenCount":10,"totalTokenCount":110}},{"candidates":[{"content":{"parts":[{"text":"Part 2."}],"role":"model"},"index":0,"finishReason":"STOP"}]}]}
@@ -10,8 +10,13 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execSync } from 'node:child_process';
 import { existsSync, writeFileSync, readFileSync, mkdirSync } from 'node:fs';
+import { env } from 'node:process';
 import stripAnsi from 'strip-ansi';

+// Browser agent Chrome DevTools MCP connection is flaky in Docker sandbox.
+// See: https://github.com/google-gemini/gemini-cli/issues/24382
+const isDockerSandbox = env['GEMINI_SANDBOX'] === 'docker';
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);

@@ -59,122 +64,146 @@ describe.skipIf(!chromeAvailable)('browser-policy', () => {
    await rig.cleanup();
  });

-  it('should skip confirmation when "Allow all server tools for this session" is chosen', async () => {
-    rig.setup('browser-policy-skip-confirmation', {
-      fakeResponsesPath: join(__dirname, 'browser-policy.responses'),
-      settings: {
-        agents: {
-          overrides: {
-            browser_agent: {
-              enabled: true,
+  it.skipIf(isDockerSandbox)(
+    'should skip confirmation when "Allow all server tools for this session" is chosen',
+    async () => {
+      rig.setup('browser-policy-skip-confirmation', {
+        fakeResponsesPath: join(__dirname, 'browser-policy.responses'),
+        settings: {
+          agents: {
+            overrides: {
+              browser_agent: {
+                enabled: true,
+              },
+            },
+            browser: {
+              headless: true,
+              sessionMode: 'isolated',
+              allowedDomains: ['example.com'],
            },
          },
-          browser: {
-            headless: true,
-            sessionMode: 'isolated',
-            allowedDomains: ['example.com'],
-          },
        },
-      },
-    });
+      });

-    // Manually trust the folder to avoid the dialog and enable option 3
-    const geminiDir = join(rig.homeDir!, '.gemini');
-    mkdirSync(geminiDir, { recursive: true });
+      // Manually trust the folder to avoid the dialog and enable option 3
+      const geminiDir = join(rig.homeDir!, '.gemini');
+      mkdirSync(geminiDir, { recursive: true });

-    // Write to trustedFolders.json
-    const trustedFoldersPath = join(geminiDir, 'trustedFolders.json');
-    const trustedFolders = {
-      [rig.testDir!]: 'TRUST_FOLDER',
-    };
-    writeFileSync(trustedFoldersPath, JSON.stringify(trustedFolders, null, 2));
+      // Write to trustedFolders.json
+      const trustedFoldersPath = join(geminiDir, 'trustedFolders.json');
+      const trustedFolders = {
+        [rig.testDir!]: 'TRUST_FOLDER',
+      };
+      writeFileSync(
+        trustedFoldersPath,
+        JSON.stringify(trustedFolders, null, 2),
+      );

-    // Force confirmation for browser agent.
-    // NOTE: We don't force confirm browser tools here because "Allow all server tools"
-    // adds a rule with ALWAYS_ALLOW_PRIORITY (3.9x) which would be overshadowed by
-    // a rule in the user tier (4.x) like the one from this TOML.
-    // By removing the explicit mcp rule, the first MCP tool will still prompt
-    // due to default approvalMode = 'default', and then "Allow all" will correctly
-    // bypass subsequent tools.
-    const policyFile = join(rig.testDir!, 'force-confirm.toml');
-    writeFileSync(
-      policyFile,
-      `
+      // Force confirmation for browser agent.
+      // NOTE: We don't force confirm browser tools here because "Allow all server tools"
+      // adds a rule with ALWAYS_ALLOW_PRIORITY (3.9x) which would be overshadowed by
+      // a rule in the user tier (4.x) like the one from this TOML.
+      // By removing the explicit mcp rule, the first MCP tool will still prompt
+      // due to default approvalMode = 'default', and then "Allow all" will correctly
+      // bypass subsequent tools.
+      const policyFile = join(rig.testDir!, 'force-confirm.toml');
+      writeFileSync(
+        policyFile,
+        `
 [[rule]]
 name = "Force confirm browser_agent"
 toolName = "browser_agent"
 decision = "ask_user"
 priority = 200
 `,
-    );
+      );

-    // Update settings.json in both project and home directories to point to the policy file
-    for (const baseDir of [rig.testDir!, rig.homeDir!]) {
-      const settingsPath = join(baseDir, '.gemini', 'settings.json');
-      if (existsSync(settingsPath)) {
-        const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
-        settings.policyPaths = [policyFile];
-        // Ensure folder trust is enabled
-        settings.security = settings.security || {};
-        settings.security.folderTrust = settings.security.folderTrust || {};
-        settings.security.folderTrust.enabled = true;
-        writeFileSync(settingsPath, JSON.stringify(settings, null, 2));
+      // Update settings.json in both project and home directories to point to the policy file
+      for (const baseDir of [rig.testDir!, rig.homeDir!]) {
+        const settingsPath = join(baseDir, '.gemini', 'settings.json');
+        if (existsSync(settingsPath)) {
+          const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
+          settings.policyPaths = [policyFile];
+          // Ensure folder trust is enabled
+          settings.security = settings.security || {};
+          settings.security.folderTrust = settings.security.folderTrust || {};
+          settings.security.folderTrust.enabled = true;
+          writeFileSync(settingsPath, JSON.stringify(settings, null, 2));
+        }
      }
-    }

-    const run = await rig.runInteractive({
-      approvalMode: 'default',
-      env: {
-        GEMINI_CLI_INTEGRATION_TEST: 'true',
-      },
-    });
+      const run = await rig.runInteractive({
+        approvalMode: 'default',
+        env: {
+          GEMINI_CLI_INTEGRATION_TEST: 'true',
+        },
+      });

-    await run.sendKeys(
-      'Open https://example.com and check if there is a heading\r',
-    );
-    await run.sendKeys('\r');
+      await run.sendKeys(
+        'Open https://example.com and check if there is a heading\r',
+      );
+      await run.sendKeys('\r');

-    // Handle confirmations.
-    // 1. Initial browser_agent delegation (likely only 3 options, so use option 1: Allow once)
-    await poll(
-      () => stripAnsi(run.output).toLowerCase().includes('action required'),
-      60000,
-      1000,
-    );
-    await run.sendKeys('1\r');
-    await new Promise((r) => setTimeout(r, 2000));
+      // Handle confirmations.
+      // 1. Initial browser_agent delegation (likely only 3 options, so use option 1: Allow once)
+      await poll(
+        () => stripAnsi(run.output).toLowerCase().includes('action required'),
+        60000,
+        1000,
+      );
+      await run.sendKeys('1\r');
+      await new Promise((r) => setTimeout(r, 2000));

-    // Handle privacy notice
-    await poll(
-      () => stripAnsi(run.output).toLowerCase().includes('privacy notice'),
-      5000,
-      100,
-    );
-    await run.sendKeys('1\r');
-    await new Promise((r) => setTimeout(r, 5000));
+      // Handle privacy notice
+      await poll(
+        () => stripAnsi(run.output).toLowerCase().includes('privacy notice'),
+        5000,
+        100,
+      );
+      await run.sendKeys('1\r');
+      await new Promise((r) => setTimeout(r, 5000));

-    // new_page (MCP tool, should have 4 options, use option 3: Allow all server tools)
-    await poll(
-      () => {
-        const stripped = stripAnsi(run.output).toLowerCase();
-        return (
-          stripped.includes('new_page') &&
-          stripped.includes('allow all server tools for this session')
-        );
-      },
-      60000,
-      1000,
-    );
+      // new_page (MCP tool, should have 4 options, use option 3: Allow all server tools)
+      await poll(
+        () => {
+          const stripped = stripAnsi(run.output).toLowerCase();
+          return (
+            stripped.includes('new_page') &&
+            stripped.includes('allow all server tools for this session')
+          );
+        },
+        60000,
+        1000,
+      );

-    // Select "Allow all server tools for this session" (option 3)
-    await run.sendKeys('3\r');
-    await new Promise((r) => setTimeout(r, 30000));
+      // Select "Allow all server tools for this session" (option 3)
+      await run.sendKeys('3\r');

-    const output = stripAnsi(run.output).toLowerCase();
+      // Wait for the browser agent to finish (success or failure)
+      await poll(
+        () => {
+          const stripped = stripAnsi(run.output).toLowerCase();
+          return (
+            stripped.includes('completed successfully') ||
+            stripped.includes('agent error')
+          );
+        },
+        120000,
+        1000,
+      );

-    expect(output).toContain('browser_agent');
-    expect(output).toContain('completed successfully');
-  });
+      const output = stripAnsi(run.output).toLowerCase();
+
+      expect(output).toContain('browser_agent');
+      // The test validates that "Allow all server tools" skips subsequent
+      // tool confirmations — the browser agent may still fail due to
+      // Chrome/MCP issues in CI, which is acceptable for this policy test.
+      expect(
+        output.includes('completed successfully') ||
+          output.includes('agent error'),
+      ).toBe(true);
+    },
+  );

  it('should show the visible warning when browser agent starts in existing session mode', async () => {
    rig.setup('browser-session-warning', {
@@ -10,13 +10,9 @@ import { TestMcpServer } from './test-mcp-server.js';
 import { writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { safeJsonStringify } from '@google/gemini-cli-core/src/utils/safeJsonStringify.js';
-import { env } from 'node:process';
-import { platform } from 'node:os';

 import stripAnsi from 'strip-ansi';

-const itIf = (condition: boolean) => (condition ? it : it.skip);
-
 describe('extension reloading', () => {
  let rig: TestRig;

@@ -26,141 +22,130 @@ describe('extension reloading', () => {

  afterEach(async () => await rig.cleanup());

-  const sandboxEnv = env['GEMINI_SANDBOX'];
-  // Fails in linux non-sandbox e2e tests
+  // always fails
  // TODO(#14527): Re-enable this once fixed
-  // Fails in sandbox mode, can't check for local extension updates.
-  itIf(
-    (!sandboxEnv || sandboxEnv === 'false') &&
-      platform() !== 'win32' &&
-      platform() !== 'linux',
-  )(
-    'installs a local extension, updates it, checks it was reloaded properly',
-    async () => {
-      const serverA = new TestMcpServer();
-      const portA = await serverA.start({
-        hello: () => ({ content: [{ type: 'text', text: 'world' }] }),
-      });
-      const extension = {
-        name: 'test-extension',
-        version: '0.0.1',
-        mcpServers: {
-          'test-server': {
-            httpUrl: `http://localhost:${portA}/mcp`,
-          },
+  it.skip('installs a local extension, updates it, checks it was reloaded properly', async () => {
+    const serverA = new TestMcpServer();
+    const portA = await serverA.start({
+      hello: () => ({ content: [{ type: 'text', text: 'world' }] }),
+    });
+    const extension = {
+      name: 'test-extension',
+      version: '0.0.1',
+      mcpServers: {
+        'test-server': {
+          httpUrl: `http://localhost:${portA}/mcp`,
        },
-      };
+      },
+    };

-      rig.setup('extension reload test', {
-        settings: {
-          experimental: { extensionReloading: true },
-        },
-      });
-      const testServerPath = join(rig.testDir!, 'gemini-extension.json');
-      writeFileSync(testServerPath, safeJsonStringify(extension, 2));
-      // defensive cleanup from previous tests.
-      try {
-        await rig.runCommand(['extensions', 'uninstall', 'test-extension']);
-      } catch {
-        /* empty */
-      }
-
-      const result = await rig.runCommand(
-        ['--debug', 'extensions', 'install', `${rig.testDir!}`],
-        { stdin: 'y\n' },
-      );
-      expect(result).toContain('test-extension');
-
-      // Now create the update, but its not installed yet
-      const serverB = new TestMcpServer();
-      const portB = await serverB.start({
-        goodbye: () => ({ content: [{ type: 'text', text: 'world' }] }),
-      });
-      extension.version = '0.0.2';
-      extension.mcpServers['test-server'].httpUrl =
-        `http://localhost:${portB}/mcp`;
-      writeFileSync(testServerPath, safeJsonStringify(extension, 2));
-
-      // Start the CLI.
-      const run = await rig.runInteractive({ args: '--debug' });
-      await run.expectText('You have 1 extension with an update available');
-      // See the outdated extension
-      await run.sendText('/extensions list');
-      await run.type('\r');
-      await run.expectText(
-        'test-extension (v0.0.1) - active (update available)',
-      );
-      // Wait for the UI to settle and retry the command until we see the update
-      await new Promise((resolve) => setTimeout(resolve, 1000));
-
-      // Poll for the updated list
-      await rig.pollCommand(
-        async () => {
-          await run.sendText('/mcp list');
-          await run.type('\r');
-        },
-        () => {
-          const output = stripAnsi(run.output);
-          return (
-            output.includes(
-              'test-server (from test-extension) - Ready (1 tool)',
-            ) && output.includes('- mcp_test-server_hello')
-          );
-        },
-        30000, // 30s timeout
-      );
-
-      // Update the extension, expect the list to update, and mcp servers as well.
-      await run.sendKeys('\u0015/extensions update test-extension');
-      await run.expectText('/extensions update test-extension');
-      await run.type('\r');
-      await new Promise((resolve) => setTimeout(resolve, 500));
-      await run.type('\r');
-      await run.expectText(
-        ` * test-server (remote): http://localhost:${portB}/mcp`,
-      );
-      await run.type('\r'); // consent
-      await run.expectText(
-        'Extension "test-extension" successfully updated: 0.0.1 → 0.0.2',
-      );
-
-      // Poll for the updated extension version
-      await rig.pollCommand(
-        async () => {
-          await run.sendText('/extensions list');
-          await run.type('\r');
-        },
-        () =>
-          stripAnsi(run.output).includes(
-            'test-extension (v0.0.2) - active (updated)',
-          ),
-        30000,
-      );
-
-      // Poll for the updated mcp tool
-      await rig.pollCommand(
-        async () => {
-          await run.sendText('/mcp list');
-          await run.type('\r');
-        },
-        () => {
-          const output = stripAnsi(run.output);
-          return (
-            output.includes(
-              'test-server (from test-extension) - Ready (1 tool)',
-            ) && output.includes('- mcp_test-server_goodbye')
-          );
-        },
-        30000,
-      );
-
-      await run.sendText('/quit');
-      await run.type('\r');
-
-      // Clean things up.
-      await serverA.stop();
-      await serverB.stop();
+    rig.setup('extension reload test', {
+      settings: {
+        experimental: { extensionReloading: true },
+      },
+    });
+    const testServerPath = join(rig.testDir!, 'gemini-extension.json');
+    writeFileSync(testServerPath, safeJsonStringify(extension, 2));
+    // defensive cleanup from previous tests.
+    try {
      await rig.runCommand(['extensions', 'uninstall', 'test-extension']);
-    },
-  );
+    } catch {
+      /* empty */
+    }
+
+    const result = await rig.runCommand(
+      ['--debug', 'extensions', 'install', `${rig.testDir!}`],
+      { stdin: 'y\n' },
+    );
+    expect(result).toContain('test-extension');
+
+    // Now create the update, but its not installed yet
+    const serverB = new TestMcpServer();
+    const portB = await serverB.start({
+      goodbye: () => ({ content: [{ type: 'text', text: 'world' }] }),
+    });
+    extension.version = '0.0.2';
+    extension.mcpServers['test-server'].httpUrl =
+      `http://localhost:${portB}/mcp`;
+    writeFileSync(testServerPath, safeJsonStringify(extension, 2));
+
+    // Start the CLI.
+    const run = await rig.runInteractive({ args: '--debug' });
+    await run.expectText('You have 1 extension with an update available');
+    // See the outdated extension
+    await run.sendText('/extensions list');
+    await run.type('\r');
+    await run.expectText('test-extension (v0.0.1) - active (update available)');
+    // Wait for the UI to settle and retry the command until we see the update
+    await new Promise((resolve) => setTimeout(resolve, 1000));
+
+    // Poll for the updated list
+    await rig.pollCommand(
+      async () => {
+        await run.sendText('/mcp list');
+        await run.type('\r');
+      },
+      () => {
+        const output = stripAnsi(run.output);
+        return (
+          output.includes(
+            'test-server (from test-extension) - Ready (1 tool)',
+          ) && output.includes('- mcp_test-server_hello')
+        );
+      },
+      30000, // 30s timeout
+    );
+
+    // Update the extension, expect the list to update, and mcp servers as well.
+    await run.sendKeys('\u0015/extensions update test-extension');
+    await run.expectText('/extensions update test-extension');
+    await run.type('\r');
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    await run.type('\r');
+    await run.expectText(
+      ` * test-server (remote): http://localhost:${portB}/mcp`,
+    );
+    await run.type('\r'); // consent
+    await run.expectText(
+      'Extension "test-extension" successfully updated: 0.0.1 → 0.0.2',
+    );
+
+    // Poll for the updated extension version
+    await rig.pollCommand(
+      async () => {
+        await run.sendText('/extensions list');
+        await run.type('\r');
+      },
+      () =>
+        stripAnsi(run.output).includes(
+          'test-extension (v0.0.2) - active (updated)',
+        ),
+      30000,
+    );
+
+    // Poll for the updated mcp tool
+    await rig.pollCommand(
+      async () => {
+        await run.sendText('/mcp list');
+        await run.type('\r');
+      },
+      () => {
+        const output = stripAnsi(run.output);
+        return (
+          output.includes(
+            'test-server (from test-extension) - Ready (1 tool)',
+          ) && output.includes('- mcp_test-server_goodbye')
+        );
+      },
+      30000,
+    );
+
+    await run.sendText('/quit');
+    await run.type('\r');
+
+    // Clean things up.
+    await serverA.stop();
+    await serverB.stop();
+    await rig.runCommand(['extensions', 'uninstall', 'test-extension']);
+  });
 });
@@ -121,6 +121,7 @@ describe('file-system', () => {

    const result = await rig.run({
      args: `write "hello" to "${fileName}" and then stop. Do not perform any other actions.`,
+      timeout: 600000, // 10 min — real LLM can be slow in Docker sandbox
    });

    const foundToolCall = await rig.waitForToolCall('write_file');
@@ -4,8 +4,10 @@
 * SPDX-License-Identifier: Apache-2.0
 */

+import { writeFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { TestRig, checkModelOutputContent } from './test-helper.js';
+import { GEMINI_DIR, TestRig, checkModelOutputContent } from './test-helper.js';

 describe('Plan Mode', () => {
  let rig: TestRig;
@@ -21,7 +23,9 @@ describe('Plan Mode', () => {
      'should allow read-only tools but deny write tools in plan mode',
      {
        settings: {
-          experimental: { plan: true },
+          general: {
+            plan: { enabled: true },
+          },
          tools: {
            core: [
              'run_shell_command',
@@ -65,15 +69,12 @@ describe('Plan Mode', () => {

    await rig.setup(testName, {
      settings: {
-        experimental: { plan: true },
        tools: {
          core: ['write_file', 'read_file', 'list_directory'],
        },
        general: {
+          plan: { enabled: true, directory: plansDir },
          defaultApprovalMode: 'plan',
-          plan: {
-            directory: plansDir,
-          },
        },
      },
    });
@@ -118,22 +119,19 @@ describe('Plan Mode', () => {

    await rig.setup(testName, {
      settings: {
-        experimental: { plan: true },
        tools: {
          core: ['write_file', 'read_file', 'list_directory'],
        },
        general: {
+          plan: { enabled: true, directory: plansDir },
          defaultApprovalMode: 'plan',
-          plan: {
-            directory: plansDir,
-          },
        },
      },
    });

    await rig.run({
      approvalMode: 'plan',
-      args: 'Create a file called hello.txt in the current directory.',
+      args: 'Attempt to create a file named "hello.txt" in the current directory. Do not create a plan file, try to write hello.txt directly.',
    });

    const toolLogs = rig.readToolLogs();
@@ -154,7 +152,9 @@ describe('Plan Mode', () => {
  it('should be able to enter plan mode from default mode', async () => {
    await rig.setup('should be able to enter plan mode from default mode', {
      settings: {
-        experimental: { plan: true },
+        general: {
+          plan: { enabled: true },
+        },
        tools: {
          core: ['enter_plan_mode'],
          allowed: ['enter_plan_mode'],
@@ -182,15 +182,12 @@ describe('Plan Mode', () => {

    await rig.setup(testName, {
      settings: {
-        experimental: { plan: true },
        tools: {
          core: ['write_file', 'read_file', 'list_directory'],
        },
        general: {
+          plan: { enabled: true, directory: plansDir },
          defaultApprovalMode: 'plan',
-          plan: {
-            directory: plansDir,
-          },
        },
      },
    });
@@ -227,4 +224,68 @@ describe('Plan Mode', () => {
      `Expected write_file to succeed, but it failed with error: ${planWrite?.toolRequest.error}`,
    ).toBe(true);
  });
+  it('should switch from a pro model to a flash model after exiting plan mode', async () => {
+    const plansDir = 'plans-folder';
+    const planFilename = 'my-plan.md';
+
+    await rig.setup('should-switch-to-flash', {
+      settings: {
+        model: {
+          name: 'auto-gemini-2.5',
+        },
+        experimental: { plan: true },
+        tools: {
+          core: ['exit_plan_mode', 'run_shell_command'],
+          allowed: ['exit_plan_mode', 'run_shell_command'],
+        },
+        general: {
+          defaultApprovalMode: 'plan',
+          plan: {
+            directory: plansDir,
+          },
+        },
+      },
+    });
+
+    writeFileSync(
+      join(rig.homeDir!, GEMINI_DIR, 'state.json'),
+      JSON.stringify({ terminalSetupPromptShown: true }, null, 2),
+    );
+
+    const fullPlansDir = join(rig.testDir!, plansDir);
+    mkdirSync(fullPlansDir, { recursive: true });
+    writeFileSync(join(fullPlansDir, planFilename), 'Execute echo hello');
+
+    await rig.run({
+      approvalMode: 'plan',
+      stdin: `Exit plan mode using ${planFilename} and then run a shell command \`echo hello\`.`,
+    });
+
+    const exitCallFound = await rig.waitForToolCall('exit_plan_mode');
+    expect(exitCallFound, 'Expected exit_plan_mode to be called').toBe(true);
+
+    const shellCallFound = await rig.waitForToolCall('run_shell_command');
+    expect(shellCallFound, 'Expected run_shell_command to be called').toBe(
+      true,
+    );
+
+    const apiRequests = rig.readAllApiRequest();
+    const modelNames = apiRequests.map((r) => r.attributes?.model || 'unknown');
+
+    const proRequests = apiRequests.filter((r) =>
+      r.attributes?.model?.includes('pro'),
+    );
+    const flashRequests = apiRequests.filter((r) =>
+      r.attributes?.model?.includes('flash'),
+    );
+
+    expect(
+      proRequests.length,
+      `Expected at least one Pro request. Models used: ${modelNames.join(', ')}`,
+    ).toBeGreaterThanOrEqual(1);
+    expect(
+      flashRequests.length,
+      `Expected at least one Flash request after mode switch. Models used: ${modelNames.join(', ')}`,
+    ).toBeGreaterThanOrEqual(1);
+  });
 });
@@ -11,7 +11,7 @@
        "packages/*"
      ],
      "dependencies": {
-        "ink": "npm:@jrichman/ink@6.4.11",
+        "ink": "npm:@jrichman/ink@6.6.3",
        "latest-version": "^9.0.0",
        "node-fetch-native": "^1.6.7",
        "proper-lockfile": "^4.1.2",
@@ -92,46 +92,6 @@
        "zod": "^3.25.0 || ^4.0.0"
      }
    },
-    "node_modules/@alcalzone/ansi-tokenize": {
-      "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/@alcalzone/ansi-tokenize/-/ansi-tokenize-0.2.2.tgz",
-      "integrity": "sha512-mkOh+Wwawzuf5wa30bvc4nA+Qb6DIrGWgBhRR/Pw4T9nsgYait8izvXkNyU78D6Wcu3Z+KUdwCmLCxlWjEotYA==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^6.2.1",
-        "is-fullwidth-code-point": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@alcalzone/ansi-tokenize/node_modules/ansi-styles": {
-      "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/@alcalzone/ansi-tokenize/node_modules/is-fullwidth-code-point": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-5.1.0.tgz",
-      "integrity": "sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ==",
-      "license": "MIT",
-      "dependencies": {
-        "get-east-asian-width": "^1.3.1"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
    "node_modules/@ampproject/remapping": {
      "version": "2.3.0",
      "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.3.0.tgz",
@@ -10089,14 +10049,13 @@
    },
    "node_modules/ink": {
      "name": "@jrichman/ink",
-      "version": "6.4.11",
-      "resolved": "https://registry.npmjs.org/@jrichman/ink/-/ink-6.4.11.tgz",
-      "integrity": "sha512-93LQlzT7vvZ1XJcmOMwN4s+6W334QegendeHOMnEJBlhnpIzr8bws6/aOEHG8ZCuVD/vNeeea5m1msHIdAY6ig==",
+      "version": "6.6.3",
+      "resolved": "https://registry.npmjs.org/@jrichman/ink/-/ink-6.6.3.tgz",
+      "integrity": "sha512-0v4S7TbbF2tpQrfqH1btwLgTgH+K0vY2BJbokTE5Lk1KBr4TqZ+Pyo+geSD5F+zytX6G2ajGHBQyHk8yGK4C7A==",
      "license": "MIT",
      "dependencies": {
-        "@alcalzone/ansi-tokenize": "^0.2.1",
        "ansi-escapes": "^7.0.0",
-        "ansi-styles": "^6.2.1",
+        "ansi-styles": "^6.2.3",
        "auto-bind": "^5.0.1",
        "chalk": "^5.6.0",
        "cli-boxes": "^3.0.0",
@@ -10105,6 +10064,7 @@
        "code-excerpt": "^4.0.0",
        "es-toolkit": "^1.39.10",
        "indent-string": "^5.0.0",
+        "is-fullwidth-code-point": "^5.0.0",
        "is-in-ci": "^2.0.0",
        "mnemonist": "^0.40.3",
        "patch-console": "^2.0.0",
@@ -10116,6 +10076,7 @@
        "type-fest": "^4.27.0",
        "wrap-ansi": "^9.0.0",
        "ws": "^8.18.0",
+        "yargs": "^17.7.2",
        "yoga-layout": "~3.2.1"
      },
      "engines": {
@@ -10173,9 +10134,9 @@
      }
    },
    "node_modules/ink/node_modules/ansi-styles": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.1.tgz",
-      "integrity": "sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==",
+      "version": "6.2.3",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
+      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
      "license": "MIT",
      "engines": {
        "node": ">=12"
@@ -10196,6 +10157,21 @@
        "url": "https://github.com/chalk/chalk?sponsor=1"
      }
    },
+    "node_modules/ink/node_modules/is-fullwidth-code-point": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-5.1.0.tgz",
+      "integrity": "sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "get-east-asian-width": "^1.3.1"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
    "node_modules/ink/node_modules/is-in-ci": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/is-in-ci/-/is-in-ci-2.0.0.tgz",
@@ -17550,7 +17526,7 @@
        "fzf": "^0.5.2",
        "glob": "^12.0.0",
        "highlight.js": "^11.11.1",
-        "ink": "npm:@jrichman/ink@6.4.11",
+        "ink": "npm:@jrichman/ink@6.6.3",
        "ink-gradient": "^3.0.0",
        "ink-spinner": "^5.0.0",
        "latest-version": "^9.0.0",
@@ -38,7 +38,7 @@
    "build:packages": "npm run build --workspaces",
    "build:sandbox": "node scripts/build_sandbox.js",
    "build:binary": "node scripts/build_binary.js",
-    "bundle": "npm run generate && npm run build --workspace=@google/gemini-cli-devtools && node esbuild.config.js && node scripts/copy_bundle_assets.js",
+    "bundle": "npm run generate && npm run build --workspace=@google/gemini-cli-devtools && npm run bundle:browser-mcp -w @google/gemini-cli-core && node esbuild.config.js && node scripts/copy_bundle_assets.js",
    "test": "npm run test --workspaces --if-present && npm run test:sea-launch",
    "test:ci": "npm run test:ci --workspaces --if-present && npm run test:scripts && npm run test:sea-launch",
    "test:scripts": "vitest run --config ./scripts/tests/vitest.config.ts",
@@ -52,7 +52,7 @@
    "test:integration:sandbox:none": "cross-env GEMINI_SANDBOX=false vitest run --root ./integration-tests",
    "test:integration:sandbox:docker": "cross-env GEMINI_SANDBOX=docker npm run build:sandbox && cross-env GEMINI_SANDBOX=docker vitest run --root ./integration-tests",
    "test:integration:sandbox:podman": "cross-env GEMINI_SANDBOX=podman vitest run --root ./integration-tests",
-    "lint": "eslint . --cache --max-warnings 0",
+    "lint": "cross-env NODE_OPTIONS=\"--max-old-space-size=8192\" eslint . --cache --max-warnings 0",
    "lint:fix": "eslint . --fix --ext .ts,.tsx && eslint integration-tests --fix && eslint scripts --fix && npm run format",
    "lint:ci": "npm run lint:all",
    "lint:all": "node scripts/lint.js",
@@ -68,7 +68,7 @@
    "pre-commit": "node scripts/pre-commit.js"
  },
  "overrides": {
-    "ink": "npm:@jrichman/ink@6.4.11",
+    "ink": "npm:@jrichman/ink@6.6.3",
    "wrap-ansi": "9.0.2",
    "cliui": {
      "wrap-ansi": "7.0.0"
@@ -136,7 +136,7 @@
    "yargs": "^17.7.2"
  },
  "dependencies": {
-    "ink": "npm:@jrichman/ink@6.4.11",
+    "ink": "npm:@jrichman/ink@6.6.3",
    "latest-version": "^9.0.0",
    "node-fetch-native": "^1.6.7",
    "proper-lockfile": "^4.1.2",
@@ -98,7 +98,7 @@ export class RestoreCommand implements Command {
        name: this.name,
        data: restoreResult,
      };
-    } catch (_error) {
+    } catch {
      return {
        name: this.name,
        data: {
@@ -142,7 +142,7 @@ export class ListCheckpointsCommand implements Command {
          content: JSON.stringify(checkpointInfoList),
        },
      };
-    } catch (_error) {
+    } catch {
      return {
        name: this.name,
        data: {
@@ -352,23 +352,37 @@ describe('loadConfig', () => {
    });

    describe('interactivity', () => {
-      it('should set interactive true when not headless', async () => {
+      it('should always set interactive true', async () => {
+        vi.mocked(isHeadlessMode).mockReturnValue(true);
+        await loadConfig(mockSettings, mockExtensionLoader, taskId);
+        expect(Config).toHaveBeenCalledWith(
+          expect.objectContaining({
+            interactive: true,
+          }),
+        );
+
        vi.mocked(isHeadlessMode).mockReturnValue(false);
        await loadConfig(mockSettings, mockExtensionLoader, taskId);
        expect(Config).toHaveBeenCalledWith(
          expect.objectContaining({
            interactive: true,
-            enableInteractiveShell: true,
          }),
        );
      });

-      it('should set interactive false when headless', async () => {
+      it('should set enableInteractiveShell based on headless mode', async () => {
+        vi.mocked(isHeadlessMode).mockReturnValue(false);
+        await loadConfig(mockSettings, mockExtensionLoader, taskId);
+        expect(Config).toHaveBeenCalledWith(
+          expect.objectContaining({
+            enableInteractiveShell: true,
+          }),
+        );
+
        vi.mocked(isHeadlessMode).mockReturnValue(true);
        await loadConfig(mockSettings, mockExtensionLoader, taskId);
        expect(Config).toHaveBeenCalledWith(
          expect.objectContaining({
-            interactive: false,
            enableInteractiveShell: false,
          }),
        );
@@ -410,7 +424,22 @@ describe('loadConfig', () => {
      });
    });

-    describe('authentication fallback', () => {
+    describe('authentication logic', () => {
+      const setupConfigMock = (refreshAuthMock: ReturnType<typeof vi.fn>) => {
+        vi.mocked(Config).mockImplementation(
+          (params: unknown) =>
+            ({
+              ...(params as object),
+              initialize: vi.fn(),
+              waitForMcpInit: vi.fn(),
+              refreshAuth: refreshAuthMock,
+              getExperiments: vi.fn().mockReturnValue({ flags: {} }),
+              getRemoteAdminSettings: vi.fn(),
+              setRemoteAdminSettings: vi.fn(),
+            }) as unknown as Config,
+        );
+      };
+
      beforeEach(() => {
        vi.stubEnv('USE_CCPA', 'true');
        vi.stubEnv('GEMINI_API_KEY', '');
@@ -420,182 +449,77 @@ describe('loadConfig', () => {
        vi.unstubAllEnvs();
      });

-      it('should fall back to COMPUTE_ADC in Cloud Shell if LOGIN_WITH_GOOGLE fails', async () => {
-        vi.stubEnv('CLOUD_SHELL', 'true');
-        vi.mocked(isHeadlessMode).mockReturnValue(false);
-        const refreshAuthMock = vi.fn().mockImplementation((authType) => {
-          if (authType === AuthType.LOGIN_WITH_GOOGLE) {
-            throw new FatalAuthenticationError('Non-interactive session');
-          }
-          return Promise.resolve();
-        });
-
-        // Update the mock implementation for this test
-        vi.mocked(Config).mockImplementation(
-          (params: unknown) =>
-            ({
-              ...(params as object),
-              initialize: vi.fn(),
-              waitForMcpInit: vi.fn(),
-              refreshAuth: refreshAuthMock,
-              getExperiments: vi.fn().mockReturnValue({ flags: {} }),
-              getRemoteAdminSettings: vi.fn(),
-              setRemoteAdminSettings: vi.fn(),
-            }) as unknown as Config,
-        );
-
-        await loadConfig(mockSettings, mockExtensionLoader, taskId);
-
-        expect(refreshAuthMock).toHaveBeenCalledWith(
-          AuthType.LOGIN_WITH_GOOGLE,
-        );
-        expect(refreshAuthMock).toHaveBeenCalledWith(AuthType.COMPUTE_ADC);
-      });
-
-      it('should not fall back to COMPUTE_ADC if not in cloud environment', async () => {
-        vi.mocked(isHeadlessMode).mockReturnValue(false);
-        const refreshAuthMock = vi.fn().mockImplementation((authType) => {
-          if (authType === AuthType.LOGIN_WITH_GOOGLE) {
-            throw new FatalAuthenticationError('Non-interactive session');
-          }
-          return Promise.resolve();
-        });
-
-        vi.mocked(Config).mockImplementation(
-          (params: unknown) =>
-            ({
-              ...(params as object),
-              initialize: vi.fn(),
-              waitForMcpInit: vi.fn(),
-              refreshAuth: refreshAuthMock,
-              getExperiments: vi.fn().mockReturnValue({ flags: {} }),
-              getRemoteAdminSettings: vi.fn(),
-              setRemoteAdminSettings: vi.fn(),
-            }) as unknown as Config,
-        );
-
-        await expect(
-          loadConfig(mockSettings, mockExtensionLoader, taskId),
-        ).rejects.toThrow('Non-interactive session');
-
-        expect(refreshAuthMock).toHaveBeenCalledWith(
-          AuthType.LOGIN_WITH_GOOGLE,
-        );
-        expect(refreshAuthMock).not.toHaveBeenCalledWith(AuthType.COMPUTE_ADC);
-      });
-
-      it('should skip LOGIN_WITH_GOOGLE and use COMPUTE_ADC directly in headless Cloud Shell', async () => {
-        vi.stubEnv('CLOUD_SHELL', 'true');
-        vi.mocked(isHeadlessMode).mockReturnValue(true);
-
+      it('should attempt COMPUTE_ADC by default and bypass LOGIN_WITH_GOOGLE if successful', async () => {
        const refreshAuthMock = vi.fn().mockResolvedValue(undefined);
-
-        vi.mocked(Config).mockImplementation(
-          (params: unknown) =>
-            ({
-              ...(params as object),
-              initialize: vi.fn(),
-              waitForMcpInit: vi.fn(),
-              refreshAuth: refreshAuthMock,
-              getExperiments: vi.fn().mockReturnValue({ flags: {} }),
-              getRemoteAdminSettings: vi.fn(),
-              setRemoteAdminSettings: vi.fn(),
-            }) as unknown as Config,
-        );
+        setupConfigMock(refreshAuthMock);

        await loadConfig(mockSettings, mockExtensionLoader, taskId);

+        expect(refreshAuthMock).toHaveBeenCalledWith(AuthType.COMPUTE_ADC);
        expect(refreshAuthMock).not.toHaveBeenCalledWith(
          AuthType.LOGIN_WITH_GOOGLE,
        );
-        expect(refreshAuthMock).toHaveBeenCalledWith(AuthType.COMPUTE_ADC);
      });

-      it('should skip LOGIN_WITH_GOOGLE and use COMPUTE_ADC directly if GEMINI_CLI_USE_COMPUTE_ADC is true', async () => {
-        vi.stubEnv('GEMINI_CLI_USE_COMPUTE_ADC', 'true');
-        vi.mocked(isHeadlessMode).mockReturnValue(false); // Even if not headless
-
-        const refreshAuthMock = vi.fn().mockResolvedValue(undefined);
-
-        vi.mocked(Config).mockImplementation(
-          (params: unknown) =>
-            ({
-              ...(params as object),
-              initialize: vi.fn(),
-              waitForMcpInit: vi.fn(),
-              refreshAuth: refreshAuthMock,
-              getExperiments: vi.fn().mockReturnValue({ flags: {} }),
-              getRemoteAdminSettings: vi.fn(),
-              setRemoteAdminSettings: vi.fn(),
-            }) as unknown as Config,
-        );
+      it('should fallback to LOGIN_WITH_GOOGLE if COMPUTE_ADC fails and interactive mode is available', async () => {
+        vi.mocked(isHeadlessMode).mockReturnValue(false);
+        const refreshAuthMock = vi.fn().mockImplementation((authType) => {
+          if (authType === AuthType.COMPUTE_ADC) {
+            return Promise.reject(new Error('ADC failed'));
+          }
+          return Promise.resolve();
+        });
+        setupConfigMock(refreshAuthMock);

        await loadConfig(mockSettings, mockExtensionLoader, taskId);

-        expect(refreshAuthMock).not.toHaveBeenCalledWith(
+        expect(refreshAuthMock).toHaveBeenCalledWith(AuthType.COMPUTE_ADC);
+        expect(refreshAuthMock).toHaveBeenCalledWith(
          AuthType.LOGIN_WITH_GOOGLE,
        );
-        expect(refreshAuthMock).toHaveBeenCalledWith(AuthType.COMPUTE_ADC);
      });

-      it('should throw FatalAuthenticationError in headless mode if no ADC fallback available', async () => {
+      it('should throw FatalAuthenticationError in headless mode if COMPUTE_ADC fails', async () => {
        vi.mocked(isHeadlessMode).mockReturnValue(true);

-        const refreshAuthMock = vi.fn().mockResolvedValue(undefined);
-
-        vi.mocked(Config).mockImplementation(
-          (params: unknown) =>
-            ({
-              ...(params as object),
-              initialize: vi.fn(),
-              waitForMcpInit: vi.fn(),
-              refreshAuth: refreshAuthMock,
-              getExperiments: vi.fn().mockReturnValue({ flags: {} }),
-              getRemoteAdminSettings: vi.fn(),
-              setRemoteAdminSettings: vi.fn(),
-            }) as unknown as Config,
-        );
+        const refreshAuthMock = vi.fn().mockImplementation((authType) => {
+          if (authType === AuthType.COMPUTE_ADC) {
+            return Promise.reject(new Error('ADC not found'));
+          }
+          return Promise.resolve();
+        });
+        setupConfigMock(refreshAuthMock);

        await expect(
          loadConfig(mockSettings, mockExtensionLoader, taskId),
        ).rejects.toThrow(
-          'Interactive terminal required for LOGIN_WITH_GOOGLE. Run in an interactive terminal or set GEMINI_CLI_USE_COMPUTE_ADC=true to use Application Default Credentials.',
+          'COMPUTE_ADC failed: ADC not found. (LOGIN_WITH_GOOGLE fallback skipped due to headless mode. Run in an interactive terminal to use OAuth.)',
        );

-        expect(refreshAuthMock).not.toHaveBeenCalled();
+        expect(refreshAuthMock).toHaveBeenCalledWith(AuthType.COMPUTE_ADC);
+        expect(refreshAuthMock).not.toHaveBeenCalledWith(
+          AuthType.LOGIN_WITH_GOOGLE,
+        );
      });

-      it('should include both original and fallback error when COMPUTE_ADC fallback fails', async () => {
-        vi.stubEnv('CLOUD_SHELL', 'true');
+      it('should include both original and fallback error when LOGIN_WITH_GOOGLE fallback fails', async () => {
        vi.mocked(isHeadlessMode).mockReturnValue(false);

        const refreshAuthMock = vi.fn().mockImplementation((authType) => {
-          if (authType === AuthType.LOGIN_WITH_GOOGLE) {
-            throw new FatalAuthenticationError('OAuth failed');
-          }
          if (authType === AuthType.COMPUTE_ADC) {
            throw new Error('ADC failed');
          }
+          if (authType === AuthType.LOGIN_WITH_GOOGLE) {
+            throw new FatalAuthenticationError('OAuth failed');
+          }
          return Promise.resolve();
        });
-
-        vi.mocked(Config).mockImplementation(
-          (params: unknown) =>
-            ({
-              ...(params as object),
-              initialize: vi.fn(),
-              waitForMcpInit: vi.fn(),
-              refreshAuth: refreshAuthMock,
-              getExperiments: vi.fn().mockReturnValue({ flags: {} }),
-              getRemoteAdminSettings: vi.fn(),
-              setRemoteAdminSettings: vi.fn(),
-            }) as unknown as Config,
-        );
+        setupConfigMock(refreshAuthMock);

        await expect(
          loadConfig(mockSettings, mockExtensionLoader, taskId),
        ).rejects.toThrow(
-          'OAuth failed. Fallback to COMPUTE_ADC also failed: ADC failed',
+          'OAuth failed. The initial COMPUTE_ADC attempt also failed: ADC failed',
        );
      });
    });
@@ -25,7 +25,6 @@ import {
  ExperimentFlags,
  isHeadlessMode,
  FatalAuthenticationError,
-  isCloudShell,
  PolicyDecision,
  PRIORITY_YOLO_ALLOW_ALL,
  type TelemetryTarget,
@@ -43,7 +42,6 @@ export async function loadConfig(
  taskId: string,
 ): Promise<Config> {
  const workspaceDir = process.cwd();
-  const adcFilePath = process.env['GOOGLE_APPLICATION_CREDENTIALS'];

  const folderTrust =
    settings.folderTrust === true ||
@@ -125,7 +123,7 @@ export async function loadConfig(
    trustedFolder: true,
    extensionLoader,
    checkpointing,
-    interactive: !isHeadlessMode(),
+    interactive: true,
    enableInteractiveShell: !isHeadlessMode(),
    ptyInfo: 'auto',
    enableAgents: settings.experimental?.enableAgents ?? true,
@@ -192,7 +190,7 @@ export async function loadConfig(
  await config.waitForMcpInit();
  startupProfiler.flush(config);

-  await refreshAuthentication(config, adcFilePath, 'Config');
+  await refreshAuthentication(config, 'Config');

  return config;
 }
@@ -263,75 +261,51 @@ function findEnvFile(startDir: string): string | null {

 async function refreshAuthentication(
  config: Config,
-  adcFilePath: string | undefined,
  logPrefix: string,
 ): Promise<void> {
  if (process.env['USE_CCPA']) {
    logger.info(`[${logPrefix}] Using CCPA Auth:`);
+
+    logger.info(`[${logPrefix}] Attempting COMPUTE_ADC first.`);
    try {
-      if (adcFilePath) {
-        path.resolve(adcFilePath);
-      }
-    } catch (e) {
-      logger.error(
-        `[${logPrefix}] USE_CCPA env var is true but unable to resolve GOOGLE_APPLICATION_CREDENTIALS file path ${adcFilePath}. Error ${e}`,
+      await config.refreshAuth(AuthType.COMPUTE_ADC);
+      logger.info(`[${logPrefix}] COMPUTE_ADC successful.`);
+    } catch (adcError) {
+      const adcMessage =
+        adcError instanceof Error ? adcError.message : String(adcError);
+      logger.info(
+        `[${logPrefix}] COMPUTE_ADC failed or not available: ${adcMessage}`,
      );
-    }

-    const useComputeAdc = process.env['GEMINI_CLI_USE_COMPUTE_ADC'] === 'true';
-    const isHeadless = isHeadlessMode();
-    const shouldSkipOauth = isHeadless || useComputeAdc;
+      const useComputeAdc =
+        process.env['GEMINI_CLI_USE_COMPUTE_ADC'] === 'true';
+      const isHeadless = isHeadlessMode();

-    if (shouldSkipOauth) {
-      if (isCloudShell() || useComputeAdc) {
-        logger.info(
-          `[${logPrefix}] Skipping LOGIN_WITH_GOOGLE due to ${isHeadless ? 'headless mode' : 'GEMINI_CLI_USE_COMPUTE_ADC'}. Attempting COMPUTE_ADC.`,
-        );
-        try {
-          await config.refreshAuth(AuthType.COMPUTE_ADC);
-          logger.info(`[${logPrefix}] COMPUTE_ADC successful.`);
-        } catch (adcError) {
-          const adcMessage =
-            adcError instanceof Error ? adcError.message : String(adcError);
-          throw new FatalAuthenticationError(
-            `COMPUTE_ADC failed: ${adcMessage}. (Skipped LOGIN_WITH_GOOGLE due to ${isHeadless ? 'headless mode' : 'GEMINI_CLI_USE_COMPUTE_ADC'})`,
-          );
-        }
-      } else {
+      if (isHeadless || useComputeAdc) {
+        const reason = isHeadless
+          ? 'headless mode'
+          : 'GEMINI_CLI_USE_COMPUTE_ADC=true';
        throw new FatalAuthenticationError(
-          `Interactive terminal required for LOGIN_WITH_GOOGLE. Run in an interactive terminal or set GEMINI_CLI_USE_COMPUTE_ADC=true to use Application Default Credentials.`,
+          `COMPUTE_ADC failed: ${adcMessage}. (LOGIN_WITH_GOOGLE fallback skipped due to ${reason}. Run in an interactive terminal to use OAuth.)`,
        );
      }
-    } else {
+
+      logger.info(
+        `[${logPrefix}] COMPUTE_ADC failed, falling back to LOGIN_WITH_GOOGLE.`,
+      );
      try {
        await config.refreshAuth(AuthType.LOGIN_WITH_GOOGLE);
      } catch (e) {
-        if (
-          e instanceof FatalAuthenticationError &&
-          (isCloudShell() || useComputeAdc)
-        ) {
-          logger.warn(
-            `[${logPrefix}] LOGIN_WITH_GOOGLE failed. Attempting COMPUTE_ADC fallback.`,
+        if (e instanceof FatalAuthenticationError) {
+          const originalMessage = e instanceof Error ? e.message : String(e);
+          throw new FatalAuthenticationError(
+            `${originalMessage}. The initial COMPUTE_ADC attempt also failed: ${adcMessage}`,
          );
-          try {
-            await config.refreshAuth(AuthType.COMPUTE_ADC);
-            logger.info(`[${logPrefix}] COMPUTE_ADC fallback successful.`);
-          } catch (adcError) {
-            logger.error(
-              `[${logPrefix}] COMPUTE_ADC fallback failed: ${adcError}`,
-            );
-            const originalMessage = e instanceof Error ? e.message : String(e);
-            const adcMessage =
-              adcError instanceof Error ? adcError.message : String(adcError);
-            throw new FatalAuthenticationError(
-              `${originalMessage}. Fallback to COMPUTE_ADC also failed: ${adcMessage}`,
-            );
-          }
-        } else {
-          throw e;
        }
+        throw e;
      }
    }
+
    logger.info(
      `[${logPrefix}] GOOGLE_CLOUD_PROJECT: ${process.env['GOOGLE_CLOUD_PROJECT']}`,
    );
@@ -109,6 +109,8 @@ export function createMockConfig(
        enableEnvironmentVariableRedaction: false,
      },
    }),
+    isAutoDistillationEnabled: vi.fn().mockReturnValue(false),
+    getContextManagementConfig: vi.fn().mockReturnValue({ enabled: false }),
    ...overrides,
  } as unknown as Config;

@@ -49,7 +49,7 @@
    "fzf": "^0.5.2",
    "glob": "^12.0.0",
    "highlight.js": "^11.11.1",
-    "ink": "npm:@jrichman/ink@6.4.11",
+    "ink": "npm:@jrichman/ink@6.6.3",
    "ink-gradient": "^3.0.0",
    "ink-spinner": "^5.0.0",
    "latest-version": "^9.0.0",
@@ -27,7 +27,9 @@ import {
  type MessageBus,
  LlmRole,
  type GitService,
+  type ModelRouterService,
  processSingleFileContent,
+  InvalidStreamError,
 } from '@google/gemini-cli-core';
 import {
  SettingScope,
@@ -99,17 +101,9 @@ vi.mock(
    const actual = await importOriginal();
    return {
      ...actual,
-      ReadManyFilesTool: vi.fn().mockImplementation(() => ({
-        name: 'read_many_files',
-        kind: 'read',
-        build: vi.fn().mockReturnValue({
-          getDescription: () => 'Read files',
-          toolLocations: () => [],
-          execute: vi.fn().mockResolvedValue({
-            llmContent: ['--- file.txt ---\n\nFile content\n\n'],
-          }),
-        }),
-      })),
+      updatePolicy: vi.fn(),
+      createPolicyUpdater: vi.fn(),
+      ReadManyFilesTool: vi.fn(),
      logToolCall: vi.fn(),
      LlmRole: {
        MAIN: 'main',
@@ -181,6 +175,20 @@ describe('GeminiAgent', () => {
      getWorkspaceContext: vi.fn().mockReturnValue({
        addReadOnlyPath: vi.fn(),
      }),
+      getPolicyEngine: vi.fn().mockReturnValue({
+        addRule: vi.fn(),
+      }),
+      messageBus: {
+        publish: vi.fn(),
+        subscribe: vi.fn(),
+        unsubscribe: vi.fn(),
+      },
+      storage: {
+        getWorkspaceAutoSavedPolicyPath: vi.fn(),
+        getAutoSavedPolicyPath: vi.fn(),
+        setClientName: vi.fn(),
+      },
+      setClientName: vi.fn(),
      get config() {
        return this;
      },
@@ -201,7 +209,10 @@ describe('GeminiAgent', () => {
    (loadCliConfig as unknown as Mock).mockResolvedValue(mockConfig);
    (loadSettings as unknown as Mock).mockImplementation(() => ({
      merged: {
-        security: { auth: { selectedType: AuthType.LOGIN_WITH_GOOGLE } },
+        security: {
+          auth: { selectedType: AuthType.LOGIN_WITH_GOOGLE },
+          enablePermanentToolApproval: true,
+        },
        mcpServers: {},
      },
      setValue: vi.fn(),
@@ -401,6 +412,26 @@ describe('GeminiAgent', () => {
    );
  });

+  it('should include gemini-3.1-flash-lite when useGemini31FlashLite is true', async () => {
+    mockConfig.getHasAccessToPreviewModel = vi.fn().mockReturnValue(true);
+    mockConfig.getGemini31LaunchedSync = vi.fn().mockReturnValue(true);
+    mockConfig.getGemini31FlashLiteLaunchedSync = vi.fn().mockReturnValue(true);
+
+    const response = await agent.newSession({
+      cwd: '/tmp',
+      mcpServers: [],
+    });
+
+    expect(response.models?.availableModels).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          modelId: 'gemini-3.1-flash-lite-preview',
+          name: 'gemini-3.1-flash-lite-preview',
+        }),
+      ]),
+    );
+  });
+
  it('should return modes with plan mode when plan is enabled', async () => {
    mockConfig.getContentGeneratorConfig = vi.fn().mockReturnValue({
      apiKey: 'test-key',
@@ -626,6 +657,7 @@ describe('Session', () => {
      sendMessageStream: vi.fn(),
      addHistory: vi.fn(),
      recordCompletedToolCalls: vi.fn(),
+      getHistory: vi.fn().mockReturnValue([]),
    } as unknown as Mocked<GeminiChat>;
    mockTool = {
      kind: 'read',
@@ -647,6 +679,9 @@ describe('Session', () => {
    mockConfig = {
      getModel: vi.fn().mockReturnValue('gemini-pro'),
      getActiveModel: vi.fn().mockReturnValue('gemini-pro'),
+      getModelRouterService: vi.fn().mockReturnValue({
+        route: vi.fn().mockResolvedValue({ model: 'resolved-model' }),
+      }),
      getToolRegistry: vi.fn().mockReturnValue(mockToolRegistry),
      getMcpServers: vi.fn(),
      getFileService: vi.fn().mockReturnValue({
@@ -687,13 +722,28 @@ describe('Session', () => {
      systemDefaults: { settings: {} },
      user: { settings: {} },
      workspace: { settings: {} },
-      merged: { settings: {} },
+      merged: {
+        security: { enablePermanentToolApproval: true },
+        mcpServers: {},
+      },
      errors: [],
    } as unknown as LoadedSettings);
+
+    (ReadManyFilesTool as unknown as Mock).mockImplementation(() => ({
+      name: 'read_many_files',
+      kind: 'read',
+      build: vi.fn().mockReturnValue({
+        getDescription: () => 'Read files',
+        toolLocations: () => [],
+        execute: vi.fn().mockResolvedValue({
+          llmContent: ['--- file.txt ---\n\nFile content\n\n'],
+        }),
+      }),
+    }));
  });

  afterEach(() => {
-    vi.clearAllMocks();
+    vi.restoreAllMocks();
  });

  it('should send available commands', async () => {
@@ -763,6 +813,68 @@ describe('Session', () => {
    expect(result).toMatchObject({ stopReason: 'end_turn' });
  });

+  it('should use model router to determine model', async () => {
+    const mockRouter = {
+      route: vi.fn().mockResolvedValue({ model: 'routed-model' }),
+    } as unknown as ModelRouterService;
+    mockConfig.getModelRouterService.mockReturnValue(mockRouter);
+
+    const stream = createMockStream([
+      {
+        type: StreamEventType.CHUNK,
+        value: {
+          candidates: [{ content: { parts: [{ text: 'Hello' }] } }],
+        },
+      },
+    ]);
+    mockChat.sendMessageStream.mockResolvedValue(stream);
+
+    await session.prompt({
+      sessionId: 'session-1',
+      prompt: [{ type: 'text', text: 'Hi' }],
+    });
+
+    expect(mockRouter.route).toHaveBeenCalledWith(
+      expect.objectContaining({
+        requestedModel: 'gemini-pro',
+        request: [{ text: 'Hi' }],
+      }),
+    );
+    expect(mockChat.sendMessageStream).toHaveBeenCalledWith(
+      expect.objectContaining({ model: 'routed-model' }),
+      expect.any(Array),
+      expect.any(String),
+      expect.any(Object),
+      expect.any(String),
+    );
+  });
+
+  it('should handle prompt with empty response (InvalidStreamError)', async () => {
+    mockChat.sendMessageStream.mockRejectedValue(
+      new InvalidStreamError('Empty response', 'NO_RESPONSE_TEXT'),
+    );
+
+    const result = await session.prompt({
+      sessionId: 'session-1',
+      prompt: [{ type: 'text', text: 'Hi' }],
+    });
+
+    expect(mockChat.sendMessageStream).toHaveBeenCalled();
+    expect(result).toMatchObject({ stopReason: 'end_turn' });
+  });
+
+  it('should handle prompt with empty response (NO_RESPONSE_TEXT anomaly)', async () => {
+    mockChat.sendMessageStream.mockRejectedValue({ type: 'NO_RESPONSE_TEXT' });
+
+    const result = await session.prompt({
+      sessionId: 'session-1',
+      prompt: [{ type: 'text', text: 'Hi' }],
+    });
+
+    expect(mockChat.sendMessageStream).toHaveBeenCalled();
+    expect(result).toMatchObject({ stopReason: 'end_turn' });
+  });
+
  it('should handle /memory command', async () => {
    const handleCommandSpy = vi
      .spyOn(
@@ -1026,6 +1138,166 @@ describe('Session', () => {
    );
  });

+  it('should exclude always allow and save permanent option when enablePermanentToolApproval is false', async () => {
+    mockConfig.getDisableAlwaysAllow = vi.fn().mockReturnValue(false);
+    const confirmationDetails = {
+      type: 'edit',
+      onConfirm: vi.fn(),
+    };
+    mockTool.build.mockReturnValue({
+      getDescription: () => 'Test Tool',
+      toolLocations: () => [],
+      shouldConfirmExecute: vi.fn().mockResolvedValue(confirmationDetails),
+      execute: vi.fn().mockResolvedValue({ llmContent: 'Tool Result' }),
+    });
+
+    const customSettings = {
+      system: { settings: {} },
+      systemDefaults: { settings: {} },
+      user: { settings: {} },
+      workspace: { settings: {} },
+      merged: {
+        security: { enablePermanentToolApproval: false },
+        mcpServers: {},
+      },
+      errors: [],
+    } as unknown as LoadedSettings;
+
+    const localSession = new Session(
+      'session-2',
+      mockChat,
+      mockConfig,
+      mockConnection,
+      customSettings,
+    );
+
+    mockConnection.requestPermission.mockResolvedValueOnce({
+      outcome: {
+        outcome: 'selected',
+        optionId: ToolConfirmationOutcome.ProceedOnce,
+      },
+    });
+
+    const stream1 = createMockStream([
+      {
+        type: StreamEventType.CHUNK,
+        value: {
+          functionCalls: [{ name: 'test_tool', args: {} }],
+        },
+      },
+    ]);
+    const stream2 = createMockStream([
+      {
+        type: StreamEventType.CHUNK,
+        value: { candidates: [] },
+      },
+    ]);
+
+    mockChat.sendMessageStream
+      .mockResolvedValueOnce(stream1)
+      .mockResolvedValueOnce(stream2);
+
+    await localSession.prompt({
+      sessionId: 'session-2',
+      prompt: [{ type: 'text', text: 'Call tool' }],
+    });
+
+    expect(mockConnection.requestPermission).toHaveBeenCalledWith(
+      expect.objectContaining({
+        options: expect.not.arrayContaining([
+          expect.objectContaining({
+            optionId: ToolConfirmationOutcome.ProceedAlwaysAndSave,
+          }),
+        ]),
+      }),
+    );
+    expect(mockConnection.requestPermission).toHaveBeenCalledWith(
+      expect.objectContaining({
+        options: expect.arrayContaining([
+          expect.objectContaining({
+            optionId: ToolConfirmationOutcome.ProceedAlways,
+          }),
+        ]),
+      }),
+    );
+  });
+
+  it('should include always allow and save permanent option when enablePermanentToolApproval is true', async () => {
+    mockConfig.getDisableAlwaysAllow = vi.fn().mockReturnValue(false);
+    const confirmationDetails = {
+      type: 'edit',
+      onConfirm: vi.fn(),
+    };
+    mockTool.build.mockReturnValue({
+      getDescription: () => 'Test Tool',
+      toolLocations: () => [],
+      shouldConfirmExecute: vi.fn().mockResolvedValue(confirmationDetails),
+      execute: vi.fn().mockResolvedValue({ llmContent: 'Tool Result' }),
+    });
+
+    const customSettings = {
+      system: { settings: {} },
+      systemDefaults: { settings: {} },
+      user: { settings: {} },
+      workspace: { settings: {} },
+      merged: {
+        security: { enablePermanentToolApproval: true },
+        mcpServers: {},
+      },
+      errors: [],
+    } as unknown as LoadedSettings;
+
+    const localSession = new Session(
+      'session-2',
+      mockChat,
+      mockConfig,
+      mockConnection,
+      customSettings,
+    );
+
+    mockConnection.requestPermission.mockResolvedValueOnce({
+      outcome: {
+        outcome: 'selected',
+        optionId: ToolConfirmationOutcome.ProceedOnce,
+      },
+    });
+
+    const stream1 = createMockStream([
+      {
+        type: StreamEventType.CHUNK,
+        value: {
+          functionCalls: [{ name: 'test_tool', args: {} }],
+        },
+      },
+    ]);
+    const stream2 = createMockStream([
+      {
+        type: StreamEventType.CHUNK,
+        value: { candidates: [] },
+      },
+    ]);
+
+    mockChat.sendMessageStream
+      .mockResolvedValueOnce(stream1)
+      .mockResolvedValueOnce(stream2);
+
+    await localSession.prompt({
+      sessionId: 'session-2',
+      prompt: [{ type: 'text', text: 'Call tool' }],
+    });
+
+    expect(mockConnection.requestPermission).toHaveBeenCalledWith(
+      expect.objectContaining({
+        options: expect.arrayContaining([
+          expect.objectContaining({
+            optionId: ToolConfirmationOutcome.ProceedAlwaysAndSave,
+            name: 'Allow for this file in all future sessions',
+          }),
+        ]),
+      }),
+    );
+  });
+
  it('should use filePath for ACP diff content in permission request', async () => {
    const confirmationDetails = {
      type: 'edit',
@@ -1154,6 +1426,56 @@ describe('Session', () => {
    );
  });

+  it('should call updatePolicy when tool permission triggers always allow', async () => {
+    const confirmationDetails = {
+      type: 'info',
+      onConfirm: vi.fn(),
+    };
+    mockTool.build.mockReturnValue({
+      getDescription: () => 'Test Tool',
+      toolLocations: () => [],
+      shouldConfirmExecute: vi.fn().mockResolvedValue(confirmationDetails),
+      execute: vi.fn().mockResolvedValue({ llmContent: 'Tool Result' }),
+    });
+
+    mockConnection.requestPermission.mockResolvedValue({
+      outcome: {
+        outcome: 'selected',
+        optionId: ToolConfirmationOutcome.ProceedAlways,
+      },
+    });
+
+    const stream1 = createMockStream([
+      {
+        type: StreamEventType.CHUNK,
+        value: {
+          functionCalls: [{ name: 'test_tool', args: {} }],
+        },
+      },
+    ]);
+    const stream2 = createMockStream([
+      {
+        type: StreamEventType.CHUNK,
+        value: { candidates: [] },
+      },
+    ]);
+
+    mockChat.sendMessageStream
+      .mockResolvedValueOnce(stream1)
+      .mockResolvedValueOnce(stream2);
+
+    const { updatePolicy } = await import('@google/gemini-cli-core');
+
+    await session.prompt({
+      sessionId: 'session-1',
+      prompt: [{ type: 'text', text: 'Call tool' }],
+    });
+
+    expect(confirmationDetails.onConfirm).toHaveBeenCalled();
+
+    expect(updatePolicy).toHaveBeenCalled();
+  });
+
  it('should use filePath for ACP diff content in tool result', async () => {
    mockTool.build.mockReturnValue({
      getDescription: () => 'Test Tool',
@@ -28,7 +28,7 @@ import {
  debugLogger,
  ReadManyFilesTool,
  REFERENCE_CONTENT_START,
-  resolveModel,
+  type RoutingContext,
  createWorkingStdio,
  startupProfiler,
  Kind,
@@ -42,13 +42,16 @@ import {
  DEFAULT_GEMINI_FLASH_LITE_MODEL,
  PREVIEW_GEMINI_MODEL,
  PREVIEW_GEMINI_3_1_MODEL,
+  PREVIEW_GEMINI_3_1_FLASH_LITE_MODEL,
  PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL,
  PREVIEW_GEMINI_FLASH_MODEL,
  DEFAULT_GEMINI_MODEL_AUTO,
  PREVIEW_GEMINI_MODEL_AUTO,
  getDisplayString,
  processSingleFileContent,
+  InvalidStreamError,
  type AgentLoopContext,
+  updatePolicy,
 } from '@google/gemini-cli-core';
 import * as acp from '@agentclientprotocol/sdk';
 import { AcpFileSystemService } from './fileSystemService.js';
@@ -64,6 +67,7 @@ import {
  loadSettings,
  type LoadedSettings,
 } from '../config/settings.js';
+import { createPolicyUpdater } from '../config/policy.js';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { z } from 'zod';
@@ -133,6 +137,7 @@ export class GeminiAgent {
    args: acp.InitializeRequest,
  ): Promise<acp.InitializeResponse> {
    this.clientCapabilities = args.clientCapabilities;
+
    const authMethods = [
      {
        id: AuthType.LOGIN_WITH_GOOGLE,
@@ -322,6 +327,7 @@ export class GeminiAgent {

    const geminiClient = config.getGeminiClient();
    const chat = await geminiClient.startChat();
+
    const session = new Session(
      sessionId,
      chat,
@@ -512,6 +518,12 @@ export class GeminiAgent {

    const config = await loadCliConfig(settings, sessionId, this.argv, { cwd });

+    createPolicyUpdater(
+      config.getPolicyEngine(),
+      config.messageBus,
+      config.storage,
+    );
+
    return config;
  }

@@ -747,10 +759,15 @@ export class Session {
      const functionCalls: FunctionCall[] = [];

      try {
-        const model = resolveModel(
-          this.context.config.getModel(),
-          (await this.context.config.getGemini31Launched?.()) ?? false,
-        );
+        const routingContext: RoutingContext = {
+          history: chat.getHistory(/*curated=*/ true),
+          request: nextMessage?.parts ?? [],
+          signal: pendingSend.signal,
+          requestedModel: this.context.config.getModel(),
+        };
+
+        const router = this.context.config.getModelRouterService();
+        const { model } = await router.route(routingContext);
        const responseStream = await chat.sendMessageStream(
          { model },
          nextMessage?.parts ?? [],
@@ -841,6 +858,37 @@ export class Session {
          return { stopReason: CoreToolCallStatus.Cancelled };
        }

+        if (
+          error instanceof InvalidStreamError ||
+          (error &&
+            typeof error === 'object' &&
+            'type' in error &&
+            error.type === 'NO_RESPONSE_TEXT')
+        ) {
+          // The stream ended with an empty response or malformed tool call.
+          // Treat this as a graceful end to the model's turn rather than a crash.
+          return {
+            stopReason: 'end_turn',
+            _meta: {
+              quota: {
+                token_count: {
+                  input_tokens: totalInputTokens,
+                  output_tokens: totalOutputTokens,
+                },
+                model_usage: Array.from(modelUsageMap.entries()).map(
+                  ([modelName, counts]) => ({
+                    model: modelName,
+                    token_count: {
+                      input_tokens: counts.input,
+                      output_tokens: counts.output,
+                    },
+                  }),
+                ),
+              },
+            },
+          };
+        }
+
        throw new acp.RequestError(
          getErrorStatus(error) || 500,
          getAcpErrorMessage(error),
@@ -1012,6 +1060,7 @@ export class Session {
          options: toPermissionOptions(
            confirmationDetails,
            this.context.config,
+            this.settings.merged.security.enablePermanentToolApproval,
          ),
          toolCall: {
            toolCallId: callId,
@@ -1036,6 +1085,16 @@ export class Session {

        await confirmationDetails.onConfirm(outcome);

+        // Update policy to enable Always Allow persistence
+        await updatePolicy(
+          tool,
+          outcome,
+          confirmationDetails,
+          this.context,
+          this.context.messageBus,
+          invocation,
+        );
+
        switch (outcome) {
          case ToolConfirmationOutcome.Cancel:
            return errorResponse(
@@ -1785,6 +1844,7 @@ const basicPermissionOptions = [
 function toPermissionOptions(
  confirmation: ToolCallConfirmationDetails,
  config: Config,
+  enablePermanentToolApproval: boolean = false,
 ): acp.PermissionOption[] {
  const disableAlwaysAllow = config.getDisableAlwaysAllow();
  const options: acp.PermissionOption[] = [];
@@ -1794,37 +1854,65 @@ function toPermissionOptions(
      case 'edit':
        options.push({
          optionId: ToolConfirmationOutcome.ProceedAlways,
-          name: 'Allow All Edits',
+          name: 'Allow for this session',
          kind: 'allow_always',
        });
+        if (enablePermanentToolApproval) {
+          options.push({
+            optionId: ToolConfirmationOutcome.ProceedAlwaysAndSave,
+            name: 'Allow for this file in all future sessions',
+            kind: 'allow_always',
+          });
+        }
        break;
      case 'exec':
        options.push({
          optionId: ToolConfirmationOutcome.ProceedAlways,
-          name: `Always Allow ${confirmation.rootCommand}`,
+          name: 'Allow for this session',
          kind: 'allow_always',
        });
+        if (enablePermanentToolApproval) {
+          options.push({
+            optionId: ToolConfirmationOutcome.ProceedAlwaysAndSave,
+            name: 'Allow this command for all future sessions',
+            kind: 'allow_always',
+          });
+        }
        break;
      case 'mcp':
        options.push(
          {
            optionId: ToolConfirmationOutcome.ProceedAlwaysServer,
-            name: `Always Allow ${confirmation.serverName}`,
+            name: 'Allow all server tools for this session',
            kind: 'allow_always',
          },
          {
            optionId: ToolConfirmationOutcome.ProceedAlwaysTool,
-            name: `Always Allow ${confirmation.toolName}`,
+            name: 'Allow tool for this session',
            kind: 'allow_always',
          },
        );
+        if (enablePermanentToolApproval) {
+          options.push({
+            optionId: ToolConfirmationOutcome.ProceedAlwaysAndSave,
+            name: 'Allow tool for all future sessions',
+            kind: 'allow_always',
+          });
+        }
        break;
      case 'info':
        options.push({
          optionId: ToolConfirmationOutcome.ProceedAlways,
-          name: `Always Allow`,
+          name: 'Allow for this session',
          kind: 'allow_always',
        });
+        if (enablePermanentToolApproval) {
+          options.push({
+            optionId: ToolConfirmationOutcome.ProceedAlwaysAndSave,
+            name: 'Allow for all future sessions',
+            kind: 'allow_always',
+          });
+        }
        break;
      case 'ask_user':
      case 'exit_plan_mode':
@@ -1927,10 +2015,31 @@ function buildAvailableModels(
  const preferredModel = config.getModel() || DEFAULT_GEMINI_MODEL_AUTO;
  const shouldShowPreviewModels = config.getHasAccessToPreviewModel();
  const useGemini31 = config.getGemini31LaunchedSync?.() ?? false;
+  const useGemini31FlashLite =
+    config.getGemini31FlashLiteLaunchedSync?.() ?? false;
  const selectedAuthType = settings.merged.security.auth.selectedType;
  const useCustomToolModel =
    useGemini31 && selectedAuthType === AuthType.USE_GEMINI;

+  // --- DYNAMIC PATH ---
+  if (
+    config.getExperimentalDynamicModelConfiguration?.() === true &&
+    config.getModelConfigService
+  ) {
+    const options = config.getModelConfigService().getAvailableModelOptions({
+      useGemini3_1: useGemini31,
+      useGemini3_1FlashLite: useGemini31FlashLite,
+      useCustomTools: useCustomToolModel,
+      hasAccessToPreview: shouldShowPreviewModels,
+    });
+
+    return {
+      availableModels: options,
+      currentModelId: preferredModel,
+    };
+  }
+
+  // --- LEGACY PATH ---
  const mainOptions = [
    {
      value: DEFAULT_GEMINI_MODEL_AUTO,
@@ -1974,7 +2083,7 @@ function buildAvailableModels(
      ? PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL
      : previewProModel;

-    manualOptions.unshift(
+    const previewOptions = [
      {
        value: previewProValue,
        title: getDisplayString(previewProModel),
@@ -1983,7 +2092,16 @@ function buildAvailableModels(
        value: PREVIEW_GEMINI_FLASH_MODEL,
        title: getDisplayString(PREVIEW_GEMINI_FLASH_MODEL),
      },
-    );
+    ];
+
+    if (useGemini31FlashLite) {
+      previewOptions.push({
+        value: PREVIEW_GEMINI_3_1_FLASH_LITE_MODEL,
+        title: getDisplayString(PREVIEW_GEMINI_3_1_FLASH_LITE_MODEL),
+      });
+    }
+
+    manualOptions.unshift(...previewOptions);
  }

  const scaleOptions = (
@@ -91,6 +91,14 @@ describe('GeminiAgent Session Resume', () => {
      storage: {
        getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
      },
+      getPolicyEngine: vi.fn().mockReturnValue({
+        addRule: vi.fn(),
+      }),
+      messageBus: {
+        publish: vi.fn(),
+        subscribe: vi.fn(),
+        unsubscribe: vi.fn(),
+      },
      getApprovalMode: vi.fn().mockReturnValue('default'),
      isPlanEnabled: vi.fn().mockReturnValue(true),
      getModel: vi.fn().mockReturnValue('gemini-pro'),
@@ -284,7 +284,7 @@ export class LinkExtensionCommand implements Command {

    try {
      await stat(sourceFilepath);
-    } catch (_error) {
+    } catch {
      return { name: this.name, data: `Invalid source: ${sourceFilepath}` };
    }

@@ -130,7 +130,7 @@ export class ListCheckpointsCommand implements Command {
      const checkpointDir = config.storage.getProjectTempCheckpointsDir();
      try {
        await fs.mkdir(checkpointDir, { recursive: true });
-      } catch (_e) {
+      } catch {
        // Ignore
      }

@@ -169,7 +169,7 @@ export class ListCheckpointsCommand implements Command {
        name: this.name,
        data: `Available Checkpoints:\n${formatted}`,
      };
-    } catch (_error) {
+    } catch {
      return {
        name: this.name,
        data: 'An unexpected error occurred while listing checkpoints.',
@@ -25,7 +25,7 @@ async function pathExists(path: string) {
  try {
    await access(path);
    return true;
-  } catch (_e) {
+  } catch {
    return false;
  }
 }
@@ -32,7 +32,7 @@ describe('mcp command', () => {

    try {
      await parser.parse('mcp');
-    } catch (_error) {
+    } catch {
      // yargs might throw an error when demandCommand is not met
    }

@@ -121,7 +121,7 @@ async function testMCPConnection(
  try {
    // Use the same transport creation logic as core
    transport = await createTransport(serverName, config, false, mcpContext);
-  } catch (_error) {
+  } catch {
    await client.close();
    return MCPServerStatus.DISCONNECTED;
  }
@@ -135,7 +135,7 @@ async function testMCPConnection(

    await client.close();
    return MCPServerStatus.CONNECTED;
-  } catch (_error) {
+  } catch {
    await transport.close();
    return MCPServerStatus.DISCONNECTED;
  }
@@ -143,12 +143,17 @@ vi.mock('@google/gemini-cli-core', async () => {
      respectGeminiIgnore: true,
      customIgnoreFilePaths: [],
    },
-    createPolicyEngineConfig: vi.fn(async () => ({
-      rules: [],
-      checkers: [],
-      defaultDecision: ServerConfig.PolicyDecision.ASK_USER,
-      approvalMode: ServerConfig.ApprovalMode.DEFAULT,
-    })),
+    createPolicyEngineConfig: vi.fn(
+      async (_settings, approvalMode, _workspacePoliciesDir, interactive) => ({
+        rules: [],
+        checkers: [],
+        defaultDecision: interactive
+          ? ServerConfig.PolicyDecision.ASK_USER
+          : ServerConfig.PolicyDecision.DENY,
+        approvalMode: approvalMode ?? ServerConfig.ApprovalMode.DEFAULT,
+        nonInteractive: !interactive,
+      }),
+    ),
    getAdminErrorMessage: vi.fn(
      (_feature) =>
        `YOLO mode is disabled by your administrator. To enable it, please request an update to the settings at: https://goo.gle/manage-gemini-cli`,
@@ -984,6 +989,7 @@ describe('Hierarchical Memory Loading (config.ts) - Placeholder Suite', () => {
        respectGeminiIgnore: true,
      }),
      200, // maxDirs
+      ['.git'], // boundaryMarkers
    );
  });

@@ -1013,6 +1019,7 @@ describe('Hierarchical Memory Loading (config.ts) - Placeholder Suite', () => {
        respectGeminiIgnore: true,
      }),
      200,
+      ['.git'], // boundaryMarkers
    );
  });

@@ -1041,6 +1048,7 @@ describe('Hierarchical Memory Loading (config.ts) - Placeholder Suite', () => {
        respectGeminiIgnore: true,
      }),
      200,
+      ['.git'], // boundaryMarkers
    );
  });
 });
@@ -1117,12 +1125,7 @@ describe('mergeExcludeTools', () => {
    ]);
    process.argv = ['node', 'script.js'];
    const argv = await parseArguments(createTestMergedSettings());
-    const config = await loadCliConfig(
-      settings,
-
-      'test-session',
-      argv,
-    );
+    const config = await loadCliConfig(settings, 'test-session', argv);
    expect(config.getExcludeTools()).toEqual(
      new Set(['tool1', 'tool2', 'tool3', 'tool4', 'tool5']),
    );
@@ -1361,8 +1364,8 @@ describe('Approval mode tool exclusion logic', () => {
      'test',
    ];
    const settings = createTestMergedSettings({
-      experimental: {
-        plan: true,
+      general: {
+        plan: { enabled: true },
      },
    });
    const argv = await parseArguments(createTestMergedSettings());
@@ -1476,9 +1479,7 @@ describe('Approval mode tool exclusion logic', () => {
    const settings = createTestMergedSettings({
      general: {
        defaultApprovalMode: 'plan',
-      },
-      experimental: {
-        plan: false,
+        plan: { enabled: false },
      },
    });
    const argv = await parseArguments(settings);
@@ -1486,14 +1487,12 @@ describe('Approval mode tool exclusion logic', () => {
    expect(config.getApprovalMode()).toBe(ApprovalMode.DEFAULT);
  });

-  it('should allow plan approval mode if experimental plan is enabled', async () => {
+  it('should allow plan approval mode if plan is enabled', async () => {
    process.argv = ['node', 'script.js'];
    const settings = createTestMergedSettings({
      general: {
        defaultApprovalMode: 'plan',
-      },
-      experimental: {
-        plan: true,
+        plan: { enabled: true },
      },
    });
    const argv = await parseArguments(settings);
@@ -2739,12 +2738,12 @@ describe('loadCliConfig approval mode', () => {
    expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.YOLO);
  });

-  it('should set Plan approval mode when --approval-mode=plan is used and experimental.plan is enabled', async () => {
+  it('should set Plan approval mode when --approval-mode=plan is used and plan is enabled', async () => {
    process.argv = ['node', 'script.js', '--approval-mode', 'plan'];
    const argv = await parseArguments(createTestMergedSettings());
    const settings = createTestMergedSettings({
-      experimental: {
-        plan: true,
+      general: {
+        plan: { enabled: true },
      },
    });
    const config = await loadCliConfig(settings, 'test-session', argv);
@@ -2764,12 +2763,12 @@ describe('loadCliConfig approval mode', () => {
    expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.DEFAULT);
  });

-  it('should throw error when --approval-mode=plan is used but experimental.plan is disabled', async () => {
+  it('should throw error when --approval-mode=plan is used but plan is disabled', async () => {
    process.argv = ['node', 'script.js', '--approval-mode', 'plan'];
    const argv = await parseArguments(createTestMergedSettings());
    const settings = createTestMergedSettings({
-      experimental: {
-        plan: false,
+      general: {
+        plan: { enabled: false },
      },
    });

@@ -2890,22 +2889,26 @@ describe('loadCliConfig approval mode', () => {
      expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.YOLO);
    });

-    it('should respect plan mode from settings when experimental.plan is enabled', async () => {
+    it('should respect plan mode from settings when plan is enabled', async () => {
      process.argv = ['node', 'script.js'];
      const settings = createTestMergedSettings({
-        general: { defaultApprovalMode: 'plan' },
-        experimental: { plan: true },
+        general: {
+          defaultApprovalMode: 'plan',
+          plan: { enabled: true },
+        },
      });
      const argv = await parseArguments(settings);
      const config = await loadCliConfig(settings, 'test-session', argv);
      expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.PLAN);
    });

-    it('should throw error if plan mode is in settings but experimental.plan is disabled', async () => {
+    it('should fall back to default if plan mode is in settings but disabled', async () => {
      process.argv = ['node', 'script.js'];
      const settings = createTestMergedSettings({
-        general: { defaultApprovalMode: 'plan' },
-        experimental: { plan: false },
+        general: {
+          defaultApprovalMode: 'plan',
+          plan: { enabled: false },
+        },
      });
      const argv = await parseArguments(settings);
      const config = await loadCliConfig(settings, 'test-session', argv);
@@ -3460,6 +3463,8 @@ describe('Policy Engine Integration in loadCliConfig', () => {
        }),
      }),
      expect.anything(),
+      undefined,
+      expect.anything(),
    );
  });

@@ -3481,6 +3486,8 @@ describe('Policy Engine Integration in loadCliConfig', () => {
        }),
      }),
      expect.anything(),
+      undefined,
+      expect.anything(),
    );
  });

@@ -3504,6 +3511,8 @@ describe('Policy Engine Integration in loadCliConfig', () => {
        ],
      }),
      expect.anything(),
+      undefined,
+      expect.anything(),
    );
  });
 });
@@ -3687,7 +3696,9 @@ describe('loadCliConfig mcpEnabled', () => {
    it('should use plan directory from active extension when user has not specified one', async () => {
      process.argv = ['node', 'script.js'];
      const settings = createTestMergedSettings({
-        experimental: { plan: true },
+        general: {
+          plan: { enabled: true },
+        },
      });
      const argv = await parseArguments(settings);

@@ -3706,9 +3717,11 @@ describe('loadCliConfig mcpEnabled', () => {
    it('should NOT use plan directory from active extension when user has specified one', async () => {
      process.argv = ['node', 'script.js'];
      const settings = createTestMergedSettings({
-        experimental: { plan: true },
        general: {
-          plan: { directory: 'user-plans-dir' },
+          plan: {
+            enabled: true,
+            directory: 'user-plans-dir',
+          },
        },
      });
      const argv = await parseArguments(settings);
@@ -3729,7 +3742,9 @@ describe('loadCliConfig mcpEnabled', () => {
    it('should NOT use plan directory from inactive extension', async () => {
      process.argv = ['node', 'script.js'];
      const settings = createTestMergedSettings({
-        experimental: { plan: true },
+        general: {
+          plan: { enabled: true },
+        },
      });
      const argv = await parseArguments(settings);

@@ -3750,7 +3765,9 @@ describe('loadCliConfig mcpEnabled', () => {
    it('should use default path if neither user nor extension settings provide a plan directory', async () => {
      process.argv = ['node', 'script.js'];
      const settings = createTestMergedSettings({
-        experimental: { plan: true },
+        general: {
+          plan: { enabled: true },
+        },
      });
      const argv = await parseArguments(settings);

@@ -642,6 +642,7 @@ export async function loadCliConfig(
      memoryImportFormat,
      memoryFileFiltering,
      settings.context?.discoveryMaxDirs,
+      settings.context?.memoryBoundaryMarkers,
    );
    memoryContent = result.memoryContent;
    fileCount = result.fileCount;
@@ -668,9 +669,9 @@ export async function loadCliConfig(
        approvalMode = ApprovalMode.AUTO_EDIT;
        break;
      case 'plan':
-        if (!(settings.experimental?.plan ?? false)) {
+        if (!(settings.general?.plan?.enabled ?? true)) {
          debugLogger.warn(
-            'Approval mode "plan" is only available when experimental.plan is enabled. Falling back to "default".',
+            'Approval mode "plan" is disabled in your settings. Falling back to "default".',
          );
          approvalMode = ApprovalMode.DEFAULT;
        } else {
@@ -792,8 +793,8 @@ export async function loadCliConfig(
    effectiveSettings,
    approvalMode,
    workspacePoliciesDir,
+    interactive,
  );
-  policyEngineConfig.nonInteractive = !interactive;

  const defaultModel = PREVIEW_GEMINI_MODEL_AUTO;
  const specifiedModel =
@@ -896,6 +897,7 @@ export async function loadCliConfig(
    loadMemoryFromIncludeDirectories:
      settings.context?.loadMemoryFromIncludeDirectories || false,
    discoveryMaxDirs: settings.context?.discoveryMaxDirs,
+    memoryBoundaryMarkers: settings.context?.memoryBoundaryMarkers,
    importFormat: settings.context?.importFormat,
    debugMode,
    question,
@@ -964,7 +966,7 @@ export async function loadCliConfig(
    extensionRegistryURI,
    enableExtensionReloading: settings.experimental?.extensionReloading,
    enableAgents: settings.experimental?.enableAgents,
-    plan: settings.experimental?.plan,
+    plan: settings.general?.plan?.enabled ?? true,
    tracker: settings.experimental?.taskTracker,
    directWebFetch: settings.experimental?.directWebFetch,
    planSettings: settings.general?.plan?.directory
@@ -975,9 +977,12 @@ export async function loadCliConfig(
    disabledSkills: settings.skills?.disabled,
    experimentalJitContext: settings.experimental?.jitContext,
    experimentalMemoryManager: settings.experimental?.memoryManager,
+    contextManagement: {
+      enabled: settings.experimental?.contextManagement,
+      ...settings?.contextManagement,
+    },
    modelSteering: settings.experimental?.modelSteering,
    topicUpdateNarration: settings.experimental?.topicUpdateNarration,
-    toolOutputMasking: settings.experimental?.toolOutputMasking,
    noBrowser: !!process.env['NO_BROWSER'],
    summarizeToolOutput: settings.model?.summarizeToolOutput,
    ideMode,
@@ -990,6 +995,8 @@ export async function loadCliConfig(
    useAlternateBuffer: settings.ui?.useAlternateBuffer,
    useRipgrep: settings.tools?.useRipgrep,
    enableInteractiveShell: settings.tools?.shell?.enableInteractiveShell,
+    shellBackgroundCompletionBehavior: settings.tools?.shell
+      ?.backgroundCompletionBehavior as string | undefined,
    shellToolInactivityTimeout: settings.tools?.shell?.inactivityTimeout,
    enableShellOutputEfficiency:
      settings.tools?.shell?.enableShellOutputEfficiency ?? true,
@@ -1002,6 +1009,7 @@ export async function loadCliConfig(
      format: (argv.outputFormat ?? settings.output?.format) as OutputFormat,
    },
    gemmaModelRouter: settings.experimental?.gemmaModelRouter,
+    adk: settings.experimental?.adk,
    fakeResponses: argv.fakeResponses,
    recordResponses: argv.recordResponses,
    retryFetchErrors: settings.general?.retryFetchErrors,
@@ -1056,7 +1064,7 @@ async function resolveWorktreeSettings(
    if (isGeminiWorktree(toplevel, projectRoot)) {
      worktreePath = toplevel;
    }
-  } catch (_e) {
+  } catch {
    return undefined;
  }

@@ -33,7 +33,7 @@ describe('copyExtension permissions', () => {
            makeWritableSync(path.join(p, child)),
          );
        }
-      } catch (_e) {
+      } catch {
        // Ignore errors during cleanup
      }
    };
@@ -199,6 +199,7 @@ describe('ExtensionManager theme loading', () => {
        respectGeminiIgnore: true,
      }),
      getDiscoveryMaxDirs: () => 200,
+      getMemoryBoundaryMarkers: () => ['.git'],
      getMcpClientManager: () => ({
        getMcpInstructions: () => '',
        startExtension: vi.fn().mockResolvedValue(undefined),
@@ -101,7 +101,7 @@ describe('ExtensionManager', () => {
    themeManager.clearExtensionThemes();
    try {
      fs.rmSync(tempHomeDir, { recursive: true, force: true });
-    } catch (_e) {
+    } catch {
      // Ignore
    }
  });
@@ -63,7 +63,7 @@ export function loadInstallMetadata(
    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
    const metadata = JSON.parse(configContent) as ExtensionInstallMetadata;
    return metadata;
-  } catch (_e) {
+  } catch {
    return undefined;
  }
 }
@@ -151,7 +151,7 @@ export async function fetchReleaseFromGithub(
      return await fetchJson(
        `https://api.github.com/repos/${owner}/${repo}/releases/latest`,
      );
-    } catch (_) {
+    } catch {
      // This can fail if there is no release marked latest. In that case
      // we want to just try the pre-release logic below.
    }
@@ -5,87 +5,153 @@
 */

 import { describe, it, expect } from 'vitest';
-import { deriveItemsFromLegacySettings } from './footerItems.js';
+import {
+  deriveItemsFromLegacySettings,
+  resolveFooterState,
+} from './footerItems.js';
 import { createMockSettings } from '../test-utils/settings.js';

-describe('deriveItemsFromLegacySettings', () => {
-  it('returns defaults when no legacy settings are customized', () => {
-    const settings = createMockSettings({
-      ui: { footer: { hideContextPercentage: true } },
-    }).merged;
-    const items = deriveItemsFromLegacySettings(settings);
-    expect(items).toEqual([
-      'workspace',
-      'git-branch',
-      'sandbox',
-      'model-name',
-      'quota',
-    ]);
-  });
+describe('footerItems', () => {
+  describe('deriveItemsFromLegacySettings', () => {
+    it('returns defaults when no legacy settings are customized', () => {
+      const settings = createMockSettings({
+        ui: { footer: { hideContextPercentage: true } },
+      }).merged;
+      const items = deriveItemsFromLegacySettings(settings);
+      expect(items).toEqual([
+        'workspace',
+        'git-branch',
+        'sandbox',
+        'model-name',
+        'quota',
+      ]);
+    });

-  it('removes workspace when hideCWD is true', () => {
-    const settings = createMockSettings({
-      ui: { footer: { hideCWD: true, hideContextPercentage: true } },
-    }).merged;
-    const items = deriveItemsFromLegacySettings(settings);
-    expect(items).not.toContain('workspace');
-  });
+    it('removes workspace when hideCWD is true', () => {
+      const settings = createMockSettings({
+        ui: { footer: { hideCWD: true, hideContextPercentage: true } },
+      }).merged;
+      const items = deriveItemsFromLegacySettings(settings);
+      expect(items).not.toContain('workspace');
+    });

-  it('removes sandbox when hideSandboxStatus is true', () => {
-    const settings = createMockSettings({
-      ui: { footer: { hideSandboxStatus: true, hideContextPercentage: true } },
-    }).merged;
-    const items = deriveItemsFromLegacySettings(settings);
-    expect(items).not.toContain('sandbox');
-  });
-
-  it('removes model-name, context-used, and quota when hideModelInfo is true', () => {
-    const settings = createMockSettings({
-      ui: { footer: { hideModelInfo: true, hideContextPercentage: true } },
-    }).merged;
-    const items = deriveItemsFromLegacySettings(settings);
-    expect(items).not.toContain('model-name');
-    expect(items).not.toContain('context-used');
-    expect(items).not.toContain('quota');
-  });
-
-  it('includes context-used when hideContextPercentage is false', () => {
-    const settings = createMockSettings({
-      ui: { footer: { hideContextPercentage: false } },
-    }).merged;
-    const items = deriveItemsFromLegacySettings(settings);
-    expect(items).toContain('context-used');
-    // Should be after model-name
-    const modelIdx = items.indexOf('model-name');
-    const contextIdx = items.indexOf('context-used');
-    expect(contextIdx).toBe(modelIdx + 1);
-  });
-
-  it('includes memory-usage when showMemoryUsage is true', () => {
-    const settings = createMockSettings({
-      ui: { showMemoryUsage: true, footer: { hideContextPercentage: true } },
-    }).merged;
-    const items = deriveItemsFromLegacySettings(settings);
-    expect(items).toContain('memory-usage');
-  });
-
-  it('handles combination of settings', () => {
-    const settings = createMockSettings({
-      ui: {
-        showMemoryUsage: true,
-        footer: {
-          hideCWD: true,
-          hideModelInfo: true,
-          hideContextPercentage: false,
+    it('removes sandbox when hideSandboxStatus is true', () => {
+      const settings = createMockSettings({
+        ui: {
+          footer: { hideSandboxStatus: true, hideContextPercentage: true },
        },
-      },
-    }).merged;
-    const items = deriveItemsFromLegacySettings(settings);
-    expect(items).toEqual([
-      'git-branch',
-      'sandbox',
-      'context-used',
-      'memory-usage',
-    ]);
+      }).merged;
+      const items = deriveItemsFromLegacySettings(settings);
+      expect(items).not.toContain('sandbox');
+    });
+
+    it('removes model-name, context-used, and quota when hideModelInfo is true', () => {
+      const settings = createMockSettings({
+        ui: { footer: { hideModelInfo: true, hideContextPercentage: true } },
+      }).merged;
+      const items = deriveItemsFromLegacySettings(settings);
+      expect(items).not.toContain('model-name');
+      expect(items).not.toContain('context-used');
+      expect(items).not.toContain('quota');
+    });
+
+    it('includes context-used when hideContextPercentage is false', () => {
+      const settings = createMockSettings({
+        ui: { footer: { hideContextPercentage: false } },
+      }).merged;
+      const items = deriveItemsFromLegacySettings(settings);
+      expect(items).toContain('context-used');
+      // Should be after model-name
+      const modelIdx = items.indexOf('model-name');
+      const contextIdx = items.indexOf('context-used');
+      expect(contextIdx).toBe(modelIdx + 1);
+    });
+
+    it('includes memory-usage when showMemoryUsage is true', () => {
+      const settings = createMockSettings({
+        ui: { showMemoryUsage: true, footer: { hideContextPercentage: true } },
+      }).merged;
+      const items = deriveItemsFromLegacySettings(settings);
+      expect(items).toContain('memory-usage');
+    });
+
+    it('handles combination of settings', () => {
+      const settings = createMockSettings({
+        ui: {
+          showMemoryUsage: true,
+          footer: {
+            hideCWD: true,
+            hideModelInfo: true,
+            hideContextPercentage: false,
+          },
+        },
+      }).merged;
+      const items = deriveItemsFromLegacySettings(settings);
+      expect(items).toEqual([
+        'git-branch',
+        'sandbox',
+        'context-used',
+        'memory-usage',
+      ]);
+    });
+  });
+
+  describe('resolveFooterState', () => {
+    it('filters out auth item when showUserIdentity is false', () => {
+      const settings = createMockSettings({
+        ui: {
+          showUserIdentity: false,
+          footer: {
+            items: ['workspace', 'auth', 'model-name'],
+          },
+        },
+      }).merged;
+
+      const state = resolveFooterState(settings);
+      expect(state.orderedIds).not.toContain('auth');
+      expect(state.selectedIds.has('auth')).toBe(false);
+      // It should also not be in the 'others' part of orderedIds
+      expect(state.orderedIds).toEqual([
+        'workspace',
+        'model-name',
+        'git-branch',
+        'sandbox',
+        'context-used',
+        'quota',
+        'memory-usage',
+        'session-id',
+        'code-changes',
+        'token-count',
+      ]);
+    });
+
+    it('includes auth item when showUserIdentity is true', () => {
+      const settings = createMockSettings({
+        ui: {
+          showUserIdentity: true,
+          footer: {
+            items: ['workspace', 'auth', 'model-name'],
+          },
+        },
+      }).merged;
+
+      const state = resolveFooterState(settings);
+      expect(state.orderedIds).toContain('auth');
+      expect(state.selectedIds.has('auth')).toBe(true);
+    });
+
+    it('includes auth item by default when showUserIdentity is undefined (defaults to true)', () => {
+      const settings = createMockSettings({
+        ui: {
+          footer: {
+            items: ['workspace', 'auth', 'model-name'],
+          },
+        },
+      }).merged;
+
+      const state = resolveFooterState(settings);
+      expect(state.orderedIds).toContain('auth');
+      expect(state.selectedIds.has('auth')).toBe(true);
+    });
  });
 });
@@ -47,6 +47,11 @@ export const ALL_ITEMS = [
    header: 'session',
    description: 'Unique identifier for the current session',
  },
+  {
+    id: 'auth',
+    header: '/auth',
+    description: 'Current authentication info',
+  },
  {
    id: 'code-changes',
    header: 'diff',
@@ -70,6 +75,7 @@ export const DEFAULT_ORDER = [
  'quota',
  'memory-usage',
  'session-id',
+  'auth',
  'code-changes',
  'token-count',
 ];
@@ -121,10 +127,19 @@ export function resolveFooterState(settings: MergedSettings): {
  orderedIds: string[];
  selectedIds: Set<string>;
 } {
+  const showUserIdentity = settings.ui?.showUserIdentity !== false;
+  const filteredValidIds = showUserIdentity
+    ? VALID_IDS
+    : new Set([...VALID_IDS].filter((id) => id !== 'auth'));
+
  const source = (
    settings.ui?.footer?.items ?? deriveItemsFromLegacySettings(settings)
-  ).filter((id: string) => VALID_IDS.has(id));
-  const others = DEFAULT_ORDER.filter((id) => !source.includes(id));
+  ).filter((id: string) => filteredValidIds.has(id));
+
+  const others = DEFAULT_ORDER.filter(
+    (id) => !source.includes(id) && filteredValidIds.has(id),
+  );
+
  return {
    orderedIds: [...source, ...others],
    selectedIds: new Set(source),
@@ -605,12 +605,12 @@ describe('Policy Engine Integration Tests', () => {
    it('should verify non-interactive mode transformation', async () => {
      const settings: Settings = {};

-      const config = await createPolicyEngineConfig(
+      const engineConfig = await createPolicyEngineConfig(
        settings,
        ApprovalMode.DEFAULT,
+        undefined,
+        false,
      );
-      // Enable non-interactive mode
-      const engineConfig = { ...config, nonInteractive: true };
      const engine = new PolicyEngine(engineConfig);

      // ASK_USER should become DENY in non-interactive mode
@@ -53,6 +53,7 @@ export async function createPolicyEngineConfig(
  settings: Settings,
  approvalMode: ApprovalMode,
  workspacePoliciesDir?: string,
+  interactive: boolean = true,
 ): Promise<PolicyEngineConfig> {
  // Explicitly construct PolicySettings from Settings to ensure type safety
  // and avoid accidental leakage of other settings properties.
@@ -68,7 +69,12 @@ export async function createPolicyEngineConfig(
      settings.admin?.secureModeEnabled,
  };

-  return createCorePolicyEngineConfig(policySettings, approvalMode);
+  return createCorePolicyEngineConfig(
+    policySettings,
+    approvalMode,
+    undefined,
+    interactive,
+  );
 }

 export function createPolicyUpdater(
@@ -93,7 +93,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'docker',
        image: 'default/image',
      });
@@ -122,7 +122,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'lxc',
        image: 'default/image',
      });
@@ -148,7 +148,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'sandbox-exec',
        image: 'default/image',
      });
@@ -161,7 +161,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'sandbox-exec',
        image: 'default/image',
      });
@@ -174,7 +174,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'docker',
        image: 'default/image',
      });
@@ -187,7 +187,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'podman',
        image: 'default/image',
      });
@@ -210,7 +210,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'podman',
        image: 'default/image',
      });
@@ -244,7 +244,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'docker',
        image: 'env/image',
      });
@@ -257,7 +257,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'docker',
        image: 'default/image',
      });
@@ -285,7 +285,7 @@ describe('loadSandboxConfig', () => {
        expect(config).toEqual({
          enabled: true,
          allowedPaths: [],
-          networkAccess: false,
+          networkAccess: true,
          command: 'docker',
          image: 'default/image',
        });
@@ -339,7 +339,7 @@ describe('loadSandboxConfig', () => {
              enabled: true,
              command: 'podman',
              allowedPaths: [],
-              networkAccess: false,
+              networkAccess: true,
            },
          },
        },
@@ -356,7 +356,7 @@ describe('loadSandboxConfig', () => {
              enabled: true,
              image: 'custom/image',
              allowedPaths: [],
-              networkAccess: false,
+              networkAccess: true,
            },
          },
        },
@@ -372,7 +372,7 @@ describe('loadSandboxConfig', () => {
            sandbox: {
              enabled: false,
              allowedPaths: [],
-              networkAccess: false,
+              networkAccess: true,
            },
          },
        },
@@ -388,7 +388,7 @@ describe('loadSandboxConfig', () => {
            sandbox: {
              enabled: true,
              allowedPaths: ['/settings-path'],
-              networkAccess: false,
+              networkAccess: true,
            },
          },
        },
@@ -410,7 +410,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'runsc',
        image: 'default/image',
      });
@@ -425,7 +425,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'runsc',
        image: 'default/image',
      });
@@ -442,7 +442,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'runsc',
        image: 'default/image',
      });
@@ -460,7 +460,7 @@ describe('loadSandboxConfig', () => {
      expect(config).toEqual({
        enabled: true,
        allowedPaths: [],
-        networkAccess: false,
+        networkAccess: true,
        command: 'runsc',
        image: 'default/image',
      });
@@ -131,7 +131,7 @@ export async function loadSandboxConfig(

  let sandboxValue: boolean | string | null | undefined;
  let allowedPaths: string[] = [];
-  let networkAccess = false;
+  let networkAccess = true;
  let customImage: string | undefined;

  if (
@@ -142,7 +142,7 @@ export async function loadSandboxConfig(
    const config = sandboxOption;
    sandboxValue = config.enabled ? (config.command ?? true) : false;
    allowedPaths = config.allowedPaths ?? [];
-    networkAccess = config.networkAccess ?? false;
+    networkAccess = config.networkAccess ?? true;
    customImage = config.image;
  } else if (typeof sandboxOption !== 'object' || sandboxOption === null) {
    sandboxValue = sandboxOption;
@@ -612,7 +612,7 @@ export function loadEnvironment(
          }
        }
      }
-    } catch (_e) {
+    } catch {
      // Errors are ignored to match the behavior of `dotenv.config({ quiet: true })`.
    }
  }
@@ -1124,15 +1124,15 @@ function migrateExperimentalSettings(
    };
    let modified = false;

-    const migrateExperimental = (
+    const migrateExperimental = <T = Record<string, unknown>>(
      oldKey: string,
-      migrateFn: (oldValue: Record<string, unknown>) => void,
+      migrateFn: (oldValue: T) => void,
    ) => {
      const old = experimentalSettings[oldKey];
-      if (old) {
+      if (old !== undefined) {
        foundDeprecated?.push(`experimental.${oldKey}`);
        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
-        migrateFn(old as Record<string, unknown>);
+        migrateFn(old as T);
        modified = true;
      }
    };
@@ -1197,6 +1197,24 @@ function migrateExperimentalSettings(
      agentsOverrides['cli_help'] = override;
    });

+    // Migrate experimental.plan -> general.plan.enabled
+    migrateExperimental<boolean>('plan', (planValue) => {
+      const generalSettings =
+        (settings.general as Record<string, unknown> | undefined) || {};
+      const newGeneral = { ...generalSettings };
+      const planSettings =
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+        (newGeneral['plan'] as Record<string, unknown> | undefined) || {};
+      const newPlan = { ...planSettings };
+
+      if (newPlan['enabled'] === undefined) {
+        newPlan['enabled'] = planValue;
+        newGeneral['plan'] = newPlan;
+        loadedSettings.setValue(scope, 'general', newGeneral);
+        modified = true;
+      }
+    });
+
    if (modified) {
      agentsSettings['overrides'] = agentsOverrides;
      loadedSettings.setValue(scope, 'agents', agentsSettings);
@@ -1205,6 +1223,7 @@ function migrateExperimentalSettings(
        const newExperimental = { ...experimentalSettings };
        delete newExperimental['codebaseInvestigatorSettings'];
        delete newExperimental['cliHelpAgentSettings'];
+        delete newExperimental['plan'];
        loadedSettings.setValue(scope, 'experimental', newExperimental);
      }
      return true;
@@ -87,7 +87,7 @@ describe('SettingsSchema', () => {
      const definition = getSettingsSchema().ui?.properties?.loadingPhrases;
      expect(definition).toBeDefined();
      expect(definition?.type).toBe('enum');
-      expect(definition?.default).toBe('tips');
+      expect(definition?.default).toBe('off');
      expect(definition?.options?.map((o) => o.value)).toEqual([
        'tips',
        'witty',
@@ -418,14 +418,17 @@ describe('SettingsSchema', () => {
    });

    it('should have plan setting in schema', () => {
-      const setting = getSettingsSchema().experimental.properties.plan;
+      const setting =
+        getSettingsSchema().general.properties.plan.properties.enabled;
      expect(setting).toBeDefined();
      expect(setting.type).toBe('boolean');
-      expect(setting.category).toBe('Experimental');
+      expect(setting.category).toBe('General');
      expect(setting.default).toBe(true);
      expect(setting.requiresRestart).toBe(true);
      expect(setting.showInDialog).toBe(true);
-      expect(setting.description).toBe('Enable Plan Mode.');
+      expect(setting.description).toBe(
+        'Enable Plan Mode for read-only safety during planning.',
+      );
    });

    it('should have hooksConfig.notifications setting in schema', () => {
@@ -502,6 +505,31 @@ describe('SettingsSchema', () => {
        'The model to use for the classifier. Only tested on `gemma3-1b-gpu-custom`.',
      );
    });
+
+    it('should have adk setting in schema', () => {
+      const adk = getSettingsSchema().experimental.properties.adk;
+      expect(adk).toBeDefined();
+      expect(adk.type).toBe('object');
+      expect(adk.category).toBe('Experimental');
+      expect(adk.default).toEqual({});
+      expect(adk.requiresRestart).toBe(true);
+      expect(adk.showInDialog).toBe(false);
+      expect(adk.description).toBe(
+        'Settings for the Agent Development Kit (ADK).',
+      );
+
+      const agentSessionNoninteractiveEnabled =
+        adk.properties.agentSessionNoninteractiveEnabled;
+      expect(agentSessionNoninteractiveEnabled).toBeDefined();
+      expect(agentSessionNoninteractiveEnabled.type).toBe('boolean');
+      expect(agentSessionNoninteractiveEnabled.category).toBe('Experimental');
+      expect(agentSessionNoninteractiveEnabled.default).toBe(false);
+      expect(agentSessionNoninteractiveEnabled.requiresRestart).toBe(true);
+      expect(agentSessionNoninteractiveEnabled.showInDialog).toBe(false);
+      expect(agentSessionNoninteractiveEnabled.description).toBe(
+        'Enable non-interactive agent sessions.',
+      );
+    });
  });

  it('has JSON schema definitions for every referenced ref', () => {
@@ -261,7 +261,7 @@ const SETTINGS_SCHEMA = {
        requiresRestart: false,
        default: false,
        description:
-          'Enable run-event notifications for action-required prompts and session completion. Currently macOS only.',
+          'Enable run-event notifications for action-required prompts and session completion.',
        showInDialog: true,
      },
      checkpointing: {
@@ -293,6 +293,16 @@ const SETTINGS_SCHEMA = {
        description: 'Planning features configuration.',
        showInDialog: false,
        properties: {
+          enabled: {
+            type: 'boolean',
+            label: 'Enable Plan Mode',
+            category: 'General',
+            requiresRestart: true,
+            default: true,
+            description:
+              'Enable Plan Mode for read-only safety during planning.',
+            showInDialog: true,
+          },
          directory: {
            type: 'string',
            label: 'Plan Directory',
@@ -561,6 +571,16 @@ const SETTINGS_SCHEMA = {
        description: 'Show the "? for shortcuts" hint above the input.',
        showInDialog: true,
      },
+      compactToolOutput: {
+        type: 'boolean',
+        label: 'Compact Tool Output',
+        category: 'UI',
+        requiresRestart: false,
+        default: false,
+        description:
+          'Display tool outputs (like directory listings and file reads) in a compact, structured format.',
+        showInDialog: true,
+      },
      hideBanner: {
        type: 'boolean',
        label: 'Hide Banner',
@@ -756,9 +776,9 @@ const SETTINGS_SCHEMA = {
        label: 'Loading Phrases',
        category: 'UI',
        requiresRestart: false,
-        default: 'tips',
+        default: 'off',
        description:
-          'What to show while the model is working: tips, witty comments, both, or nothing.',
+          'What to show while the model is working: tips, witty comments, all, or off.',
        showInDialog: true,
        options: [
          { value: 'tips', label: 'Tips' },
@@ -1291,6 +1311,19 @@ const SETTINGS_SCHEMA = {
        description: 'Maximum number of directories to search for memory.',
        showInDialog: true,
      },
+      memoryBoundaryMarkers: {
+        type: 'array',
+        label: 'Memory Boundary Markers',
+        category: 'Context',
+        requiresRestart: true,
+        default: ['.git'] as string[],
+        description:
+          'File or directory names that mark the boundary for GEMINI.md discovery. ' +
+          'The upward traversal stops at the first directory containing any of these markers. ' +
+          'An empty array disables parent traversal.',
+        showInDialog: false,
+        items: { type: 'string' },
+      },
      includeDirectories: {
        type: 'array',
        label: 'Include Directories',
@@ -1445,6 +1478,21 @@ const SETTINGS_SCHEMA = {
            `,
            showInDialog: true,
          },
+          backgroundCompletionBehavior: {
+            type: 'enum',
+            label: 'Background Completion Behavior',
+            category: 'Tools',
+            requiresRestart: false,
+            default: 'silent',
+            description:
+              "Controls what happens when a background shell command finishes. 'silent' (default): quietly exits in background. 'inject': automatically returns output to agent. 'notify': shows brief message in chat.",
+            showInDialog: false,
+            options: [
+              { label: 'Silent', value: 'silent' },
+              { label: 'Inject', value: 'inject' },
+              { label: 'Notify', value: 'notify' },
+            ],
+          },
          pager: {
            type: 'string',
            label: 'Pager',
@@ -1839,7 +1887,7 @@ const SETTINGS_SCHEMA = {
        label: 'Auto Configure Max Old Space Size',
        category: 'Advanced',
        requiresRestart: true,
-        default: false,
+        default: true,
        description: 'Automatically configure Node.js memory limits',
        showInDialog: true,
      },
@@ -1885,54 +1933,22 @@ const SETTINGS_SCHEMA = {
    description: 'Setting to enable experimental features',
    showInDialog: false,
    properties: {
-      toolOutputMasking: {
+      adk: {
        type: 'object',
-        label: 'Tool Output Masking',
+        label: 'ADK',
        category: 'Experimental',
        requiresRestart: true,
-        ignoreInDocs: false,
        default: {},
-        description:
-          'Advanced settings for tool output masking to manage context window efficiency.',
+        description: 'Settings for the Agent Development Kit (ADK).',
        showInDialog: false,
        properties: {
-          enabled: {
+          agentSessionNoninteractiveEnabled: {
            type: 'boolean',
-            label: 'Enable Tool Output Masking',
+            label: 'Agent Session Non-interactive Enabled',
            category: 'Experimental',
            requiresRestart: true,
-            default: true,
-            description: 'Enables tool output masking to save tokens.',
-            showInDialog: true,
-          },
-          toolProtectionThreshold: {
-            type: 'number',
-            label: 'Tool Protection Threshold',
-            category: 'Experimental',
-            requiresRestart: true,
-            default: 50000,
-            description:
-              'Minimum number of tokens to protect from masking (most recent tool outputs).',
-            showInDialog: false,
-          },
-          minPrunableTokensThreshold: {
-            type: 'number',
-            label: 'Min Prunable Tokens Threshold',
-            category: 'Experimental',
-            requiresRestart: true,
-            default: 30000,
-            description:
-              'Minimum prunable tokens required to trigger a masking pass.',
-            showInDialog: false,
-          },
-          protectLatestTurn: {
-            type: 'boolean',
-            label: 'Protect Latest Turn',
-            category: 'Experimental',
-            requiresRestart: true,
-            default: true,
-            description:
-              'Ensures the absolute latest turn is never masked, regardless of token count.',
+            default: false,
+            description: 'Enable non-interactive agent sessions.',
            showInDialog: false,
          },
        },
@@ -2008,7 +2024,7 @@ const SETTINGS_SCHEMA = {
        label: 'JIT Context Loading',
        category: 'Experimental',
        requiresRestart: true,
-        default: true,
+        default: false,
        description: 'Enable Just-In-Time (JIT) context loading.',
        showInDialog: false,
      },
@@ -2032,15 +2048,6 @@ const SETTINGS_SCHEMA = {
          'Use OSC 52 for copying. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it).',
        showInDialog: true,
      },
-      plan: {
-        type: 'boolean',
-        label: 'Plan',
-        category: 'Experimental',
-        requiresRestart: true,
-        default: true,
-        description: 'Enable Plan Mode.',
-        showInDialog: true,
-      },
      taskTracker: {
        type: 'boolean',
        label: 'Task Tracker',
@@ -2141,6 +2148,15 @@ const SETTINGS_SCHEMA = {
          'Replace the built-in save_memory tool with a memory manager subagent that supports adding, removing, de-duplicating, and organizing memories.',
        showInDialog: true,
      },
+      contextManagement: {
+        type: 'boolean',
+        label: 'Enable Context Management',
+        category: 'Experimental',
+        requiresRestart: true,
+        default: false,
+        description: 'Enable logic for context management.',
+        showInDialog: true,
+      },
      topicUpdateNarration: {
        type: 'boolean',
        label: 'Topic & Update Narration',
@@ -2417,6 +2433,171 @@ const SETTINGS_SCHEMA = {
    },
  },

+  contextManagement: {
+    type: 'object',
+    label: 'Context Management',
+    category: 'Experimental',
+    requiresRestart: true,
+    default: {},
+    description:
+      'Settings for agent history and tool distillation context management.',
+    showInDialog: false,
+    properties: {
+      historyWindow: {
+        type: 'object',
+        label: 'History Window Settings',
+        category: 'Context Management',
+        requiresRestart: true,
+        default: {},
+        showInDialog: false,
+        properties: {
+          maxTokens: {
+            type: 'number',
+            label: 'Max Tokens',
+            category: 'Context Management',
+            requiresRestart: true,
+            default: 150_000,
+            description:
+              'The number of tokens to allow before triggering compression.',
+            showInDialog: false,
+          },
+          retainedTokens: {
+            type: 'number',
+            label: 'Retained Tokens',
+            category: 'Context Management',
+            requiresRestart: true,
+            default: 40_000,
+            description: 'The number of tokens to always retain.',
+            showInDialog: false,
+          },
+        },
+      },
+      messageLimits: {
+        type: 'object',
+        label: 'Message Limits',
+        category: 'Context Management',
+        requiresRestart: true,
+        default: {},
+        showInDialog: false,
+        properties: {
+          normalMaxTokens: {
+            type: 'number',
+            label: 'Normal Maximum Tokens',
+            category: 'Context Management',
+            requiresRestart: true,
+            default: 2500,
+            description:
+              'The target number of tokens to budget for a normal conversation turn.',
+            showInDialog: false,
+          },
+          retainedMaxTokens: {
+            type: 'number',
+            label: 'Retained Maximum Tokens',
+            category: 'Context Management',
+            requiresRestart: true,
+            default: 12000,
+            description:
+              'The maximum number of tokens a single conversation turn can consume before truncation.',
+            showInDialog: false,
+          },
+          normalizationHeadRatio: {
+            type: 'number',
+            label: 'Normalization Head Ratio',
+            category: 'Context Management',
+            requiresRestart: true,
+            default: 0.25,
+            description:
+              'The ratio of tokens to retain from the beginning of a truncated message (0.0 to 1.0).',
+            showInDialog: false,
+          },
+        },
+      },
+      tools: {
+        type: 'object',
+        label: 'Context Management Tools',
+        category: 'Context Management',
+        requiresRestart: true,
+        default: {},
+        showInDialog: false,
+        properties: {
+          distillation: {
+            type: 'object',
+            label: 'Tool Distillation',
+            category: 'Context Management',
+            requiresRestart: true,
+            default: {},
+            showInDialog: false,
+            properties: {
+              maxOutputTokens: {
+                type: 'number',
+                label: 'Max Output Tokens',
+                category: 'Context Management',
+                requiresRestart: true,
+                default: 10_000,
+                description:
+                  'Maximum tokens to show to the model when truncating large tool outputs.',
+                showInDialog: false,
+              },
+              summarizationThresholdTokens: {
+                type: 'number',
+                label: 'Tool Summarization Threshold',
+                category: 'Context Management',
+                requiresRestart: true,
+                default: 20_000,
+                description:
+                  'Threshold above which truncated tool outputs will be summarized by an LLM.',
+                showInDialog: false,
+              },
+            },
+          },
+          outputMasking: {
+            type: 'object',
+            label: 'Tool Output Masking',
+            category: 'Context Management',
+            requiresRestart: true,
+            ignoreInDocs: false,
+            default: {},
+            description:
+              'Advanced settings for tool output masking to manage context window efficiency.',
+            showInDialog: false,
+            properties: {
+              protectionThresholdTokens: {
+                type: 'number',
+                label: 'Tool Protection Threshold (Tokens)',
+                category: 'Context Management',
+                requiresRestart: true,
+                default: 50_000,
+                description:
+                  'Minimum number of tokens to protect from masking (most recent tool outputs).',
+                showInDialog: false,
+              },
+              minPrunableThresholdTokens: {
+                type: 'number',
+                label: 'Min Prunable Tokens Threshold',
+                category: 'Context Management',
+                requiresRestart: true,
+                default: 30_000,
+                description:
+                  'Minimum prunable tokens required to trigger a masking pass.',
+                showInDialog: false,
+              },
+              protectLatestTurn: {
+                type: 'boolean',
+                label: 'Protect Latest Turn',
+                category: 'Context Management',
+                requiresRestart: true,
+                default: true,
+                description:
+                  'Ensures the absolute latest turn is never masked, regardless of token count.',
+                showInDialog: false,
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+
  admin: {
    type: 'object',
    label: 'Admin',
@@ -88,6 +88,8 @@ describe('Workspace-Level Policy CLI Integration', () => {
        ),
      }),
      expect.anything(),
+      undefined,
+      expect.anything(),
    );
  });

@@ -107,6 +109,8 @@ describe('Workspace-Level Policy CLI Integration', () => {
        workspacePoliciesDir: undefined,
      }),
      expect.anything(),
+      undefined,
+      expect.anything(),
    );
  });

@@ -131,6 +135,8 @@ describe('Workspace-Level Policy CLI Integration', () => {
        workspacePoliciesDir: undefined,
      }),
      expect.anything(),
+      undefined,
+      expect.anything(),
    );
  });

@@ -163,6 +169,8 @@ describe('Workspace-Level Policy CLI Integration', () => {
        ),
      }),
      expect.anything(),
+      undefined,
+      expect.anything(),
    );
  });

@@ -201,6 +209,8 @@ describe('Workspace-Level Policy CLI Integration', () => {
        ),
      }),
      expect.anything(),
+      undefined,
+      expect.anything(),
    );
  });

@@ -237,6 +247,8 @@ describe('Workspace-Level Policy CLI Integration', () => {
        ),
      }),
      expect.anything(),
+      undefined,
+      expect.anything(),
    );
  });

@@ -278,6 +290,8 @@ describe('Workspace-Level Policy CLI Integration', () => {
          workspacePoliciesDir: undefined,
        }),
        expect.anything(),
+        undefined,
+        expect.anything(),
      );
    } finally {
      // Restore for other tests
@@ -671,11 +671,6 @@ export async function main() {
      }
    }

-    // Register SessionEnd hook for graceful exit
-    registerCleanup(async () => {
-      await config.getHookSystem()?.fireSessionEndEvent(SessionEndReason.Exit);
-    });
-
    if (!input) {
      debugLogger.error(
        `No input provided via stdin. Input can be provided by piping data into gemini or using the --prompt option.`,
@@ -6,7 +6,12 @@

 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { main } from './gemini.js';
-import { debugLogger, type Config } from '@google/gemini-cli-core';
+import {
+  debugLogger,
+  SessionEndReason,
+  type Config,
+  type HookSystem,
+} from '@google/gemini-cli-core';

 vi.mock('@google/gemini-cli-core', async (importOriginal) => {
  const actual =
@@ -197,11 +202,11 @@ describe('gemini.tsx main function cleanup', () => {
      setValue: vi.fn(),
      forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
      errors: [],
-    } as any); // eslint-disable-line @typescript-eslint/no-explicit-any
+    } as unknown as ReturnType<typeof loadSettings>);

    vi.mocked(parseArguments).mockResolvedValue({
      promptInteractive: false,
-    } as any); // eslint-disable-line @typescript-eslint/no-explicit-any
+    } as unknown as Awaited<ReturnType<typeof parseArguments>>);
    vi.mocked(loadCliConfig).mockResolvedValue({
      isInteractive: vi.fn(() => false),
      getQuestion: vi.fn(() => 'test'),
@@ -238,7 +243,8 @@ describe('gemini.tsx main function cleanup', () => {
      setTerminalBackground: vi.fn(),
      refreshAuth: vi.fn(),
      getRemoteAdminSettings: vi.fn(() => undefined),
-    } as any); // eslint-disable-line @typescript-eslint/no-explicit-any
+      getUseAlternateBuffer: vi.fn(() => false),
+    } as unknown as Config);

    await main();

@@ -248,4 +254,80 @@ describe('gemini.tsx main function cleanup', () => {
      expect.objectContaining({ message: 'Cleanup failed' }),
    );
  });
+
+  it('should register SessionEnd hook exactly once in non-interactive mode', async () => {
+    const { loadCliConfig, parseArguments } = await import(
+      './config/config.js'
+    );
+    const { registerCleanup } = await import('./utils/cleanup.js');
+
+    const mockHookSystem = {
+      fireSessionEndEvent: vi.fn().mockResolvedValue(undefined),
+      fireSessionStartEvent: vi.fn().mockResolvedValue(undefined),
+    } as unknown as HookSystem;
+
+    vi.mocked(parseArguments).mockResolvedValue({
+      promptInteractive: false,
+    } as unknown as Awaited<ReturnType<typeof parseArguments>>);
+
+    vi.mocked(loadCliConfig).mockResolvedValue(
+      buildMockConfig({
+        getHookSystem: vi.fn(() => mockHookSystem),
+      }),
+    );
+
+    vi.spyOn(process, 'exit').mockImplementation(() => undefined as never);
+
+    await main();
+
+    const registeredCallbacks = vi
+      .mocked(registerCleanup)
+      .mock.calls.map(([fn]) => fn);
+    for (const fn of registeredCallbacks) await fn();
+    expect(mockHookSystem.fireSessionEndEvent).toHaveBeenCalledTimes(1);
+    expect(mockHookSystem.fireSessionEndEvent).toHaveBeenCalledWith(
+      SessionEndReason.Exit,
+    );
+  });
+
+  function buildMockConfig(overrides: Partial<Config> = {}): Config {
+    return {
+      isInteractive: vi.fn(() => false),
+      getQuestion: vi.fn(() => 'test'),
+      getSandbox: vi.fn(() => false),
+      getDebugMode: vi.fn(() => false),
+      getPolicyEngine: vi.fn(),
+      getMessageBus: () => ({ subscribe: vi.fn() }),
+      getEnableHooks: vi.fn(() => true),
+      getHookSystem: vi.fn(() => undefined),
+      initialize: vi.fn(),
+      storage: { initialize: vi.fn().mockResolvedValue(undefined) },
+      getContentGeneratorConfig: vi.fn(),
+      getMcpClientManager: vi.fn(),
+      getIdeMode: vi.fn(() => false),
+      getAcpMode: vi.fn(() => false),
+      getScreenReader: vi.fn(() => false),
+      getGeminiMdFileCount: vi.fn(() => 0),
+      getProjectRoot: vi.fn(() => '/'),
+      getListExtensions: vi.fn(() => false),
+      getListSessions: vi.fn(() => false),
+      getDeleteSession: vi.fn(() => undefined),
+      getToolRegistry: vi.fn(),
+      getExtensions: vi.fn(() => []),
+      getModel: vi.fn(() => 'gemini-pro'),
+      getEmbeddingModel: vi.fn(() => 'embedding-001'),
+      getApprovalMode: vi.fn(() => 'default'),
+      getCoreTools: vi.fn(() => []),
+      getTelemetryEnabled: vi.fn(() => false),
+      getTelemetryLogPromptsEnabled: vi.fn(() => false),
+      getFileFilteringRespectGitIgnore: vi.fn(() => true),
+      getOutputFormat: vi.fn(() => 'text'),
+      getUsageStatisticsEnabled: vi.fn(() => false),
+      setTerminalBackground: vi.fn(),
+      refreshAuth: vi.fn(),
+      getRemoteAdminSettings: vi.fn(() => undefined),
+      getUseAlternateBuffer: vi.fn(() => false),
+      ...overrides,
+    } as unknown as Config;
+  }
 });
@@ -46,6 +46,7 @@ import { TerminalProvider } from './ui/contexts/TerminalContext.js';
 import { isAlternateBufferEnabled } from './ui/hooks/useAlternateBuffer.js';
 import { OverflowProvider } from './ui/contexts/OverflowContext.js';
 import { profiler } from './ui/components/DebugProfiler.js';
+import { initializeConsoleStore } from './ui/hooks/useConsoleMessages.js';

 const SLOW_RENDER_MS = 200;

@@ -57,6 +58,7 @@ export async function startInteractiveUI(
  resumedSessionData: ResumedSessionData | undefined,
  initializationResult: InitializationResult,
 ) {
+  initializeConsoleStore();
  // Never enter Ink alternate buffer mode when screen reader mode is enabled
  // as there is no benefit of alternate buffer mode when using a screen reader
  // and the Ink alternate buffer mode requires line wrapping harmful to
@@ -1712,7 +1712,7 @@ describe('runNonInteractive', () => {
          input,
          prompt_id: promptId,
        });
-      } catch (_error) {
+      } catch {
        // Expected exit
      }

@@ -56,7 +56,7 @@ import { themeCommand } from '../ui/commands/themeCommand.js';
 import { toolsCommand } from '../ui/commands/toolsCommand.js';
 import { skillsCommand } from '../ui/commands/skillsCommand.js';
 import { settingsCommand } from '../ui/commands/settingsCommand.js';
-import { shellsCommand } from '../ui/commands/shellsCommand.js';
+import { tasksCommand } from '../ui/commands/tasksCommand.js';
 import { vimCommand } from '../ui/commands/vimCommand.js';
 import { setupGithubCommand } from '../ui/commands/setupGithubCommand.js';
 import { terminalSetupCommand } from '../ui/commands/terminalSetupCommand.js';
@@ -221,7 +221,7 @@ export class BuiltinCommandLoader implements ICommandLoader {
          : [skillsCommand]
        : []),
      settingsCommand,
-      shellsCommand,
+      tasksCommand,
      vimCommand,
      setupGithubCommand,
      terminalSetupCommand,
@@ -61,6 +61,7 @@ export const createMockCommandContext = (
      toggleCorgiMode: vi.fn(),
      toggleShortcutsHelp: vi.fn(),
      toggleVimEnabled: vi.fn(),
+      reloadCommands: vi.fn(),
      openAgentConfigDialog: vi.fn(),
      closeAgentConfigDialog: vi.fn(),
      extensionsUpdateState: new Map(),
@@ -38,6 +38,7 @@ export const createMockConfig = (overrides: Partial<Config> = {}): Config =>
      fireSessionEndEvent: vi.fn().mockResolvedValue(undefined),
      fireSessionStartEvent: vi.fn().mockResolvedValue(undefined),
    })),
+    isMemoryManagerEnabled: vi.fn(() => false),
    getListExtensions: vi.fn(() => false),
    getExtensions: vi.fn(() => []),
    getListSessions: vi.fn(() => false),
@@ -163,6 +164,7 @@ export const createMockConfig = (overrides: Partial<Config> = {}): Config =>
    getAdminSkillsEnabled: vi.fn().mockReturnValue(false),
    getDisabledSkills: vi.fn().mockReturnValue([]),
    getExperimentalJitContext: vi.fn().mockReturnValue(false),
+    getMemoryBoundaryMarkers: vi.fn().mockReturnValue(['.git']),
    getTerminalBackground: vi.fn().mockReturnValue(undefined),
    getEmbeddingModel: vi.fn().mockReturnValue('embedding-model'),
    getQuotaErrorOccurred: vi.fn().mockReturnValue(false),
@@ -193,6 +195,17 @@ export function createMockSettings(
    user: { settings: {} },
    workspace: { settings: {} },
    errors: [],
+    subscribe: vi.fn().mockReturnValue(() => {}),
+    getSnapshot: vi.fn().mockReturnValue({
+      system: { settings: {} },
+      systemDefaults: { settings: {} },
+      user: { settings: {} },
+      workspace: { settings: {} },
+      isTrusted: true,
+      errors: [],
+      merged,
+    }),
+    setValue: vi.fn(),
    ...overrides,
    merged,
  } as unknown as LoadedSettings;
@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { vi } from 'vitest';
+import type { SpinnerName } from 'cli-spinners';
+
+export function mockInkSpinner() {
+  vi.mock('ink-spinner', async () => {
+    const { Text } = await import('ink');
+    const cliSpinners = (await import('cli-spinners')).default;
+
+    return {
+      default: function MockSpinner({ type = 'dots' }: { type?: SpinnerName }) {
+        const spinner = cliSpinners[type];
+        const frame = spinner ? spinner.frames[0] : '⠋';
+        return <Text>{frame}</Text>;
+      },
+    };
+  });
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Keith Guerin	c498284996	fix(ui): ensure autocomplete allows immediate execution and subcommand disclosure (Team Consensus)	2026-04-02 14:22:36 -07:00
Alisa	973092df50	feat: implement high-signal PR regression check for evaluations (#23937 )	2026-04-02 05:14:43 +00:00
Sandy Tao	e446733b53	feat(core): add background memory service for skill extraction (#24274 )	2026-04-02 05:05:31 +00:00
Alisa	3344f6849c	Unused error variables in catch block are not allowed (#24487 )	2026-04-02 04:33:07 +00:00
Jacob Richman	84936dc85d	Auto configure memory. (#24474 )	2026-04-02 03:15:27 +00:00
Jacob Richman	18cdbbf81a	Terminal Serializer Optimization (#24485 )	2026-04-02 02:56:52 +00:00
Gal Zahavi	13ccc16457	fix(core): enhance sandbox usability and fix build error (#24460 ) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2026-04-01 23:51:06 +00:00
N. Taylor Mullen	ca78a0f177	fix(cli): ensure agent stops when all declinable tools are cancelled (#24479 )	2026-04-01 23:16:34 +00:00
Keith Guerin	cb7f7d6c72	feat(cli): change default loadingPhrases to 'off' to hide tips (#24342 )	2026-04-01 23:04:43 +00:00
gemini-cli-robot	0d7e778e08	Changelog for v0.36.0-preview.8 (#24453 ) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com>	2026-04-01 20:47:06 +00:00
Adam Weidman	b5f568fefe	feat(config): add experimental.adk.agentSessionNoninteractiveEnabled setting (#24439 )	2026-04-01 20:41:38 +00:00
Emily Hedlund	d00b43733c	fix(core): refactor linux sandbox to fix ARG_MAX crashes (#24286 )	2026-04-01 20:17:10 +00:00
Adib234	55f5d3923c	feat(policy): explicitly allow web_fetch in plan mode with ask_user (#24456 ) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2026-04-01 19:57:56 +00:00
Abhi	2d432c1489	fix(core): ensure complete_task tool calls are recorded in chat history (#24437 )	2026-04-01 19:53:46 +00:00
Sam Roberts	597778e55f	Update README.md for links. (#22759 )	2026-04-01 19:15:44 +00:00
N. Taylor Mullen	4e21e5b8a3	fix(cli): refresh slash command list after /skills reload (#24454 )	2026-04-01 19:15:27 +00:00
AK	d9d51ba15b	docs(core): add subagent tool isolation draft doc (#23275 ) Co-authored-by: Abhi <43648792+abhipatel12@users.noreply.github.com>	2026-04-01 18:45:21 +00:00
Gaurav	aed85725b6	feat(browser): supersede stale snapshots to reclaim context-window tokens (#24440 )	2026-04-01 18:41:39 +00:00
anj-s	43cf63e189	fix: update task tracker storage location in system prompt (#24034 )	2026-04-01 18:29:09 +00:00
gemini-cli-robot	bda4491616	Changelog for v0.36.0-preview.7 (#24346 ) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com>	2026-04-01 18:23:28 +00:00
Sri Pasumarthi	6b303a13eb	fix(acp) refactor(core,cli): centralize model discovery logic in ModelConfigService (#24392 )	2026-04-01 18:03:30 +00:00
cynthialong0-0	16468a855d	feat(core): update browser agent prompt to check open pages first when bringing up (#24431 )	2026-04-01 17:52:18 +00:00
joshualitt	377e834e03	refactor(core): Unified context management settings schema (#24391 )	2026-04-01 17:24:45 +00:00
anj-s	3a32d9723e	feat(core): enhance tracker task schemas for detailed titles and descriptions (#23902 )	2026-04-01 17:19:47 +00:00
Gaurav	bf3ac20da0	feat(browser): add sandbox-aware browser agent initialization (#24419 )	2026-04-01 17:18:17 +00:00
Gaurav	a3ef87e6e2	fix(build): wire bundle:browser-mcp into bundle pipeline (#24424 )	2026-04-01 17:09:58 +00:00
Dev Randalpura	4c4d8bc411	fix(ui): removed additional vertical padding for tables (#24381 )	2026-04-01 16:46:38 +00:00
Sehoon Shon	f938a3f51d	fix(build): upload full bundle directory archive to GitHub releases (#24403 )	2026-04-01 16:39:44 +00:00
cynthialong0-0	c61506bbc1	fix(core): ensure blue border overlay and input blocker to act correctly depending on browser agent activities (#24385 )	2026-04-01 16:35:44 +00:00
Emily Hedlund	6a8a0d4faa	feat(core): populate sandbox forbidden paths with project ignore file contents (#24038 )	2026-04-01 16:27:55 +00:00
Dev Randalpura	066da2a1d1	fix(ui): add accelerated scrolling on alternate buffer mode (#23940 ) Co-authored-by: jacob314 <jacob314@gmail.com>	2026-04-01 16:23:40 +00:00
PROTHAM	7d1848d578	fix(cli): cap shell output at 10 MB to prevent RangeError crash (#24168 )	2026-04-01 16:09:30 +00:00
ruomeng	eb95e99b3d	feat(plan): conditionally add enter/exit plan mode tools based on current mode (#24378 )	2026-04-01 15:56:10 +00:00
Jerop Kipruto	ca43f8c291	feat(core): prioritize discussion before formal plan approval (#24423 )	2026-04-01 15:55:47 +00:00
Abhi	dcf5afafda	fix(core): resolve subagent chat recording gaps and directory inheritance (#24368 )	2026-04-01 15:29:38 +00:00
Jacob Richman	9f76f34049	ink 6.6.3 (#24372 ) Co-authored-by: matt korwel <matt.korwel@gmail.com>	2026-04-01 04:50:12 +00:00
matt korwel	7c5cd693ce	Set memoryManager to false in settings.json (#24393 )	2026-04-01 03:38:50 +00:00
matt korwel	c9ed5e41b1	fix(cli): refactor test config loading and mock debugLogger in test-setup (#24389 )	2026-03-31 20:11:02 -07:00
Daniel R. Neal	8ae5b56b5b	feat(ui): add Tokyo Night theme (#24054 ) Co-authored-by: Gal Zahavi <38544478+galz10@users.noreply.github.com>	2026-04-01 01:08:28 +00:00
Sri Pasumarthi	1b265f343f	fix(core): pin AuthType.GATEWAY to use Gemini 3.1 Pro/Flash Lite by default (#24375 )	2026-04-01 00:25:59 +00:00
joshualitt	fd5c103f99	refactor(core): Centralize context management logic into src/context (#24380 )	2026-04-01 00:01:46 +00:00
Jarrod Whelan	cdc602edd7	fix(ui): wrap topic and intent fields in TopicMessage (#24386 )	2026-04-01 00:00:48 +00:00
Gaurav	782bb4e4bd	fix(core): fix browser agent UX issues and improve E2E test reliability (#24312 )	2026-03-31 23:00:16 +00:00
David Pierce	94f9480a3a	fix(core): resolve Plan Mode deadlock during plan file creation due to sandbox restrictions (#24047 )	2026-03-31 22:06:50 +00:00
Abhi	9364dd8a49	feat(core): infrastructure for event-driven subagent history (#23914 )	2026-03-31 21:54:22 +00:00
Tirth Panchal	6d48a12efe	docs: fix broken GEMINI.md link in CONTRIBUTING.md (#24182 ) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Sam Roberts <158088236+g-samroberts@users.noreply.github.com>	2026-03-31 21:44:00 +00:00
Abhi	beab7cc053	docs(policy): remove unsupported mcpName wildcard edge case (#24133 )	2026-03-31 21:11:29 +00:00
Gal Zahavi	6cade3eaec	test(sandbox): add integration test for dynamic permission expansion (#24359 )	2026-03-31 20:59:44 +00:00
Sandy Tao	c8d18eb2ac	fix(config): disable JIT context loading by default (#24364 )	2026-03-31 20:31:22 +00:00
Tommaso Sciortino	91400c5b0b	don't try to remove tags in dry run (#24356 )	2026-03-31 12:54:53 -07:00
Gal Zahavi	554a5a36a3	fix(core): implement __read and __write commands in sandbox managers (#24283 )	2026-03-31 19:39:51 +00:00
Abhi	7e117ac0ac	docs: update subagents docs to not be experimental (#24343 )	2026-03-31 18:58:41 +00:00
Jerop Kipruto	6f053dd8b9	Revert "Add security settings for tool sandboxing" (#24357 )	2026-03-31 18:39:28 +00:00
Sehoon Shon	25af91e4df	chore(release): allow bundling for all builds, including stable (#24305 )	2026-03-31 18:37:14 +00:00
Emily Hedlund	1edc542b55	ci: install bubblewrap on Linux for release workflows (#24347 )	2026-03-31 18:19:48 +00:00
Sehoon Shon	119dff3b73	perf(build): optimize build scripts for parallel execution and remove redundant checks (#24307 )	2026-03-31 17:46:36 +00:00
cynthialong0-0	7c4b497a84	fix(core): fix race condition between browser agent and main closing process (#24340 )	2026-03-31 17:43:37 +00:00
Emily Hedlund	65ee6171e7	fix(core): batch macOS seatbelt rules into a profile file to prevent ARG_MAX errors (#24255 )	2026-03-31 17:35:13 +00:00
Yifan Ruan	9cb09ccf8e	docs: Add 'plan' option to approval mode in CLI reference (#24134 )	2026-03-31 17:34:59 +00:00
cynthialong0-0	a79f2f81ae	Fix(browser): terminate immediately for "browser is already running" error (#24233 ) Co-authored-by: Gaurav <39389231+gsquared94@users.noreply.github.com>	2026-03-31 17:07:58 +00:00
ruomeng	140c2b9914	feat(cli): add UI to update extensions (#23682 )	2026-03-31 17:05:08 +00:00
Gaurav	6805e818f7	fix(browser): terminate subagent immediately on domain restriction violations (#24313 )	2026-03-31 16:51:27 +00:00
ruomeng	07e2053e12	feat(plan): promote planning feature to stable (#24282 )	2026-03-31 16:10:13 +00:00
Sehoon Shon	f9a93a1337	feat(cli): add auth info to footer (#24042 )	2026-03-31 16:10:13 +00:00
cynthialong0-0	3982a252bb	fix(browser): reset action counter for each agent session and let it ignore internal actions (#24228 )	2026-03-31 15:23:19 +00:00
gemini-cli-robot	e293424bb4	Changelog for v0.35.3 (#24083 ) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com>	2026-03-31 06:35:30 +00:00
gemini-cli-robot	21ad42f677	Changelog for v0.36.0-preview.6 (#24082 ) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com>	2026-03-31 06:35:26 +00:00
Sehoon Shon	561418c554	fix(core): enable mid-stream retries for all models and re-enable compression test (#24302 )	2026-03-31 06:25:21 +00:00
Adib234	d0d3639e16	feat(plan): support `Plan` mode in untrusted folders (#17586 )	2026-03-31 03:33:55 +00:00
Sehoon Shon	2f7f967189	test(integration): fix plan mode write denial test false positive (#24299 )	2026-03-31 03:17:36 +00:00
Sandy Tao	46d6b119b6	feat(core): add project-level memory scope to save_memory tool (#24161 )	2026-03-31 01:32:15 +00:00
Abhijit Balaji	80929c48c5	feat(core): enable topic update narration for legacy models (#24241 ) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2026-03-31 00:57:46 +00:00
Sehoon Shon	35efdfc409	chore(test-utils): switch integration tests to use PREVIEW_GEMINI_MODEL (#24276 ) Co-authored-by: Tommaso Sciortino <sciortino@gmail.com>	2026-03-31 00:31:04 +00:00
Gal Zahavi	bea57a2f3d	Add security settings for tool sandboxing (#23923 )	2026-03-30 23:49:53 +00:00
Jarrod Whelan	1df5c98b33	feat(cli): implement compact tool output (#20974 )	2026-03-30 23:43:29 +00:00
Sehoon Shon	3e95b8ec59	feat(cli): show Flash Lite Preview model regardless of user tier (#23904 )	2026-03-30 23:30:33 +00:00
Abhi	5b5f87abc7	fix(core): ensure default agents provide tools and use model-specific schemas (#24268 )	2026-03-30 23:10:57 +00:00
Christian Gunderman	991dca4c40	Default enable narration for the team. (#24224 )	2026-03-30 22:30:55 +00:00
joshualitt	dfba0e91e2	feat(core): Unified Context Management and Tool Distillation. (#24157 )	2026-03-30 22:29:59 +00:00
Christian Gunderman	117a2d3844	fix(evals): add update_topic behavioral eval (#24223 )	2026-03-30 22:02:53 +00:00
Tommaso Sciortino	4b20d93e1d	fix broken tests (#24279 )	2026-03-30 15:25:56 -07:00
Tommaso Sciortino	44cdb3e376	fix(cli): resolve missing F12 logs via global console store (#24235 )	2026-03-30 13:15:10 -07:00
Alex Stephen	9cf410478c	Text can be added after /plan command (#22833 )	2026-03-30 14:31:20 +00:00
Spencer	a255529c6b	fix(a2a-server): prioritize ADC before evaluating headless constraints for auth initialization (#23614 )	2026-03-30 12:26:15 +00:00
Abhi	d9d2ce36f2	test(evals): add comprehensive subagent delegation evaluations (#24132 )	2026-03-29 23:13:50 +00:00
Tommaso Sciortino	da8c841ef4	fix: shellcheck warnings in scripts (#24035 )	2026-03-29 02:47:05 +00:00
Christian Gunderman	b7c86b5497	UX for topic narration tool (#24079 )	2026-03-28 21:33:38 +00:00
Adam Weidman	3eebb75b7a	feat(core): agnostic background task UI with CompletionBehavior (#22740 ) Co-authored-by: mkorwel <matt.korwel@gmail.com>	2026-03-28 21:27:51 +00:00
Christian Gunderman	07ab16dbbe	feat(cli): support 'tab to queue' for messages while generating (#24052 )	2026-03-28 01:31:11 +00:00
Abhijit Balaji	afc1d50c20	feat(core): implement tool-based topic grouping (Chapters) (#23150 ) Co-authored-by: Christian Gunderman <gundermanc@google.com>	2026-03-28 01:28:25 +00:00
Gal Zahavi	ae123c547c	fix(sandbox): implement Windows Mandatory Integrity Control for GeminiSandbox (#24057 )	2026-03-28 00:14:35 +00:00
Keith Guerin	c2705e8332	fix(cli): resolve layout contention and flashing loop in StatusRow (#24065 )	2026-03-28 00:06:07 +00:00
Sam Roberts	9574855435	Re-word intro to Gemini 3 page. (#24069 )	2026-03-28 00:01:22 +00:00
krishdef7	bf6dae4690	fix(hooks): prevent SessionEnd from firing twice in non-interactive mode (#22139 ) Co-authored-by: Tommaso Sciortino <sciortino@gmail.com>	2026-03-27 23:39:48 +00:00
Ivan Porty	b5529c2475	fix(core): resolve ACP Operation Aborted Errors in grep_search (#23821 ) Co-authored-by: Sri Pasumarthi <sripas@google.com>	2026-03-27 23:12:34 +00:00
Tommaso Sciortino	9e74a7ec18	feat(core): implement windows sandbox expansion and denial detection (#24027 )	2026-03-27 22:35:01 +00:00
Sandy Tao	4034c030e7	feat(context): add configurable memoryBoundaryMarkers setting (#24020 )	2026-03-27 21:51:32 +00:00
Gal Zahavi	765fb67011	Enable network access in sandbox configuration (#24055 )	2026-03-27 21:28:01 +00:00
Jacob Richman	97c99f263a	Fix test flakes by globally mocking ink-spinner (#24044 )	2026-03-27 21:19:46 +00:00
gemini-cli-robot	f1a3c35dee	Changelog for v0.36.0-preview.5 (#24046 ) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> Co-authored-by: Sam Roberts <158088236+g-samroberts@users.noreply.github.com>	2026-03-27 21:19:26 +00:00
Jacob Richman	ebe98fdee9	Debug command. (#23851 ) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2026-03-27 21:05:22 +00:00
Abhi	ba71ffa736	fix(core): switch to subshells for shell tool wrapping to fix heredocs and edge cases (#24024 )	2026-03-27 20:34:39 +00:00
joshualitt	320c8aba4c	feat(core): Land `AgentHistoryProvider`. (#23978 )	2026-03-27 19:22:35 +00:00
Sri Pasumarthi	e7dccabf14	fix(acp): prevent crash on empty response in ACP mode (#23952 )	2026-03-27 18:49:13 +00:00
Jacob Richman	a84d4d876e	Increase memory limited for eslint. (#24022 )	2026-03-27 18:40:26 +00:00
Emily Hedlund	29031ea7cf	refactor(core): improve ignore resolution and fix directory-matching bug (#23816 )	2026-03-27 17:12:26 +00:00
Spencer	f3977392e6	revert(core): support custom base URL via env vars (#23976 )	2026-03-27 17:10:14 +00:00
Emily Hedlund	535667baf6	feat(core): add forbiddenPaths to GlobalSandboxOptions and refactor createSandboxManager (#23936 )	2026-03-27 16:57:26 +00:00
Tommaso Sciortino	33cf2da1df	disable extension-reload test (#24018 )	2026-03-27 16:19:15 +00:00
Abhi	104587bae8	feat(core): subagent isolation and cleanup hardening (#23903 )	2026-03-27 03:43:39 +00:00
Yuna Seol	aca8e1af05	fix(core): explicitly set error names to avoid bundling renaming issues (#23913 )	2026-03-27 03:40:49 +00:00
Sam Roberts	6f92642524	ACP integration documents (#22254 ) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: nmcnamara-eng <118702206+nmcnamara-eng@users.noreply.github.com>	2026-03-27 02:10:29 +00:00
gemini-cli-robot	8413dd62ef	Changelog for v0.35.2 (#23960 ) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com>	2026-03-27 02:10:03 +00:00
Sri Pasumarthi	750dec5d8d	fix(acp): Update allow approval policy flow for ACP clients to fix config persistence and compatible with TUI (#23818 )	2026-03-27 01:42:17 +00:00
gemini-cli-robot	335b36893b	Changelog for v0.36.0-preview.4 (#23935 ) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com>	2026-03-27 01:08:39 +00:00
Jenna Inouye	25a20f8e4e	Docs: Update 'docs-writer' skill for relative links (#21463 )	2026-03-27 00:32:20 +00:00
Jacob Richman	b5ba88b001	dep(update) Update Ink version to 6.5.0 (#23843 )	2026-03-26 23:49:51 +00:00
Tommaso Sciortino	8868b34c75	refactor(core): delegate sandbox denial parsing to SandboxManager (#23928 )	2026-03-26 22:10:15 +00:00
Aditya Bijalwan	73dd7328df	feat(core): implement persistent browser session management (#21306 ) Co-authored-by: Gaurav <39389231+gsquared94@users.noreply.github.com> Co-authored-by: cynthialong0-0 <82900738+cynthialong0-0@users.noreply.github.com>	2026-03-26 21:33:37 +00:00
Spencer	d25ce0e143	fix(core): remove shell outputChunks buffer caching to prevent memory bloat and sanitize prompt input (#23751 )	2026-03-26 21:16:07 +00:00
David Pierce	30397816da	feat(sandbox): implement secret visibility lockdown for env files (#23712 ) Co-authored-by: Tommaso Sciortino <sciortino@gmail.com>	2026-03-26 20:35:21 +00:00
Gen Zhang	84f1c19265	feat(cli): enable notifications cross-platform via terminal bell fallback (#21618 ) Co-authored-by: Sandy Tao <sandytao520@icloud.com>	2026-03-26 20:10:49 +00:00
Gal Zahavi	d33170931c	fix(core): allow disabling environment variable redaction (#23927 )	2026-03-26 20:04:44 +00:00
Jenna Inouye	1d230dbfbf	Docs: Update quotas and pricing (#23835 )	2026-03-26 19:29:37 +00:00
Sehoon Shon	c92ae8a359	feat(core): define TrajectoryProvider interface (#23050 )	2026-03-26 19:24:06 +00:00
Keith Schaab	bf03543bf6	fix(a2a-server): A2A server should execute ask policies in interactive mode (#23831 )	2026-03-26 19:10:18 +00:00
matt korwel	1d2fbbf9c3	feat(gcp): add development worker infrastructure (#23814 )	2026-03-26 19:01:37 +00:00
Adib234	9762bf2965	fix(plan): after exiting plan mode switches model to a flash model (#23885 )	2026-03-26 18:45:03 +00:00
ruomeng	c888da5f73	fix(core): replace hardcoded non-interactive ASK_USER denial with explicit policy rules (#23668 )	2026-03-26 18:35:12 +00:00
Dev Randalpura	aa4d9316a9	feat(core): new skill to look for duplicated code while reviewing PRs (#23704 )	2026-03-26 18:32:30 +00:00
Aditya Bijalwan	5755ec2dcf	fix(browser): keep input blocker active across navigations (#22562 ) Co-authored-by: cynthialong0-0 <82900738+cynthialong0-0@users.noreply.github.com>	2026-03-26 16:54:49 +00:00
gemini-cli-robot	a3c1c659fd	Changelog for v0.35.1 (#23840 ) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> Co-authored-by: Sam Roberts <158088236+g-samroberts@users.noreply.github.com>	2026-03-26 16:43:23 +00:00
Sehoon Shon	49534209f2	fix(cli): prioritize primary name matches in slash command search (#23850 )	2026-03-26 12:18:57 +00:00
Chris Williams	9e7f52b8f5	Merge examples of use into quickstart documentation (#23319 )	2026-03-26 02:57:23 +00:00
Gal Zahavi	30e0ab102a	feat(sandbox): dynamic Linux sandbox expansion and worktree support (#23692 ) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2026-03-26 01:58:45 +00:00
Alisa	2e03e3aed5	feat(evals): add reliability harvester and 500/503 retry support (#23626 )	2026-03-26 01:48:45 +00:00