Refine ADK migration design doc

Auth:
- Coast Assist / LOGIN_WITH_GOOGLE uses AuthClient.request() against a
  Code Assist backend, NOT the standard Gemini API
- GcliAgentModel must extend BaseLlm directly with dual transport
  (API-key via httpOptions.headers, Coast Assist via AuthClient.request())
- OAuth flow, token refresh, credential caching all work as-is

Telemetry:
- Stream-interceptor approach replaced with BasePlugin recommendation
- ClearcutTelemetryPlugin for token counts (afterModelCallback),
  per-tool timing (beforeToolCallback/afterToolCallback with functionCallId),
  agent lifecycle, and model errors
- Corrects earlier claim: token usage IS available on ADK events
  (llm_agent.ts spreads LlmResponse into events)
- HTTP-level metrics captured in GcliAgentModel wrapper
- ~70% of Clearcut metrics stay in existing call sites unchanged

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gcp/Dockerfile.development

@@ -0,0 +1,89 @@
+# --- STAGE 1: Base Runtime ---
+FROM docker.io/library/node:20-slim AS base
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  python3 \
+  python3-pip \
+  python3-venv \
+  curl \
+  dnsutils \
+  less \
+  jq \
+  ca-certificates \
+  git \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+# --- STAGE 2: Builder (Compile Main) ---
+FROM base AS builder
+WORKDIR /build
+COPY . .
+RUN npm ci --ignore-scripts
+RUN npm run bundle
+# Run the official release preparation script to move the bundle and assets into packages/cli
+RUN node scripts/prepare-npm-release.js
+
+# --- STAGE 3: Development Environment ---
+FROM base AS development
+
+WORKDIR /home/node/dev/main
+
+# Set up npm global package folder
+RUN mkdir -p /usr/local/share/npm-global \
+  && chown -R node:node /usr/local/share/npm-global
+ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
+ENV PATH=$PATH:/usr/local/share/npm-global/bin
+
+# Copy package.json to extract versions for global tools
+COPY package.json /tmp/package.json
+
+# Install Build Tools, Global Dev Tools (pinned), and Linters
+ARG ACTIONLINT_VER=1.7.7
+ARG SHELLCHECK_VER=0.11.0
+ARG YAMLLINT_VER=1.35.1
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  make \
+  g++ \
+  gh \
+  git \
+  unzip \
+  rsync \
+  ripgrep \
+  procps \
+  psmisc \
+  lsof \
+  socat \
+  tmux \
+  docker.io \
+  build-essential \
+  libsecret-1-dev \
+  libkrb5-dev \
+  file \
+  && curl -sSLo /tmp/actionlint.tar.gz https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VER}/actionlint_${ACTIONLINT_VER}_linux_amd64.tar.gz \
+  && tar -xzf /tmp/actionlint.tar.gz -C /usr/local/bin actionlint \
+  && curl -sSLo /tmp/shellcheck.tar.xz https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VER}/shellcheck-v${SHELLCHECK_VER}.linux.x86_64.tar.xz \
+  && tar -xf /tmp/shellcheck.tar.xz -C /usr/local/bin --strip-components=1 shellcheck-v${SHELLCHECK_VER}/shellcheck \
+  && pip3 install --break-system-packages yamllint==${YAMLLINT_VER} \
+  && export TSX_VER=$(node -p "require('/tmp/package.json').devDependencies.tsx") \
+  && export VITEST_VER=$(node -p "require('/tmp/package.json').devDependencies.vitest") \
+  && export PRETTIER_VER=$(node -p "require('/tmp/package.json').devDependencies.prettier") \
+  && export ESLINT_VER=$(node -p "require('/tmp/package.json').devDependencies.eslint") \
+  && export CROSS_ENV_VER=$(node -p "require('/tmp/package.json').devDependencies['cross-env']") \
+  && npm install -g tsx@$TSX_VER vitest@$VITEST_VER prettier@$PRETTIER_VER eslint@$ESLINT_VER cross-env@$CROSS_ENV_VER typescript@5.3.3 \
+  && npm install -g @google/gemini-cli@nightly && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-nightly \
+  && npm install -g @google/gemini-cli@preview && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-preview \
+  && npm install -g @google/gemini-cli@latest  && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-stable \
+  && apt-get purge -y build-essential libsecret-1-dev libkrb5-dev \
+  && apt-get autoremove -y \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /tmp/* /root/.npm
+
+# Copy the bundled CLI package to a permanent location and install it
+# We MUST not delete this source folder as 'npm install -g <folder>' 
+# often symlinks to it for local folder installs.
+COPY --from=builder /build/packages/cli /usr/local/lib/gemini-cli
+RUN npm install -g /usr/local/lib/gemini-cli
+
+USER node
+CMD ["/bin/bash"]

.gcp/Dockerfile.development.dockerignore

@@ -0,0 +1,10 @@
+node_modules
+.git
+.gemini/workspaces
+dist
+!packages/*/dist/*.tgz
+bundle
+out
+*.log
+.env
+.DS_Store

.gcp/development-worker.yml

@@ -0,0 +1,58 @@
+substitutions:
+  _IMAGE_NAME: 'development'
+  _ARTIFACT_REGISTRY_REPO: 'us-docker.pkg.dev/gemini-code-dev/gemini-cli'
+
+steps:
+  # Step 1: Install root dependencies
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Install Dependencies'
+    entrypoint: 'npm'
+    args: ['install']
+
+  # Step 2: Authenticate for Docker
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Authenticate docker'
+    entrypoint: 'npm'
+    args: ['run', 'auth']
+
+  # Step 3: Build workspace packages
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build packages'
+    entrypoint: 'npm'
+    args: ['run', 'build:packages']
+
+  # Step 4: Build Development Image
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build Development Image'
+    entrypoint: 'bash'
+    env:
+      - 'RAW_BRANCH_VALUE=${BRANCH_NAME}'
+    args:
+      - '-c'
+      - |-
+        IMAGE_BASE="${_ARTIFACT_REGISTRY_REPO}/${_IMAGE_NAME}"
+
+        # Determine the primary tag (branch name or 'latest' for main)
+        # Use $$ for shell variables to avoid Cloud Build attempting premature substitution
+        RAW_BRANCH="$$RAW_BRANCH_VALUE"
+        if [ "$${RAW_BRANCH}" == "main" ]; then
+          TAG_PRIMARY="latest"
+        else
+          TAG_PRIMARY=$$(echo "$${RAW_BRANCH}" | sed 's/[^a-zA-Z0-9]/-/g' | tr '[:upper:]' '[:lower:]')
+        fi
+
+        # Use SHORT_SHA if available (Cloud Build) or fallback to latest-dev
+        TAG_SHA="$${SHORT_SHA:-latest-dev}"
+
+        echo "📦 Building Development Image for: $${RAW_BRANCH} -> $${TAG_PRIMARY} ($${TAG_SHA})"
+
+        docker build -f .gcp/Dockerfile.development \
+          -t "$${IMAGE_BASE}:$${TAG_SHA}" \
+          -t "$${IMAGE_BASE}:$${TAG_PRIMARY}" .
+
+        docker push "$${IMAGE_BASE}:$${TAG_SHA}"
+        docker push "$${IMAGE_BASE}:$${TAG_PRIMARY}"
+
+options:
+  defaultLogsBucketBehavior: 'REGIONAL_USER_OWNED_BUCKET'
+  dynamicSubstitutions: true

.gemini/commands/fix-behavioral-eval.toml

@@ -1,60 +0,0 @@
-description = "Check status of nightly evals, fix failures for key models, and re-run."
-prompt = """
-You are an expert at fixing behavioral evaluations.
-
-1. **Investigate**:
-   - Use 'gh' cli to fetch the results from the latest run from the main branch: https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml.
-   - DO NOT push any changes or start any runs. The rest of your evaluation will be local.
-   - Evals are in evals/ directory and are documented by evals/README.md.
-   - The test case trajectory logs will be logged to evals/logs.
-   - You should also enable and review the verbose agent logs by setting the GEMINI_DEBUG_LOG_FILE environment variable.
-   - Identify the relevant test. Confine your investigation and validation to just this test.
-   - Proactively add logging that will aid in gathering information or validating your hypotheses.
-
-2. **Fix**:
-   - If a relevant test is failing, locate the test file and the corresponding prompt/code.
-   - It's often helpful to make an extreme, brute force change to see if you are changing the right place to make an improvement and then scope it back iteratively.
-   - Your **final** change should be **minimal and targeted**.
-   - Keep in mind the following:
-     - The prompt has multiple configurations and pieces. Take care that your changes
-       end up in the final prompt for the selected model and configuration.
-     - The prompt chosen for the eval is intentional. It's often vague or indirect
-       to see how the agent performs with ambiguous instructions. Changing it should
-       be a last resort.
-     - When changing the test prompt, carefully consider whether the prompt still tests
-       the same scenario. We don't want to lose test fidelity by making the prompts too
-       direct (i.e.: easy).
-     - Your primary mechanism for improving the agent's behavior is to make changes to
-       tool instructions, system prompt (snippets.ts), and/or modules that contribute to the prompt.
-     - If prompt and description changes are unsuccessful, use logs and debugging to
-       confirm that everything is working as expected.
-    - If unable to fix the test, you can make recommendations for architecture changes
-      that might help stablize the test. Be sure to THINK DEEPLY if offering architecture guidance.
-      Some facts that might help with this are:
-      - Agents may be composed of one or more agent loops.
-      - AgentLoop == 'context + toolset + prompt'. Subagents are one type of agent loop.
-      - Agent loops perform better when:
-        - They have direct, unambiguous, and non-contradictory prompts.
-        - They have fewer irrelevant tools.
-        - They have fewer goals or steps to perform.
-        - They have less low value or irrelevant context.
-      - You may suggest compositions of existing primitives, like subagents, or
-        propose a new one.
-      - These recommendations should be high confidence and should be grounded
-        in observed deficient behaviors rather than just parroting the facts above.
-        Investigate as needed to ground your recommendations.
-
-3. **Verify**:
-   - Run just that one test if needed to validate that it is fixed. Be sure to run vitest in non-interactive mode.
-   - Running the tests can take a long time, so consider whether you can diagnose via other means or log diagnostics before committing the time. You must minimize the number of test runs needed to diagnose the failure.
-   - After the test completes, check whether it seems to have improved.
-   - You will need to run the test 3 times for Gemini 3.0, Gemini 3 flash, and Gemini 2.5 pro to ensure that it is truly stable. Run these runs in parallel, using scripts if needed.
-   - Some flakiness is expected; if it looks like a transient issue or the test is inherently unstable but passes 2/3 times, you might decide it cannot be improved.
-
-4. **Report**:
-   - Provide a summary of the test success rate for each of the tested models.
-   - Success rate is calculated based on 3 runs per model (e.g., 3/3 = 100%).
-   - If you couldn't fix it due to persistent flakiness, explain why.
-
-{{args}}
-"""

.gemini/commands/promote-behavioral-eval.toml

@@ -1,29 +0,0 @@
-description = "Promote behavioral evals that have a 100% success rate over the last 7 nightly runs."
-prompt = """
-You are an expert at analyzing and promoting behavioral evaluations.
-
-1. **Investigate**:
-   - Use 'gh' cli to fetch the results from the most recent run from the main branch: https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml.
-   - DO NOT push any changes or start any runs. The rest of your evaluation will be local.
-   - Evals are in evals/ directory and are documented by evals/README.md.
-   - Identify tests that have passed 100% of the time for ALL enabled models across the past 7 runs in a row.
-   - NOTE: the results summary from the most recent run contains the last 7 runs test results. 100% means the test passed 3/3 times for that model and run.
-   - If a test meets this criteria, it is a candidate for promotion.
-
-2. **Promote**:
-   - For each candidate test, locate the test file in the evals/ directory.
-   - Promote the test according to the project's standard promotion process (e.g., moving it to a stable suite, updating its tags, or removing skip/flaky annotations). 
-   - Ensure you follow any guidelines in evals/README.md for stable tests.
-   - Your **final** change should be **minimal and targeted** to just promoting the test status.
-
-3. **Verify**:
-   - Run the promoted tests locally to validate that they still execute correctly. Be sure to run vitest in non-interactive mode.
-   - Check that the test is now part of the expected standard or stable test suites.
-
-4. **Report**:
-   - Provide a summary of the tests that were promoted.
-   - Include the success rate evidence (7/7 runs passed for all models) for each promoted test.
-   - If no tests met the criteria for promotion, clearly state that and summarize the closest candidates.
-
-{{args}}
-"""

.gemini/settings.json

@@ -1,8 +1,9 @@
 {
   "experimental": {
-    "plan": true,
     "extensionReloading": true,
-    "modelSteering": true
+    "modelSteering": true,
+    "memoryManager": false,
+    "topicUpdateNarration": true
   },
   "general": {
     "devtools": true

.gemini/skills/async-pr-review/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: async-pr-review
+description: Trigger this skill when the user wants to start an asynchronous PR review, run background checks on a PR, or check the status of a previously started async PR review.
+---
+
+# Async PR Review
+
+This skill provides a set of tools to asynchronously review a Pull Request. It will create a background job to run the project's preflight checks, execute Gemini-powered test plans, and perform a comprehensive code review using custom prompts.
+
+This skill is designed to showcase an advanced "Agentic Asynchronous Pattern":
+1.  **Native Background Shells vs Headless Inference**: While Gemini CLI can natively spawn and detach background shell commands (using the `run_shell_command` tool with `is_background: true`), a standard bash background job cannot perform LLM inference. To conduct AI-driven code reviews and test generation in the background, the shell script *must* invoke the `gemini` executable headlessly using `-p`. This offloads the AI tasks to independent worker agents.
+2.  **Dynamic Git Scoping**: The review scripts avoid hardcoded paths. They use `git rev-parse --show-toplevel` to automatically resolve the root of the user's current project.
+3.  **Ephemeral Worktrees**: Instead of checking out branches in the user's main workspace, the skill provisions temporary git worktrees in `.gemini/tmp/async-reviews/pr-<number>`. This prevents git lock conflicts and namespace pollution.
+4.  **Agentic Evaluation (`check-async-review.sh`)**: The check script outputs clean JSON/text statuses for the main agent to parse. The interactive agent itself synthesizes the final assessment dynamically from the generated log files.
+
+## Workflow
+
+1.  **Determine Action**: Establish whether the user wants to start a new async review or check the status of an existing one.
+    *   If the user says "start an async review for PR #123" or similar, proceed to **Start Review**.
+    *   If the user says "check the status of my async review for PR #123" or similar, proceed to **Check Status**.
+
+### Start Review
+
+If the user wants to start a new async PR review:
+
+1.  Ask the user for the PR number if they haven't provided it.
+2.  Execute the `async-review.sh` script, passing the PR number as the first argument. Be sure to run it with the `is_background` flag set to true to ensure it immediately detaches.
+    ```bash
+    .gemini/skills/async-pr-review/scripts/async-review.sh <PR_NUMBER>
+    ```
+3.  Inform the user that the tasks have started successfully and they can check the status later.
+
+### Check Status
+
+If the user wants to check the status or view the final assessment of a previously started async review:
+
+1.  Ask the user for the PR number if they haven't provided it.
+2.  Execute the `check-async-review.sh` script, passing the PR number as the first argument:
+    ```bash
+    .gemini/skills/async-pr-review/scripts/check-async-review.sh <PR_NUMBER>
+    ```
+3.  **Evaluate Output**: Read the output from the script.
+    *   If the output contains `STATUS: IN_PROGRESS`, tell the user which tasks are still running.
+    *   If the output contains `STATUS: COMPLETE`, use your file reading tools (`read_file`) to retrieve the contents of `final-assessment.md`, `review.md`, `pr-diff.diff`, `npm-test.log`, and `test-execution.log` files from the `LOG_DIR` specified in the output.
+    *   **Final Assessment**: Read those files, synthesize their results, and give the user a concise recommendation on whether the PR builds successfully, passes tests, and if you recommend they approve it based on the review.

.gemini/skills/async-pr-review/policy.toml

@@ -0,0 +1,148 @@
+# --- CORE TOOLS ---
+[[rule]]
+toolName = "read_file"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "write_file"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "grep_search"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "glob"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "list_directory"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "codebase_investigator"
+decision = "allow"
+priority = 100
+
+# --- SHELL COMMANDS ---
+
+# Git (Safe/Read-only)
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = [
+  "git blame",
+  "git show",
+  "git grep",
+  "git show-ref",
+  "git ls-tree",
+  "git ls-remote",
+  "git reflog",
+  "git remote -v",
+  "git diff",
+  "git rev-list",
+  "git rev-parse",
+  "git merge-base",
+  "git cherry",
+  "git fetch",
+  "git status",
+  "git st",
+  "git branch",
+  "git br",
+  "git log",
+  "git --version"
+]
+decision = "allow"
+priority = 100
+
+# GitHub CLI (Read-only)
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = [
+  "gh workflow list",
+  "gh auth status",
+  "gh checkout view",
+  "gh run view",
+  "gh run job view",
+  "gh run list",
+  "gh run --help",
+  "gh issue view",
+  "gh issue list",
+  "gh label list",
+  "gh pr diff",
+  "gh pr check",
+  "gh pr checks",
+  "gh pr view",
+  "gh pr list",
+  "gh pr status",
+  "gh repo view",
+  "gh job view",
+  "gh api",
+  "gh log"
+]
+decision = "allow"
+priority = 100
+
+# Node.js/NPM (Generic Tests, Checks, and Build)
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = [
+  "npm run start",
+  "npm install",
+  "npm run",
+  "npm test",
+  "npm ci",
+  "npm list",
+  "npm --version"
+]
+decision = "allow"
+priority = 100
+
+# Core Utilities (Safe)
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = [
+  "sleep",
+  "env",
+  "break",
+  "xargs",
+  "base64",
+  "uniq",
+  "sort",
+  "echo",
+  "which",
+  "ls",
+  "find",
+  "tail",
+  "head",
+  "cat",
+  "cd",
+  "grep",
+  "ps",
+  "pwd",
+  "wc",
+  "file",
+  "stat",
+  "diff",
+  "lsof",
+  "date",
+  "whoami",
+  "uname",
+  "du",
+  "cut",
+  "true",
+  "false",
+  "readlink",
+  "awk",
+  "jq",
+  "rg",
+  "less",
+  "more",
+  "tree"
+]
+decision = "allow"
+priority = 100

.gemini/skills/async-pr-review/scripts/async-review.sh

@@ -0,0 +1,245 @@
+#!/bin/bash
+
+notify() {
+  local title="${1}"
+  local message="${2}"
+  local pr="${3}"
+  # Terminal escape sequence
+  printf "\e]9;%s | PR #%s | %s\a" "${title}" "${pr}" "${message}"
+  # Native macOS notification
+  os_type="$(uname || true)"
+  if [[ "${os_type}" == "Darwin" ]]; then
+    osascript -e "display notification \"${message}\" with title \"${title}\" subtitle \"PR #${pr}\""
+  fi
+}
+
+pr_number="${1}"
+if [[ -z "${pr_number}" ]]; then
+  echo "Usage: async-review <pr_number>"
+  exit 1
+fi
+
+base_dir="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+if [[ -z "${base_dir}" ]]; then
+  echo "❌ Must be run from within a git repository."
+  exit 1
+fi
+
+# Use the repository's local .gemini/tmp directory for ephemeral worktrees and logs
+pr_dir="${base_dir}/.gemini/tmp/async-reviews/pr-${pr_number}"
+target_dir="${pr_dir}/worktree"
+log_dir="${pr_dir}/logs"
+
+cd "${base_dir}" || exit 1
+
+mkdir -p "${log_dir}"
+rm -f "${log_dir}/setup.exit" "${log_dir}/final-assessment.exit" "${log_dir}/final-assessment.md"
+
+echo "🧹 Cleaning up previous worktree if it exists..." | tee -a "${log_dir}/setup.log"
+git worktree remove -f "${target_dir}" >> "${log_dir}/setup.log" 2>&1 || true
+git branch -D "gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1 || true
+git worktree prune >> "${log_dir}/setup.log" 2>&1 || true
+
+echo "📡 Fetching PR #${pr_number}..." | tee -a "${log_dir}/setup.log"
+if ! git fetch origin -f "pull/${pr_number}/head:gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1; then
+  echo 1 > "${log_dir}/setup.exit"
+  echo "❌ Fetch failed. Check ${log_dir}/setup.log"
+  notify "Async Review Failed" "Fetch failed." "${pr_number}"
+  exit 1
+fi
+
+if [[ ! -d "${target_dir}" ]]; then
+  echo "🧹 Pruning missing worktrees..." | tee -a "${log_dir}/setup.log"
+  git worktree prune >> "${log_dir}/setup.log" 2>&1
+  echo "🌿 Creating worktree in ${target_dir}..." | tee -a "${log_dir}/setup.log"
+  if ! git worktree add "${target_dir}" "gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1; then
+    echo 1 > "${log_dir}/setup.exit"
+    echo "❌ Worktree creation failed. Check ${log_dir}/setup.log"
+    notify "Async Review Failed" "Worktree creation failed." "${pr_number}"
+    exit 1
+  fi
+else
+  echo "🌿 Worktree already exists." | tee -a "${log_dir}/setup.log"
+fi
+echo 0 > "${log_dir}/setup.exit"
+
+cd "${target_dir}" || exit 1
+
+echo "🚀 Launching background tasks. Logs saving to: ${log_dir}"
+
+echo "  ↳ [1/5] Grabbing PR diff..."
+rm -f "${log_dir}/pr-diff.exit"
+{ gh pr diff "${pr_number}" > "${log_dir}/pr-diff.diff" 2>&1; echo $? > "${log_dir}/pr-diff.exit"; } &
+
+echo "  ↳ [2/5] Starting build and lint..."
+rm -f "${log_dir}/build-and-lint.exit"
+{ { npm run clean && npm ci && npm run format && npm run build && npm run lint:ci && npm run typecheck; } > "${log_dir}/build-and-lint.log" 2>&1; echo $? > "${log_dir}/build-and-lint.exit"; } &
+
+# Dynamically resolve gemini binary (fallback to your nightly path)
+GEMINI_CMD="$(command -v gemini || echo "${HOME}/.gcli/nightly/node_modules/.bin/gemini")"
+# shellcheck disable=SC2312
+POLICY_PATH="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/policy.toml"
+
+echo "  ↳ [3/5] Starting Gemini code review..."
+rm -f "${log_dir}/review.exit"
+{ "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "/review-frontend ${pr_number}" > "${log_dir}/review.md" 2>&1; echo $? > "${log_dir}/review.exit"; } &
+
+echo "  ↳ [4/5] Starting automated tests (waiting for build and lint)..."
+rm -f "${log_dir}/npm-test.exit"
+{ 
+  while [[ ! -f "${log_dir}/build-and-lint.exit" ]]; do sleep 1; done
+  read -r build_exit < "${log_dir}/build-and-lint.exit" || build_exit=""
+  if [[ "${build_exit}" == "0" ]]; then
+    gh pr checks "${pr_number}" > "${log_dir}/ci-checks.log" 2>&1
+    ci_status=$?
+    
+    if [[ "${ci_status}" -eq 0 ]]; then
+      echo "CI checks passed. Skipping local npm tests." > "${log_dir}/npm-test.log"
+      echo 0 > "${log_dir}/npm-test.exit"
+    elif [[ "${ci_status}" -eq 8 ]]; then
+      echo "CI checks are still pending. Skipping local npm tests to avoid duplicate work. Please check GitHub for final results." > "${log_dir}/npm-test.log"
+      echo 0 > "${log_dir}/npm-test.exit"
+    else
+      echo "CI checks failed. Failing checks:" > "${log_dir}/npm-test.log"
+      gh pr checks "${pr_number}" --json name,bucket -q '.[] | select(.bucket=="fail") | .name' >> "${log_dir}/npm-test.log" 2>&1
+      
+      echo "Attempting to extract failing test files from CI logs..." >> "${log_dir}/npm-test.log"
+      pr_branch="$(gh pr view "${pr_number}" --json headRefName -q '.headRefName' 2>/dev/null || true)"
+      run_id="$(gh run list --branch "${pr_branch}" --workflow ci.yml --json databaseId -q '.[0].databaseId' 2>/dev/null || true)"
+      
+      failed_files=""
+      if [[ -n "${run_id}" ]]; then
+        failed_files="$(gh run view "${run_id}" --log-failed 2>/dev/null | grep -o -E '(packages/[a-zA-Z0-9_-]+|integration-tests|evals)/[a-zA-Z0-9_/-]+\.test\.ts(x)?' | sort | uniq || true)"
+      fi
+      
+      if [[ -n "${failed_files}" ]]; then
+        echo "Found failing test files from CI:" >> "${log_dir}/npm-test.log"
+        for f in ${failed_files}; do echo "  - ${f}" >> "${log_dir}/npm-test.log"; done
+        echo "Running ONLY failing tests locally..." >> "${log_dir}/npm-test.log"
+        
+        exit_code=0
+        for file in ${failed_files}; do
+           if [[ "${file}" == packages/* ]]; then
+             ws_dir="$(echo "${file}" | cut -d'/' -f1,2)"
+           else
+             ws_dir="$(echo "${file}" | cut -d'/' -f1)"
+           fi
+           rel_file="${file#"${ws_dir}"/}"
+           
+           echo "--- Running ${rel_file} in workspace ${ws_dir} ---" >> "${log_dir}/npm-test.log"
+           if ! npm run test:ci -w "${ws_dir}" -- "${rel_file}" >> "${log_dir}/npm-test.log" 2>&1; then
+             exit_code=1
+           fi
+        done
+        echo "${exit_code}" > "${log_dir}/npm-test.exit"
+      else
+        echo "Could not extract specific failing files. Skipping full local test suite as it takes too long. Please check CI logs manually." >> "${log_dir}/npm-test.log"
+        echo 1 > "${log_dir}/npm-test.exit"
+      fi
+    fi
+  else
+    echo "Skipped due to build-and-lint failure" > "${log_dir}/npm-test.log"
+    echo 1 > "${log_dir}/npm-test.exit"
+  fi
+} &
+
+echo "  ↳ [5/5] Starting Gemini test execution (waiting for build and lint)..."
+rm -f "${log_dir}/test-execution.exit"
+{ 
+  while [[ ! -f "${log_dir}/build-and-lint.exit" ]]; do sleep 1; done
+  read -r build_exit < "${log_dir}/build-and-lint.exit" || build_exit=""
+  if [[ "${build_exit}" == "0" ]]; then
+    "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "Analyze the diff for PR ${pr_number} using 'gh pr diff ${pr_number}'. Instead of running the project's automated test suite (like 'npm test'), physically exercise the newly changed code in the terminal (e.g., by writing a temporary script to call the new functions, or testing the CLI command directly). Verify the feature's behavior works as expected. IMPORTANT: Do NOT modify any source code to fix errors. Just exercise the code and log the results, reporting any failures clearly. Do not ask for user confirmation." > "${log_dir}/test-execution.log" 2>&1; echo $? > "${log_dir}/test-execution.exit"
+  else
+    echo "Skipped due to build-and-lint failure" > "${log_dir}/test-execution.log"
+    echo 1 > "${log_dir}/test-execution.exit"
+  fi
+} &
+
+echo "✅ All tasks dispatched!"
+echo "You can monitor progress with: tail -f ${log_dir}/*.log"
+echo "Read your review later at: ${log_dir}/review.md"
+
+# Polling loop to wait for all background tasks to finish
+tasks=("pr-diff" "build-and-lint" "review" "npm-test" "test-execution")
+log_files=("pr-diff.diff" "build-and-lint.log" "review.md" "npm-test.log" "test-execution.log")
+
+declare -A task_done
+for t in "${tasks[@]}"; do task_done[${t}]=0; done
+
+all_done=0
+while [[ "${all_done}" -eq 0 ]]; do
+  clear
+  echo "=================================================="
+  echo "🚀 Async PR Review Status for PR #${pr_number}"
+  echo "=================================================="
+  echo ""
+  
+  all_done=1
+  for i in "${!tasks[@]}"; do
+    t="${tasks[${i}]}"
+    
+    if [[ -f "${log_dir}/${t}.exit" ]]; then
+      read -r task_exit < "${log_dir}/${t}.exit" || task_exit=""
+      if [[ "${task_exit}" == "0" ]]; then
+        echo "  ✅ ${t}: SUCCESS"
+      else
+        echo "  ❌ ${t}: FAILED (exit code ${task_exit})"
+      fi
+      task_done[${t}]=1
+    else
+      echo "  ⏳ ${t}: RUNNING"
+      all_done=0
+    fi
+  done
+  
+  echo ""
+  echo "=================================================="
+  echo "📝 Live Logs (Last 5 lines of running tasks)"
+  echo "=================================================="
+  
+  for i in "${!tasks[@]}"; do
+    t="${tasks[${i}]}"
+    log_file="${log_files[${i}]}"
+    
+    if [[ "${task_done[${t}]}" -eq 0 ]]; then
+      if [[ -f "${log_dir}/${log_file}" ]]; then
+        echo ""
+        echo "--- ${t} ---"
+        tail -n 5 "${log_dir}/${log_file}"
+      fi
+    fi
+  done
+  
+  if [[ "${all_done}" -eq 0 ]]; then
+    sleep 3
+  fi
+done
+
+clear
+echo "=================================================="
+echo "🚀 Async PR Review Status for PR #${pr_number}"
+echo "=================================================="
+echo ""
+for t in "${tasks[@]}"; do
+  read -r task_exit < "${log_dir}/${t}.exit" || task_exit=""
+  if [[ "${task_exit}" == "0" ]]; then
+    echo "  ✅ ${t}: SUCCESS"
+  else
+    echo "  ❌ ${t}: FAILED (exit code ${task_exit})"
+  fi
+done
+echo ""
+
+echo "⏳ Tasks complete! Synthesizing final assessment..."
+if ! "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "Read the review at ${log_dir}/review.md, the automated test logs at ${log_dir}/npm-test.log, and the manual test execution logs at ${log_dir}/test-execution.log. Summarize the results, state whether the build and tests passed based on ${log_dir}/build-and-lint.exit and ${log_dir}/npm-test.exit, and give a final recommendation for PR ${pr_number}." > "${log_dir}/final-assessment.md" 2>&1; then
+  echo $? > "${log_dir}/final-assessment.exit"
+  echo "❌ Final assessment synthesis failed!"
+  echo "Check ${log_dir}/final-assessment.md for details."
+  notify "Async Review Failed" "Final assessment synthesis failed." "${pr_number}"
+  exit 1
+fi
+
+echo 0 > "${log_dir}/final-assessment.exit"
+echo "✅ Final assessment complete! Check ${log_dir}/final-assessment.md"
+notify "Async Review Complete" "Review and test execution finished successfully." "${pr_number}"

.gemini/skills/async-pr-review/scripts/check-async-review.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+pr_number="${1}"
+
+if [[ -z "${pr_number}" ]]; then
+  echo "Usage: check-async-review <pr_number>"
+  exit 1
+fi
+
+base_dir="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+if [[ -z "${base_dir}" ]]; then
+  echo "❌ Must be run from within a git repository."
+  exit 1
+fi
+
+log_dir="${base_dir}/.gemini/tmp/async-reviews/pr-${pr_number}/logs"
+
+if [[ ! -d "${log_dir}" ]]; then
+  echo "STATUS: NOT_FOUND"
+  echo "❌ No logs found for PR #${pr_number} in ${log_dir}"
+  exit 0
+fi
+
+tasks=(
+  "setup|setup.log"
+  "pr-diff|pr-diff.diff"
+  "build-and-lint|build-and-lint.log"
+  "review|review.md"
+  "npm-test|npm-test.log"
+  "test-execution|test-execution.log"
+  "final-assessment|final-assessment.md"
+)
+
+all_done=true
+echo "STATUS: CHECKING"
+
+for task_info in "${tasks[@]}"; do
+  IFS="|" read -r task_name log_file <<< "${task_info}"
+  
+  file_path="${log_dir}/${log_file}"
+  exit_file="${log_dir}/${task_name}.exit"
+
+  if [[ -f "${exit_file}" ]]; then
+    read -r exit_code < "${exit_file}" || exit_code=""
+    if [[ "${exit_code}" == "0" ]]; then
+      echo "✅ ${task_name}: SUCCESS"
+    else
+      echo "❌ ${task_name}: FAILED (exit code ${exit_code})"
+      echo "   Last lines of ${file_path}:"
+      tail -n 3 "${file_path}" | sed 's/^/      /' || true
+    fi
+  elif [[ -f "${file_path}" ]]; then
+    echo "⏳ ${task_name}: RUNNING"
+    all_done=false
+  else
+    echo "➖ ${task_name}: NOT STARTED"
+    all_done=false
+  fi
+done
+
+if [[ "${all_done}" == "true" ]]; then
+  echo "STATUS: COMPLETE"
+  echo "LOG_DIR: ${log_dir}"
+else
+  echo "STATUS: IN_PROGRESS"
+fi

.gemini/skills/behavioral-evals/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: behavioral-evals
+description: Guidance for creating, running, fixing, and promoting behavioral evaluations. Use when verifying agent decision logic, debugging failures, debugging prompt steering, or adding workspace regression tests.
+---
+
+# Behavioral Evals
+
+## Overview
+
+Behavioral evaluations (evals) are tests that validate the **agent's decision-making** (e.g., tool choice) rather than pure functionality. They are critical for verifying prompt changes, debugging steerability, and preventing regressions.
+
+> [!NOTE]
+> **Single Source of Truth**: For core concepts, policies, running tests, and general best practices, always refer to **[evals/README.md](file:///Users/abhipatel/code/gemini-cli/docs/evals/README.md)**.
+
+---
+
+## 🔄 Workflow Decision Tree
+
+1.  **Does a prompt/tool change need validation?**
+    *   *No* -> Normal integration tests.
+    *   *Yes* -> Continue below.
+2.  **Is it UI/Interaction heavy?**
+    *   *Yes* -> Use `appEvalTest` (`AppRig`). See **[creating.md](references/creating.md)**.
+    *   *No* -> Use `evalTest` (`TestRig`). See **[creating.md](references/creating.md)**.
+3.  **Is it a new test?**
+    *   *Yes* -> Set policy to `USUALLY_PASSES`.
+    *   *No* -> `ALWAYS_PASSES` (locks in regression).
+4.  **Are you fixing a failure or promoting a test?**
+    *   *Fixing* -> See **[fixing.md](references/fixing.md)**.
+    *   *Promoting* -> See **[promoting.md](references/promoting.md)**.
+
+---
+
+## 📋 Quick Checklist
+
+### 1. Setup Workspace
+Seed the workspace with necessary files using the `files` object to simulate a realistic scenario (e.g., NodeJS project with `package.json`).
+*   *Details in **[creating.md](references/creating.md)***
+
+### 2. Write Assertions
+Audit agent decisions using `rig.setBreakpoint()` (AppRig only) or index verification on `rig.readToolLogs()`.
+*   *Details in **[creating.md](references/creating.md)***
+
+### 3. Verify
+Run single tests locally with Vitest. Confirm stability locally before relying on CI workflows.
+*   *See **[evals/README.md](file:///Users/abhipatel/code/gemini-cli/docs/evals/README.md)** for running commands.*
+
+---
+
+## 📦 Bundled Resources
+
+Detailed procedural guides:
+*   **[creating.md](references/creating.md)**: Assertion strategies, Rig selection, Mock MCPs.
+*   **[fixing.md](references/fixing.md)**: Step-by-step automated investigation, architecture diagnosis guidelines.
+*   **[promoting.md](references/promoting.md)**: Candidate identification criteria and threshold guidelines.
+

.gemini/skills/behavioral-evals/assets/interactive_eval.ts.txt

@@ -0,0 +1,27 @@
+import { describe, expect } from 'vitest';
+import { appEvalTest } from './app-test-helper.js';
+
+describe('interactive_feature', () => {
+  // New tests MUST start as USUALLY_PASSES
+  appEvalTest('USUALLY_PASSES', {
+    name: 'should pause for user confirmation',
+    files: {
+      'package.json': JSON.stringify({ name: 'app' })
+    },
+    prompt: 'Task description here requiring approval',
+    timeout: 60000, 
+    setup: async (rig) => {
+      // ⚠️ Breakpoints are ONLY safe in appEvalTest
+      rig.setBreakpoint(['ask_user']);
+    },
+    assert: async (rig) => {
+      // 1. Wait for the breakpoint to trigger
+      const confirmation = await rig.waitForPendingConfirmation('ask_user');
+      expect(confirmation).toBeDefined();
+
+      // 2. Resolve it so the test can finish
+      await rig.resolveTool(confirmation);
+      await rig.waitForIdle();
+    },
+  });
+});

.gemini/skills/behavioral-evals/assets/standard_eval.ts.txt

@@ -0,0 +1,30 @@
+import { describe, expect } from 'vitest';
+import { evalTest } from './test-helper.js';
+
+describe('core_feature', () => {
+  // New tests MUST start as USUALLY_PASSES
+  evalTest('USUALLY_PASSES', {
+    name: 'should perform expected agent action',
+    setup: async (rig) => {
+      // For mocking offline MCP:
+      // rig.addMockMcpServer('workspace-server', 'google-workspace');
+    },
+    files: {
+      'src/app.ts': '// some code',
+    },
+    prompt: 'Task description here',
+    timeout: 60000, // 1 minute safety limit
+    assert: async (rig, result) => {
+      // 1. Audit the trajectory (Safe for standard evalTest)
+      const logs = rig.readToolLogs();
+      const hasTool = logs.some((l) => l.toolRequest.name === 'read_file');
+      expect(hasTool, 'Agent should have read the file').toBe(true);
+
+      // 2. Assert efficiency (Cost/Turn)
+      expect(logs.length).toBeLessThan(5);
+
+      // 3. Assert final output
+      expect(result).toContain('Expected Keyword');
+    },
+  });
+});

.gemini/skills/behavioral-evals/references/creating.md

@@ -0,0 +1,151 @@
+# Creating Behavioral Evals
+
+## 🔬 Rig Selection
+
+| Rig Type          | Import From            | Architecture                                                         | Use When                                                                                              |
+| :---------------- | :--------------------- | :------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------- |
+| **`evalTest`**    | `./test-helper.js`     | **Subprocess**. Runs the CLI in a separate process + waits for exit. | Standard workspace tests. **Do not use `setBreakpoint`**; auditing history (`readToolLogs`) is safer. |
+| **`appEvalTest`** | `./app-test-helper.js` | **In-Process**. Runs directly inside the runner loop.                | UI/Ink rendering. Safe for `setBreakpoint` triggers.                                                  |
+
+---
+
+## 🏗️ Scenario Design
+
+Evals must simulate realistic agent environments to effectively test
+decision-making.
+
+- **Workspace State**: Seed with standard project anchors if testing general
+  capabilities:
+  - `package.json` for NodeJS environments.
+  - Minimal configuration files (`tsconfig.json`, `GEMINI.md`).
+- **Structural Complexity**: Provide enough files to force the agent to _search_
+  or _navigate_, rather than giving the answer directly. Avoid trivial one-file
+  tests unless testing exact prompt steering.
+
+---
+
+## ❌ Fail First Principle
+
+Before asserting a new capability or locking in a fix, **verify that the test
+fails first**.
+
+- It is easy to accidentally write an eval that asserts behaviors that are
+  already met or pass by default.
+- **Process**: reproduce failure with test -> apply fix (prompt/tool) -> verify
+  test passes.
+
+---
+
+## ✋ Testing Patterns
+
+### 1. Breakpoints
+
+Verifies the agent _intends_ to use a tool BEFORE executing it. Useful for
+interactive prompts or safety checks.
+
+```typescript
+// ⚠️ Only works with appEvalTest (AppRig)
+setup: async (rig) => {
+  rig.setBreakpoint(['ask_user']);
+},
+assert: async (rig) => {
+  const confirmation = await rig.waitForPendingConfirmation('ask_user');
+  expect(confirmation).toBeDefined();
+}
+```
+
+### 2. Tool Confirmation Race
+
+When asserting multiple triggers (e.g., "enters plan mode then asks question"):
+
+```typescript
+assert: async (rig) => {
+  let confirmation = await rig.waitForPendingConfirmation([
+    'enter_plan_mode',
+    'ask_user',
+  ]);
+
+  if (confirmation?.name === 'enter_plan_mode') {
+    rig.acceptConfirmation('enter_plan_mode');
+    confirmation = await rig.waitForPendingConfirmation('ask_user');
+  }
+  expect(confirmation?.toolName).toBe('ask_user');
+};
+```
+
+### 3. Audit Tool Logs
+
+Audit exact operations to ensure efficiency (e.g., no redundant reads).
+
+```typescript
+assert: async (rig, result) => {
+  await rig.waitForTelemetryReady();
+  const toolLogs = rig.readToolLogs();
+
+  const writeCall = toolLogs.find(
+    (log) => log.toolRequest.name === 'write_file',
+  );
+  expect(writeCall).toBeDefined();
+};
+```
+
+### 4. Mock MCP Facades
+
+To evaluate tools connected via MCP without hitting live endpoints, load a mock
+server configuration in the `setup` hook.
+
+```typescript
+setup: async (rig) => {
+  rig.addMockMcpServer('workspace-server', 'google-workspace');
+},
+assert: async (rig) => {
+  await rig.waitForTelemetryReady();
+  const toolLogs = rig.readToolLogs();
+  const workspaceCall = toolLogs.find(
+    (log) => log.toolRequest.name === 'mcp_workspace-server_docs.getText'
+  );
+  expect(workspaceCall).toBeDefined();
+};
+```
+
+---
+
+## ⚠️ Safety & Efficiency Guardrails
+
+### 1. Breakpoint Deadlocks
+
+Breakpoints (`setBreakpoint`) pause execution. In standard `evalTest`,
+`rig.run()` waits for the process to exit _before_ assertions run. **This will
+hang indefinitely.**
+
+- **Use Breakpoints** for `appEvalTest` or interactive simulations.
+- **Use Audit Tool Logs** (above) for standard trajectory tests.
+
+### 2. Runaway Timeout
+
+Always set a budget boundary in the `EvalCase` to prevent runaway loops on
+quota:
+
+```typescript
+evalTest('USUALLY_PASSES', {
+  name: '...',
+  timeout: 60000, // 1 minute safety limit
+  // ...
+});
+```
+
+### 3. Efficiency Assertion (Turn limits)
+
+Check if a tool is called _early_ using index checks:
+
+```typescript
+assert: async (rig) => {
+  const toolLogs = rig.readToolLogs();
+  const toolCallIndex = toolLogs.findIndex(
+    (log) => log.toolRequest.name === 'cli_help',
+  );
+
+  expect(toolCallIndex).toBeGreaterThan(-1);
+  expect(toolCallIndex).toBeLessThan(5); // Called within first 5 turns
+};
+```

.gemini/skills/behavioral-evals/references/fixing.md

@@ -0,0 +1,71 @@
+# Fixing Behavioral Evals
+
+Use this guide when asked to debug, troubleshoot, or fix a failing behavioral
+evaluation.
+
+---
+
+## 1. 🔍 Investigate
+
+1.  **Fetch Nightly Results**: Use the `gh` CLI to inspect the latest run from
+    `evals-nightly.yml` if applicable.
+    - _Example view URL_:
+      `https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml`
+2.  **Isolate**: DO NOT push changes or start remote runs. Confine investigation
+    to the local workspace.
+3.  **Read Logs**:
+    - Eval logs live in `evals/logs/<test_name>.log`.
+    - Enable verbose debugging via `export GEMINI_DEBUG_LOG_FILE="debug.log"`.
+4.  **Diagnose**: Audit tool logs and telemetry. Note if due to setup/assert.
+    - **Tip**: Proactively add custom logging/diagnostics to check hypotheses.
+
+---
+
+## 2. 🛠️ Fix Strategy
+
+1.  **Targeted Location**: Locate the test case and the corresponding
+    prompt/code.
+2.  **Iterative Scope**: Make extreme change first to verify scope, then refine
+    to a minimal, targeted change.
+3.  **Assertion Fidelity**:
+    - Changing the test prompt is a **last resort** (prompts are often vague by
+      design).
+    - **Warning**: Do not lose test fidelity by making prompts too direct/easy.
+    - **Primary Fix Trigger**: Adjust tool descriptions, system prompts
+      (`snippets.ts`), or **modules that contribute to the prompt template**.
+    - **Warning**: Prompts have multiple configurations; ensure your fix targets
+      the correct config for the model in question.
+4.  **Architecture Options**: If prompt or instruction tuning triggers no
+    improvement, analyze loop composition.
+    - **AgentLoop**: Defined by `context + toolset + prompt`.
+    - **Enhancements**: Loops perform best with direct prompts, fewer irrelevant
+      tools, low goal density, and minimal low-value/irrelevant context.
+    - **Modifications**: Compose subagents or isolate tools. Ground in observed
+      traces.
+    - **Warning**: Think deeply before offering recommendations; avoid parroting
+      abstract design guidelines.
+
+---
+
+## 3. ✅ Verify
+
+1.  **Run Local**: Run Vitest in non-interactive mode on just the file.
+2.  **Log Audit**: Prioritize diagnosing failures via log comparison before
+    triggering heavy test runs.
+3.  **Stability Limit**: Run the test **3 times** locally on key models (can use
+    scripts to run in parallel for speed):
+    - **Gemini 3.0**
+    - **Gemini 3 Flash**
+    - **Gemini 2.5 Pro**
+4.  **Flakiness Rule**: If it passes 2/3 times, it may be inherent noise
+    difficult to improve without a structural split.
+
+---
+
+## 4. 📊 Report
+
+Provide a summary of:
+
+- Test success rate for each tested model (e.g., 3/3 = 100%).
+- Root cause identification and fix explanation.
+- If unfixed, provide high-confidence architecture recommendations.

.gemini/skills/behavioral-evals/references/promoting.md

@@ -0,0 +1,55 @@
+# Promoting Behavioral Evals
+
+Use this guide when asked to analyze nightly results and promote incubated tests
+to stable suites.
+
+---
+
+## 1. 🔍 Investigate candidates
+
+1.  **Audit Nightly Logs**: Use the `gh` CLI to fetch results from
+    `evals-nightly.yml` (Direct URL:
+    `https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml`).
+    - **Tip**: The aggregate summary from the most recent run integrates the
+      last 7 runs of history automatically.
+    - **Safety**: DO NOT push changes or start remote runs. All verification is
+      local.
+2.  **Assess Stability**: Identify tests that pass **100% of the time** across
+    ALL enabled models over the **last 7 nightly runs** in a row.
+    - _100% means the test passed 3/3 times for every model and run._
+3.  **Promotion Targets**: Tests meeting this criteria are candidates for
+    promotion from `USUALLY_PASSES` to `ALWAYS_PASSES`.
+
+---
+
+## 2. 🚥 Promotion Steps
+
+1.  **Locate File**: Locate the eval file in the `evals/` directory.
+2.  **Update Policy**: Modify the policy argument to `ALWAYS_PASSES`.
+    ```typescript
+    evalTest('ALWAYS_PASSES', { ... })
+    ```
+3.  **Targeting**: Follow guidelines in `evals/README.md` regarding stable suite
+    organization.
+4.  **Constraint**: Your final change must be **minimal and targeted** strictly
+    to promoting the test status. Do not refactor the test or setup fixtures.
+
+---
+
+## 3. ✅ Verify
+
+1.  **Run Prompted Tests**: Run the promoted test locally using non-interactive
+    Vitest to confirm structure validity.
+2.  **Verify Suite Inclusion**: Check that the test is successfully picked up by
+    standard runnable ranges.
+
+---
+
+## 4. 📊 Report
+
+Provide a summary of:
+
+- Which tests were promoted.
+- Provide the success rate evidence (e.g., 7/7 runs passed for all models).
+- If no candidates qualified, list the next closest candidates and their current
+  pass rate.

.gemini/skills/behavioral-evals/references/running.md

@@ -0,0 +1,95 @@
+# Running & Promoting Evals
+
+## 🛠️ Prerequisites
+
+Behavioral evals run against the compiled binary. You **must** build and bundle
+the project first after making changes:
+
+```bash
+npm run build && npm run bundle
+```
+
+---
+
+## 🏃‍♂️ Running Tests
+
+### 1. Configure Environment Variables
+
+Evals require a standard API key. If your `.env` file has multiple keys or
+comments, use this precise extraction setup:
+
+```bash
+export GEMINI_API_KEY=$(grep '^GEMINI_API_KEY=' .env | cut -d '=' -f2) && RUN_EVALS=1 npx vitest run --config evals/vitest.config.ts <file_name>
+```
+
+### 2. Commands
+
+| Command                             | Scope           | Description                                        |
+| :---------------------------------- | :-------------- | :------------------------------------------------- |
+| `npm run test:always_passing_evals` | `ALWAYS_PASSES` | Fast feedback, runs in CI.                         |
+| `npm run test:all_evals`            | All             | Runs nightly incubation tests. Sets `RUN_EVALS=1`. |
+
+### Target Specific File
+
+_Note: `RUN_EVALS=1` is required for incubated (`USUALLY_PASSES`) tests._
+
+```bash
+RUN_EVALS=1 npx vitest run --config evals/vitest.config.ts my_feature.eval.ts
+```
+
+---
+
+## 🐞 Debugging and Logs
+
+If a test fails, verify:
+
+- **Tool Trajectory Logs**:序列 of calls in `evals/logs/<test_name>.log`.
+- **Verbose Reasoning**: Capture raw buffer traces by setting
+  `GEMINI_DEBUG_LOG_FILE`:
+  ```bash
+  export GEMINI_DEBUG_LOG_FILE="debug.log"
+  ```
+
+---
+
+### 🎯 Verify Model Targeting
+
+- **Tip:** Standard evals benchmark against model variations. If a test passes
+  on Flash but fails on Pro (or vice versa), the issue is usually in the **tool
+  description**, not the prompt definition. Flash is sensitive to "instruction
+  bloat," while Pro is sensitive to "ambiguous intent."
+
+---
+
+## 🚥 deflaking & Promotion
+
+To maintain CI stability, all new evals follow a strict incubation period.
+
+### 1. Incubation (`USUALLY_PASSES`)
+
+New tests must be created with the `USUALLY_PASSES` policy.
+
+```typescript
+evalTest('USUALLY_PASSES', { ... })
+```
+
+They run in **Evals: Nightly** workflows and do not block PR merges.
+
+### 2. Investigate Failures
+
+If a nightly eval regresses, investigate via agent:
+
+```bash
+gemini /fix-behavioral-eval [optional-run-uri]
+```
+
+### 3. Promotion (`ALWAYS_PASSES`)
+
+Once a test scores 100% consistency over multiple nightly cycles:
+
+```bash
+gemini /promote-behavioral-eval
+```
+
+_Do not promote manually._ The command verifies trajectory logs before updating
+the file policy.

.gemini/skills/ci/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: ci
+description:
+  A specialized skill for Gemini CLI that provides high-performance, fail-fast
+  monitoring of GitHub Actions workflows and automated local verification of CI
+  failures. It handles run discovery automatically—simply provide the branch name.
+---
+
+# CI Replicate & Status
+
+This skill enables the agent to efficiently monitor GitHub Actions, triage
+failures, and bridge remote CI errors to local development. It defaults to
+**automatic replication** of failures to streamline the fix cycle.
+
+## Core Capabilities
+
+- **Automatic Replication**: Automatically monitors CI and immediately executes 
+  suggested test or lint commands locally upon failure.
+- **Real-time Monitoring**: Aggregated status line for all concurrent workflows
+  on the current branch.
+- **Fail-Fast Triage**: Immediately stops on the first job failure to provide a
+  structured report.
+
+## Workflow
+
+### 1. CI Replicate (`replicate`) - DEFAULT
+Use this as the primary path to monitor CI and **automatically** replicate 
+failures locally for immediate triage and fixing.
+- **Behavior**: When this workflow is triggered, the agent will monitor the CI
+  and **immediately and automatically execute** all suggested test or lint
+  commands (marked with 🚀) as soon as a failure is detected. 
+- **Tool**: `node .gemini/skills/ci/scripts/ci.mjs [branch]`
+- **Discovery**: The script **automatically** finds the latest active or recent
+  run for the branch. Do NOT manually search for run IDs.
+- **Goal**: Reproduce the failure locally without manual intervention, then
+  proceed to analyze and fix the code.
+
+### 1. CI Status (`status`)
+Use this when you have pushed changes and need to monitor the CI and reproduce
+any failures locally.
+- **Tool**: `node .gemini/skills/ci/scripts/ci.mjs [branch] [run_id]`
+- **Discovery**: The script **automatically** finds the latest active or recent
+  run for the branch. You should NOT manually search for \`run_id\` using \`gh run list\`
+  unless a specific historical run is requested. Simply provide the branch name.
+- **Step 1 (Monitor)**: Execute the tool with the branch name.
+- **Step 2 (Extract)**: Extract suggested \`npm test\` or \`npm run lint\` commands
+  from the output (marked with 🚀).
+- **Step 3 (Reproduce)**: Execute those commands locally to confirm the failure.
+- **Behavior**: It will poll every 15 seconds. If it detects a failure, it will
+  exit with a structured report and provide the exact commands to run locally.
+
+## Failure Categories & Actions
+
+- **Test Failures**: Agent should run the specific `npm test -w <pkg> -- <path>`
+  command suggested.
+- **Lint Errors**: Agent should run `npm run lint:all` or the specific package
+  lint command.
+- **Build Errors**: Agent should check `tsc` output or build logs to resolve
+  compilation issues.
+- **Job Errors**: Investigate `gh run view --job <job_id> --log` for
+  infrastructure or setup failures.
+
+## Noise Filtering
+The underlying scripts automatically filter noise (Git logs, NPM warnings, stack
+trace overhead). The agent should focus on the "Structured Failure Report"
+provided by the tool.

.gemini/skills/ci/scripts/ci.mjs

@@ -0,0 +1,281 @@
+#!/usr/bin/env node
+
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { execSync } from 'node:child_process';
+
+const BRANCH =
+  process.argv[2] || execSync('git branch --show-current').toString().trim();
+const RUN_ID_OVERRIDE = process.argv[3];
+
+let REPO;
+try {
+  const remoteUrl = execSync('git remote get-url origin').toString().trim();
+  REPO = remoteUrl
+    .replace(/.*github\.com[\/:]/, '')
+    .replace(/\.git$/, '')
+    .trim();
+} catch (e) {
+  REPO = 'google-gemini/gemini-cli';
+}
+
+const FAILED_FILES = new Set();
+
+function runGh(args) {
+  try {
+    return execSync(`gh ${args}`, {
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).toString();
+  } catch (e) {
+    return null;
+  }
+}
+
+function fetchFailuresViaApi(jobId) {
+  try {
+    const cmd = `gh api repos/${REPO}/actions/jobs/${jobId}/logs | grep -iE " FAIL |❌|ERROR|Lint failed|Build failed|Exception|failed with exit code"`;
+    return execSync(cmd, {
+      stdio: ['ignore', 'pipe', 'ignore'],
+      maxBuffer: 10 * 1024 * 1024,
+    }).toString();
+  } catch (e) {
+    return '';
+  }
+}
+
+function isNoise(line) {
+  const lower = line.toLowerCase();
+  return (
+    lower.includes('* [new branch]') ||
+    lower.includes('npm warn') ||
+    lower.includes('fetching updates') ||
+    lower.includes('node:internal/errors') ||
+    lower.includes('at ') || // Stack traces
+    lower.includes('checkexecsyncerror') ||
+    lower.includes('node_modules')
+  );
+}
+
+function extractTestFile(failureText) {
+  const cleanLine = failureText
+    .replace(/[|#\[\]()]/g, ' ')
+    .replace(/<[^>]*>/g, ' ')
+    .trim();
+  const fileMatch = cleanLine.match(/([\w\/._-]+\.test\.[jt]sx?)/);
+  if (fileMatch) return fileMatch[1];
+  return null;
+}
+
+function generateTestCommand(failedFilesMap) {
+  const workspaceToFiles = new Map();
+  for (const [file, info] of failedFilesMap.entries()) {
+    if (
+      ['Job Error', 'Unknown File', 'Build Error', 'Lint Error'].includes(file)
+    )
+      continue;
+    let workspace = '@google/gemini-cli';
+    let relPath = file;
+    if (file.startsWith('packages/core/')) {
+      workspace = '@google/gemini-cli-core';
+      relPath = file.replace('packages/core/', '');
+    } else if (file.startsWith('packages/cli/')) {
+      workspace = '@google/gemini-cli';
+      relPath = file.replace('packages/cli/', '');
+    }
+    relPath = relPath.replace(/^.*packages\/[^\/]+\//, '');
+    if (!workspaceToFiles.has(workspace))
+      workspaceToFiles.set(workspace, new Set());
+    workspaceToFiles.get(workspace).add(relPath);
+  }
+  const commands = [];
+  for (const [workspace, files] of workspaceToFiles.entries()) {
+    commands.push(`npm test -w ${workspace} -- ${Array.from(files).join(' ')}`);
+  }
+  return commands.join(' && ');
+}
+
+async function monitor() {
+  let targetRunIds = [];
+  if (RUN_ID_OVERRIDE) {
+    targetRunIds = [RUN_ID_OVERRIDE];
+  } else {
+    // 1. Get runs directly associated with the branch
+    const runListOutput = runGh(
+      `run list --branch "${BRANCH}" --limit 10 --json databaseId,status,workflowName,createdAt`,
+    );
+    if (runListOutput) {
+      const runs = JSON.parse(runListOutput);
+      const activeRuns = runs.filter((r) => r.status !== 'completed');
+      if (activeRuns.length > 0) {
+        targetRunIds = activeRuns.map((r) => r.databaseId);
+      } else if (runs.length > 0) {
+        const latestTime = new Date(runs[0].createdAt).getTime();
+        targetRunIds = runs
+          .filter((r) => latestTime - new Date(r.createdAt).getTime() < 60000)
+          .map((r) => r.databaseId);
+      }
+    }
+
+    // 2. Get runs associated with commit statuses (handles chained/indirect runs)
+    try {
+      const headSha = execSync(`git rev-parse "${BRANCH}"`).toString().trim();
+      const statusOutput = runGh(
+        `api repos/${REPO}/commits/${headSha}/status -q '.statuses[] | select(.target_url | contains("actions/runs/")) | .target_url'`,
+      );
+      if (statusOutput) {
+        const statusRunIds = statusOutput
+          .split('\n')
+          .filter(Boolean)
+          .map((url) => {
+            const match = url.match(/actions\/runs\/(\d+)/);
+            return match ? parseInt(match[1], 10) : null;
+          })
+          .filter(Boolean);
+
+        for (const runId of statusRunIds) {
+          if (!targetRunIds.includes(runId)) {
+            targetRunIds.push(runId);
+          }
+        }
+      }
+    } catch (e) {
+      // Ignore if branch/SHA not found or API fails
+    }
+
+    if (targetRunIds.length > 0) {
+      const runNames = [];
+      for (const runId of targetRunIds) {
+        const runInfo = runGh(`run view "${runId}" --json workflowName`);
+        if (runInfo) {
+          runNames.push(JSON.parse(runInfo).workflowName);
+        }
+      }
+      console.log(`Monitoring workflows: ${[...new Set(runNames)].join(', ')}`);
+    }
+  }
+
+  if (targetRunIds.length === 0) {
+    console.log(`No runs found for branch ${BRANCH}.`);
+    process.exit(0);
+  }
+
+  while (true) {
+    let allPassed = 0,
+      allFailed = 0,
+      allRunning = 0,
+      allQueued = 0,
+      totalJobs = 0;
+    let anyRunInProgress = false;
+    const fileToTests = new Map();
+    let failuresFoundInLoop = false;
+
+    for (const runId of targetRunIds) {
+      const runOutput = runGh(
+        `run view "${runId}" --json databaseId,status,conclusion,workflowName`,
+      );
+      if (!runOutput) continue;
+      const run = JSON.parse(runOutput);
+      if (run.status !== 'completed') anyRunInProgress = true;
+
+      const jobsOutput = runGh(`run view "${runId}" --json jobs`);
+      if (jobsOutput) {
+        const { jobs } = JSON.parse(jobsOutput);
+        totalJobs += jobs.length;
+        const failedJobs = jobs.filter((j) => j.conclusion === 'failure');
+        if (failedJobs.length > 0) {
+          failuresFoundInLoop = true;
+          for (const job of failedJobs) {
+            const failures = fetchFailuresViaApi(job.databaseId);
+            if (failures.trim()) {
+              failures.split('\n').forEach((line) => {
+                if (!line.trim() || isNoise(line)) return;
+                const file = extractTestFile(line);
+                const filePath =
+                  file ||
+                  (line.toLowerCase().includes('lint')
+                    ? 'Lint Error'
+                    : line.toLowerCase().includes('build')
+                      ? 'Build Error'
+                      : 'Unknown File');
+                let testName = line;
+                if (line.includes(' > ')) {
+                  testName = line.split(' > ').slice(1).join(' > ').trim();
+                }
+                if (!fileToTests.has(filePath))
+                  fileToTests.set(filePath, new Set());
+                fileToTests.get(filePath).add(testName);
+              });
+            } else {
+              const step =
+                job.steps?.find((s) => s.conclusion === 'failure')?.name ||
+                'unknown';
+              const category = step.toLowerCase().includes('lint')
+                ? 'Lint Error'
+                : step.toLowerCase().includes('build')
+                  ? 'Build Error'
+                  : 'Job Error';
+              if (!fileToTests.has(category))
+                fileToTests.set(category, new Set());
+              fileToTests
+                .get(category)
+                .add(`${job.name}: Failed at step "${step}"`);
+            }
+          }
+        }
+        for (const job of jobs) {
+          if (job.status === 'in_progress') allRunning++;
+          else if (job.status === 'queued') allQueued++;
+          else if (job.conclusion === 'success') allPassed++;
+          else if (job.conclusion === 'failure') allFailed++;
+        }
+      }
+    }
+
+    if (failuresFoundInLoop) {
+      console.log(
+        `\n\n❌ Failures detected across ${allFailed} job(s). Stopping monitor...`,
+      );
+      console.log('\n--- Structured Failure Report (Noise Filtered) ---');
+      for (const [file, tests] of fileToTests.entries()) {
+        console.log(`\nCategory/File: ${file}`);
+        // Limit output per file if it's too large
+        const testsArr = Array.from(tests).map((t) =>
+          t.length > 500 ? t.substring(0, 500) + '... [TRUNCATED]' : t,
+        );
+        testsArr.slice(0, 10).forEach((t) => console.log(`  - ${t}`));
+        if (testsArr.length > 10)
+          console.log(`  ... and ${testsArr.length - 10} more`);
+      }
+      const testCmd = generateTestCommand(fileToTests);
+      if (testCmd) {
+        console.log('\n🚀 Run this to verify fixes:');
+        console.log(testCmd);
+      } else if (
+        Array.from(fileToTests.keys()).some((k) => k.includes('Lint'))
+      ) {
+        console.log('\n🚀 Run this to verify lint fixes:\nnpm run lint:all');
+      }
+      console.log('---------------------------------');
+      process.exit(1);
+    }
+
+    const completed = allPassed + allFailed;
+    process.stdout.write(
+      `\r⏳ Monitoring ${targetRunIds.length} runs... ${completed}/${totalJobs} jobs (${allPassed} passed, ${allFailed} failed, ${allRunning} running, ${allQueued} queued)          `,
+    );
+    if (!anyRunInProgress) {
+      console.log('\n✅ All workflows passed!');
+      process.exit(0);
+    }
+    await new Promise((r) => setTimeout(r, 15000));
+  }
+}
+
+monitor().catch((err) => {
+  console.error('\nMonitor error:', err.message);
+  process.exit(1);
+});

.gemini/skills/docs-writer/SKILL.md

@@ -65,18 +65,60 @@ accessible.
 - **UI and code:** Use **bold** for UI elements and `code font` for filenames,
   snippets, commands, and API elements. Focus on the task when discussing
   interaction.
-- **Links:** Use descriptive anchor text; avoid "click here." Ensure the link
-  makes sense out of context.
 - **Accessibility:** Use semantic HTML elements correctly (headings, lists, 
   tables).
 - **Media:** Use lowercase hyphenated filenames. Provide descriptive alt text
   for all images.
+- **Details section:** Use the `<details>` tag to create a collapsible section.
+  This is useful for supplementary or data-heavy information that isn't critical
+  to the main flow.
+
+  Example:
+
+  <details>
+  <summary>Title</summary>
+
+  - First entry
+  - Second entry
+
+  </details>
+
+- **Callouts**: Use GitHub-flavored markdown alerts to highlight important
+  information. To ensure the formatting is preserved by `npm run format`, place
+  an empty line, then the `<!-- prettier-ignore -->` comment directly before
+  the callout block. The callout type (`[!TYPE]`) should be on the first line,
+  followed by a newline, and then the content, with each subsequent line of
+  content starting with `>`. Available types are `NOTE`, `TIP`, `IMPORTANT`,
+  `WARNING`, and `CAUTION`.
+
+  Example:
+
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is an example of a multi-line note that will be preserved
+> by Prettier.
+
+### Links
+- **Accessibility:** Use descriptive anchor text; avoid "click here." Ensure the
+  link makes sense out of context, such as when being read by a screen reader.
+- **Use relative links in docs:** Use relative links in documentation (`/docs/`)
+  to ensure portability. Use paths relative to the current file's directory
+  (for example, `../tools/` from `docs/cli/`). Do not include the `/docs/`
+  section of a path, but do verify that the resulting relative link exists. This
+  does not apply to meta files such as README.MD and CONTRIBUTING.MD.
+- **When changing headings, check for deep links:** If a user is changing a
+  heading, check for deep links to that heading in other pages and update
+  accordingly.
 
 ### Structure
 - **BLUF:** Start with an introduction explaining what to expect.
 - **Experimental features:** If a feature is clearly noted as experimental,
-add the following note immediately after the introductory paragraph:
-  `> **Note:** This is a preview feature currently under active development.`
+  add the following note immediately after the introductory paragraph:
+
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is an experimental feature currently under active development.
+
 - **Headings:** Use hierarchical headings to support the user journey.
 - **Procedures:** 
   - Introduce lists of steps with a complete sentence.
@@ -85,8 +127,7 @@ add the following note immediately after the introductory paragraph:
   - Put conditions before instructions (e.g., "On the Settings page, click...").
   - Provide clear context for where the action takes place.
   - Indicate optional steps clearly (e.g., "Optional: ...").
-- **Elements:** Use bullet lists, tables, notes (`> **Note:**`), and warnings 
-  (`> **Warning:**`).
+- **Elements:** Use bullet lists, tables, details, and callouts.
 - **Avoid using a table of contents:** If a table of contents is present, remove
   it.
 - **Next steps:** Conclude with a "Next steps" section if applicable.
@@ -126,7 +167,6 @@ documentation.
 - **Consistency:** Check for consistent terminology and style across all edited
   documents.
 
-
 ## Phase 4: Verification and finalization
 Perform a final quality check to ensure that all changes are correctly formatted
 and that all links are functional.

.gemini/skills/review-duplication/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: review-duplication
+description: Use this skill during code reviews to proactively investigate the codebase for duplicated functionality, reinvented wheels, or failure to reuse existing project best practices and shared utilities.
+---
+
+# Review Duplication
+
+## Overview
+
+This skill provides a structured workflow for investigating a codebase during a code review to identify duplicated logic, reinvented utilities, and missed opportunities to reuse established patterns. By executing this workflow, you ensure that new code integrates seamlessly with the existing project architecture.
+
+## Workflow: Investigating for Duplication
+
+When reviewing code, perform the following steps before finalizing your review:
+
+### 1. Extract Core Logic
+Analyze the new code to identify the core algorithms, utility functions, generic data structures, or UI components being introduced. Look beyond the specific business logic to see the underlying mechanics.
+
+### 2. Hypothesize Existing Locations & Trace Dependencies
+Think about where this type of code *would* live if it already existed in the project. Provide absolute paths from the repo root to disambiguate.
+- **Utilities:** `packages/core/src/utils/`, `packages/cli/src/utils/`
+- **UI Components:** `packages/cli/src/ui/components/`, `packages/cli/src/ui/`
+- **Services:** `packages/core/src/services/`, `packages/cli/src/services/`
+- **Configuration:** `packages/core/src/config/`, `packages/cli/src/config/`
+- **Core Logic:** Call out `packages/core/` if functionality does not appear React UI specific.
+
+**Trace Third-Party Dependencies:** If the PR introduces a new import for a utility library (e.g., `lodash.merge`, `date-fns`), trace how and where the project currently uses that library. There is likely an existing wrapper or shared utility.
+
+**Check Package Files:** Before flagging a custom implementation of a complex algorithm, check `package.json` to see if a standard library (like `lodash` or `uuid`) is already installed that provides this functionality.
+
+### 3. Investigate the Codebase (Sub-Agent Delegation)
+Delegate the heavy lifting of codebase investigation to specialized sub-agents. They are optimized to perform deep searches and semantic mapping without bloating your session history.
+
+To ensure a comprehensive review, you MUST formulate highly specific objectives for the sub-agents, providing them with the "scents" you discovered in Step 1.
+
+- **Codebase Investigator:** Use the `codebase_investigator` as your primary researcher. When delegating, formulate an objective that asks specific, investigative questions about the codebase, explicitly including these search vectors:
+  - **Structural Similarity:** Ask if existing code uses the same underlying APIs (e.g., "Does any existing code use `Intl.DateTimeFormat` or `setTimeout` for similar purposes?").
+  - **Naming Conventions:** Ask if there are existing symbols with similar naming patterns (e.g., "Are there existing symbols with naming patterns like `*Format*` or `*Debounce*`?").
+  - **Comments & Documentation:** Ask if keywords from the PR's comments or JSDoc exist in describing similar behavior elsewhere.
+  - **Architectural Fit:** Ask where this type of logic is currently centralized (e.g., "Where is centralized date formatting logic located?").
+  - **Refactoring Guidance:** Crucially, ask the sub-agent to explain *how* the new code could be refactored to use any existing logic it finds.
+- **Generalist Agent:** Use the `generalist` for detailed, turn-intensive comparisons. For example: "Review the implementation of `MyNewComponent` in the PR and compare it semantically against all components in `packages/ui/src`. Are there any existing components that could be extended or used instead?"
+- **Retain Fast Path for Simple Searches:** For extremely simple, unambiguous checks (e.g., "Does `package.json` include `lodash`?"), perform a direct search to save time. Default to delegation for any open-ended "investigations."
+
+### 4. Evaluate Best Practices
+Check if the new code aligns with the project's established conventions.
+- **Error Handling:** Does it use the project's standard error classes or logging mechanisms?
+- **State Management:** Does it bypass established stores or contexts?
+- **Styling:** Does it hardcode colors or spacing instead of using theme variables?
+If the PR introduces a new pattern, compare it against the documented standards and explicitly confirm if an existing project pattern should have been used instead.
+
+### 5. Formulate Constructive Feedback
+If you discover that the PR duplicates existing functionality or ignores a best practice:
+- Provide a clear review comment.
+- **Identify the Source:** Explicitly mention the absolute or project-relative file path and the specific symbol (function, component, class) that should be reused.
+- **Implementation Guidance:** Provide a brief code snippet or a clear explanation showing **how** to integrate the existing code to fulfill the task's requirements.
+- **Explain the Value:** Briefly explain why reusing the existing code is beneficial (e.g., maintainability, consistency, built-in edge case handling).
+
+Example comment:
+> "It looks like this PR introduces a new `formatDate` utility. We already have a robust, tested `formatDate` function in `src/utils/dateHelpers.ts`. 
+>
+> You can replace your implementation by importing it like this:
+> ```typescript
+> import { formatDate } from '../utils/dateHelpers';
+> 
+> // Then use it here:
+> const displayDate = formatDate(userDate, 'MMM Do, YYYY');
+> ```
+> Reusing this ensures that the date formatting remains consistent with the rest of the application and handles timezone conversions correctly."

.geminiignore

@@ -0,0 +1 @@
+packages/core/src/services/scripts/*.exe

.github/ISSUE_TEMPLATE/website_issue.yml

@@ -1,7 +1,9 @@
 name: 'Website issue'
 description: 'Report an issue with the Gemini CLI Website and Gemini CLI Extensions Gallery'
+title: 'GeminiCLI.com Feedback: [ISSUE]'
 labels:
   - 'area/extensions'
+  - 'area/documentation'
 body:
   - type: 'markdown'
     attributes:

.github/actions/publish-release/action.yml

@@ -175,7 +175,9 @@ runs:
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_CORE_PACKAGE_NAME}" \
           --no-tag
-        npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} false --silent
+        if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+          npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} false
+        fi
 
     - name: '🔗 Install latest core package'
       working-directory: '${{ inputs.working-directory }}'
@@ -193,7 +195,7 @@ runs:
         INPUTS_A2A_PACKAGE_NAME: '${{ inputs.a2a-package-name }}'
 
     - name: '📦 Prepare bundled CLI for npm release'
-      if: "inputs.npm-registry-url != 'https://npm.pkg.github.com/' && inputs.npm-tag != 'latest'"
+      if: "inputs.npm-registry-url != 'https://npm.pkg.github.com/'"
       working-directory: '${{ inputs.working-directory }}'
       shell: 'bash'
       run: |
@@ -221,7 +223,9 @@ runs:
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_CLI_PACKAGE_NAME}" \
           --no-tag
-        npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} false --silent
+        if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+          npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} false
+        fi
 
     - name: 'Get a2a-server Token'
       uses: './.github/actions/npm-auth-token'
@@ -246,7 +250,9 @@ runs:
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_A2A_PACKAGE_NAME}" \
           --no-tag
-        npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} false --silent
+          if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+            npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} false
+          fi
 
     - name: '🔬 Verify NPM release by version'
       uses: './.github/actions/verify-release'
@@ -285,8 +291,25 @@ runs:
         INPUTS_PREVIOUS_TAG: '${{ inputs.previous-tag }}'
       shell: 'bash'
       run: |
+        rm -f gemini-cli-bundle.zip
+        (cd bundle && chmod +x gemini.js && zip -r ../gemini-cli-bundle.zip .)
+
+        echo "Testing the generated bundle archive..."
+        rm -rf test-bundle
+        mkdir -p test-bundle
+        unzip -q gemini-cli-bundle.zip -d test-bundle
+
+        # Verify it runs and outputs a version
+        BUNDLE_VERSION=$(node test-bundle/gemini.js --version | xargs)
+        echo "Bundle version output: ${BUNDLE_VERSION}"
+        if [[ -z "${BUNDLE_VERSION}" ]]; then
+          echo "Error: Bundle failed to execute or return version."
+          exit 1
+        fi
+        rm -rf test-bundle
+
         gh release create "${INPUTS_RELEASE_TAG}" \
-          bundle/gemini.js \
+          gemini-cli-bundle.zip \
           --target "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}" \
           --title "Release ${INPUTS_RELEASE_TAG}" \
           --notes-start-tag "${INPUTS_PREVIOUS_TAG}" \

.github/actions/push-sandbox/action.yml

@@ -34,7 +34,7 @@ runs:
         JSON_INPUTS: '${{ toJSON(inputs) }}'
       run: 'echo "$JSON_INPUTS"'
     - name: 'Checkout'
-      uses: 'actions/checkout@v4'
+      uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
       with:
         ref: '${{ inputs.github-sha }}'
         fetch-depth: 0
@@ -45,11 +45,11 @@ runs:
       shell: 'bash'
       run: 'npm run build'
     - name: 'Set up QEMU'
-      uses: 'docker/setup-qemu-action@v3'
+      uses: 'docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130' # ratchet:docker/setup-qemu-action@v3
     - name: 'Set up Docker Buildx'
-      uses: 'docker/setup-buildx-action@v3'
+      uses: 'docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f' # ratchet:docker/setup-buildx-action@v3
     - name: 'Log in to GitHub Container Registry'
-      uses: 'docker/login-action@v3'
+      uses: 'docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9' # ratchet:docker/login-action@v3
       with:
         registry: 'docker.io'
         username: '${{ inputs.dockerhub-username }}'

.github/actions/run-tests/action.yml

@@ -18,6 +18,13 @@ runs:
       env:
         JSON_INPUTS: '${{ toJSON(inputs) }}'
       run: 'echo "$JSON_INPUTS"'
+    - name: 'Install system dependencies'
+      if: "runner.os == 'Linux'"
+      run: |
+        sudo apt-get update -qq && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq bubblewrap
+        # Ubuntu 24.04+ requires this to allow bwrap to function in CI
+        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+      shell: 'bash'
     - name: 'Run Tests'
       env:
         GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'

.github/actions/verify-release/action.yml

@@ -36,7 +36,7 @@ runs:
       run: 'echo "$JSON_INPUTS"'
 
     - name: 'setup node'
-      uses: 'actions/setup-node@v4'
+      uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
       with:
         node-version: '20'
 

.github/workflows/chained_e2e.yml

@@ -334,8 +334,20 @@ jobs:
         if: "${{ steps.check_evals.outputs.should_run == 'true' }}"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_MODEL: 'gemini-3-pro-preview'
+          # Disable Vitest internal retries to avoid double-retrying;
+          # custom retry logic is handled in evals/test-helper.ts
+          VITEST_RETRY: 0
         run: 'npm run test:always_passing_evals'
 
+      - name: 'Upload Reliability Logs'
+        if: "always() && steps.check_evals.outputs.should_run == 'true'"
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'eval-logs-${{ github.run_id }}-${{ github.run_attempt }}'
+          path: 'evals/logs/api-reliability.jsonl'
+          retention-days: 7
+
   e2e:
     name: 'E2E'
     if: |

.github/workflows/ci.yml

@@ -67,7 +67,7 @@ jobs:
           cache: 'npm'
 
       - name: 'Cache Linters'
-        uses: 'actions/cache@v4'
+        uses: 'actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830' # ratchet:actions/cache@v4
         with:
           path: '${{ env.GEMINI_LINT_TEMP_DIR }}'
           key: "${{ runner.os }}-${{ runner.arch }}-linters-${{ hashFiles('scripts/lint.js') }}"
@@ -76,7 +76,7 @@ jobs:
         run: 'npm ci'
 
       - name: 'Cache ESLint'
-        uses: 'actions/cache@v4'
+        uses: 'actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830' # ratchet:actions/cache@v4
         with:
           path: '.eslintcache'
           key: "${{ runner.os }}-eslint-${{ hashFiles('package-lock.json', 'eslint.config.js') }}"
@@ -114,6 +114,9 @@ jobs:
       - name: 'Run sensitive keyword linter'
         run: 'node scripts/lint.js --sensitive-keywords'
 
+      - name: 'Run GitHub Actions pinning linter'
+        run: 'node scripts/lint.js --check-github-actions-pinning'
+
   link_checker:
     name: 'Link Checker'
     runs-on: 'ubuntu-latest'
@@ -158,6 +161,12 @@ jobs:
       - name: 'Build project'
         run: 'npm run build'
 
+      - name: 'Install system dependencies'
+        run: |
+          sudo apt-get update -qq && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq bubblewrap
+          # Ubuntu 24.04+ requires this to allow bwrap to function in CI
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+
       - name: 'Install dependencies for testing'
         run: 'npm ci'
 
@@ -166,10 +175,10 @@ jobs:
           NO_COLOR: true
         run: |
           if [[ "${{ matrix.shard }}" == "cli" ]]; then
-            npm run test:ci --workspace @google/gemini-cli
+            npm run test:ci --workspace "@google/gemini-cli"
           else
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
             npm run test:scripts
           fi
 
@@ -254,10 +263,10 @@ jobs:
           NO_COLOR: true
         run: |
           if [[ "${{ matrix.shard }}" == "cli" ]]; then
-            npm run test:ci --workspace @google/gemini-cli -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli" -- --coverage.enabled=false
           else
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
             npm run test:scripts
           fi
 
@@ -420,11 +429,14 @@ jobs:
           NODE_ENV: 'test'
         run: |
           if ("${{ matrix.shard }}" -eq "cli") {
-            npm run test:ci --workspace @google/gemini-cli -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli" -- --coverage.enabled=false
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           } else {
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
             npm run test:scripts
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
         shell: 'pwsh'
 

.github/workflows/eval-pr.yml

@@ -0,0 +1,142 @@
+name: 'Evals: PR Evaluation & Regression'
+
+on:
+  pull_request:
+    types: ['opened', 'synchronize', 'reopened', 'ready_for_review']
+    paths:
+      - 'packages/core/src/prompts/**'
+      - 'packages/core/src/tools/**'
+      - 'packages/core/src/agents/**'
+      - 'evals/**'
+      - '!**/*.test.ts'
+      - '!**/*.test.tsx'
+  workflow_dispatch:
+
+# Prevents multiple runs for the same PR simultaneously (saves tokens)
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: 'write'
+  contents: 'read'
+  actions: 'read'
+
+jobs:
+  pr-evaluation:
+    name: 'Evaluate Steering & Regressions'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli' && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository))"
+    # External contributors' PRs will wait for approval in this environment
+    environment: |-
+      ${{ (github.event.pull_request.head.repo.full_name == github.repository) && 'internal' || 'external-evals' }}
+    env:
+      # CENTRALIZED MODEL LIST
+      MODEL_LIST: 'gemini-3-flash-preview'
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4.4.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Detect Steering Changes'
+        id: 'detect'
+        run: |
+          SHOULD_RUN=$(node scripts/changed_prompt.js)
+          STEERING_DETECTED=$(node scripts/changed_prompt.js --steering-only)
+          echo "SHOULD_RUN=$SHOULD_RUN" >> "$GITHUB_OUTPUT"
+          echo "STEERING_DETECTED=$STEERING_DETECTED" >> "$GITHUB_OUTPUT"
+
+      - name: 'Install dependencies'
+        if: "steps.detect.outputs.SHOULD_RUN == 'true'"
+        run: 'npm ci'
+
+      - name: 'Build project'
+        if: "steps.detect.outputs.SHOULD_RUN == 'true'"
+        run: 'npm run build'
+
+      - name: 'Analyze PR Content (Guidance)'
+        if: "steps.detect.outputs.STEERING_DETECTED == 'true'"
+        id: 'analysis'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          # Check for behavioral eval changes
+          EVAL_CHANGES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep "^evals/" || true)
+          if [ -z "$EVAL_CHANGES" ]; then
+            echo "MISSING_EVALS=true" >> "$GITHUB_OUTPUT"
+          fi
+
+          # Check if user is a maintainer
+          USER_PERMISSION=$(gh api repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission --jq '.permission')
+          if [[ "$USER_PERMISSION" == "admin" || "$USER_PERMISSION" == "write" ]]; then
+            echo "IS_MAINTAINER=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: 'Execute Regression Check'
+        if: "steps.detect.outputs.SHOULD_RUN == 'true'"
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          MODEL_LIST: '${{ env.MODEL_LIST }}'
+        run: |
+          # Run the regression check loop. The script saves the report to a file.
+          node scripts/run_eval_regression.js
+
+          # Use the generated report file if it exists
+          if [[ -f eval_regression_report.md ]]; then
+            echo "REPORT_FILE=eval_regression_report.md" >> "$GITHUB_ENV"
+          fi
+
+      - name: 'Post or Update PR Comment'
+        if: "always() && (steps.detect.outputs.STEERING_DETECTED == 'true' || env.REPORT_FILE != '')"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          # 1. Build the full comment body
+          {
+            if [[ -f eval_regression_report.md ]]; then
+              cat eval_regression_report.md
+              echo ""
+            fi
+
+            if [[ "${{ steps.detect.outputs.STEERING_DETECTED }}" == "true" ]]; then
+              echo "### 🧠 Model Steering Guidance"
+              echo ""
+              echo "This PR modifies files that affect the model's behavior (prompts, tools, or instructions)."
+              echo ""
+
+              if [[ "${{ steps.analysis.outputs.MISSING_EVALS }}" == "true" ]]; then
+                echo "- ⚠️ **Consider adding Evals:** No behavioral evaluations (\`evals/*.eval.ts\`) were added or updated in this PR. Consider [adding a test case](https://github.com/google-gemini/gemini-cli/blob/main/evals/README.md#creating-an-evaluation) to verify the new behavior and prevent regressions."
+              fi
+
+              if [[ "${{ steps.analysis.outputs.IS_MAINTAINER }}" == "true" ]]; then
+                echo "- 🚀 **Maintainer Reminder:** Please ensure that these changes do not regress results on benchmark evals before merging."
+              fi
+            fi
+
+            echo ""
+            echo "---"
+            echo "*This is an automated guidance message triggered by steering logic signatures.*"
+            echo "<!-- eval-pr-report -->"
+          } > full_comment.md
+
+          # 2. Find if a comment with our unique tag already exists
+          # We extract the numeric ID from the URL to ensure compatibility with the REST API
+          COMMENT_ID=$(gh pr view ${{ github.event.pull_request.number }} --json comments --jq '.comments[] | select(.body | contains("<!-- eval-pr-report -->")) | .url' | grep -oE "[0-9]+$" | head -n 1)
+
+          # 3. Update or Create the comment
+          if [ -n "$COMMENT_ID" ]; then
+            echo "Updating existing comment $COMMENT_ID via API..."
+            gh api -X PATCH "repos/${{ github.repository }}/issues/comments/$COMMENT_ID" -F body=@full_comment.md
+          else
+            echo "Creating new PR comment..."
+            gh pr comment ${{ github.event.pull_request.number }} --body-file full_comment.md
+          fi

.github/workflows/evals-nightly.yml

@@ -61,6 +61,9 @@ jobs:
           GEMINI_MODEL: '${{ matrix.model }}'
           RUN_EVALS: "${{ github.event.inputs.run_all != 'false' }}"
           TEST_NAME_PATTERN: '${{ github.event.inputs.test_name_pattern }}'
+          # Disable Vitest internal retries to avoid double-retrying;
+          # custom retry logic is handled in evals/test-helper.ts
+          VITEST_RETRY: 0
         run: |
           CMD="npm run test:all_evals"
           PATTERN="${TEST_NAME_PATTERN}"

.github/workflows/gemini-scheduled-stale-issue-closer.yml

@@ -28,14 +28,14 @@ jobs:
     steps:
       - name: 'Generate GitHub App Token'
         id: 'generate_token'
-        uses: 'actions/create-github-app-token@v2'
+        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
         with:
           app-id: '${{ secrets.APP_ID }}'
           private-key: '${{ secrets.PRIVATE_KEY }}'
           permission-issues: 'write'
 
       - name: 'Process Stale Issues'
-        uses: 'actions/github-script@v7'
+        uses: 'actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' # ratchet:actions/github-script@v7
         env:
           DRY_RUN: '${{ inputs.dry_run }}'
         with:

.github/workflows/gemini-scheduled-stale-pr-closer.yml

@@ -27,19 +27,21 @@ jobs:
           APP_ID: '${{ secrets.APP_ID }}'
         if: |-
           ${{ env.APP_ID != '' }}
-        uses: 'actions/create-github-app-token@v2'
+        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
         with:
           app-id: '${{ secrets.APP_ID }}'
           private-key: '${{ secrets.PRIVATE_KEY }}'
 
       - name: 'Process Stale PRs'
-        uses: 'actions/github-script@v7'
+        uses: 'actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' # ratchet:actions/github-script@v7
         env:
           DRY_RUN: '${{ inputs.dry_run }}'
         with:
           github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
           script: |
             const dryRun = process.env.DRY_RUN === 'true';
+            const fourteenDaysAgo = new Date();
+            fourteenDaysAgo.setDate(fourteenDaysAgo.getDate() - 14);
             const thirtyDaysAgo = new Date();
             thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
 
@@ -56,48 +58,38 @@ jobs:
                 for (const m of members) maintainerLogins.add(m.login.toLowerCase());
                 core.info(`Successfully fetched ${members.length} team members from ${team_slug}`);
               } catch (e) {
-                core.warning(`Failed to fetch team members from ${team_slug}: ${e.message}`);
+                // Silently skip if permissions are insufficient; we will rely on author_association
+                core.debug(`Skipped team fetch for ${team_slug}: ${e.message}`);
               }
             }
 
-            const isGooglerCache = new Map();
-            const isGoogler = async (login) => {
-              if (isGooglerCache.has(login)) return isGooglerCache.get(login);
+            const isMaintainer = async (login, assoc) => {
+              // Reliably identify maintainers using authorAssociation (provided by GitHub)
+              // and organization membership (if available).
+              const isTeamMember = maintainerLogins.has(login.toLowerCase());
+              const isRepoMaintainer = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(assoc);
 
+              if (isTeamMember || isRepoMaintainer) return true;
+
+              // Fallback: Check if user belongs to the 'google' or 'googlers' orgs (requires permission)
               try {
-                // Check membership in 'googlers' or 'google' orgs
                 const orgs = ['googlers', 'google'];
                 for (const org of orgs) {
                   try {
-                    await github.rest.orgs.checkMembershipForUser({
-                      org: org,
-                      username: login
-                    });
-                    core.info(`User ${login} is a member of ${org} organization.`);
-                    isGooglerCache.set(login, true);
+                    await github.rest.orgs.checkMembershipForUser({ org: org, username: login });
                     return true;
                   } catch (e) {
-                    // 404 just means they aren't a member, which is fine
                     if (e.status !== 404) throw e;
                   }
                 }
               } catch (e) {
-                core.warning(`Failed to check org membership for ${login}: ${e.message}`);
+                // Gracefully ignore failures here
               }
 
-              isGooglerCache.set(login, false);
               return false;
             };
 
-            const isMaintainer = async (login, assoc) => {
-              const isTeamMember = maintainerLogins.has(login.toLowerCase());
-              const isRepoMaintainer = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(assoc);
-              if (isTeamMember || isRepoMaintainer) return true;
-
-              return await isGoogler(login);
-            };
-
-            // 2. Determine which PRs to check
+            // 2. Fetch all open PRs
             let prs = [];
             if (context.eventName === 'pull_request') {
               const { data: pr } = await github.rest.pulls.get({
@@ -118,64 +110,77 @@ jobs:
             for (const pr of prs) {
               const maintainerPr = await isMaintainer(pr.user.login, pr.author_association);
               const isBot = pr.user.type === 'Bot' || pr.user.login.endsWith('[bot]');
+              if (maintainerPr || isBot) continue;
 
-              // Detection Logic for Linked Issues
-              // Check 1: Official GitHub "Closing Issue" link (GraphQL)
-              const linkedIssueQuery = `query($owner:String!, $repo:String!, $number:Int!) {
+              // Helper: Fetch labels and linked issues via GraphQL
+              const prDetailsQuery = `query($owner:String!, $repo:String!, $number:Int!) {
                 repository(owner:$owner, name:$repo) {
                   pullRequest(number:$number) {
-                    closingIssuesReferences(first: 1) { totalCount }
+                    closingIssuesReferences(first: 10) {
+                      nodes {
+                        number
+                        labels(first: 20) {
+                          nodes { name }
+                        }
+                      }
+                    }
                   }
                 }
               }`;
 
-              let hasClosingLink = false;
+              let linkedIssues = [];
               try {
-                const res = await github.graphql(linkedIssueQuery, {
+                const res = await github.graphql(prDetailsQuery, {
                   owner: context.repo.owner, repo: context.repo.repo, number: pr.number
                 });
-                hasClosingLink = res.repository.pullRequest.closingIssuesReferences.totalCount > 0;
-              } catch (e) {}
-
-              // Check 2: Regex for mentions (e.g., "Related to #123", "Part of #123", "#123")
-              // We check for # followed by numbers or direct URLs to issues.
-              const body = pr.body || '';
-              const mentionRegex = /(?:#|https:\/\/github\.com\/[^\/]+\/[^\/]+\/issues\/)(\d+)/i;
-              const hasMentionLink = mentionRegex.test(body);
-
-              const hasLinkedIssue = hasClosingLink || hasMentionLink;
-
-              // Logic for Closed PRs (Auto-Reopen)
-              if (pr.state === 'closed' && context.eventName === 'pull_request' && context.payload.action === 'edited') {
-                if (hasLinkedIssue) {
-                  core.info(`PR #${pr.number} now has a linked issue. Reopening.`);
-                  if (!dryRun) {
-                    await github.rest.pulls.update({
-                      owner: context.repo.owner,
-                      repo: context.repo.repo,
-                      pull_number: pr.number,
-                      state: 'open'
-                    });
-                    await github.rest.issues.createComment({
-                      owner: context.repo.owner,
-                      repo: context.repo.repo,
-                      issue_number: pr.number,
-                      body: "Thank you for linking an issue! This pull request has been automatically reopened."
-                    });
-                  }
-                }
-                continue;
+                linkedIssues = res.repository.pullRequest.closingIssuesReferences.nodes;
+              } catch (e) {
+                core.warning(`GraphQL fetch failed for PR #${pr.number}: ${e.message}`);
               }
 
-              // Logic for Open PRs (Immediate Closure)
-              if (pr.state === 'open' && !maintainerPr && !hasLinkedIssue && !isBot) {
-                core.info(`PR #${pr.number} is missing a linked issue. Closing.`);
+              // Check for mentions in body as fallback (regex)
+              const body = pr.body || '';
+              const mentionRegex = /(?:#|https:\/\/github\.com\/[^\/]+\/[^\/]+\/issues\/)(\d+)/i;
+              const matches = body.match(mentionRegex);
+              if (matches && linkedIssues.length === 0) {
+                const issueNumber = parseInt(matches[1]);
+                try {
+                  const { data: issue } = await github.rest.issues.get({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issueNumber
+                  });
+                  linkedIssues = [{ number: issueNumber, labels: { nodes: issue.labels.map(l => ({ name: l.name })) } }];
+                } catch (e) {}
+              }
+
+              // 3. Enforcement Logic
+              const prLabels = pr.labels.map(l => l.name.toLowerCase());
+              const hasHelpWanted = prLabels.includes('help wanted') ||
+                                    linkedIssues.some(issue => issue.labels.nodes.some(l => l.name.toLowerCase() === 'help wanted'));
+
+              const hasMaintainerOnly = prLabels.includes('🔒 maintainer only') ||
+                                        linkedIssues.some(issue => issue.labels.nodes.some(l => l.name.toLowerCase() === '🔒 maintainer only'));
+
+              const hasLinkedIssue = linkedIssues.length > 0;
+
+              // Closure Policy: No help-wanted label = Close after 14 days
+              if (pr.state === 'open' && !hasHelpWanted && !hasMaintainerOnly) {
+                const prCreatedAt = new Date(pr.created_at);
+
+                // We give a 14-day grace period for non-help-wanted PRs to be manually reviewed/labeled by an EM
+                if (prCreatedAt > fourteenDaysAgo) {
+                  core.info(`PR #${pr.number} is new and lacks 'help wanted'. Giving 14-day grace period for EM review.`);
+                  continue;
+                }
+
+                core.info(`PR #${pr.number} is older than 14 days and lacks 'help wanted' association. Closing.`);
                 if (!dryRun) {
                   await github.rest.issues.createComment({
                     owner: context.repo.owner,
                     repo: context.repo.repo,
                     issue_number: pr.number,
-                    body: "Hi there! Thank you for your contribution to Gemini CLI. \n\nTo improve our contribution process and better track changes, we now require all pull requests to be associated with an existing issue, as announced in our [recent discussion](https://github.com/google-gemini/gemini-cli/discussions/16706) and as detailed in our [CONTRIBUTING.md](https://github.com/google-gemini/gemini-cli/blob/main/CONTRIBUTING.md#1-link-to-an-existing-issue).\n\nThis pull request is being closed because it is not currently linked to an issue. **Once you have updated the description of this PR to link an issue (e.g., by adding `Fixes #123` or `Related to #123`), it will be automatically reopened.**\n\n**How to link an issue:**\nAdd a keyword followed by the issue number (e.g., `Fixes #123`) in the description of your pull request. For more details on supported keywords and how linking works, please refer to the [GitHub Documentation on linking pull requests to issues](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue).\n\nThank you for your understanding and for being a part of our community!"
+                    body: "Hi there! Thank you for your interest in contributing to Gemini CLI. \n\nTo ensure we maintain high code quality and focus on our prioritized roadmap, we have updated our contribution policy (see [Discussion #17383](https://github.com/google-gemini/gemini-cli/discussions/17383)). \n\n**We only *guarantee* review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'.** All other community pull requests are subject to closure after 14 days if they do not align with our current focus areas. For this reason, we strongly recommend that contributors only submit pull requests against issues explicitly labeled as **'help-wanted'**. \n\nThis pull request is being closed as it has been open for 14 days without a 'help wanted' designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding and for being part of our community!"
                   });
                   await github.rest.pulls.update({
                     owner: context.repo.owner,
@@ -187,27 +192,22 @@ jobs:
                 continue;
               }
 
-              // Staleness check (Scheduled runs only)
-              if (pr.state === 'open' && context.eventName !== 'pull_request') {
-                const labels = pr.labels.map(l => l.name.toLowerCase());
-                if (labels.includes('help wanted') || labels.includes('🔒 maintainer only')) continue;
+              // Also check for linked issue even if it has help wanted (redundant but safe)
+              if (pr.state === 'open' && !hasLinkedIssue) {
+                 // Already covered by hasHelpWanted check above, but good for future-proofing
+                 continue;
+              }
 
+              // 4. Staleness Check (Scheduled only)
+              if (pr.state === 'open' && context.eventName !== 'pull_request') {
                 // Skip PRs that were created less than 30 days ago - they cannot be stale yet
                 const prCreatedAt = new Date(pr.created_at);
-                if (prCreatedAt > thirtyDaysAgo) {
-                  const daysOld = Math.floor((Date.now() - prCreatedAt.getTime()) / (1000 * 60 * 60 * 24));
-                  core.info(`PR #${pr.number} was created ${daysOld} days ago. Skipping staleness check.`);
-                  continue;
-                }
+                if (prCreatedAt > thirtyDaysAgo) continue;
 
-                // Initialize lastActivity to PR creation date (not epoch) as a safety baseline.
-                // This ensures we never incorrectly mark a PR as stale due to failed activity lookups.
                 let lastActivity = new Date(pr.created_at);
                 try {
                   const reviews = await github.paginate(github.rest.pulls.listReviews, {
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    pull_number: pr.number
+                    owner: context.repo.owner, repo: context.repo.repo, pull_number: pr.number
                   });
                   for (const r of reviews) {
                     if (await isMaintainer(r.user.login, r.author_association)) {
@@ -216,9 +216,7 @@ jobs:
                     }
                   }
                   const comments = await github.paginate(github.rest.issues.listComments, {
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: pr.number
+                    owner: context.repo.owner, repo: context.repo.repo, issue_number: pr.number
                   });
                   for (const c of comments) {
                     if (await isMaintainer(c.user.login, c.author_association)) {
@@ -226,25 +224,23 @@ jobs:
                       if (d > lastActivity) lastActivity = d;
                     }
                   }
-                } catch (e) {
-                  core.warning(`Failed to fetch reviews/comments for PR #${pr.number}: ${e.message}`);
-                }
-
-                // For maintainer PRs, the PR creation itself counts as maintainer activity.
-                // (Now redundant since we initialize to pr.created_at, but kept for clarity)
-                if (maintainerPr) {
-                  const d = new Date(pr.created_at);
-                  if (d > lastActivity) lastActivity = d;
-                }
+                } catch (e) {}
 
                 if (lastActivity < thirtyDaysAgo) {
-                  core.info(`PR #${pr.number} is stale.`);
+                  const labels = pr.labels.map(l => l.name.toLowerCase());
+                  const isProtected = labels.includes('help wanted') || labels.includes('🔒 maintainer only');
+                  if (isProtected) {
+                    core.info(`PR #${pr.number} is stale but has a protected label. Skipping closure.`);
+                    continue;
+                  }
+
+                  core.info(`PR #${pr.number} is stale (no maintainer activity for 30+ days). Closing.`);
                   if (!dryRun) {
                     await github.rest.issues.createComment({
                       owner: context.repo.owner,
                       repo: context.repo.repo,
                       issue_number: pr.number,
-                      body: "Hi there! Thank you for your contribution to Gemini CLI. We really appreciate the time and effort you've put into this pull request.\n\nTo keep our backlog manageable and ensure we're focusing on current priorities, we are closing pull requests that haven't seen maintainer activity for 30 days. Currently, the team is prioritizing work associated with **🔒 maintainer only** or **help wanted** issues.\n\nIf you believe this change is still critical, please feel free to comment with updated details. Otherwise, we encourage contributors to focus on open issues labeled as **help wanted**. Thank you for your understanding!"
+                      body: "Hi there! Thank you for your contribution. To keep our backlog manageable, we are closing pull requests that haven't seen maintainer activity for 30 days. If you're still working on this, please let us know!"
                     });
                     await github.rest.pulls.update({
                       owner: context.repo.owner,

.github/workflows/label-backlog-child-issues.yml

@@ -18,10 +18,10 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
 
       - name: 'Setup Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version: '20'
           cache: 'npm'
@@ -40,10 +40,10 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
 
       - name: 'Setup Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version: '20'
           cache: 'npm'

.github/workflows/label-workstream-rollup.yml

@@ -15,7 +15,7 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Check for Parent Workstream and Apply Label'
-        uses: 'actions/github-script@v7'
+        uses: 'actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' # ratchet:actions/github-script@v7
         with:
           script: |
             const labelToAdd = 'workstream-rollup';

.github/workflows/pr-contribution-guidelines-notifier.yml

@@ -19,7 +19,7 @@ jobs:
           APP_ID: '${{ secrets.APP_ID }}'
         if: |-
           ${{ env.APP_ID != '' }}
-        uses: 'actions/create-github-app-token@v2'
+        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
         with:
           app-id: '${{ secrets.APP_ID }}'
           private-key: '${{ secrets.PRIVATE_KEY }}'

.github/workflows/release-change-tags.yml

@@ -40,7 +40,7 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
         with:
           ref: '${{ github.ref }}'
           fetch-depth: 0

.github/workflows/release-notes.yml

@@ -29,14 +29,14 @@ jobs:
       pull-requests: 'write'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
         with:
           # The user-level skills need to be available to the workflow
           fetch-depth: 0
           ref: 'main'
 
       - name: 'Set up Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version: '20'
 
@@ -86,7 +86,7 @@ jobs:
 
       - name: 'Create Pull Request'
         if: "steps.validate_version.outputs.CONTINUE == 'true'"
-        uses: 'peter-evans/create-pull-request@v6'
+        uses: 'peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c' # ratchet:peter-evans/create-pull-request@v6
         with:
           token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
           commit-message: 'docs(changelog): update for ${{ steps.release_info.outputs.VERSION }}'

.github/workflows/test-build-binary.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
 
       - name: 'Optimize Windows Performance'
         if: "matrix.os == 'windows-latest'"
@@ -46,7 +46,7 @@ jobs:
         shell: 'powershell'
 
       - name: 'Set up Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
           architecture: '${{ matrix.arch }}'
@@ -63,7 +63,7 @@ jobs:
 
       - name: 'Setup Windows SDK (Windows)'
         if: "matrix.os == 'windows-latest'"
-        uses: 'microsoft/setup-msbuild@v2'
+        uses: 'microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce' # ratchet:microsoft/setup-msbuild@v2
 
       - name: 'Add Signtool to Path (Windows)'
         if: "matrix.os == 'windows-latest'"
@@ -153,7 +153,7 @@ jobs:
           npm run test:integration:sandbox:none -- --testTimeout=600000
 
       - name: 'Upload Artifact'
-        uses: 'actions/upload-artifact@v4'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
         with:
           name: 'gemini-cli-${{ matrix.platform_name }}'
           path: 'dist/${{ matrix.platform_name }}/'

.github/workflows/unassign-inactive-assignees.yml

@@ -40,13 +40,13 @@ jobs:
     steps:
       - name: 'Generate GitHub App Token'
         id: 'generate_token'
-        uses: 'actions/create-github-app-token@v2'
+        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
         with:
           app-id: '${{ secrets.APP_ID }}'
           private-key: '${{ secrets.PRIVATE_KEY }}'
 
       - name: 'Unassign inactive assignees'
-        uses: 'actions/github-script@v7'
+        uses: 'actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' # ratchet:actions/github-script@v7
         env:
           DRY_RUN: '${{ inputs.dry_run }}'
         with:

CONTRIBUTING.md

@@ -323,8 +323,8 @@ fi
 
 #### Formatting
 
-To separately format the code in this project by running the following command
-from the root directory:
+To separately format the code in this project, run the following command from
+the root directory:
 
 ```bash
 npm run format
@@ -346,27 +346,14 @@ npm run lint
 
 - Please adhere to the coding style, patterns, and conventions used throughout
   the existing codebase.
-- Consult [GEMINI.md](../GEMINI.md) (typically found in the project root) for
-  specific instructions related to AI-assisted development, including
-  conventions for React, comments, and Git usage.
+- Consult
+  [GEMINI.md](https://github.com/google-gemini/gemini-cli/blob/main/GEMINI.md)
+  (typically found in the project root) for specific instructions related to
+  AI-assisted development, including conventions for React, comments, and Git
+  usage.
 - **Imports:** Pay special attention to import paths. The project uses ESLint to
   enforce restrictions on relative imports between packages.
 
-### Project structure
-
-- `packages/`: Contains the individual sub-packages of the project.
-  - `a2a-server`: A2A server implementation for the Gemini CLI. (Experimental)
-  - `cli/`: The command-line interface.
-  - `core/`: The core backend logic for the Gemini CLI.
-  - `test-utils` Utilities for creating and cleaning temporary file systems for
-    testing.
-  - `vscode-ide-companion/`: The Gemini CLI Companion extension pairs with
-    Gemini CLI.
-- `docs/`: Contains all project documentation.
-- `scripts/`: Utility scripts for building, testing, and development tasks.
-
-For more detailed architecture, see `docs/architecture.md`.
-
 ### Debugging
 
 #### VS Code
@@ -520,8 +507,9 @@ code.
 
 ### Documentation structure
 
-Our documentation is organized using [sidebar.json](/docs/sidebar.json) as the
-table of contents. When adding new documentation:
+Our documentation is organized using
+[sidebar.json](https://github.com/google-gemini/gemini-cli/blob/main/docs/sidebar.json)
+as the table of contents. When adding new documentation:
 
 1. Create your markdown file **in the appropriate directory** under `/docs`.
 2. Add an entry to `sidebar.json` in the relevant section.

GEMINI.md

@@ -22,9 +22,10 @@ powerful tool for developers.
     rendering.
   - `packages/core`: Backend logic, Gemini API orchestration, prompt
     construction, and tool execution.
-  - `packages/core/src/tools/`: Built-in tools for file system, shell, and web
-    operations.
   - `packages/a2a-server`: Experimental Agent-to-Agent server.
+  - `packages/sdk`: Programmatic SDK for embedding Gemini CLI capabilities.
+  - `packages/devtools`: Integrated developer tools (Network/Console inspector).
+  - `packages/test-utils`: Shared test utilities and test rig.
   - `packages/vscode-ide-companion`: VS Code extension pairing with the CLI.
 
 ## Building and Running
@@ -58,10 +59,6 @@ powerful tool for developers.
 
 ## Development Conventions
 
-- **Legacy Snippets:** `packages/core/src/prompts/snippets.legacy.ts` is a
-  snapshot of an older system prompt. Avoid changing the prompting verbiage to
-  preserve its historical behavior; however, structural changes to ensure
-  compilation or simplify the code are permitted.
 - **Contributions:** Follow the process outlined in `CONTRIBUTING.md`. Requires
   signing the Google CLA.
 - **Pull Requests:** Keep PRs small, focused, and linked to an existing issue.
@@ -69,8 +66,6 @@ powerful tool for developers.
   `gh` CLI.
 - **Commit Messages:** Follow the
   [Conventional Commits](https://www.conventionalcommits.org/) standard.
-- **Coding Style:** Adhere to existing patterns in `packages/cli` (React/Ink)
-  and `packages/core` (Backend logic).
 - **Imports:** Use specific imports and avoid restricted relative imports
   between packages (enforced by ESLint).
 - **License Headers:** For all new source code files (`.ts`, `.tsx`, `.js`),

README.md

@@ -30,7 +30,7 @@ Learn all about Gemini CLI in our [documentation](https://geminicli.com/docs/).
 ## 📦 Installation
 
 See
-[Gemini CLI installation, execution, and releases](./docs/get-started/installation.md)
+[Gemini CLI installation, execution, and releases](https://www.geminicli.com/docs/get-started/installation)
 for recommended system specifications and a detailed installation guide.
 
 ### Quick Install
@@ -71,9 +71,9 @@ conda activate gemini_env
 npm install -g @google/gemini-cli
 ```
 
-## Release Cadence and Tags
+## Release Channels
 
-See [Releases](./docs/releases.md) for more details.
+See [Releases](https://www.geminicli.com/docs/changelogs) for more details.
 
 ### Preview
 
@@ -209,7 +209,7 @@ gemini
 ```
 
 For Google Workspace accounts and other authentication methods, see the
-[authentication guide](./docs/get-started/authentication.md).
+[authentication guide](https://www.geminicli.com/docs/get-started/authentication).
 
 ## 🚀 Getting Started
 
@@ -278,60 +278,64 @@ gemini
 
 ### Getting Started
 
-- [**Quickstart Guide**](./docs/get-started/index.md) - Get up and running
-  quickly.
-- [**Authentication Setup**](./docs/get-started/authentication.md) - Detailed
-  auth configuration.
-- [**Configuration Guide**](./docs/reference/configuration.md) - Settings and
-  customization.
-- [**Keyboard Shortcuts**](./docs/reference/keyboard-shortcuts.md) -
+- [**Quickstart Guide**](https://www.geminicli.com/docs/get-started) - Get up
+  and running quickly.
+- [**Authentication Setup**](https://www.geminicli.com/docs/get-started/authentication) -
+  Detailed auth configuration.
+- [**Configuration Guide**](https://www.geminicli.com/docs/reference/configuration) -
+  Settings and customization.
+- [**Keyboard Shortcuts**](https://www.geminicli.com/docs/reference/keyboard-shortcuts) -
   Productivity tips.
 
 ### Core Features
 
-- [**Commands Reference**](./docs/reference/commands.md) - All slash commands
-  (`/help`, `/chat`, etc).
-- [**Custom Commands**](./docs/cli/custom-commands.md) - Create your own
-  reusable commands.
-- [**Context Files (GEMINI.md)**](./docs/cli/gemini-md.md) - Provide persistent
-  context to Gemini CLI.
-- [**Checkpointing**](./docs/cli/checkpointing.md) - Save and resume
-  conversations.
-- [**Token Caching**](./docs/cli/token-caching.md) - Optimize token usage.
+- [**Commands Reference**](https://www.geminicli.com/docs/reference/commands) -
+  All slash commands (`/help`, `/chat`, etc).
+- [**Custom Commands**](https://www.geminicli.com/docs/cli/custom-commands) -
+  Create your own reusable commands.
+- [**Context Files (GEMINI.md)**](https://www.geminicli.com/docs/cli/gemini-md) -
+  Provide persistent context to Gemini CLI.
+- [**Checkpointing**](https://www.geminicli.com/docs/cli/checkpointing) - Save
+  and resume conversations.
+- [**Token Caching**](https://www.geminicli.com/docs/cli/token-caching) -
+  Optimize token usage.
 
 ### Tools & Extensions
 
-- [**Built-in Tools Overview**](./docs/reference/tools.md)
-  - [File System Operations](./docs/tools/file-system.md)
-  - [Shell Commands](./docs/tools/shell.md)
-  - [Web Fetch & Search](./docs/tools/web-fetch.md)
-- [**MCP Server Integration**](./docs/tools/mcp-server.md) - Extend with custom
-  tools.
-- [**Custom Extensions**](./docs/extensions/index.md) - Build and share your own
-  commands.
+- [**Built-in Tools Overview**](https://www.geminicli.com/docs/reference/tools)
+  - [File System Operations](https://www.geminicli.com/docs/tools/file-system)
+  - [Shell Commands](https://www.geminicli.com/docs/tools/shell)
+  - [Web Fetch & Search](https://www.geminicli.com/docs/tools/web-fetch)
+- [**MCP Server Integration**](https://www.geminicli.com/docs/tools/mcp-server) -
+  Extend with custom tools.
+- [**Custom Extensions**](https://geminicli.com/docs/extensions/writing-extensions) -
+  Build and share your own commands.
 
 ### Advanced Topics
 
-- [**Headless Mode (Scripting)**](./docs/cli/headless.md) - Use Gemini CLI in
-  automated workflows.
-- [**Architecture Overview**](./docs/architecture.md) - How Gemini CLI works.
-- [**IDE Integration**](./docs/ide-integration/index.md) - VS Code companion.
-- [**Sandboxing & Security**](./docs/cli/sandbox.md) - Safe execution
-  environments.
-- [**Trusted Folders**](./docs/cli/trusted-folders.md) - Control execution
-  policies by folder.
-- [**Enterprise Guide**](./docs/cli/enterprise.md) - Deploy and manage in a
-  corporate environment.
-- [**Telemetry & Monitoring**](./docs/cli/telemetry.md) - Usage tracking.
-- [**Tools reference**](./docs/reference/tools.md) - Built-in tools overview.
-- [**Local development**](./docs/local-development.md) - Local development
-  tooling.
+- [**Headless Mode (Scripting)**](https://www.geminicli.com/docs/cli/headless) -
+  Use Gemini CLI in automated workflows.
+- [**IDE Integration**](https://www.geminicli.com/docs/ide-integration) - VS
+  Code companion.
+- [**Sandboxing & Security**](https://www.geminicli.com/docs/cli/sandbox) - Safe
+  execution environments.
+- [**Trusted Folders**](https://www.geminicli.com/docs/cli/trusted-folders) -
+  Control execution policies by folder.
+- [**Enterprise Guide**](https://www.geminicli.com/docs/cli/enterprise) - Deploy
+  and manage in a corporate environment.
+- [**Telemetry & Monitoring**](https://www.geminicli.com/docs/cli/telemetry) -
+  Usage tracking.
+- [**Tools reference**](https://www.geminicli.com/docs/reference/tools) -
+  Built-in tools overview.
+- [**Local development**](https://www.geminicli.com/docs/local-development) -
+  Local development tooling.
 
 ### Troubleshooting & Support
 
-- [**Troubleshooting Guide**](./docs/resources/troubleshooting.md) - Common
-  issues and solutions.
-- [**FAQ**](./docs/resources/faq.md) - Frequently asked questions.
+- [**Troubleshooting Guide**](https://www.geminicli.com/docs/resources/troubleshooting) -
+  Common issues and solutions.
+- [**FAQ**](https://www.geminicli.com/docs/resources/faq) - Frequently asked
+  questions.
 - Use `/bug` command to report issues directly from the CLI.
 
 ### Using MCP Servers
@@ -345,8 +349,9 @@ custom tools:
 > @database Run a query to find inactive users
 ```
 
-See the [MCP Server Integration guide](./docs/tools/mcp-server.md) for setup
-instructions.
+See the
+[MCP Server Integration guide](https://www.geminicli.com/docs/tools/mcp-server)
+for setup instructions.
 
 ## 🤝 Contributing
 
@@ -367,7 +372,8 @@ for planned features and priorities.
 ## 📖 Resources
 
 - **[Official Roadmap](./ROADMAP.md)** - See what's coming next.
-- **[Changelog](./docs/changelogs/index.md)** - See recent notable updates.
+- **[Changelog](https://www.geminicli.com/docs/changelogs)** - See recent
+  notable updates.
 - **[NPM Package](https://www.npmjs.com/package/@google/gemini-cli)** - Package
   registry.
 - **[GitHub Issues](https://github.com/google-gemini/gemini-cli/issues)** -
@@ -377,13 +383,14 @@ for planned features and priorities.
 
 ### Uninstall
 
-See the [Uninstall Guide](./docs/resources/uninstall.md) for removal
-instructions.
+See the [Uninstall Guide](https://www.geminicli.com/docs/resources/uninstall)
+for removal instructions.
 
 ## 📄 Legal
 
 - **License**: [Apache License 2.0](LICENSE)
-- **Terms of Service**: [Terms & Privacy](./docs/resources/tos-privacy.md)
+- **Terms of Service**:
+  [Terms & Privacy](https://www.geminicli.com/docs/resources/tos-privacy)
 - **Security**: [Security Policy](SECURITY.md)
 
 ---

docs/adk-replat/NOTES-adk-alignment.md

@@ -0,0 +1,529 @@
+# ADK-TS Alignment Pass
+
+Every interface in our outline must map cleanly to ADK-TS. This document
+verifies that mapping field-by-field, identifies gaps, and confirms
+HITL/plugin/transfer patterns work.
+
+Source: ADK-TS v0.4.0 at `/Users/adamfweidman/Desktop/adk-int/adk-js/core/src/`
+
+---
+
+## 1. AgentDescriptor ↔ ADK Agent Hierarchy
+
+### Field-by-field mapping
+
+| AgentDescriptor field        | ADK-TS source                                | Notes                                                                                                                                                    |
+| ---------------------------- | -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `name`                       | `BaseAgent.name`                             | Direct. ADK validates it's a valid JS identifier.                                                                                                        |
+| `displayName`                | —                                            | ADK doesn't have this. No conflict.                                                                                                                      |
+| `description`                | `BaseAgent.description` (optional in ADK)    | Direct. Used for model routing in AgentTool.                                                                                                             |
+| `executor`                   | —                                            | New concept. ADK agents are always 'adk'. Adapter sets this.                                                                                             |
+| `inputSchema`                | `LlmAgent.inputSchema` (Zod or JSON Schema)  | Direct. ADK's AgentTool uses this for tool parameter generation.                                                                                         |
+| `outputSchema`               | `LlmAgent.outputSchema` (Zod or JSON Schema) | Direct. ADK uses for structured output + AgentTool response.                                                                                             |
+| `capabilities`               | —                                            | New concept. Adapter infers from agent type: LlmAgent gets `['elicitation', 'streaming', 'host_tool_execution']`, LoopAgent gets `['composition']`, etc. |
+| `ownTools`                   | `LlmAgent.tools: ToolUnion[]`                | Maps via ToolDescriptor adapter. ADK tools have `name`, `description`, `_getDeclaration()` which returns JSON Schema.                                    |
+| `requiredTools`              | —                                            | New concept. ADK agents don't declare required host tools. Adapter can infer from tool references.                                                       |
+| `subAgents`                  | `BaseAgent.subAgents: BaseAgent[]`           | Recursive. Each sub-agent becomes a nested AgentDescriptor.                                                                                              |
+| `constraints.maxTurns`       | `RunConfig.maxLlmCalls` (default 500)        | Maps, though semantics differ slightly (LLM calls vs turns).                                                                                             |
+| `constraints.maxTimeMinutes` | —                                            | ADK doesn't have time limits. No conflict — host enforces.                                                                                               |
+| `constraints.maxBudgetUsd`   | —                                            | ADK doesn't have budget. No conflict — host enforces.                                                                                                    |
+| `metadata`                   | —                                            | New concept. Adapter can populate from agent registration context.                                                                                       |
+
+### ADK-specific fields NOT in AgentDescriptor
+
+| ADK field                           | Where it lives | Our approach                                                                                               |
+| ----------------------------------- | -------------- | ---------------------------------------------------------------------------------------------------------- |
+| `instruction` / `globalInstruction` | LlmAgent       | Executor-internal. Not in descriptor (it's runtime config, not identity).                                  |
+| `model`                             | LlmAgent       | Goes in ExecutionOptions.model or executor-internal config.                                                |
+| `generateContentConfig`             | LlmAgent       | Executor-internal.                                                                                         |
+| `disallowTransferToParent/Peers`    | LlmAgent       | Could be `constraints` or `_meta`. Transfer policy is host-enforced.                                       |
+| `includeContents`                   | LlmAgent       | Executor-internal (context management).                                                                    |
+| `outputKey`                         | LlmAgent       | Executor-internal (state management).                                                                      |
+| `beforeModelCallback`, etc.         | LlmAgent       | Executor-internal. These are ADK's callback system — our LifecycleInterceptor is the interface equivalent. |
+
+### Verdict: CLEAN MAPPING
+
+AgentDescriptor captures everything needed to describe an ADK agent externally.
+ADK-specific runtime config (instruction, model, callbacks) stays inside the
+executor — exactly right for the descriptor/executor separation.
+
+**Key ADK pattern preserved:** AgentTool wraps an agent as a tool using
+`inputSchema` for parameters and `description` for the tool description. Our
+AgentDescriptor has both, so SubagentTool can do the same thing.
+
+---
+
+## 2. AgentSession ↔ ADK Runner
+
+### Method mapping
+
+| AgentSession method     | ADK-TS equivalent                                               | How adapter works                                                                                                                                                   |
+| ----------------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `stream(data, options)` | `Runner.runAsync({ userId, sessionId, newMessage, runConfig })` | Adapter creates/loads session, maps data+options → runAsync params, wraps Event generator → AgentEvent generator. Each `stream()` call triggers a new `runAsync()`. |
+| `update(config)`        | No direct equivalent                                            | ADK doesn't support mid-stream config changes. Adapter queues updates for next `runAsync()` call.                                                                   |
+| `steer(data)`           | No direct equivalent                                            | ADK doesn't support mid-stream intervention. Adapter can queue for next invocation or ignore.                                                                       |
+| `abort()`               | No direct equivalent                                            | ADK uses `invocationContext.endInvocation = true`. Adapter sets this flag. Could also use AbortController.                                                          |
+
+### ExecutionRequest → Runner.runAsync mapping
+
+| ExecutionRequest field      | ADK mapping                                                      |
+| --------------------------- | ---------------------------------------------------------------- |
+| `descriptor`                | Used to find/create the BaseAgent instance                       |
+| `input`                     | → `newMessage: Content` (converted from ContentPart[] → Content) |
+| `sessionRef`                | → `sessionId` (string) or creates session from SessionSnapshot   |
+| `forkSession`               | Adapter clones session before running                            |
+| `options.tools`             | → merged into agent's `tools` config                             |
+| `options.model`             | → `LlmAgent.model` override                                      |
+| `options.hostToolExecution` | → `RunConfig.pauseOnToolCalls: true`                             |
+| `options.streaming`         | → `RunConfig.streamingMode`                                      |
+| `options.permissionMode`    | → SecurityPlugin config                                          |
+| `signal`                    | → wired to `invocationContext.endInvocation`                     |
+
+### HITL: How pauseOnToolCalls works end-to-end
+
+This is the critical path. Here's the full flow:
+
+```
+1. LLM returns tool call (FunctionCall in Event)
+2. ADK checks RunConfig.pauseOnToolCalls === true
+3. ADK sets invocationContext.endInvocation = true
+4. ADK yields the Event (with FunctionCall) and stops
+5. Runner.runAsync() generator completes
+
+   --- OUR INTERFACE BOUNDARY ---
+
+6. Adapter translates ADK Event → ToolRequestEvent
+7. Host receives ToolRequestEvent from session.stream() generator
+8. Host runs policy check (PolicyEvaluator.evaluate())
+9. Host fires hooks (LifecycleInterceptor.fire('before_tool', ...))
+10. If policy allows → Host executes tool → gets ToolResultData
+11. Host calls session.stream({ kind: 'tool_result', ... }) to get next stream
+
+   --- BACK INTO ADK ---
+
+12. Adapter receives tool result
+13. Adapter creates FunctionResponse Content
+14. Adapter calls Runner.runAsync() again with FunctionResponse as newMessage
+15. ADK loads session (has prior tool call event)
+16. ADK resumes agent with tool response
+17. Loop continues from step 1
+```
+
+**Why this works:** ADK's `pauseOnToolCalls` was designed exactly for this
+pattern — external tool execution by a host. The adapter translates between
+ADK's "end invocation + resume with FunctionResponse" pattern and our
+"ToolRequestEvent + send(tool_result)" pattern.
+
+**Key insight:** Each `session.stream()` call triggers a new `Runner.runAsync()`
+call. This means each ADK "invocation" maps to one `stream()` call. The session
+persists state across invocations. Mid-stream `update()` and `steer()` calls are
+queued for the next invocation since ADK doesn't support mid-turn changes.
+
+### HITL: ToolConfirmation flow
+
+ADK also has a separate ToolConfirmation pattern (via
+`context.requestConfirmation()`):
+
+```
+1. beforeToolCallback calls context.requestConfirmation({ hint: '...' })
+2. This sets eventActions.requestedToolConfirmations[functionCallId]
+3. ADK yields event with requestedToolConfirmations populated
+4. Runner completes (invocation ends)
+
+   --- OUR INTERFACE BOUNDARY ---
+
+5. Adapter sees requestedToolConfirmations in event
+6. Adapter translates → ElicitationRequest { kind: 'tool_confirmation', ... }
+7. Host renders confirmation UI
+8. User responds → ElicitationResponse { action: 'accept' | 'decline' }
+
+   --- BACK INTO ADK ---
+
+9. Adapter receives elicitation response
+10. If accepted: Adapter creates FunctionResponse with confirmed=true
+11. Calls Runner.runAsync() with FunctionResponse
+12. ADK's SecurityPlugin or callback reads confirmation from session
+13. Tool executes
+```
+
+**Maps to our ElicitationRequest:** ADK's `ToolConfirmation.hint` →
+`ElicitationRequest.message`. ADK's `ToolConfirmation.payload` →
+`ElicitationRequest.context`. The `kind: 'tool_confirmation'` is the
+discriminator.
+
+### HITL: Auth request flow
+
+```
+1. Tool or callback calls context.requestCredential(authConfig)
+2. Sets eventActions.requestedAuthConfigs[functionCallId]
+3. Event yields, invocation ends
+
+   --- OUR INTERFACE BOUNDARY ---
+
+4. Adapter sees requestedAuthConfigs
+5. Translates → ElicitationRequest { kind: 'auth_required', context: authConfig }
+6. User provides credentials
+7. ElicitationResponse { action: 'accept', content: { credential: ... } }
+
+   --- BACK INTO ADK ---
+
+8. Adapter stores credential via CredentialService
+9. Calls Runner.runAsync() again
+10. Tool calls context.getAuthResponse() → gets credential
+```
+
+**Maps to our ElicitationRequest:** ADK's auth pattern is just another
+elicitation kind. This validates our generic elicitation design — it handles
+tool confirmation, auth, and any future interaction type.
+
+---
+
+## 3. AgentEvent ↔ ADK Event
+
+### Event type mapping
+
+| Our AgentEvent        | ADK Event pattern                                                                 | Adapter translation                           |
+| --------------------- | --------------------------------------------------------------------------------- | --------------------------------------------- |
+| `InitializeEvent`     | First event from Runner.runAsync()                                                | Adapter emits on first stream() call          |
+| `SessionUpdateEvent`  | `eventActions.stateDelta`                                                         | Adapter emits when stateDelta is non-empty    |
+| `MessageEvent`        | `event.content` with text Parts                                                   | Filter text/thought parts from Content        |
+| `ToolRequestEvent`    | `getFunctionCalls(event)` returns FunctionCall[]                                  | Each FunctionCall → one ToolRequestEvent      |
+| `ToolUpdateEvent`     | `event.longRunningToolIds`                                                        | Adapter emits progress for long-running tools |
+| `ToolResponseEvent`   | `getFunctionResponses(event)` returns FunctionResponse[]                          | Each FunctionResponse → one ToolResponseEvent |
+| `ElicitationRequest`  | `eventActions.requestedToolConfirmations` or `requestedAuthConfigs`               | Map to generic elicitation                    |
+| `ElicitationResponse` | User input → FunctionResponse in next runAsync call                               | Reverse of above                              |
+| `UsageEvent`          | `event.usageMetadata` (GenerateContentResponseUsageMetadata)                      | Map token counts                              |
+| `ErrorEvent`          | `event.errorCode` + `event.errorMessage`                                          | Map error fields                              |
+| `stream_end`          | `isFinalResponse(event)`, `eventActions.transferToAgent`, `eventActions.escalate` | Derive `stream_end` reason from ADK signals   |
+| `CustomEvent`         | `event.customMetadata`                                                            | Pass through                                  |
+
+### ADK EventActions → Our events
+
+| EventActions field           | Our event                                                                 | Notes                                                                                                        |
+| ---------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
+| `stateDelta`                 | SessionUpdate or embedded in other events                                 | Delta state is a core ADK pattern                                                                            |
+| `artifactDelta`              | `CustomEvent { kind: 'artifact_delta' }`                                  | Artifacts not in our core events                                                                             |
+| `transferToAgent`            | Tool call (`transfer_to_agent`) + `stream_end` `reason: 'completed'`      | Handoff is a tool call. Host intercepts the tool request, mediates the handoff, originating agent completes. |
+| `escalate`                   | `stream_end` `reason: 'completed'` with `data: { escalateReason: '...' }` | LoopAgent exit signal. ADK's escalate = "I'm done, pass control back up"                                     |
+| `requestedToolConfirmations` | `ElicitationRequest { kind: 'tool_confirmation' }`                        | Per function call ID                                                                                         |
+| `requestedAuthConfigs`       | `ElicitationRequest { kind: 'auth_required' }`                            | Per function call ID                                                                                         |
+| `skipSummarization`          | `_meta: { skipSummarization: true }`                                      | ADK-specific, goes in metadata                                                                               |
+
+### AgentEventBase mapping
+
+| AgentEventBase field | ADK Event field                          | Notes                                             |
+| -------------------- | ---------------------------------------- | ------------------------------------------------- |
+| `id`                 | `event.id`                               | Direct                                            |
+| `timestamp`          | `event.timestamp` (number)               | Convert to ISO 8601 string                        |
+| `type`               | Derived from content analysis            | ADK doesn't have event types — adapter classifies |
+| `agentId`            | `event.author` (agent name) or context   | **New field** — which agent emitted this event    |
+| `threadId`           | `event.branch` (e.g., "agent_1.agent_2") | Direct mapping                                    |
+| `source`             | `event.author` ("user" or agent name)    | Direct                                            |
+| `_meta`              | `event.customMetadata`                   | Direct                                            |
+
+### Verdict: CLEAN MAPPING
+
+Every ADK event pattern maps to our event types. The adapter classifies ADK's
+untyped events into our typed event taxonomy. Key insight: ADK events are richer
+(they carry EventActions, function calls, auth requests all in one event), so
+the adapter may fan out one ADK Event into multiple AgentEvents (e.g., one
+Message + one ToolRequest + one ElicitationRequest). The new `agentId` field
+maps directly from ADK's `event.author`.
+
+---
+
+## 4. ToolContract ↔ ADK Tool System
+
+### ToolDescriptor ↔ BaseTool
+
+| ToolDescriptor field      | ADK source                                                    | Notes                             |
+| ------------------------- | ------------------------------------------------------------- | --------------------------------- |
+| `name`                    | `BaseTool.name`                                               | Direct                            |
+| `displayName`             | —                                                             | ADK doesn't have this             |
+| `description`             | `BaseTool.description`                                        | Direct                            |
+| `parametersSchema`        | `BaseTool._getDeclaration()` → FunctionDeclaration.parameters | JSON Schema from declaration      |
+| `annotations.readOnly`    | Inferred from tool type                                       | FunctionTool with no side effects |
+| `annotations.longRunning` | `BaseTool.isLongRunning`                                      | Direct                            |
+
+### ToolCallRequest ↔ FunctionCall
+
+| ToolCallRequest | ADK FunctionCall    | Notes  |
+| --------------- | ------------------- | ------ |
+| `requestId`     | `functionCall.id`   | Direct |
+| `name`          | `functionCall.name` | Direct |
+| `args`          | `functionCall.args` | Direct |
+
+### ToolResultData ↔ FunctionResponse + tool return
+
+| ToolResultData   | ADK                            | Notes                                            |
+| ---------------- | ------------------------------ | ------------------------------------------------ |
+| `llmContent`     | `FunctionResponse.response`    | Adapter wraps into ContentPart[]                 |
+| `displayContent` | —                              | ADK doesn't separate display from model content  |
+| `isError`        | Error thrown from `runAsync()` | Adapter catches and sets flag                    |
+| `tailCalls`      | —                              | ADK doesn't have tail calls (gemini-cli concept) |
+
+### AgentTool pattern
+
+ADK's `AgentTool` wraps a `BaseAgent` as a `BaseTool`:
+
+- Uses `agent.inputSchema` for tool parameters
+- Uses `agent.description` for tool description
+- Creates internal Runner with isolated session
+- Returns agent output as tool result
+- Merges state deltas back to parent
+
+**Our equivalent:** `SubagentTool` wraps `AgentDescriptor` as a tool:
+
+- Uses `descriptor.inputSchema` for tool parameters
+- Uses `descriptor.description` for tool description
+- Creates executor via `SessionFactory.create(descriptor, context)`
+- Returns execution result as tool result
+
+**Mapping is 1:1.** The only difference is ADK does it with concrete agent
+instances; we do it with descriptors + factory.
+
+---
+
+## 5. LifecycleInterceptor ↔ ADK Plugin System
+
+### Hook point mapping
+
+| Our hook point string | ADK Plugin callback     | Mapping                                    |
+| --------------------- | ----------------------- | ------------------------------------------ |
+| `'before_agent'`      | `beforeAgentCallback`   | `payload: { agent, context }`              |
+| `'after_agent'`       | `afterAgentCallback`    | `payload: { agent, context }`              |
+| `'before_model'`      | `beforeModelCallback`   | `payload: { context, llmRequest }`         |
+| `'after_model'`       | `afterModelCallback`    | `payload: { context, llmResponse }`        |
+| `'before_tool'`       | `beforeToolCallback`    | `payload: { tool, args, context }`         |
+| `'after_tool'`        | `afterToolCallback`     | `payload: { tool, args, context, result }` |
+| `'on_event'`          | `onEventCallback`       | `payload: { event }`                       |
+| `'on_user_message'`   | `onUserMessageCallback` | `payload: { userMessage }`                 |
+| `'before_run'`        | `beforeRunCallback`     | `payload: { context }`                     |
+| `'after_run'`         | `afterRunCallback`      | `payload: { context }`                     |
+| `'on_model_error'`    | `onModelErrorCallback`  | `payload: { request, error }`              |
+| `'on_tool_error'`     | `onToolErrorCallback`   | `payload: { tool, args, error }`           |
+
+### HookResult ↔ ADK callback return
+
+| HookResult field    | ADK pattern                                     | Notes                               |
+| ------------------- | ----------------------------------------------- | ----------------------------------- |
+| `action: 'proceed'` | Return `undefined`                              | Plugin returns nothing → continue   |
+| `action: 'block'`   | Return `Content` (for agent/model) or throw     | Non-undefined return short-circuits |
+| `modifications`     | Return modified `LlmRequest`/`LlmResponse`/args | Plugin returns modified version     |
+
+### ADK's early-exit pattern
+
+ADK plugins use "first non-undefined return wins":
+
+- `beforeModelCallback` returns `LlmResponse` → skips LLM call entirely (cache
+  hit)
+- `beforeToolCallback` returns modified `args` → tool runs with new args
+- `beforeAgentCallback` returns `Content` → skips agent run entirely
+
+Our `HookResult.modifications` carries the same data. The `action: 'block'` +
+return value pattern maps cleanly.
+
+### gemini-cli hooks NOT in ADK
+
+| gemini-cli hook       | ADK equivalent                       | Notes                                                         |
+| --------------------- | ------------------------------------ | ------------------------------------------------------------- |
+| `BeforeToolSelection` | —                                    | ADK doesn't let you modify which tools are available mid-turn |
+| `Notification`        | —                                    | ADK doesn't have notification hooks                           |
+| `SessionStart`        | `onUserMessageCallback` (first call) | Close enough                                                  |
+| `SessionEnd`          | `afterRunCallback`                   | Close enough                                                  |
+| `PreCompress`         | —                                    | ADK doesn't have context compression hooks                    |
+
+These gaps are fine — they're gemini-cli-specific hook points. Our generic
+`fire(hookPoint, payload)` handles them because the hook point is an open
+string. ADK executors simply don't fire these hook points, and
+`supportedHookPoints()` reflects that.
+
+---
+
+## 6. PolicyEvaluator ↔ ADK SecurityPlugin
+
+### ADK SecurityPlugin
+
+```typescript
+class SecurityPlugin extends BasePlugin {
+  policyEngine: BasePolicyEngine;
+
+  // In beforeToolCallback:
+  async beforeToolCallback({ tool, args, context }) {
+    const outcome = await this.policyEngine.evaluate(tool.name, args);
+    switch (outcome) {
+      case PolicyOutcome.DENY:
+        throw error;
+      case PolicyOutcome.CONFIRM:
+        context.requestConfirmation({ hint });
+      case PolicyOutcome.ALLOW:
+        return undefined; // proceed
+    }
+  }
+}
+```
+
+### Mapping
+
+| Our PolicyEvaluator       | ADK SecurityPlugin                                        | Notes                                      |
+| ------------------------- | --------------------------------------------------------- | ------------------------------------------ |
+| `evaluate(request)`       | `policyEngine.evaluate(toolName, args)`                   | ADK is simpler — tool name + args only     |
+| `PolicyDecision.allow`    | `PolicyOutcome.ALLOW`                                     | Direct                                     |
+| `PolicyDecision.deny`     | `PolicyOutcome.DENY`                                      | Direct                                     |
+| `PolicyDecision.ask_user` | `PolicyOutcome.CONFIRM` → `context.requestConfirmation()` | ADK chains to ToolConfirmation             |
+| `getExcluded()`           | —                                                         | ADK doesn't pre-filter tools               |
+| `request.principal`       | —                                                         | ADK doesn't track who's calling            |
+| `request.principalPath`   | Could use `context.agentName` + branch                    | For hierarchical policy                    |
+| `request.context`         | —                                                         | Our extension point for host-specific data |
+
+### How ADK policy maps when host controls execution
+
+With `pauseOnToolCalls: true`, the flow is:
+
+1. ADK yields tool call → adapter converts to ToolRequestEvent
+2. **Host** runs PolicyEvaluator.evaluate() — NOT ADK's SecurityPlugin
+3. Host decides allow/deny/ask_user
+4. If allowed, host executes tool and sends result via `session.stream()`
+
+This means **ADK's SecurityPlugin is bypassed when the host controls tool
+execution** — which is correct! The host's PolicyEvaluator is the authority.
+ADK's SecurityPlugin only matters when ADK executes tools internally
+(`pauseOnToolCalls: false`).
+
+---
+
+## 7. SessionContract ↔ ADK Session
+
+### Session mapping
+
+| Our SessionHandle | ADK Session                              | Notes                                     |
+| ----------------- | ---------------------------------------- | ----------------------------------------- |
+| `id`              | `Session.id`                             | Direct                                    |
+| `agentName`       | `Session.appName`                        | ADK uses appName, not agent name          |
+| `events`          | `Session.events: Event[]`                | Direct (but ADK Events → our AgentEvents) |
+| `state`           | `Session.state: Record<string, unknown>` | Direct                                    |
+| `lastUpdateTime`  | `Session.lastUpdateTime`                 | Direct                                    |
+
+### SessionProvider ↔ BaseSessionService
+
+| Our SessionProvider           | ADK BaseSessionService                          | Notes                      |
+| ----------------------------- | ----------------------------------------------- | -------------------------- |
+| `create(agentName, metadata)` | `createSession({ appName, userId })`            | ADK requires userId        |
+| `load(sessionId)`             | `getSession({ appName, userId, sessionId })`    | ADK requires all three IDs |
+| `list(agentName)`             | `listSessions({ appName, userId })`             | ADK scopes by userId       |
+| `delete(sessionId)`           | `deleteSession({ appName, userId, sessionId })` | Same pattern               |
+
+### Gap: ADK requires userId
+
+ADK sessions are scoped by `(appName, userId, sessionId)`. Our interface uses
+just `sessionId`. The adapter can embed userId in the session metadata or derive
+it from HostContext.
+
+### State prefixes (ADK-specific)
+
+ADK uses prefixed state keys:
+
+- `app:` — app-scoped, persisted
+- `user:` — user-scoped, persisted
+- `temp:` — temporary, stripped before persistence
+
+Our `SessionHandle.state` is a flat `Record<string, unknown>`. The adapter
+preserves prefixes as-is — they're just string keys. No conflict.
+
+---
+
+## 8. ContentPart ↔ ADK Content/Part
+
+### ADK uses Google GenAI types
+
+ADK's `Content` and `Part` come from `@google/genai`:
+
+```typescript
+interface Content {
+  role?: string;  // 'user' | 'model'
+  parts: Part[];
+}
+
+type Part = TextPart | InlineDataPart | FunctionCallPart | FunctionResponsePart | ...
+```
+
+### Mapping
+
+| Our ContentPart                                     | ADK/GenAI Part                                 | Notes                                                  |
+| --------------------------------------------------- | ---------------------------------------------- | ------------------------------------------------------ |
+| `{ type: 'text', text }`                            | `{ text: string }`                             | Direct                                                 |
+| `{ type: 'thought', thought }`                      | `{ thought: true, text: string }`              | ADK uses `thought` boolean flag on TextPart            |
+| `{ type: 'media', mimeType, data }`                 | `{ inlineData: { mimeType, data } }`           | Restructure                                            |
+| `{ type: 'reference', text, uri }`                  | `{ fileData: { fileUri, mimeType } }`          | Map fileData → reference                               |
+| `{ type: 'refusal', text }`                         | —                                              | Not in ADK/GenAI. Adapter would map from finishReason. |
+| `{ type: 'function_call', name, args, id }`         | `{ functionCall: { name, args, id } }`         | Unwrap                                                 |
+| `{ type: 'function_response', name, response, id }` | `{ functionResponse: { name, response, id } }` | Unwrap                                                 |
+
+### Verdict: CLEAN MAPPING
+
+The adapter converts between our flat discriminated union and ADK's nested Part
+structure. No information loss in either direction.
+
+---
+
+## 9. Composition ↔ ADK Agent Patterns
+
+| Our CompositionConfig.pattern | ADK Agent type                         | Notes                                            |
+| ----------------------------- | -------------------------------------- | ------------------------------------------------ |
+| `'hierarchical'`              | Any agent with `subAgents`             | Default — parent calls sub-agents as tools       |
+| `'sequential'`                | `SequentialAgent`                      | Runs children in order                           |
+| `'parallel'`                  | `ParallelAgent`                        | Runs children concurrently, branch isolation     |
+| `'loop'`                      | `LoopAgent`                            | Repeats children until escalate or maxIterations |
+| `'transfer'`                  | LlmAgent with `transfer_to_agent` tool | Peer-to-peer handoff                             |
+
+### Branch isolation
+
+ADK's `ParallelAgent` gives each child an isolated `branch` context:
+
+- Children don't see peer events
+- Each gets unique branch path: `"parent.child_0"`, `"parent.child_1"`
+- Results merged after all complete
+
+Maps to our `threadId` — each parallel branch gets a unique threadId. Events
+from different branches are interleaved by the host.
+
+---
+
+## 10. Summary: Gaps and Resolutions
+
+### No gaps blocking ADK integration:
+
+| Concern                 | Status    | Resolution                                                                |
+| ----------------------- | --------- | ------------------------------------------------------------------------- |
+| pauseOnToolCalls HITL   | **Works** | Adapter maps to stream() cycle (§2)                                       |
+| ToolConfirmation        | **Works** | Maps to ElicitationRequest (§2)                                           |
+| Auth requests           | **Works** | Maps to ElicitationRequest (§2)                                           |
+| Plugin hooks (12 types) | **Works** | Maps to LifecycleInterceptor.fire() (§5)                                  |
+| Agent transfers         | **Works** | Tool call (`transfer_to_agent`) + `stream_end` `reason: 'completed'` (§3) |
+| State delta pattern     | **Works** | SessionUpdateEvent or \_meta (§3)                                         |
+| Branch isolation        | **Works** | threadId mapping (§9)                                                     |
+| AgentTool pattern       | **Works** | SubagentTool with descriptor + factory (§4)                               |
+| Session management      | **Works** | Adapter maps userId into session (§7)                                     |
+
+### Minor adapter complexity:
+
+1. **Event fan-out:** One ADK Event may become multiple AgentEvents (message +
+   tool call + elicitation). Adapter logic needed but straightforward.
+2. **userId scoping:** ADK sessions require userId; our interface doesn't.
+   Adapter derives from HostContext.
+3. **Timestamp format:** ADK uses `number` (epoch ms); we use ISO 8601 string.
+   Simple conversion.
+4. **Content structure:** ADK uses nested Part types; we use flat discriminated
+   union. Adapter converts bidirectionally.
+
+### ADK features our interface supports that gemini-cli doesn't have yet:
+
+- `LoopAgent` / `ParallelAgent` / `SequentialAgent` composition → our
+  CompositionConfig
+- `eventActions.stateDelta` → our SessionUpdateEvent
+- `eventActions.transferToAgent` → tool call (`transfer_to_agent`) +
+  `stream_end` `reason: 'completed'`
+- `eventActions.escalate` → `stream_end` `reason: 'completed'` with
+  `data: { escalateReason }`
+- Long-running tools → our ToolUpdateEvent
+- Auth credential flow → our ElicitationRequest with kind: 'auth_required'

docs/adk-replat/NOTES-adk-ts-architecture.md

@@ -0,0 +1,274 @@
+# ADK-TS (Agent Development Kit - TypeScript) Architecture Notes
+
+## Package: `@google/adk` v0.4.0
+
+**Location:** `/Users/adamfweidman/Desktop/adk-int/adk-js/core/`
+
+## Agent Hierarchy
+
+```
+BaseAgent (abstract)
+├── LlmAgent         - Model-driven agent with tools (the main one)
+├── LoopAgent         - Runs sub-agents in a loop (maxIterations, escalate to exit)
+├── ParallelAgent     - Runs sub-agents concurrently (isolated branches)
+└── SequentialAgent   - Runs sub-agents sequentially
+```
+
+### BaseAgent Config
+
+- `name: string` - Unique identifier (must be valid JS identifier)
+- `description?: string` - One-line capability for model routing
+- `parentAgent?: BaseAgent` - Parent in agent tree
+- `subAgents?: BaseAgent[]` - Child agents
+- `beforeAgentCallback / afterAgentCallback` - Pre/post execution hooks
+
+### LlmAgent Config (extends BaseAgent)
+
+- `model?: string | BaseLlm` - LLM to use
+- `instruction?: string | InstructionProvider` - Agent-specific instructions
+- `globalInstruction?: string | InstructionProvider` - Tree-wide (root only)
+- `tools?: ToolUnion[]` - Available tools
+- `generateContentConfig?: GenerateContentConfig` - LLM params
+- `disallowTransferToParent / disallowTransferToPeers` - Transfer controls
+- `includeContents?: 'default' | 'none'` - Context history inclusion
+- `inputSchema / outputSchema` - Validation schemas
+- `outputKey?: string` - Session state key for output storage
+- `beforeModelCallback / afterModelCallback` - LLM hooks
+- `beforeToolCallback / afterToolCallback` - Tool hooks
+- `requestProcessors / responseProcessors` - LLM request/response processors
+- `codeExecutor?: BaseCodeExecutor`
+
+## Event System
+
+### Event Interface
+
+```typescript
+interface Event extends LlmResponse {
+  id: string;
+  invocationId: string;
+  author?: string; // "user" or agent name
+  actions: EventActions; // State/artifact/auth/transfer operations
+  longRunningToolIds?: string[];
+  branch?: string; // Hierarchical agent path
+  timestamp: number;
+  content?: Content;
+  partial?: boolean; // Streaming indicator
+}
+```
+
+### EventActions
+
+```typescript
+interface EventActions {
+  skipSummarization?: boolean;
+  stateDelta: Record<string, unknown>;
+  artifactDelta: Record<string, number>;
+  transferToAgent?: string;
+  escalate?: boolean;
+  requestedAuthConfigs: Record<string, AuthConfig>;
+  requestedToolConfirmations: Record<string, ToolConfirmation>;
+}
+```
+
+### Structured Events (utility layer)
+
+Converts raw Event to discriminated union:
+
+```
+EventType: THOUGHT | CONTENT | TOOL_CALL | TOOL_RESULT | CALL_CODE |
+           CODE_RESULT | ERROR | ACTIVITY | TOOL_CONFIRMATION | FINISHED
+```
+
+## Tool System
+
+### BaseTool (abstract)
+
+- `name, description, isLongRunning`
+- `_getDeclaration(): FunctionDeclaration` - OpenAPI schema for LLM
+- `runAsync(request): Promise<unknown>` - Execute tool
+- `processLlmRequest(request): Promise<void>` - Preprocessing
+
+### Concrete Tool Types
+
+1. **FunctionTool** - Generic typed tools (Zod schema support)
+2. **AgentTool** - Wrap agents as tools (for hierarchical composition)
+3. **MCPTool** - Model Context Protocol server tools
+4. **GoogleSearchTool** - Built-in web search
+5. **ExitLoopTool** - Signal loop exit
+6. **LongRunningFunctionTool** - Async long-running operations
+
+### BaseToolset
+
+- Filter tools by predicate or string list
+- `getTools(context)`, `close()`, `isToolSelected()`
+- **MCPToolset** - Toolset for MCP server connections
+
+## Session Management
+
+### Session Interface
+
+```typescript
+interface Session {
+  id: string;
+  appName: string;
+  userId: string;
+  state: Record<string, unknown>; // Mutable key-value store
+  events: Event[]; // Complete conversation history
+  lastUpdateTime: number;
+}
+```
+
+### Session Services
+
+- `BaseSessionService` (abstract) - createSession, getSession, listSessions,
+  deleteSession, appendEvent
+- `InMemorySessionService` - In-process storage
+- `DatabaseSessionService` - Mikro-ORM backed (SQL)
+
+### State Management
+
+- `State` class wraps base state + delta
+- `get()` returns from delta if present, else base
+- `set()` updates delta only
+- `hasDelta()` checks if changes made
+
+## Human-in-the-Loop (HITL)
+
+### Tool Confirmation
+
+```typescript
+class ToolConfirmation {
+  hint?: string; // Guidance for user
+  confirmed: boolean; // User approval
+  payload?: unknown; // Additional context
+}
+```
+
+### Security Plugin
+
+- `beforeToolCallback` - Evaluates policy before tool execution
+- `BasePolicyEngine` interface with `evaluate()` method
+- `PolicyOutcome`: DENY | CONFIRM | ALLOW
+
+### Auth Requests
+
+- `context.requestCredential(authConfig)` - Request auth from user
+- `context.getAuthResponse(authConfig)` - Check for auth response
+- Sets `eventActions.requestedAuthConfigs[functionCallId]`
+
+## Multi-Agent Patterns
+
+### Agent Transfer
+
+- LlmAgent injects `transfer_to_agent(agentName)` tool
+- Sets `eventActions.transferToAgent = targetAgentName`
+- Runner resolves target and continues
+- Can transfer to: sub-agents, parent (if not disabled), peers (if not disabled)
+
+### Parallel Agent
+
+- Runs all subAgents concurrently
+- Isolates each via `branch` context
+- Sub-agents don't see peer history
+- Merges event streams with fair ordering
+
+### Loop Agent
+
+- Repeatedly runs subAgents
+- `maxIterations` caps loop count
+- Exits on `event.actions.escalate === true`
+
+## Plugin System
+
+### BasePlugin Lifecycle Hooks (14 hooks!)
+
+- `onUserMessageCallback` - Preprocess user messages
+- `beforeRunCallback` - Before agent run (can short-circuit)
+- `onEventCallback` - Per-event (can modify events)
+- `afterRunCallback` - Final cleanup
+- `beforeAgentCallback / afterAgentCallback` - Agent lifecycle
+- `beforeModelCallback / afterModelCallback` - LLM lifecycle
+- `onModelErrorCallback` - Model error handling
+- `beforeToolCallback / afterToolCallback` - Tool lifecycle
+- `onToolErrorCallback` - Tool error handling
+
+### Built-in Plugins
+
+- **LoggingPlugin** - Debug logging
+- **SecurityPlugin** - Policy enforcement + tool confirmation
+- **PluginManager** - Plugin orchestration
+
+## Runner
+
+### Runner Config
+
+```typescript
+interface RunnerConfig {
+  appName: string;
+  agent: BaseAgent; // Root agent
+  plugins?: BasePlugin[];
+  artifactService?: BaseArtifactService;
+  sessionService: BaseSessionService; // Required
+  memoryService?: BaseMemoryService;
+  credentialService?: BaseCredentialService;
+}
+```
+
+### RunConfig (per-run options)
+
+```typescript
+interface RunConfig {
+  speechConfig?: SpeechConfig;
+  responseModalities?: Modality[];
+  maxLlmCalls?: number; // Default 500
+  pauseOnToolCalls?: boolean; // Client-side tool execution
+  streamingMode?: StreamingMode; // NONE | SSE | BIDI
+  // ... audio/live configs
+}
+```
+
+### Execution Pipeline
+
+1. Load or create session
+2. Create InvocationContext
+3. Run pluginManager.runOnUserMessageCallback()
+4. Append user message to session
+5. Run agent.runAsync(invocationContext) → yields events
+6. For each non-partial event: append to session
+7. Run pluginManager.runOnEventCallback()
+8. Run pluginManager.runAfterRunCallback()
+
+## Model Layer
+
+### BaseLlm (abstract)
+
+- `generateContentAsync(llmRequest, stream?): AsyncGenerator<LlmResponse>`
+- `connect(llmRequest): Promise<BaseLlmConnection>` - For live/streaming
+
+### Implementations
+
+- `Gemini` - Google Gemini API
+- `ApigeeLlm` - Apigee-wrapped models
+- `LLMRegistry` - Static registry for model lookup
+
+## Service Adapters (all abstract base + implementations)
+
+| Service               | Implementations                |
+| --------------------- | ------------------------------ |
+| BaseSessionService    | InMemory, Database (Mikro-ORM) |
+| BaseArtifactService   | InMemory, File, GCS            |
+| BaseMemoryService     | InMemory                       |
+| BaseCredentialService | InMemory                       |
+| BaseCodeExecutor      | BuiltIn                        |
+
+## Design Patterns
+
+1. **Symbol-based type guards** - Every class uses `Symbol.for()` + `isXxx()`
+2. **Abstract base classes** - Service interfaces via abstract classes
+3. **Async generators** - All agent execution yields events
+4. **Context objects** - Rich context passed to callbacks/tools
+5. **Delta state** - Session state + event action deltas
+6. **Plugin middleware** - 14 hooks at multiple execution points
+7. **Tree-based hierarchy** - Parent-child agents with root traversal
+8. **Branch isolation** - Parallel agents use branch paths
+9. **Callback chains** - Multiple callbacks per stage with early termination

docs/adk-replat/NOTES-cross-sdk-comparison.md

@@ -0,0 +1,587 @@
+# Cross-SDK Comparison: Events, Agents, and Interface Superset
+
+## 1. AgentEvents: Our Outline vs Michael's
+
+Our outline and Michael's `Gemini CLI Agents.txt` are **nearly identical** in
+event taxonomy. The only difference is we added a `stream_end` event type:
+
+| #   | Michael's Events       | Our Outline           | Delta                                                                           |
+| --- | ---------------------- | --------------------- | ------------------------------------------------------------------------------- |
+| 1   | `initialize`           | `InitializeEvent`     | Same                                                                            |
+| 2   | `session_update`       | `SessionUpdateEvent`  | Same                                                                            |
+| 3   | `message`              | `MessageEvent`        | Same — streaming handled by AsyncGenerator                                      |
+| 4   | `tool_request`         | `ToolRequestEvent`    | Same                                                                            |
+| 5   | `tool_update`          | `ToolUpdateEvent`     | Same                                                                            |
+| 6   | `tool_response`        | `ToolResponseEvent`   | Same                                                                            |
+| 7   | `elicitation_request`  | `ElicitationRequest`  | Same                                                                            |
+| 8   | `elicitation_response` | `ElicitationResponse` | Same                                                                            |
+| 9   | `usage`                | `UsageEvent`          | Same                                                                            |
+| 10  | `error`                | `ErrorEvent`          | Same                                                                            |
+| 11  | `custom`               | `CustomEvent`         | Same                                                                            |
+| 12  | —                      | **StreamEnd**         | **Added**: completed, failed, aborted, max_turns, max_budget, max_time, refusal |
+
+### Minor structural differences:
+
+| Aspect                 | Michael                                             | Our Outline                                                               |
+| ---------------------- | --------------------------------------------------- | ------------------------------------------------------------------------- |
+| **Base type**          | `AgentEventCommon` with `type: string` (fully open) | `AgentEventBase` with `type: AgentEventType` (`'known' \| (string & {})`) |
+| **Agent ID**           | —                                                   | `agentId` on event base (which agent emitted this event)                  |
+| **Event map**          | Generic `interface AgentEvents` + mapped type       | Same — adopted Michael's pattern for declaration merging extensibility    |
+| **ContentPart.\_meta** | Required (`_meta: Record<string, unknown>`)         | Optional (`_meta?: Record<string, unknown>`)                              |
+| **ErrorData.status**   | Google RPC codes (`'RESOURCE_EXHAUSTED' \| '...'`)  | Open string (per our generic philosophy)                                  |
+| **Message.role**       | `'user' \| 'agent' \| 'developer'`                  | Same                                                                      |
+| **Stream end**         | Only `initialize`                                   | `stream_end` with `reason` field + open `data` bag                        |
+| **Handoff**            | Not covered                                         | Tool call (`transfer_to_agent`) — no dedicated event                      |
+| **Pausing**            | Implicit (elicitation/tool events)                  | Same — no explicit pause/resume events                                    |
+
+### Design decisions adopted from Michael
+
+1. **`interface AgentEvents` + mapped type** — Michael's pattern enables
+   declaration merging, letting any module add new event types without modifying
+   the base definition. Strictly better than an explicit union type.
+2. **`_meta` on ContentPart** — More extensible. We adopted it (as optional).
+3. **Implicit pausing** — No separate pause/resume events. When the agent emits
+   an `elicitation_request` or `tool_request`, the stream naturally pauses. The
+   host calls `stream()` to resume.
+
+---
+
+## 2. Claude Agent SDK — Key Interfaces
+
+Source: `@anthropic-ai/claude-agent-sdk`
+
+### Agent Execution Model
+
+```typescript
+// Entry point — not an interface, a function
+function query({
+  prompt: string | AsyncIterable<SDKUserMessage>,
+  options?: Options
+}): Query  // extends AsyncGenerator<SDKMessage, void>
+```
+
+### Message Types (Event Stream)
+
+```typescript
+type SDKMessage =
+  | SystemMessage // subtype: "init" | "compact_boundary"
+  | AssistantMessage // Claude's response with tool calls
+  | UserMessage // Tool results fed back
+  | StreamEvent // Raw API stream events (opt-in)
+  | ResultMessage // Final: success | error_max_turns | error_max_budget_usd | error_during_execution
+  | CompactBoundaryMessage; // Context compaction marker
+```
+
+### Tool Approval (HITL)
+
+```typescript
+canUseTool: async (toolName: string, input: Record<string, any>) =>
+  Promise<
+    | { behavior: 'allow'; updatedInput: Record<string, any> }
+    | { behavior: 'deny'; message: string }
+  >;
+```
+
+### Subagent Definition
+
+```typescript
+interface AgentDefinition {
+  description: string; // When to invoke
+  prompt: string; // System prompt
+  tools?: string[]; // Available tools (defaults to all)
+  model?: 'sonnet' | 'opus' | 'haiku' | 'inherit';
+}
+```
+
+### Session Management
+
+```typescript
+interface Options {
+  continue?: boolean;         // Resume most recent session
+  resume?: string;            // Resume by session ID
+  forkSession?: boolean;      // Branch from resume point
+  persistSession?: boolean;   // Default: true
+  maxTurns?: number;
+  maxBudgetUsd?: number;      // Spend limit
+  permissionMode?: 'default' | 'acceptEdits' | 'plan' | 'dontAsk' | 'bypassPermissions';
+  structuredOutput?: { type: "json_schema", ... };
+}
+```
+
+### Result (Termination)
+
+```typescript
+interface SDKResultMessage {
+  type: 'result';
+  subtype:
+    | 'success'
+    | 'error_max_turns'
+    | 'error_max_budget_usd'
+    | 'error_during_execution'
+    | 'error_max_structured_output_retries';
+  result?: string;
+  total_cost_usd: number;
+  usage: { input_tokens: number; output_tokens: number };
+  num_turns: number;
+  session_id: string;
+  stop_reason: string | null; // "end_turn", "max_tokens", "refusal"
+}
+```
+
+### V2 Preview (Simpler API)
+
+```typescript
+await using session = unstable_v2_createSession({ model: "..." });
+await session.send("Hello!");
+for await (const msg of session.stream()) { ... }
+await session.send("Follow-up");
+for await (const msg of session.stream()) { ... }
+```
+
+---
+
+## 3. OpenAI Codex SDK / Responses API — Key Interfaces
+
+### Codex SDK (TypeScript)
+
+```typescript
+// Client
+const codex = new Codex({ env?, config? });
+const thread = codex.startThread({ workingDirectory?, skipGitRepoCheck? });
+const thread = codex.resumeThread(threadId);
+
+// Execution
+const turn = await thread.run(prompt: string | InputEntry[], options?);
+const { events } = await thread.runStreamed(prompt);
+
+// Streaming
+for await (const event of events) {
+  switch (event.type) {
+    case "item.completed": // event.item
+    case "turn.completed": // event.usage
+  }
+}
+```
+
+### Responses API Streaming Events (53 types)
+
+Organized hierarchically:
+
+**Response Lifecycle (7):**
+
+- `response.queued`, `response.created`, `response.in_progress`
+- `response.completed`, `response.incomplete`, `response.failed`
+- `error`
+
+**Content Streaming (8):**
+
+- `response.output_item.added`, `response.output_item.done`
+- `response.content_part.added`, `response.content_part.done`
+- `response.output_text.delta`, `response.output_text.done`
+- `response.refusal.delta`, `response.refusal.done`
+
+**Reasoning (6):**
+
+- `response.reasoning_text.delta`, `response.reasoning_text.done`
+- `response.reasoning_summary_part.added`,
+  `response.reasoning_summary_part.done`
+- `response.reasoning_summary_text.delta`,
+  `response.reasoning_summary_text.done`
+
+**Function Calls (2):**
+
+- `response.function_call_arguments.delta`,
+  `response.function_call_arguments.done`
+
+**MCP (8):**
+
+- `response.mcp_call_arguments.delta`, `response.mcp_call_arguments.done`
+- `response.mcp_call.in_progress`, `response.mcp_call.completed`,
+  `response.mcp_call.failed`
+- `response.mcp_list_tools.in_progress`, `response.mcp_list_tools.completed`,
+  `response.mcp_list_tools.failed`
+
+**Built-in Tools (15):**
+
+- File search: `in_progress`, `searching`, `completed`
+- Web search: `in_progress`, `searching`, `completed`
+- Code interpreter: `in_progress`, `interpreting`, `code.delta`, `code.done`,
+  `completed`
+- Image gen: `in_progress`, `generating`, `partial_image`, `completed`
+
+**Audio (4):**
+
+- `response.audio.delta`, `response.audio.done`
+- `response.audio.transcript.delta`, `response.audio.transcript.done`
+
+**Annotations (1):**
+
+- `response.output_text.annotation.added`
+
+### OpenAI Agents SDK (higher-level)
+
+```python
+# Python-first, but patterns apply
+class RunItemStreamEvent:
+    name: Literal[
+        "message_output_created",
+        "handoff_requested",
+        "handoff_occurred",
+        "tool_called",
+        "tool_output",
+        "tool_search_called",
+        "tool_search_output_created",
+        "reasoning_item_created",
+        "mcp_approval_requested",
+        "mcp_approval_response",
+        "mcp_list_tools",
+    ]
+
+class AgentUpdatedStreamEvent:
+    # Fires when current agent changes (handoff)
+    new_agent: Agent
+```
+
+---
+
+## 4. Superset Analysis — What Changes Our Interfaces?
+
+### Concepts Present in ALL Systems
+
+| Concept               | gemini-cli | ADK-TS | Claude SDK    | Codex/OpenAI   | Our Interfaces          |
+| --------------------- | ---------- | ------ | ------------- | -------------- | ----------------------- |
+| Text streaming        | ✅         | ✅     | ✅            | ✅             | ✅ MessageEvent         |
+| Tool request/response | ✅         | ✅     | ✅            | ✅             | ✅ ToolRequest/Response |
+| Thinking/reasoning    | ✅         | ✅     | ✅ (thinking) | ✅ (reasoning) | ✅ ContentPart.thought  |
+| Error events          | ✅         | ✅     | ✅            | ✅             | ✅ ErrorEvent           |
+| Token usage           | ✅         | ✅     | ✅            | ✅             | ✅ UsageEvent           |
+| Tool progress         | ✅         | ✅     | —             | ✅             | ✅ ToolUpdateEvent      |
+| Session resume        | ✅         | ✅     | ✅            | ✅             | ✅ sessionRef           |
+| Subagents             | ✅         | ✅     | ✅            | —              | ✅ threadId             |
+| Abort/cancel          | ✅         | ✅     | ✅            | ✅             | ✅ abort()              |
+| Metadata escape hatch | —          | ✅     | —             | —              | ✅ \_meta               |
+
+### NEW Concepts From Claude/Codex That We Should Incorporate
+
+#### 4.1 Structured Stream End Reasons (HIGH PRIORITY)
+
+**What:** Claude SDK has typed termination:
+`success | error_max_turns | error_max_budget_usd | error_during_execution`.
+OpenAI has `completed | incomplete | failed`.
+
+**Why it matters:** We need a `stream_end` event that captures why the stream
+ended — the one signal not covered by other event types.
+
+**Final design — `stream_end` with `reason` + open `data` bag:**
+
+```typescript
+type StreamEndReason =
+  | 'completed'
+  | 'failed'
+  | 'aborted'
+  | 'max_turns'
+  | 'max_budget'
+  | 'max_time'
+  | 'refusal'
+  | (string & {});
+
+interface StreamEnd {
+  reason: StreamEndReason;
+  data?: Record<string, unknown>; // { result?, cost?, usage?, numTurns?, error?, ... }
+}
+```
+
+**Design rationale:**
+
+- Start is covered by `initialize`. Pausing is implicit (elicitation/tool
+  request events). Handoff is a tool call (`transfer_to_agent`).
+- End-of-stream details go in `data` as an open bag, not fixed fields.
+
+#### 4.2 Budget Constraints (MEDIUM PRIORITY)
+
+**What:** Claude SDK has `maxBudgetUsd`. Neither gemini-cli nor ADK has this
+today.
+
+**Why it matters:** Cost control is critical for production deployments.
+
+**Proposed change to AgentConstraints:**
+
+```typescript
+interface AgentConstraints {
+  maxTurns?: number;
+  maxTimeMinutes?: number;
+  maxLlmCalls?: number;
+  maxBudgetUsd?: number; // NEW: from Claude SDK
+}
+```
+
+#### 4.3 Session Forking (MEDIUM PRIORITY)
+
+**What:** Claude SDK supports `forkSession: boolean` — branch from a resume
+point to explore alternatives.
+
+**Why it matters:** Enables "what if" exploration without destroying history.
+Useful for plan mode.
+
+**Proposed change to ExecutionRequest:**
+
+```typescript
+interface ExecutionRequest {
+  // ... existing fields ...
+  sessionRef?: string | SessionSnapshot;
+  forkSession?: boolean; // NEW: branch from sessionRef instead of continuing
+}
+```
+
+#### 4.4 Permission Modes on Execution (MEDIUM PRIORITY)
+
+**What:** Claude has 5 permission modes:
+`default | acceptEdits | plan | dontAsk | bypassPermissions`. gemini-cli has 4
+approval modes: `default | autoEdit | yolo | plan`.
+
+**Why it matters:** Both systems have this concept. It should be in
+ExecutionOptions, not hard-coded.
+
+**Proposed change to ExecutionOptions:**
+
+```typescript
+interface ExecutionOptions {
+  // ... existing fields ...
+  permissionMode?: string; // Open string. Conventions: 'default' | 'auto_edit' | 'autonomous' | 'plan' | string
+}
+```
+
+#### 4.5 Agent Handoff (MEDIUM PRIORITY)
+
+**What:** OpenAI Agents SDK has explicit `handoff_requested` /
+`handoff_occurred` events plus `AgentUpdatedStreamEvent`. ADK has
+`transfer_to_agent` tool + `eventActions.transferToAgent`. Claude SDK has
+subagent invocation via Agent tool.
+
+**Why it matters:** When agent A delegates to agent B, the host/UI needs to
+know.
+
+**Design decision: Handoff is a tool call, not a separate event type.**
+
+The agent calls `transfer_to_agent` as a tool (ToolRequest event). The host
+intercepts this tool call (since host controls tool execution), looks up the
+target agent, creates a new executor via the factory, and mediates the handoff.
+The originating agent's stream ends with `stream_end` reason `'completed'`.
+
+```typescript
+// 1. Agent emits tool request:
+{ type: 'tool_request', name: 'transfer_to_agent', args: { target: 'coder', reason: '...' } }
+
+// 2. Host mediates handoff, originating agent completes:
+{ type: 'stream_end', reason: 'completed', agentId: 'planner', data: { handoffTarget: 'coder' } }
+```
+
+This avoids duplicating routing logic between stream_end events and tool calls.
+Matches ADK's `transfer_to_agent` tool pattern.
+
+#### 4.6 Refusal as Distinct Signal (LOW PRIORITY)
+
+**What:** OpenAI has explicit `response.refusal.delta/done` events. Claude has
+`stop_reason: "refusal"`.
+
+**Why it matters:** Model refusals are operationally important (safety, policy).
+
+**Proposed:** No new event type. Handle via `MessageEvent` with a `refusal`
+content part type, or via `ErrorEvent` with specific error code. ContentPart can
+be extended:
+
+```typescript
+| { type: 'refusal'; text: string }
+```
+
+#### 4.7 Content Annotations (LOW PRIORITY)
+
+**What:** OpenAI has `response.output_text.annotation.added` for citations, file
+paths.
+
+**Why it matters:** Citations and source attribution are increasingly important.
+
+**Proposed:** Michael's `reference` ContentPart already covers this. No change
+needed — `reference` with `uri` and `text` handles citations.
+
+#### 4.8 Context Compaction Events (LOW PRIORITY)
+
+**What:** Claude SDK has `CompactBoundaryMessage` marking when context was
+compressed.
+
+**Why it matters:** For long sessions, knowing when context was compressed helps
+with debugging and UI.
+
+**Proposed:** `CustomEvent` with `kind: 'compact_boundary'`. No new event type
+needed.
+
+#### 4.9 Structured Output Schema (ALREADY COVERED)
+
+**What:** Both Claude (`structuredOutput`) and OpenAI support JSON Schema output
+constraints.
+
+**Status:** Already covered by `AgentDescriptor.outputSchema: JsonSchema`. No
+change needed.
+
+### Concepts We DON'T Need to Adopt
+
+| Concept                                                                   | Why Skip                                                                                                               |
+| ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| OpenAI's 53 granular streaming events                                     | Too coupled to Responses API internals. Our `ToolUpdateEvent` + `MessageEvent` via AsyncGenerator abstracts over this. |
+| OpenAI's per-tool-type events (file_search, web_search, code_interpreter) | Tool-specific progress belongs in `ToolUpdateEvent.data`, not in the event taxonomy.                                   |
+| Audio/Image streaming events                                              | Handle via `ToolUpdateEvent` with media ContentParts. When needed, add as ContentPart types, not event types.          |
+| Claude's raw `StreamEvent` wrapper                                        | Implementation detail of the Claude API client. Our adapters consume these internally.                                 |
+| MCP-specific events (mcp_call, mcp_list_tools)                            | MCP tools are just tools. Use generic `ToolRequestEvent/ToolResponseEvent`. MCP approval is an `ElicitationRequest`.   |
+
+---
+
+## 5. Updated Event Type Comparison (Full Superset)
+
+| #   | Event Type           | Michael | Our Outline | Claude SDK                    | OpenAI                            | Verdict                                        |
+| --- | -------------------- | ------- | ----------- | ----------------------------- | --------------------------------- | ---------------------------------------------- |
+| 1   | Initialize           | ✅      | ✅          | SystemMessage(init)           | —                                 | **Keep**                                       |
+| 2   | Session Update       | ✅      | ✅          | —                             | —                                 | **Keep**                                       |
+| 3   | Message              | ✅      | ✅          | AssistantMessage              | output_text.delta/done            | **Keep**                                       |
+| 4   | Tool Request         | ✅      | ✅          | AssistantMessage.tool_use     | function_call_arguments           | **Keep**                                       |
+| 5   | Tool Update          | ✅      | ✅          | —                             | per-tool progress events          | **Keep**                                       |
+| 6   | Tool Response        | ✅      | ✅          | UserMessage                   | —                                 | **Keep**                                       |
+| 7   | Elicitation Request  | ✅      | ✅          | canUseTool callback           | mcp_approval_requested            | **Keep**                                       |
+| 8   | Elicitation Response | ✅      | ✅          | canUseTool return             | mcp_approval_response             | **Keep**                                       |
+| 9   | Usage                | ✅      | ✅          | ResultMessage.usage           | response.completed                | **Keep**                                       |
+| 10  | Error                | ✅      | ✅          | ResultMessage(error\_\*)      | response.failed                   | **Keep**                                       |
+| 11  | Custom               | ✅      | ✅          | —                             | —                                 | **Keep**                                       |
+| 12  | StreamEnd            | —       | ✅          | ResultMessage + SystemMessage | response.created/completed/failed | **Keep — `stream_end` with `reason` + `data`** |
+
+**Result: Our 12 event types are the right abstraction level.** Claude and
+OpenAI validate every category. The granularity differences (OpenAI's 53 vs
+our 12) are implementation details that adapters handle internally. `stream_end`
+uses a single `reason` field with an open `data` bag. Handoff is a tool call.
+Pausing is implicit.
+
+---
+
+## 6. Updated ContentPart Types (Superset)
+
+```typescript
+type ContentPart = (
+  | { type: 'text'; text: string }
+  | { type: 'thought'; thought: string; thoughtSignature?: string }
+  | { type: 'media'; data?: string; uri?: string; mimeType?: string }
+  | {
+      type: 'reference';
+      text: string;
+      data?: string;
+      uri?: string;
+      mimeType?: string;
+    }
+  | { type: 'refusal'; text: string } // NEW: from OpenAI
+) &
+  // Future: type: string for unknown types from new SDKs
+  { _meta?: Record<string, unknown> };
+```
+
+Adding `refusal` as a ContentPart type (rather than a new event) keeps the event
+taxonomy stable while supporting model refusals from both Claude and OpenAI.
+
+---
+
+## 7. Key Architectural Patterns Across SDKs
+
+### Pattern: Execution Entry Points
+
+| SDK         | Entry Point                                                               | Multi-turn Pattern                              |
+| ----------- | ------------------------------------------------------------------------- | ----------------------------------------------- |
+| Michael     | `agent.send(trajectory, data)` / `session.send()` + `session.update()`    | Same method / three-method session              |
+| Our Outline | `session.stream(data)` + `session.update(config)` + `session.steer(data)` | Four-method session (stream/update/steer/abort) |
+| Claude SDK  | `query({ prompt, options })`                                              | New `query()` call with `resume: sessionId`     |
+| Claude V2   | `session.send()` + `session.stream()`                                     | Separate send/stream                            |
+| Codex SDK   | `thread.run(prompt)` / `thread.runStreamed(prompt)`                       | Same thread object                              |
+
+**Observation:** Claude V2 and Codex both use a stateful session/thread object
+with send+stream. Michael uses a single `send()` method. Our `stream()` method
+is the unified version — the first call starts, subsequent calls continue (like
+ADK's `runAsync()`).
+
+### Pattern: Tool Approval
+
+| SDK         | Pattern                                                  | Sync/Async               |
+| ----------- | -------------------------------------------------------- | ------------------------ |
+| gemini-cli  | PolicyEngine + ConfirmationBus                           | Async (message bus)      |
+| ADK-TS      | SecurityPlugin.policyCheck()                             | Async (plugin callback)  |
+| Claude SDK  | `canUseTool()` callback                                  | Async (callback)         |
+| OpenAI      | `mcp_approval_requested` event                           | Event-based              |
+| Our Outline | `ElicitationRequest` event + `PolicyEvaluator` interface | Both (event + interface) |
+
+**Observation:** Our approach covers both patterns — the `ElicitationRequest`
+event for event-based approval (like OpenAI), and the `PolicyEvaluator`
+interface for synchronous policy checks (like gemini-cli/ADK/Claude). This is
+the right superset.
+
+### Pattern: Subagent Definition
+
+| SDK           | Pattern                          | Key Fields                                                                                 |
+| ------------- | -------------------------------- | ------------------------------------------------------------------------------------------ |
+| gemini-cli    | `AgentDefinition` (local/remote) | name, description, kind, tools, model                                                      |
+| ADK-TS        | `BaseAgentConfig`                | name, description, subAgents, tools                                                        |
+| Claude SDK    | `AgentDefinition`                | description, prompt, tools, model                                                          |
+| OpenAI Agents | `Agent` class                    | name, instructions, tools, handoffs, model                                                 |
+| Our Outline   | `AgentDescriptor`                | name, description, executor, inputSchema, capabilities, ownTools, requiredTools, subAgents |
+
+**Observation:** Our `AgentDescriptor` is the most complete. Claude's `prompt`
+field and OpenAI's `instructions` are executor-level concerns (system prompt),
+not descriptor-level. The descriptor declares identity; the executor uses the
+prompt. This separation is correct.
+
+One gap: **handoffs**. OpenAI Agents has an explicit `handoffs` field listing
+which agents can be delegated to. Our `subAgents` field serves the same purpose
+but the naming implies hierarchy rather than peer delegation. Consider whether
+`subAgents` should be renamed to `delegateAgents` or kept as-is with
+documentation clarifying it covers both hierarchical and peer delegation.
+
+---
+
+## 8. Concrete Changes to outline.md
+
+Based on this analysis, the following changes should be made:
+
+### Applied (validated by multiple SDKs):
+
+1. ✅ **`type: AgentEventType`** with known values + `(string & {})`
+   (autocomplete + extensibility)
+2. ✅ **`interface AgentEvents` + mapped type** (adopted from Michael for
+   declaration merging)
+3. ✅ **`agentId` on event base** (which agent emitted this event)
+4. ✅ **`_meta` on ContentPart** (aligned with Michael)
+5. ✅ **`stream_end` event** — signals why the stream ended, with `reason`
+   field + open `data` bag
+6. ✅ **Handoff as tool call** — `transfer_to_agent` tool, not a separate event
+7. ✅ **`maxBudgetUsd` in AgentConstraints** (Claude SDK, increasingly standard)
+8. ✅ **`refusal` ContentPart type** (both Claude and OpenAI surface refusals)
+9. ✅ **`forkSession` in ExecutionRequest** (Claude SDK, valuable for
+   exploration)
+10. ✅ **`permissionMode` in ExecutionOptions** (both gemini-cli and Claude SDK)
+11. ✅ **`cost` field on Usage** (Claude SDK tracks total_cost_usd)
+
+### Correctly abstracted (no change needed):
+
+- Event taxonomy (12 types) — validated as right abstraction level
+- `AgentDescriptor` shape — most complete across all SDKs
+- `AgentSession.stream/update/steer/abort` — covers all SDK patterns
+- ToolUpdate — correctly abstracts over OpenAI's 15+ tool-specific progress
+  events
+- `ElicitationRequest/Response` — covers both callback and event patterns
+- `ContentPart` types — text/thought/media/reference/refusal
+
+---
+
+## Sources
+
+- [Claude Agent SDK TypeScript Reference](https://platform.claude.com/docs/en/agent-sdk/typescript)
+- [Claude Agent SDK Streaming](https://platform.claude.com/docs/en/agent-sdk/streaming-output)
+- [Claude Agent SDK Sessions](https://platform.claude.com/docs/en/agent-sdk/sessions)
+- [Claude Agent SDK Subagents](https://platform.claude.com/docs/en/agent-sdk/subagents)
+- [OpenAI Codex SDK TypeScript](https://github.com/openai/codex/tree/main/sdk/typescript)
+- [OpenAI Codex SDK Docs](https://developers.openai.com/codex/sdk/)
+- [OpenAI Responses API Streaming Events](https://developers.openai.com/api/reference/resources/responses/streaming-events/)
+- [OpenAI Agents SDK Streaming](https://openai.github.io/openai-agents-python/streaming/)
+- [Responses API Streaming Guide (Community)](https://community.openai.com/t/responses-api-streaming-the-simple-guide-to-events/1363122)

docs/adk-replat/NOTES-gemini-cli-architecture.md

@@ -0,0 +1,259 @@
+# Gemini CLI Architecture Notes
+
+## Project Structure
+
+**Monorepo packages:**
+
+- `packages/core/` - Main execution engine (the big one)
+- `packages/cli/` - CLI frontend
+- `packages/sdk/` - SDK for extensions
+- `packages/a2a-server/` - Agent-to-agent server
+- `packages/devtools/` - Dev utilities
+- `packages/vscode-ide-companion/` - VS Code extension
+
+## Core Execution Loop
+
+### GeminiClient (`core/src/core/client.ts` ~38KB)
+
+- **Primary orchestrator** for user interactions
+- Manages session lifecycle, message routing, model selection
+- Coordinates hooks, context management, error recovery
+- Enforces `MAX_TURNS = 100` per session
+- Tracks `currentSequenceModel` for multi-turn stickiness
+- Handles history compression when context grows
+
+### GeminiChat (`core/src/core/geminiChat.ts` ~34KB)
+
+- Bidirectional LLM communication
+- Maintains `history[]` alternating user/model turns
+- Retry logic: max 2 attempts, 500ms delay for invalid responses
+- Fires `BeforeModel` and `AfterModel` hooks
+- Integrates ChatRecordingService for persistence
+
+### Scheduler (`core/src/scheduler/scheduler.ts` ~23KB)
+
+- **Three-phase event-driven**: Ingestion → Processing → Completion
+- Tool call state machine:
+  `Validating → AwaitingApproval → Scheduled → Executing → Terminal`
+- Terminal states: `Success`, `Error`, `Cancelled`
+- Parallel execution for read-only and agent-type tools
+- Yields to event loop for user approval
+- Publishes state changes via MessageBus
+
+### CoreToolScheduler (`core/src/core/coreToolScheduler.ts` ~38KB)
+
+- Sequential, queue-based tool processing
+- Validates policy via PolicyEngine
+- Confirmation handling via ToolModificationHandler (editor integration)
+- Uses MessageBus for async confirmation responses
+
+## Tool System
+
+### DeclarativeTool Pattern
+
+- **Separation of concerns**: build() → validate → createInvocation() →
+  execute()
+- `ToolBuilder` defines metadata (name, displayName, description, kind) + schema
+  via `getSchema()`
+- `ToolInvocation` has: `getDescription()`, `toolLocations()`,
+  `shouldConfirmExecute()`, `execute()`
+- `ToolResult` contains: `llmContent` (for LLM), `returnDisplay` (for UI), error
+  details, tail calls
+
+### BaseToolInvocation
+
+- Abstract base with MessageBus integration for policy/confirmation
+- Three decision paths: ALLOW, DENY, ASK_USER via `getMessageBusDecision()`
+
+### ToolRegistry (`core/src/tools/tool-registry.ts`)
+
+- Registers tools via `registerTool()`
+- MCP tools with fully qualified names: `mcp_serverName_toolName`
+- Priority sorting: built-in → discovered → MCP (by server name)
+- Filters by active status based on configuration
+
+### Confirmation System
+
+- `ToolCallConfirmationDetails` union: edit, execute, MCP, info, ask_user,
+  exit_plan_mode
+- `ToolConfirmationOutcome` enum: ProceedOnce, ProceedAlways, etc.
+- Async confirmation via MessageBus pub/sub
+
+## Hooks System
+
+### Hook Types (11 hook points)
+
+| Hook                  | Trigger                 | Key Capability                    |
+| --------------------- | ----------------------- | --------------------------------- |
+| `BeforeTool`          | Before tool execution   | Modify tool_input                 |
+| `AfterTool`           | After tool completion   | Context injection, tail calls     |
+| `BeforeAgent`         | Before agent prompt     | Additional context                |
+| `AfterAgent`          | After agent response    | Clear context flag                |
+| `BeforeModel`         | Before LLM request      | Modify request or inject response |
+| `AfterModel`          | After LLM response      | Modify response                   |
+| `BeforeToolSelection` | Before tool selection   | Modify toolConfig                 |
+| `Notification`        | When notifications fire | Suppress/modify message           |
+| `SessionStart`        | Session begins          | Additional context                |
+| `SessionEnd`          | Session terminates      | Cleanup                           |
+| `PreCompress`         | Before compression      | Suppress/modify                   |
+
+### Hook Output Fields (common to all hooks)
+
+- `continue` - Whether execution proceeds
+- `stopReason` - Reason to halt
+- `suppressOutput` - Hide from user
+- `systemMessage` - Add to system context
+- `decision` - ask/block/deny/approve/allow
+
+### Hook System Components
+
+- `HookSystem` - Main coordinator
+- `HookRegistry` - Stores/manages configurations
+- `HookRunner` - Executes registered hooks
+- `HookAggregator` - Combines multiple hook results
+- `HookPlanner` - Determines execution order
+- `HookEventHandler` - Orchestrates event firing
+- `HookTranslator` - Converts between formats
+
+## Policy Engine
+
+### Rule Structure
+
+```
+PolicyRule {
+  toolName: string;        // wildcards supported
+  decision: PolicyDecision; // ALLOW | DENY | ASK_USER
+  priority: number;
+  argsPattern?: RegExp;    // conditional on args
+  mcpName?: string;
+  source: string;
+}
+```
+
+### Tier Hierarchy (lowest → highest priority)
+
+1. Default (1) - Core built-in policies
+2. Extension (2) - Extension contributions
+3. Workspace (3) - Project-scoped (.gemini/)
+4. User (4) - User-provided (~/.gemini/)
+5. Admin (5) - System-level policies
+
+### Dynamic Rule Priorities (within User Tier)
+
+- 4.9 - MCP_EXCLUDED (persistent server blocks)
+- 4.4 - EXCLUDE_TOOLS_FLAG (CLI exclusions)
+- 4.3 - ALLOWED_TOOLS_FLAG (CLI allows)
+- 4.2 - TRUSTED_MCP_SERVER
+- 4.1 - ALLOWED_MCP_SERVER
+- 3.95 - ALWAYS_ALLOW (interactive selections)
+
+### Security Constraint
+
+- Extensions CANNOT contribute ALLOW rules or YOLO mode
+
+## Agent System
+
+### Agent Registry (`core/src/agents/registry.ts`)
+
+Discovery sources:
+
+1. Built-in: CodebaseInvestigator, CliHelp, Generalist, Browser
+2. User-level: `~/.gemini/agents/`
+3. Project-level: `.gemini/agents/` (requires folder trust)
+4. Extension-based: From active extensions
+
+### LocalAgentExecutor (`core/src/agents/local-executor.ts`)
+
+- Prompt processing: input augmentation → template expansion → system prompt
+  construction
+- Uses GeminiChat for accumulating conversation
+- ChatCompressionService for history management
+- Turn loop: invoke model → extract function calls → check auth → append results
+- Termination: complete_task tool, max turns, timeout
+
+### SubagentTool (`core/src/agents/subagent-tool.ts`)
+
+- Extends BaseDeclarativeTool - agents invoked like standard tools
+- Read-only status checking, user hint propagation
+- Execution: validate → optional confirmation → parameter enrichment →
+  SubagentToolWrapper
+
+### Remote Agents
+
+- A2A client manager for agent-to-agent protocol
+- Remote invocation for external agents
+- Agent acknowledgement system (security for project agents)
+
+## Model System
+
+### ModelConfigService
+
+- **Hierarchical alias system**: children override parents
+- Resolution: alias chain → level assignment → apply overrides
+- Deep merging with array override capability
+- Fallback to `chat-base` alias for unknown models
+
+### ModelRouterService
+
+Sequential strategy pattern:
+
+1. Fallback & Override
+2. Approval Mode Strategy
+3. Gemma Classifier (if enabled)
+4. Generic Classifier
+5. Numerical Classifier
+6. Default Strategy
+
+### ModelAvailabilityService
+
+Health states:
+
+- **Terminal** - permanently unavailable
+- **Sticky Retry** - failed once, can retry once per turn
+- **Healthy** - no issues
+
+## Services
+
+| Service                     | Purpose                                 |
+| --------------------------- | --------------------------------------- |
+| ChatRecordingService        | Session persistence (JSON files)        |
+| ChatCompressionService      | History summarization for token budgets |
+| ModelConfigService          | Hierarchical model config with aliases  |
+| ModelAvailabilityService    | Model health tracking                   |
+| ModelRouterService          | Model selection via strategies          |
+| FolderTrustDiscoveryService | Workspace security scanning             |
+| KeychainService             | Credential storage                      |
+| LoopDetectionService        | Detect repetitive agent loops           |
+
+## UI + Core Separation
+
+### IDE Client (`core/src/ide/ide-client.ts`)
+
+- Singleton managing CLI ↔ IDE communication via MCP
+- **Outbound** (CLI → IDE): `openDiff`, `closeDiff`
+- **Inbound** (IDE → CLI): `ide/contextUpdate`, `ide/diffAccepted`,
+  `ide/diffRejected`
+
+### Event Contract
+
+```typescript
+interface IdeContextNotification {
+  method: 'ide/contextUpdate';
+  params: { workspaceState: { openFiles: string[]; isTrusted: boolean } };
+}
+```
+
+### Confirmation Bus
+
+- `TOOL_CONFIRMATION_REQUEST` / `TOOL_CONFIRMATION_RESPONSE`
+- Detail types: edit, execute, MCP, info, ask_user, exit_plan_mode
+- Async pub/sub via MessageBus
+
+## Configuration (`core/src/config/config.ts` ~95KB!)
+
+- Tool config: core tools, allowed/excluded, MCP servers
+- File filtering: git ignore, fuzzy search, max counts, timeouts
+- Approval modes: policy engine config
+- Experiments: feature flags (GEMINI_3_1_PRO_LAUNCHED, ENABLE_ADMIN_CONTROLS,
+  etc.)
+- FolderTrust: discovery scans for commands, skills, settings, MCP, hooks

docs/adk-replat/NOTES-key-systems-deep-dive.md

@@ -0,0 +1,296 @@
+# Deep Dive: Key Gemini-CLI Systems
+
+## Hooks System (Complete)
+
+### 11 Hook Points
+
+| Hook                | Input                                  | Key Output Capabilities                       |
+| ------------------- | -------------------------------------- | --------------------------------------------- |
+| BeforeTool          | toolName, toolInput, mcpContext        | Modify tool_input, block/allow, systemMessage |
+| AfterTool           | toolName, toolInput, toolResponse      | additionalContext, tailToolCallRequest        |
+| BeforeAgent         | prompt                                 | Additional context                            |
+| AfterAgent          | prompt, response, stopHookActive       | Clear context                                 |
+| BeforeModel         | llmRequest (GenerateContentParameters) | Modify llm_request OR inject llm_response     |
+| AfterModel          | llmRequest, llmResponse                | Modify llm_response                           |
+| BeforeToolSelection | llmRequest                             | Modify toolConfig (function list, mode)       |
+| Notification        | type, message, details                 | Suppress/modify                               |
+| SessionStart        | source (Startup/Resume/Clear)          | Additional context                            |
+| SessionEnd          | reason (Exit/Clear/Logout/etc)         | Cleanup                                       |
+| PreCompress         | trigger (Manual/Auto)                  | Suppress/modify                               |
+
+### Hook Configuration Types
+
+- **Runtime hooks** (HookType.Runtime): JS/TS functions, registered
+  programmatically
+- **Command hooks** (HookType.Command): External shell commands with JSON I/O
+
+### Exit Code Semantics (Command Hooks)
+
+- 0 = Success (allowed with system message)
+- 1 = Non-blocking error (warning, continues)
+- 2+ = Blocking failure (denied, stderr as reason)
+
+### Hook Decision Values
+
+`'ask' | 'block' | 'deny' | 'approve' | 'allow' | undefined`
+
+### Execution Strategies
+
+- **Parallel** (default): Promise.all(), independent
+- **Sequential** (opt-in per hook): Chained, output→input cascading
+
+### Aggregation
+
+- Blocking decisions: OR logic (any block → all block)
+- Field replacement: later overrides earlier
+- Tool selection: union of allowed functions, mode precedence NONE > ANY > AUTO
+
+### Trust Model
+
+- Project hooks require folder trust verification
+- TrustedHooksManager at `~/.gemini/trusted-hooks.json`
+- Environment sanitized for command hooks (sensitive vars removed)
+- `GEMINI_PROJECT_DIR` injected
+
+### Key Insight for Abstraction
+
+Hooks fire inside gemini-cli's execution loop. When ADK controls the model:
+
+- BeforeModel/AfterModel still fire because AdkGeminiModel wraps GeminiChat
+- BeforeTool/AfterTool still fire because AdkToolAdapter wraps DeclarativeTool
+- This is dewitt's solution: adapters preserve hook injection points
+
+**For OpenRouter or opaque agents, hooks CANNOT fire unless the agent delegates
+model/tool calls back to gemini-cli.**
+
+---
+
+## Policy Engine (Complete)
+
+### TOML Rule Format
+
+```toml
+[[rules]]
+decision = "allow" | "deny" | "ask_user"
+priority = 0-999
+toolName = "tool_name"       # wildcards: *, mcp_*, mcp_server_*
+mcpName = "server_name"      # MCP server filter
+argsPattern = "regex"        # matches JSON-stringified args
+commandPrefix = "cmd"        # shell command prefix match
+commandRegex = "regex"       # shell command regex (mutually exclusive with prefix)
+modes = ["default", "autoEdit", "yolo", "plan"]
+annotations = ["read-only", "experimental"]
+allowRedirection = true      # for shell commands
+allowMessage = "..."         # user-facing message on allow
+denyMessage = "..."          # user-facing message on deny
+```
+
+### 5-Tier Priority System
+
+- Tier 5 (Admin): 5.000-5.999
+- Tier 4 (User): 4.000-4.999
+- Tier 3 (Workspace): 3.000-3.999
+- Tier 2 (Extension): 2.000-2.999
+- Tier 1 (Default): 1.000-1.999
+
+Formula: `tier + (priority / 1000)`
+
+### 4 Approval Modes
+
+1. **default** — ASK_USER decisions prompt user
+2. **autoEdit** — File writes auto-approved with safety checking (conseca)
+3. **yolo** — All auto-approved except explicit ask_user rules
+4. **plan** — Read-only, blocks modifications, allows planning docs
+
+### Shell Command Safety
+
+- Parses multi-command sequences (&&, ;, ||)
+- Detects injection: $(...), `...`, <(...), >(...), --flag=$(...)
+- Each subcommand evaluated independently
+- DENY overrides everything; ASK_USER escalates; ALLOW only if all pass
+- Redirections (>) downgrade ALLOW → ASK_USER unless allowRedirection=true
+
+### Security Constraints
+
+- Extensions cannot contribute ALLOW rules or YOLO mode
+- Regex patterns validated for ReDoS
+- Tool name typos detected via Levenshtein distance ≤3
+- Policy file integrity: SHA-256 hash checking
+
+### Key Insight for Abstraction
+
+Policy is evaluated at the tool execution boundary. For the interface layer:
+
+- If CLI controls tool execution → policy naturally applies
+- If agent controls tool execution internally → policy bypassed (danger!)
+- This reinforces the `pauseOnToolCalls: true` approach for ADK
+- Need a `PolicyEvaluator` interface that any executor can call
+
+---
+
+## Tool System (Complete)
+
+### Core Abstraction Chain
+
+```
+ToolBuilder (metadata + schema)
+  → build(params) validates → ToolInvocation (ready to execute)
+    → shouldConfirmExecute() → execute(signal) → ToolResult
+```
+
+### DeclarativeTool Pattern
+
+- `build(params)` — Validate and create invocation
+- `buildAndExecute(params)` — One-step convenience
+- `validateBuildAndExecute(params)` — Non-throwing variant
+
+### BaseToolInvocation
+
+- Message bus integration for policy decisions
+- Three decision paths: ALLOW → execute, DENY → reject, ASK_USER → confirm
+
+### ToolResult Structure
+
+- `llmContent` — For LLM conversation history
+- `returnDisplay` — For UI presentation
+- `displayContent` — Additional display formatting
+- `errorDetails` — Optional error info
+- `result` — Structured data payload
+- `tailCall` — Optional chaining requests
+
+### Confirmation System (6 types)
+
+1. **edit** — File modification with diff
+2. **execute** — Command execution
+3. **mcp** — MCP tool with allowlist mgmt
+4. **info** — Information-only
+5. **ask_user** — General user approval
+6. **exit_plan_mode** — Plan exit notification
+
+### Confirmation Outcomes (7 values)
+
+ProceedOnce, ProceedAlways, ProceedAlwaysAndSave, ProceedAlwaysServer,
+ProceedAlwaysTool, ModifyWithEditor, Cancel
+
+### Tool Kinds
+
+- **Mutator**: Edit, Delete, Move, Execute
+- **Read-Only**: Read, Search, Fetch
+- **Other**: Think, Agent, Communicate, Plan, SwitchMode, Other
+
+### MCP Tools
+
+- Naming: `mcp_<server>_<toolname>` (64-char limit)
+- Schema validation via LenientJsonSchemaValidator
+- Response types: McpTextBlock, McpMediaBlock, McpResourceBlock,
+  McpResourceLinkBlock
+- Transform to GenAI Parts format
+
+### Error Types (20+)
+
+- **Recoverable**: INVALID_TOOL_PARAMS, FILE_NOT_FOUND,
+  EDIT_NO_OCCURRENCE_FOUND, SHELL_TIMEOUT, MCP_TOOL_ERROR...
+- **Fatal**: NO_SPACE_LEFT (only one!)
+
+### ModifiableTool
+
+- Extends DeclarativeTool with external editor support
+- `getModifyContext()` → temp files → editor opens → `getUpdatedParams()` → diff
+
+---
+
+## Execution Loop (Complete)
+
+### LocalAgentExecutor Flow
+
+1. Collect user hints, setup deadline timer
+2. **Turn loop**: executeTurn() repeatedly until completion
+3. Per-turn: compress chat → callModel() → processFunctionCalls()
+4. On limit hit: executeFinalWarningTurn() with 60s grace period
+5. Return OutputObject { result, terminate_reason }
+
+### AgentTerminateMode
+
+GOAL | TIMEOUT | MAX_TURNS | ABORTED | ERROR | ERROR_NO_COMPLETE_TASK_CALL
+
+### SubagentTool Architecture
+
+```
+Parent Agent
+  └─ SubagentTool (wraps AgentDefinition as DeclarativeTool)
+       └─ SubagentToolWrapper (routes by agent kind)
+            ├─ LocalSubagentInvocation → LocalAgentExecutor
+            ├─ RemoteAgentInvocation → A2AClientManager
+            └─ BrowserAgentInvocation
+```
+
+### Agent Types
+
+- `LocalAgentDefinition` — kind: 'local', has promptConfig, modelConfig,
+  runConfig, toolConfig
+- `RemoteAgentDefinition` — kind: 'remote', has agentCardUrl, auth config
+
+### Key Defaults
+
+- DEFAULT_MAX_TURNS = 15
+- DEFAULT_MAX_TIME_MINUTES = 5
+- A2A_TIMEOUT = 1800000 (30 min for remote agents)
+
+---
+
+## Services/Config (Complete)
+
+### ModelConfigService
+
+- **Alias chains**: Inheritance with `extends`, merged root-to-leaf
+- **Overrides**: Contextual (model, scope, retry, isChatModel), sorted by
+  specificity
+- **Runtime registration**: Dynamic aliases and overrides
+- **Deep merge**: Objects merged, arrays replaced entirely
+
+### ModelRouterService (Strategy Chain)
+
+1. Fallback & Override → 2. Approval Mode → 3. Gemma Classifier → 4. Generic
+   Classifier → 5. Numerical Classifier → 6. Default
+
+### ModelAvailabilityService
+
+- Terminal (permanent), Sticky_retry (one retry per turn), Healthy
+- `selectFirstAvailable()` iterates fallback chain
+- `resetTurn()` at turn boundaries enables fresh retries
+
+### Config (~95KB!)
+
+Central dependency injection. Initializes: ModelAvailabilityService →
+ModelConfigService → FolderTrustDiscoveryService → PolicyEngine →
+FileDiscoveryService → GitService → ToolRegistry → MCP → GeminiClient →
+HookSystem
+
+### CoreEventEmitter (UI Events)
+
+Event types: UserFeedback, ModelChanged, ConsoleLog, Output, RetryAttempt,
+ConsentRequest, McpProgress, Hook, QuotaChanged
+
+Backlog buffering (max 10,000) with head-pointer eviction and auto-compaction.
+
+### Scheduler Types
+
+```typescript
+ToolCallRequestInfo {
+  callId, name, args, originalRequestName,
+  isClientInitiated, prompt_id, checkpoint, traceId,
+  parentCallId, schedulerId
+}
+ToolCallResponseInfo {
+  callId, responseParts, resultDisplay, error, errorType,
+  outputFile, contentLength, data
+}
+CoreToolCallStatus: Validating → AwaitingApproval → Scheduled → Executing → Success|Error|Cancelled
+```
+
+### FolderTrust
+
+Scans: commands (.toml), skills (SKILL.md), settings.json, MCP servers, hooks
+Security warnings: auto-approved tools, autonomous agents, disabled trust,
+disabled sandbox Pattern: discovery → review → execution (no code runs during
+scan)

docs/adk-replat/PRIORITY-ANALYSIS.md

@@ -0,0 +1,349 @@
+# Interface Priority Analysis & Open Questions
+
+## The Big Picture
+
+We're defining **framework-agnostic interfaces** that allow gemini-cli to:
+
+1. Keep its existing execution loop working unchanged (Legacy path)
+2. Swap in ADK as an alternative runtime via config flag
+3. Eventually support OpenRouter or other agent backends
+4. Maintain all existing CLI behavior: hooks, policies, confirmations, UI events
+
+## Proposed Interface Layers (Priority Order)
+
+---
+
+### P0 (Critical Path - Must Define First)
+
+#### 1. AgentEvent / Event Stream Contract
+
+**Why first:** Everything else consumes or produces these events. The UI renders
+them. The hooks intercept them. The adapters translate to/from them.
+
+**Key decision:** Merge Dewitt's simpler model with Coworker's richer model?
+
+**Recommendation:** Coworker's approach is more complete. Key additions:
+
+- `threadId` for sub-agent tracking (AG-UI has `parentRunId`)
+- `tool_update` for progress on long-running tools
+- `elicitation_request/response` as first-class (not just tool_confirmation)
+- `usage` event for token tracking
+- `_meta` escape hatch (matches AG-UI's extensibility philosophy)
+- `initialize` event (matches AG-UI's RunStarted)
+
+**Open questions:**
+
+- Do we need AG-UI's start/content/end triple pattern for streaming? Or is
+  yielding partial events sufficient?
+- How do ContentPart types map to existing gemini-cli Part types?
+- Should events carry a `source` field? (useful for hook attribution)
+
+#### 2. Agent Interface
+
+**Why second:** This is the primary abstraction that LocalAgentExecutor, ADK
+adapters, and future OpenRouter adapters all implement.
+
+**Key decision:** Dewitt's `runAsync/runEphemeral` vs Coworker's
+`send(Trajectory|string)`
+
+**Recommendation:** Hybrid approach:
+
+- Dewitt's `runAsync/runEphemeral` split is ADK-aligned and cleaner for the
+  factory pattern
+- BUT add Coworker's elicitation support via AgentSend union type
+- The Trajectory concept is powerful but may be too opinionated for Phase 2
+
+```
+Agent<TInput, TOutput>
+  name: string
+  description: string
+  runAsync(input, options) → AsyncGenerator<AgentEvent, TOutput>
+  runEphemeral(input, options) → AsyncGenerator<AgentEvent, TOutput>
+```
+
+**Open questions:**
+
+- Should Agent also support `send()` for mid-stream interactions (elicitations)?
+- How does AbortSignal propagate through the adapter boundary?
+- Do we need a `capabilities` field (supports elicitation? supports HITL? etc.)?
+
+#### 3. Tool Execution Contract
+
+**Why third:** Tools are the primary action mechanism. Both the policy engine
+and hooks system wrap tool execution.
+
+**What needs abstracting:**
+
+- Tool declaration (name, schema) — already somewhat generic via JSON Schema
+- Tool execution (args → result)
+- Tool confirmation flow (ASK_USER → user decision → proceed/deny)
+- Tool result shape (llmContent + displayContent + error + tailCalls)
+
+**Key decision:** Keep DeclarativeTool pattern or flatten to a simpler
+interface?
+
+**Recommendation:** Define a minimal `ToolExecutor` interface:
+
+```
+ToolExecutor {
+  name: string
+  description: string
+  schema: JSONSchema
+  execute(args, context): Promise<ToolResult>
+  requiresConfirmation?(args, context): Promise<boolean>
+}
+```
+
+DeclarativeTool remains the concrete implementation. ADK's BaseTool adapts to
+this.
+
+**Open questions:**
+
+- How do MCP tools fit? They already have their own protocol.
+- Tool annotations (destructive hints) — should these be in the interface?
+- Long-running tools need progress reporting — how does this interact with
+  tool_update events?
+
+---
+
+### P1 (Important - Define After P0)
+
+#### 4. Policy / Permission Interface
+
+**Why important:** Every tool call goes through policy. External agents need
+policy enforcement too.
+
+**Current state:** gemini-cli has a sophisticated TOML-based policy engine with
+tiered priorities. ADK-TS has a simpler SecurityPlugin with PolicyOutcome
+(DENY/CONFIRM/ALLOW).
+
+**What needs abstracting:**
+
+```
+PolicyEngine {
+  evaluate(toolName, args, context): PolicyDecision  // ALLOW | DENY | ASK_USER
+  getExcludedTools(): string[]  // Tools statically denied
+}
+```
+
+**Key decision:** Do external agents (OpenRouter, etc.) get the same policy
+enforcement?
+
+**Open questions:**
+
+- If an ADK agent calls a tool internally, does gemini-cli's policy apply?
+- With `pauseOnToolCalls: true` in ADK, the CLI controls execution — but what
+  about headless mode?
+- How do agent-level policies work? (allow/deny entire agents, not just tools)
+- Should policy be a middleware (AG-UI pattern) or a callback (ADK plugin
+  pattern)?
+
+#### 5. Hooks Interface
+
+**Why important:** Hooks are a major gemini-cli feature. They need to work
+regardless of which agent backend runs.
+
+**Current state:** 11 hook types firing at specific lifecycle points.
+
+**What needs abstracting:**
+
+- Hook lifecycle must be backend-agnostic
+- BeforeModel/AfterModel hooks need to work even when ADK controls the model
+- BeforeTool/AfterTool hooks need to intercept regardless of who executes the
+  tool
+
+**Key challenge:** When ADK runs the model internally, gemini-cli hooks can't
+easily intercept. **Dewitt's solution:** ADK uses gemini-cli's model via
+AdkGeminiModel adapter — hooks fire inside GeminiChat.
+
+**Open questions:**
+
+- If OpenRouter runs the model, how do BeforeModel/AfterModel hooks work?
+- Do we need a "model steering" abstraction (injecting context mid-stream)?
+- Can hooks be expressed as AG-UI middleware? (intercept event stream)
+
+#### 6. Model / LLM Interface
+
+**Why important:** Model abstraction enables swapping LLM providers.
+
+**Dewitt's approach:** Exposes Model interface, ADK uses it via AdkGeminiModel
+adapter. **Coworker's approach:** Model is internal to Agent (no separate Model
+interface).
+
+**Recommendation:** Keep Dewitt's separate Model interface BUT make it
+provider-agnostic:
+
+- Remove `@google/genai` types from the interface signature
+- Define generic Message/Content types
+- Model interface is an implementation detail, not part of the Agent contract
+
+**Open questions:**
+
+- Can we define a truly provider-agnostic Model interface?
+- Or is the Model always tied to the agent backend? (ADK uses Gemini, OpenRouter
+  uses whatever)
+- Model routing (choosing which model) — is this a concern of the Model
+  interface or a separate service?
+
+---
+
+### P2 (Important but Can Follow)
+
+#### 7. Session / State Interface
+
+**Current state:** gemini-cli uses ChatRecordingService (JSON files). ADK uses
+Session with BaseSessionService.
+
+**What needs abstracting:**
+
+- Session creation/retrieval
+- State persistence across turns
+- History/trajectory management
+
+**Open questions:**
+
+- Does the trajectory (coworker's concept) replace gemini-cli's chat recording?
+- Should session state be shared between gemini-cli and the agent backend?
+
+#### 8. Elicitation / User Interaction Interface
+
+**What it covers:** Model fallback dialogs, tool confirmations, Ctrl+B
+interrupts, user questions
+
+**Current state:** gemini-cli uses ConfirmationBus + MessageBus. AG-UI uses
+frontend tools.
+
+**Open questions:**
+
+- Is elicitation just a special case of tool calls (AG-UI approach)?
+- Or is it a first-class event type (coworker's approach)?
+- How does Ctrl+B (cancel/interrupt) propagate through the agent boundary?
+
+#### 9. Configuration / Capability Discovery
+
+**What it covers:** Feature flags, experiment settings, agent capabilities
+
+**Open questions:**
+
+- How does an external agent declare its capabilities?
+- Does OpenRouter support HITL? Elicitation? Tool confirmation? Each agent may
+  differ.
+- Need a `capabilities` negotiation at connection time?
+
+---
+
+### P3 (Future / Can Defer)
+
+#### 10. A2UI / Rich UI Interface
+
+- Declarative UI generation from agents
+- Not critical for Phase 2 but important for differentiation
+
+#### 11. Memory / Artifact Interface
+
+- ADK has memory/artifact services
+- gemini-cli has ChatRecordingService + memory tools
+- Can standardize later
+
+#### 12. Telemetry / Observability Interface
+
+- Both systems have telemetry
+- Can standardize later
+
+---
+
+## Critical Open Questions (Need Team Discussion)
+
+### 1. OpenRouter Integration Model
+
+**Question:** When OpenRouter (or any external agent) is used, what does the
+integration look like?
+
+**Option A: Full Agent Interface** — OpenRouter implements the Agent interface
+directly
+
+- Pro: Clean, uniform
+- Con: OpenRouter doesn't support HITL, hooks, policies natively
+
+**Option B: ACP Shim** — Agent Communication Protocol between CLI and external
+agents
+
+- Pro: Standards-based
+- Con: Additional protocol layer, may be premature
+
+**Option C: Model-only Integration** — OpenRouter is just an alternative Model,
+not Agent
+
+- Pro: Simpler, leverages existing agent loop
+- Con: Doesn't support OpenRouter-specific features
+
+**Recommendation:** Start with Option C (model-only). OpenRouter provides an LLM
+endpoint. Gemini-cli's own agent loop handles tools, policies, hooks. This means
+defining a provider-agnostic Model interface is the key enabler.
+
+### 2. Tool Execution: Client-side vs Agent-side
+
+**Question:** Who executes tools — the CLI or the agent backend?
+
+**Option A: Always client-side** (CLI executes, agent suspends)
+
+- ADK: `pauseOnToolCalls: true`
+- Pro: CLI maintains control, policies enforced, hooks fire
+- Con: Higher latency, more round-trips
+
+**Option B: Agent-side execution** (agent runs tools internally)
+
+- Pro: Faster, simpler
+- Con: Bypasses CLI policies, hooks, confirmations
+
+**Option C: Configurable** — CLI decides per-tool or per-agent
+
+- Pro: Flexible
+- Con: Complex
+
+**Recommendation:** Option A for safety-critical CLI use case. Option B only for
+trusted/sandboxed sub-agents.
+
+### 3. Model Steering (Hooks that inject context mid-stream)
+
+**Question:** How do user-local hooks (like injecting project context) work with
+external agents?
+
+**Answer:** They can only work if:
+
+- The CLI controls the model (via Model interface adapter) — then BeforeModel
+  hook injects context
+- OR the agent supports a "system instruction update" mechanism
+
+For OpenRouter: model steering works because CLI controls the model call. For
+ADK: model steering works because AdkGeminiModel wraps GeminiChat. For fully
+opaque agents: model steering **cannot work** — this is a known limitation.
+
+### 4. Elicitation Flow
+
+**Question:** When the agent needs user input (model fallback, clarification),
+how does it work?
+
+**For CLI-controlled agents:** Agent yields an elicitation_request event → CLI
+renders prompt → user responds → CLI sends response back via session.stream({
+kind: 'elicitation_response', ... }) to resume
+
+**For external agents:** Agent uses A2A protocol or similar to send elicitation
+→ CLI bridges the request to user → response sent back via protocol
+
+**Key insight:** Elicitation is fundamentally about the agent SUSPENDING and
+waiting for user input. ADK already supports this via `pauseOnToolCalls`. Can we
+generalize to `pauseOnElicitation`?
+
+### 5. Sub-agent Identity and Policies
+
+**Question:** When a sub-agent spawns, does it inherit parent policies? Get its
+own?
+
+**Current gemini-cli behavior:** Sub-agents registered as tools, go through same
+policy engine. **ADK behavior:** Sub-agents are child nodes in agent tree, get
+parent's plugins.
+
+**Recommendation:** Sub-agents inherit parent policy context. Additional
+restrictions can be layered (e.g., sub-agent X cannot use shell tool). This is
+already how gemini-cli works.

docs/adk-replat/adk_migration_design_doc.md

@@ -0,0 +1,438 @@
+# Architectural Design: Gemini CLI to ADK Migration
+
+| Authors: [Adam Weidman](mailto:adamfweidman@google.com)  Contributors:  Reviewers: *See section [Status of this document](#status-of-this-document).* | Status: Draft  Last revised: Apr 7, 2026 Visibility: Confidential |
+| :--- | :--- |
+
+---
+
+# Goal
+
+To migrate the Gemini CLI backend execution engine from its legacy fragmented loop structure to the Agent Development Kit (ADK). This migration will unify how agents and subagents are orchestrated, simplify state persistence, and expose a standard `AgentSession` interface for the CLI, future SDK surfaces, and subagent execution.
+
+---
+
+# Context
+
+Over time, Gemini CLI has accumulated complex runtime behaviors: multi-tier tool scheduling, policy-driven approvals, payload masking, dynamic routing, and fine-grained telemetry. Integrating these with ADK requires a clean boundary that preserves Gemini CLI semantics without forking ADK core behavior.
+
+The key migration boundary is:
+
+- ADK runtime semantics -> Gemini CLI `AgentProtocol` / `AgentSession`
+- ADK `Event` stream -> Gemini CLI `AgentEvent` stream
+
+That boundary, not the model wrapper alone, is the architectural center of this design.
+
+---
+
+# Current State and Proposed Mappings
+
+The following analysis maps existing Gemini CLI components onto ADK capabilities, citing both repositories (`gemini-cli` and `adk-js`).
+
+## Core Runtime Architecture
+
+The migration uses one shared ADK-backed runtime core. Every orchestrated agent, including subagents, is exposed through the same external session contract:
+
+- **Top-level CLI agent** -> `AgentSession`
+- **Future SDK entry point** -> `AgentSession`
+- **Subagent execution** -> `AgentSession`
+
+The runtime owns:
+
+- ADK runner/session lifecycle
+- tool execution
+- policy integration
+- routing, availability, compaction, and masking hooks
+- persistence integration
+
+The adapters own:
+
+- `streamId` timing guarantees
+- replay / reattach behavior
+- translation from ADK `Event` to Gemini CLI `AgentEvent`
+- top-level versus subagent event projection
+- projection of a child `AgentSession` into parent-facing tool or thread events when a subagent is embedded inside another agent
+
+The minimum shape is:
+
+```typescript
+interface PipelineServices {
+  run(
+    request: LlmRequest,
+    baseModel: BaseLlm,
+    stream: boolean,
+  ): AsyncGenerator<LlmResponse, void>;
+  connect(
+    request: LlmRequest,
+    baseModel: BaseLlm,
+  ): Promise<BaseLlmConnection>;
+}
+
+class GcliAgentModel extends BaseLlm {
+  constructor(
+    private baseModel: BaseLlm,
+    private pipeline: PipelineServices,
+  ) {
+    super({model: 'gcli-consolidated'});
+  }
+
+  async *generateContentAsync(
+    request: LlmRequest,
+    stream = false,
+  ): AsyncGenerator<LlmResponse, void> {
+    yield* this.pipeline.run(request, this.baseModel, stream);
+  }
+
+  async connect(request: LlmRequest): Promise<BaseLlmConnection> {
+    return this.pipeline.connect(request, this.baseModel);
+  }
+}
+```
+
+Design rule:
+
+- request mutation stays in the pipeline
+- all orchestrated agents expose the same `AgentSession` contract
+- session lifecycle, replay, approvals, and subagent projection stay in the runtime/adapters
+
+`AdkAgentService` is the composition root for this architecture. It creates and resumes both top-level and subagent `AgentSession`s, builds scoped registries and message-bus instances, wires policy and approval bridges, and embeds child sessions through projection adapters rather than through a separate subagent runtime. See Appendix A for the intended initialization shape.
+
+Composition rule:
+
+- stateful tools are cloned or reinstantiated per session when needed; stateless tools may be shared
+- MCP discovery is shared at the manager layer but registered into session-local tool, prompt, and resource registries
+- `AgentLoopContext` is decomposed into pipeline config, tool/subagent config, session services, callback bridges, and UI projection rather than passed through as a single runtime object
+- file persistence remains Gemini CLI-owned through `GcliFileSessionService extends BaseSessionService`
+
+Persistence rule:
+
+- persisted history is an append-only event log plus derived app/user/session state
+- the session service provides atomic append, crash-safe recovery, and single-writer enforcement
+- rewind truncates the event log, recomputes derived state, and invalidates confirmation/resumption state past the rewind point
+
+## 3.1 Authentication Flexibility
+
+The CLI resolves distinct authentication flows (OAuth, ADC, Compute metadata) using standard Google libraries.
+
+*   **Current State:** Resolved in `packages/core/src/code_assist/oauth2.ts` based on `AuthType`.
+    *   OAuth (`LOGIN_WITH_GOOGLE`)
+    *   Compute Metadata Server (`COMPUTE_ADC`)
+*   **Constraint:** Standard `Gemini` construction in `adk-js/core/src/models/google_llm.ts` still selects backend from constructor-level `apiKey` or Vertex config. It does **not** natively accept Gemini CLI's `AuthClient`-driven auth shape.
+*   **Proposed ADK Mapping:** Phase 1 keeps auth in `GcliAgentModel`. The pipeline resolves refreshed credentials and injects them through `request.config.httpOptions.headers` for unary requests and `request.liveConnectConfig.httpOptions.headers` for live connections.
+*   **Design position:** This is a **bridge**, not native ADK auth parity. Long-term cleanup is either:
+    *   a `CodeAssistLlm extends BaseLlm`, or
+    *   an upstream ADK auth-provider abstraction.
+
+```typescript
+request.config ??= {};
+request.config.httpOptions ??= {};
+request.config.httpOptions.headers = {
+  ...request.config.httpOptions.headers,
+  Authorization: `Bearer ${await auth.getAccessToken()}`,
+};
+```
+
+## 3.2 Model Steering and Mid-Stream Injection
+
+User interjections (hints) course-correct the loop mid-turn.
+
+*   **Current State:** Steering today is tied to the legacy loop and injection services.
+*   **Proposed ADK Mapping (Next-Step Steering):** Supported in Phase 1. `beforeModelCallback` can read queued hints and mutate the next outbound request.
+*   **Proposed ADK Mapping (True Real-Time Interrupt):** Still blocked. TypeScript ADK live runtime is not complete yet, and input-stream semantics are not a stable dependency.
+*   **Phase 1 behavior:** user interjections are queued and prepended to the next model request at tool or turn boundaries. True in-place turn interruption remains out of scope.
+
+## 3.3 State Management and Token Compaction
+
+The CLI truncates large tool responses and summarizes older history to protect token budgets.
+
+*   **Current State:** `ChatCompressionService` in `packages/core/src/context/chatCompressionService.ts` implements reverse token budgeting and a two-phase verification loop.
+*   **Proposed ADK Mapping:** Compaction remains a Gemini CLI-owned history processor invoked by the request pipeline.
+*   **Design position:** Phase 1 does **not** force this onto ADK `BaseContextCompactor`. Gemini CLI compression is currently an outbound-history projection with truncation plus summary/verification sub-calls, while ADK's native compactor path is event-log-centric and mutates session history.
+*   **Design choice:** In Phase 1, compaction mutates **outgoing request history only**. The persisted session event log remains canonical.
+*   **Utility calls:** Compaction sub-calls use the same routing, auth, and availability pipeline as primary model calls.
+
+## 3.4 Model Configuration and Hierarchical Overrides
+
+Dynamic aliasing (for example, temperature scoped to specific sub-commands).
+
+*   **Current State:** Managed by `ModelConfigService`.
+*   **Proposed ADK Mapping:** Resolution stays **request-scoped**, not session-init-scoped.
+*   **Design choice:** The session stores requested model and override state. The runtime resolves the concrete model and temperature on each request, including retries, subagents, and utility calls.
+
+## 3.5 Universal Policy Enforcement (TOML Rules)
+
+Tiered workspace restrictions (for example, read-only tools in untrusted folders).
+
+*   **Current State:** Intercepted at tool scheduling time in legacy scheduler loops.
+*   **Proposed ADK Mapping (Container):** Standardize on ADK `SecurityPlugin`.
+*   **Proposed ADK Mapping (Decision Brain):** Implement `GcliPolicyEngineAdapter implements BasePolicyEngine`.
+*   **Richer context:** The adapter is fed session/mode/subagent/MCP metadata from the runtime so current Gemini CLI policy semantics are preserved as closely as possible.
+*   **Phase 1 suspension flow:** current tool approvals use existing Gemini CLI callbacks. This is intentionally **non-native** and **non-resumable across process death**.
+*   **Long-term target:** move the same policy decisions onto native ADK confirmation/resumption semantics once the broader live/elicitation surface is ready.
+
+```typescript
+interface GcliPolicyBridge {
+  evaluate(context: ToolCallPolicyContext): Promise<PolicyCheckResult>;
+}
+
+export class GcliPolicyEngineAdapter implements BasePolicyEngine {
+  constructor(private readonly policyBridge: GcliPolicyBridge) {}
+
+  async evaluate(context: ToolCallPolicyContext): Promise<PolicyCheckResult> {
+    return this.policyBridge.evaluate(context);
+  }
+}
+```
+
+## 3.6 Telemetry and Observability (Clearcut Tracking)
+
+Hardware metrics, token counts, and step durations.
+
+*   **Current State:** `ClearcutLogger` reads system metrics and relies on deep scheduler hooks for latency accounting.
+*   **Proposed ADK Mapping:** Use a combination of:
+    *   passive event-stream observation, and
+    *   explicit runtime instrumentation where passive ADK events are insufficient.
+*   **Correlation rule:** tool timing is keyed by `functionCall.id`, **not** by `event.id`.
+*   **Design position:** Passive stream interception alone is not assumed to provide full parity.
+
+## 3.7 Dynamic Model Routing and Configurability
+
+Banning a model mid-turn, auto-routing via classifiers, and falling back dynamically without reinitializing the session.
+
+*   **Current State:** Managed by `ModelRouterService` and a chain of `RoutingStrategy` implementations which require the full `RoutingContext` (`history`, `request`, `AbortSignal`).
+*   **Proposed ADK Mapping:** Mostly implementable now, but not “100% possible today” without bridge logic.
+*   **Design choice:** The runtime constructs a proper `RoutingContext` from:
+    *   canonical session history
+    *   the pending user request
+    *   requested model
+    *   abort signal
+*   **Execution point:** routing remains request-scoped and runs before final dispatch.
+*   **Model banning:** treated as routing/fallback selection, not as a synthetic terminal model error.
+
+## 3.8 Fallbacks and Availability Management
+
+Ensuring availability by retrying or switching models when rate limits (429s) or terminal faults occur.
+
+*   **Current State:** Managed by `ModelAvailabilityService` and `ModelPool`.
+*   **Proposed ADK Mapping (Preflight):** availability and fallback selection run before dispatch and before routing commits to a concrete model.
+*   **Proposed ADK Mapping (Post-failure):** handled separately by the runtime. Availability state mutation and retry decisions are not treated as pure request preprocessing.
+*   **Global Application:** utility calls use the same availability/fallback services as primary model calls.
+*   **Retry safety rule:** automatic full-turn replay is allowed only before any side-effecting tool has executed. After side effects, the runtime surfaces the failure and requires explicit user action.
+*   **Phase 1 transition path:** approvals and fallback prompts continue to use existing Gemini CLI callbacks. The doc treats this as an internal bridge, not as an existing standard ADK elicitation API.
+
+## 3.9 State-Driven Mode Switching (Plan Mode)
+
+Dynamically shifting system prompts and active tools when users switch interaction tiers (for example, Chat Mode to Plan Mode).
+
+*   **Current State:** Toggled via `/plan`, which changes `ApprovalMode` and related legacy scheduler behavior.
+*   **Proposed ADK Mapping (Dynamic Prompt):** Use `InstructionProvider` in `LlmAgentConfig.instruction`.
+*   **Proposed ADK Mapping (Dynamic Tooling):** Use a custom `BaseToolset` whose filter is derived from session mode.
+*   **Single source of truth:** mode is session/runtime state derived from current approval mode; prompt, toolset, policy, routing, and UI all consume the same state.
+
+```typescript
+export class GcliModeAwareToolset extends BaseToolset {
+  constructor(
+    private readonly chatTools: BaseTool[],
+    private readonly planTools: BaseTool[],
+  ) {
+    super(() => true);
+  }
+
+  async getTools(context?: ReadonlyContext): Promise<BaseTool[]> {
+    const isPlan = context?.state.get('plan_mode') === true;
+    return isPlan ? this.planTools : this.chatTools;
+  }
+
+  async close(): Promise<void> {}
+}
+```
+
+## 3.10 Tool Output Masking
+
+Managing context window efficiency by offloading bulky tool outputs (for example, shell logs and large file reads) to files.
+
+*   **Current State:** `ToolOutputMaskingService` in `packages/core/src/context/toolOutputMaskingService.ts`.
+*   **Proposed ADK Mapping:** masking runs on **outgoing request history only**, after compaction.
+*   **Design choice:** persisted session history remains the canonical event log. Masking artifacts are session-scoped files referenced from the outbound request projection.
+
+---
+
+# 5. Known Gaps in ADK (Gating Blockers)
+
+This section highlights existing gaps in standard ADK that prevent a seamless cutover without bridge logic or upstream changes.
+
+## 5.1 Real-Time User Message Injections (Aborted Turns)
+
+While next-step steering is possible today using `beforeModelCallback`, true real-time interruption requires:
+
+- stable input-stream support, and
+- a complete TypeScript live runtime
+
+Until then, the supported behavior is queued next-step steering at model boundaries, not mid-stream interruption.
+
+## 5.2 Conversation Rewind and State Reversal
+
+Translating manual trajectory drops to ADK runtime state is cumbersome. While Python ADK supports rollback, TypeScript ADK does not yet support it natively.
+
+*   **Resolution Strategy:** Gemini CLI implements rewind in `GcliFileSessionService`, but **not** as a shallow JSON edit. Rewind truncates the event log, recomputes derived state, and invalidates any confirmation/resumption state past the rewind point.
+
+## 5.3 Phase 1 Non-Goals
+
+To keep the migration surface bounded, Phase 1 intentionally excludes:
+
+- non-interactive surfacing of `elicitation_request` / `elicitation_response`
+- true live/bidi interruption semantics
+- native ADK confirmation/resumption parity for approvals and fallback prompts
+
+---
+
+# Long-Term Vision: Unification of Agents and Subagents
+
+The long-term vision is that subagents and the primary agent share:
+
+- the same runtime core
+- the same tool definitions
+- the same policy constraints
+- the same configuration schemas
+- the same orchestration contract: `AgentSession`
+
+What may differ is the **embedding adapter**:
+
+- standalone/top-level agent -> consumed directly as `AgentSession`
+- subagent embedded by a parent agent -> projected from its `AgentSession` into parent-facing tool or child-thread events
+
+For SDK-first unification, Gemini CLI orchestration targets `AgentSession`, not a specific ADK tool abstraction. When a subagent must be exposed to a parent model as a tool, Gemini CLI wraps that child `AgentSession` with a `FunctionTool` or custom `BaseTool` projection. `AgentTool` remains the native ADK nested-agent option if we later want full ADK-native nested-agent semantics.
+
+---
+
+# Migration Sequence and Unification Checklist
+
+The migration remains non-sequential, but each phase has an explicit success condition:
+
+- [ ] **Non-interactive session parity** `#22699`
+  output/error parity, basic replay correctness, feature-flagged rollout
+- [ ] **Interactive session parity** `#22701`
+  projected event parity, approval bridge wiring, no live-interrupt claim
+- [ ] **Subagent adapter parity** `#22700`
+  tool isolation, activity projection, policy/routing parity for child runs
+- [ ] **ADK session conformance** `#22974`
+  `AgentSession` timing/replay guarantees preserved by the adapter
+- [ ] **Skills parity** `#22966`
+  skills work through the shared runtime without special legacy paths
+- [ ] **Policy and confirmation parity** `#22964`
+  phase-1 callback bridge stable; native confirmation migration scoped separately
+- [ ] **Compaction quality parity** `#22979`
+  comparable summarization and truncation quality to current behavior
+
+---
+
+# Appendix A: Initialization Sketch
+
+The main agent and subagents share the same composition root. The difference is whether the resulting `AgentSession` is consumed directly or projected into a parent session.
+
+```typescript
+shared = {
+  baseModel,
+  modelConfigService,
+  availabilityService,
+  router,
+  authService,
+  policyEngine,
+  mcpClientManager,
+  skillCatalog,
+  baseToolCatalog,
+  sessionService,
+}
+
+agentService = new AdkAgentService(shared)
+
+function createSession(definition, parentSessionId?) {
+  sessionRecord = sessionService.create({ definition, parentSessionId })
+  registries = buildScopedRegistries(definition, parentSessionId)
+  pipeline = createPipeline({
+    sessionId: sessionRecord.id,
+    agentId: definition.name,
+    parentSessionId,
+  })
+
+  model = new GcliAgentModel(baseModel, pipeline)
+  runtime = createAdkRuntime({
+    definition,
+    model,
+    sessionRecord,
+    registries,
+    policyEngine,
+  })
+
+  return new AgentSession(new AdkAgentProtocolAdapter(runtime))
+}
+
+function createSubagentTool(definition) {
+  return new FunctionTool(async (input, toolContext) => {
+    child = createSession(definition, toolContext.sessionId)
+    stream = await child.send(userMessage(input))
+
+    for await (event of child.stream(stream)) {
+      projectChildEventToParent(toolContext, event)
+    }
+
+    return collectFinalText()
+  })
+}
+```
+
+Child session projection shape:
+
+```typescript
+emit(tool_request({ requestId, name: definition.name, args: input }))
+
+for await (event of childSession.stream({ streamId })) {
+  if (event.type === 'message' || event.type === 'tool_update') {
+    emit(
+      tool_update({
+        requestId,
+        content: projectDisplayContent(event),
+      }),
+    )
+    continue
+  }
+
+  if (event.type === 'error') {
+    emit(
+      tool_response({
+        requestId,
+        name: definition.name,
+        isError: true,
+        content: projectErrorContent(event),
+      }),
+    )
+    return
+  }
+
+  if (event.type === 'agent_end') {
+    emit(
+      tool_response({
+        requestId,
+        name: definition.name,
+        content: collectFinalChildResult(),
+      }),
+    )
+    return
+  }
+}
+```
+
+Only the final `tool_response` is returned to the parent model. `tool_update` remains a progress/UI projection surface.
+
+Service lifetime split:
+
+- shared across sessions: model config, availability, routing, auth, policy engine, MCP manager, skill catalog
+- scoped per agent/session: `AgentSession`, pipeline instance, tool/prompt/resource registries, derived message bus
+- scoped per invocation: shell process, MCP request, confirmation continuation, tool progress updates
+
+---
+
+# Status of this document approvals table {#status-of-this-document}
+
+| #begin-approvals-addon-section See [go/g3a-approvals](http://goto.google.com/g3a-approvals) for instructions on adding reviewers. |
+| :---: |
+.

docs/adk-replat/unified-review.md

@@ -0,0 +1,554 @@
+# Unified ADK CLI Design Review
+
+Date: 2026-04-06
+
+> **Rollout:** All ADK migration work is feature-gated behind `experimental.adk` flags. No behavioral changes ship without an explicit opt-in. This applies to both non-interactive and interactive flows.
+
+Inputs merged:
+- `claude-adk-cli-design-review.md` (adversarial code-level review)
+- `codex-adk-cli-design-review.md`
+- Follow-up review discussion on subagent architecture, session semantics, and `BaseContextCompactor`
+
+Scope reviewed:
+- `gemini-cli/docs/adk-replat/adk_migration_design_doc.md`
+- `gemini-cli` `AgentProtocol` / `AgentSession` / interactive migration work
+- `adk-js` runner / session / tool / security / model architecture
+- PR context for interactive migration, including `google-gemini/gemini-cli#24297`
+
+## Executive Summary
+
+The design is directionally sound and the migration goal is correct. However, the document is not yet principal-review ready due to:
+
+1. **Four non-compilable code samples** (C1-C4) that will immediately erode reviewer confidence
+2. **An under-specified translation boundary** — the ADK→AgentProtocol mapping is the real architecture, but the doc treats it as an afterthought
+3. **Overclaimed parity** in routing, telemetry, and approvals
+4. **Missing phased plan** with clear milestones and non-goals
+
+The central architectural insight is right: the migration boundary is:
+
+- `adk-js Event -> Gemini CLI AgentEvent`
+- `adk-js session/runtime semantics -> AgentProtocol / AgentSession semantics`
+
+That boundary carries stream lifecycle, replay/resume, event projection, approval correlation, and persistence correctness. Until the translation architecture is explicit, parity claims remain unsupported.
+
+## Compilation Blockers (Must Fix First)
+
+These are binary errors — the code samples in the design doc will not compile against current ADK types.
+
+### C1. `LlmRequest` has no `headers` field
+
+`adk-js/core/src/models/llm_request.ts` defines: `model?`, `contents`, `config?`, `liveConnectConfig`, `toolsDict`. The design doc's `request.headers = {...}` will silently fail or not compile. **Fix:** use `llmRequest.config.httpOptions.headers` or pass headers at `Gemini` constructor time.
+
+### C2. `BaseLlm.connect()` is abstract and unimplemented
+
+`adk-js/core/src/models/base_llm.ts:67-78` has TWO abstract methods: `generateContentAsync` and `connect()`. `GcliAgentModel` must implement both. **Fix:** add `connect()` — stub with `throw new Error('not supported')` if live connections are out of scope.
+
+### C3. `BaseToolset` constructor signature is wrong
+
+`adk-js/core/src/tools/base_toolset.ts:46-49`: `constructor(readonly toolFilter: ToolPredicate | string[], readonly prefix?: string)`. The design doc's `super([])` passes an empty array as `toolFilter`, which makes `isToolSelected` return false for all tools — a silent bug. Also `close()` is abstract and must be implemented. **Fix:** match the actual signature.
+
+### C4. `FunctionalTool` does not exist
+
+The design doc references `FunctionalTool` for subagent wrapping. This class does not exist in adk-js. The correct classes are `FunctionTool` (wraps a plain function) and `AgentTool` (wraps an agent with isolated runner). See subagent architecture section below for the recommended approach.
+
+---
+
+## High-Risk Findings
+
+### 1. The actual migration boundary is under-specified
+
+Current `AgentProtocol` requires `send()` timing guarantees, replay/reattach semantics, `streamId`, and optional `threadId` for subagent threads in `gemini-cli/packages/core/src/agent/types.ts` and `gemini-cli/packages/core/src/agent/agent-session.ts`.
+
+ADK emits a different event model in `adk-js/core/src/events/event.ts`.
+
+The doc needs a first-class architecture section for:
+- `AdkSessionRuntime`
+- `AdkEventTranslator`
+- event buffering / replay
+- `threadId` mapping
+- `tool_update` mapping
+- `agent_start` / `agent_end` ownership
+
+Without that, the rest of the design sits on an unstated core contract.
+
+### 2. The consolidated decorator needs two concerns extracted
+
+The `GcliAgentModel.generateContentAsync` pipeline is a reasonable orchestrator pattern — each concern is a separate injected service call, not a monolithic class. However, two concerns don't belong in the model layer:
+
+- **Quota/availability prompting** — involves interactive UI suspension, not request mutation. Should use `beforeModelCallback` on `LlmAgent`.
+- **Policy/approval control flow** — involves blocking for user input. Should use `beforeToolCallback` or the `ApprovalBridge` (see architecture section).
+
+The remaining concerns (auth header injection, routing/model rewrite, compaction, masking) are legitimate request-preprocessing and can stay in the model pipeline.
+
+### 3. The design frequently conflates “possible with custom logic” with “supported by current ADK architecture”
+
+This is one of the main wording risks.
+
+Several statements currently read like native ADK parity when the real meaning is:
+- possible with substantial Gemini CLI-owned bridge logic
+- possible by bypassing native ADK facilities
+- possible only for phase 1 with intentionally degraded semantics
+
+That distinction needs to be explicit everywhere the doc uses strong language like “validated” or “100% possible today.”
+
+### 4. Auth architecture is deeper than header injection — Coast Assist requires a custom transport
+
+The auth section has two distinct problems:
+
+**Problem A: API surface mismatch (C1).** `LlmRequest` has no `headers` field. Per-request headers are possible via `llmRequest.config.httpOptions.headers`, and `Gemini` constructor accepts a `headers` param (`google_llm.ts:57,79`). This is fixable.
+
+**Problem B: Coast Assist / `LOGIN_WITH_GOOGLE` uses a different backend entirely.** The current `CodeAssistServer` (`packages/core/src/code_assist/server.ts:407`) does NOT call the standard Gemini API. It uses `google-auth-library`'s `AuthClient.request()` to talk to a Code Assist backend endpoint. The OAuth flow (`packages/core/src/code_assist/oauth2.ts`) handles browser launch (L305), local callback server (L492-615), token exchange (L546-550), credential caching (L739-750), and automatic token refresh via `OAuth2Client`.
+
+This means `GcliAgentModel` cannot wrap a standard `Gemini` BaseLlm and just inject headers. For Coast Assist auth, `GcliAgentModel` must **extend `BaseLlm` directly** and implement its own HTTP transport using `AuthClient.request()`, translating between `LlmRequest`/`LlmResponse` and the Code Assist protocol.
+
+What works:
+- The OAuth dance itself (browser launch, token caching, refresh) runs before the agent session starts — no blocking inside `generateContentAsync`
+- `OAuth2Client.getAccessToken()` handles mid-session token refresh transparently
+- Per-request header injection works for API-key-based auth via `httpOptions.headers`
+
+What the design doc must change:
+- Stop assuming `Gemini` as the inner model — `GcliAgentModel extends BaseLlm` directly
+- Define two transport paths: standard Gemini API (API key) and Code Assist backend (OAuth)
+- The dummy-key workaround is irrelevant for Coast Assist — you never call `GoogleGenAI.models.generateContent`
+
+### 5. Approval / elicitation bridging is acceptable only as a temporary non-native bridge
+
+The design’s callback-based approval approach is pragmatic for phase 1, but it bypasses native ADK confirmation semantics.
+
+`adk-js/core/src/plugins/security_plugin.ts` and `adk-js/core/src/agents/processors/request_confirmation_llm_request_processor.ts` show that ADK’s model is:
+- `ALLOW | DENY | CONFIRM`
+- persisted confirmation state
+- later resumption from history
+
+Blocking in callbacks may be acceptable for the first rollout, but the doc must say clearly:
+- local-only bridge
+- not resumable across process death
+- not long-term SDK behavior
+- intentionally non-native pending future elicitation/bidi work
+
+### 6. Rewind is deeper than file truncation
+
+The doc treats rewind as storage truncation. The storage part is straightforward — `GcliFileSessionService` wraps the existing `ChatRecordingService` and implements 4 abstract methods (`createSession`, `getSession`, `listSessions`, `deleteSession`). DB-level concerns (locking, stale-writer detection, `PESSIMISTIC_WRITE`) do not apply to a single-user CLI.
+
+However, rewind itself is not just storage:
+- `adk-js/core/src/agents/processors/request_confirmation_llm_request_processor.ts` scans event history to reconstruct pending confirmations and resume tool execution
+- `adk-js/core/src/runner/runner.ts:447` has a TODO acknowledging the event log is used as a transaction log
+- Truncating events without rolling back derived state (pending confirmations, app/user state prefixes) will break resumption
+
+The doc should define rewind as: event-log truncation + session state recomputation + confirmation/auth state rollback.
+
+Note: `BaseSessionService.appendEvent` handles state merging with `app:`, `user:`, `temp:` prefixed keys automatically — this is inherited for free.
+
+### 7. Routing, telemetry, and plan mode are all overclaimed
+
+Routing:
+- current routing requires a richer `RoutingContext`
+- `contents.slice(0, -1)` / `contents.pop()` is not a sufficient or type-accurate mapping
+- model banning via simulated error is not the same as model routing
+
+Telemetry:
+- **The stream-interceptor approach in section 3.6 is wrong.** The correct mechanism is ADK's `BasePlugin` system.
+- `event.id` is not a safe per-tool correlation key — use `functionCall.id` via `beforeToolCallback`/`afterToolCallback`
+- ADK can batch multiple function calls or responses in one event — stream interception cannot distinguish them, but plugin hooks fire per-tool with distinct `functionCallId`
+- **Correction:** Token usage IS available on ADK events. `llm_agent.ts:831-834` spreads `LlmResponse` (including `usageMetadata`) into the event via `createEvent({...modelResponseEvent, ...llmResponse})`. Additionally, `afterModelCallback` receives the raw `LlmResponse` with `usageMetadata` directly — providing a second capture point.
+- HTTP-level metrics (status code, request duration) are NOT on ADK events — must be captured in the `GcliAgentModel` wrapper
+- The sample APIs in the design do not match the current `ClearcutLogger` taxonomy (~195 distinct metadata keys)
+
+**Recommended telemetry architecture:**
+
+| Metric Category | Capture Mechanism | ADK Hook |
+|---|---|---|
+| Token counts (input, output, cached, thinking) | `afterModelCallback` → `LlmResponse.usageMetadata` | `BasePlugin.afterModelCallback` |
+| Per-tool timing | Timer keyed on `functionCallId` | `BasePlugin.beforeToolCallback` / `afterToolCallback` |
+| Agent lifecycle | Start/end tracking | `BasePlugin.beforeAgentCallback` / `afterAgentCallback` |
+| Model errors | Error classification | `BasePlugin.onModelErrorCallback` |
+| HTTP status, API duration | Captured in model wrapper | `GcliAgentModel.generateContentAsync` |
+| Routing decisions, latency | Captured in model or beforeModelCallback | `beforeModelCallback` / model wrapper |
+| Context token breakdowns (system, tools, history) | Computed in request pipeline | Model wrapper |
+| Tool approval decisions | Injected from approval layer | `ApprovalBridge` |
+| Session config, compression, rewind, IDE, extensions, billing, slash commands, hooks, plan execution, onboarding | **Unchanged** — stays in current call sites | Existing gemini-cli code |
+
+~30% of Clearcut metrics map to ADK plugin hooks. ~70% remain in their current call sites unchanged.
+
+Plan mode:
+- current behavior is broader than prompt + tool filtering
+- policy, approval mode, routing, and config refresh are all part of the behavior
+
+### 8. Retry safety around side effects (note)
+
+The “full turn reset” proposal could duplicate side effects (file writes, shell commands, MCP mutations) if the turn already executed side-effecting tools before the stream failure. This is an ADK-wide concern, not specific to this migration. A brief note acknowledging this limitation is sufficient — a full retry safety taxonomy is out of scope for this design.
+
+### 9. Design ignores ADK's native `BaseContextCompactor`
+
+ADK already has a compaction extension point: `BaseContextCompactor` (`adk-js/core/src/context/base_context_compactor.ts`) with `shouldCompact(invocationContext)` + `compact(invocationContext)`. It's wired into the request processor pipeline via `ContextCompactorRequestProcessor` at `llm_agent.ts:407-420`.
+
+The design doc proposes running compaction inside `GcliAgentModel.generateContentAsync` instead. This works but bypasses the native slot. Recommendation: implement `BaseContextCompactor`, delegate to the existing `ChatCompressionService` internally. ADK provides the trigger point; your service provides the logic. Note that `BaseContextCompactor` returns void — failure states (COMPRESSED, NOOP, CONTENT_TRUNCATED, etc.) must be communicated via session state or custom events.
+
+### 10. Existing `isStructuredError` type-guard bug
+
+`gemini-cli/packages/core/src/agent/event-translator.ts:431-438`: `isStructuredError()` checks only `typeof error === 'object' && 'message' in error && typeof error.message === 'string'`. Since every `Error` instance has `message: string`, plain `Error` objects pass this guard. In `mapError` (lines 390-429), the structured branch runs before `instanceof Error`, so plain errors get incorrect HTTP→gRPC status mapping. This should be fixed before the translator becomes the long-term session boundary. **Fix:** add `'status' in error` to the guard, or check `instanceof Error` first.
+
+### 11. The review should distinguish architecture defects from rollout-status evidence
+
+The interactive PR findings matter:
+- stacked-branch dependency
+- hook-order risk in `#24297`
+- `_meta.legacyState` leakage into protocol events
+
+But they are secondary to the core design defect, which is the missing runtime/translation architecture.
+
+These findings should stay in the review, but as credibility and rollout-risk evidence rather than the centerpiece.
+
+## Recommended Architecture
+
+This is the cleanest merged recommendation from both reviews plus follow-up discussion.
+
+### Core principle
+
+Use one shared ADK-based execution/runtime core, then put different adapters on top of it.
+
+Do not make `AgentSession` the innermost engine.
+
+### Recommended split
+
+1. `AdkRuntimeCore`
+- owns the ADK runner loop
+- owns tool execution, policy integration, routing integration, masking, compaction hooks, and persistence hooks
+- emits runtime-level activity/events
+
+2. `TopLevelSessionAdapter`
+- exposes the runtime as `AgentProtocol` / `AgentSession`
+- owns replay, reattach, `streamId`, `threadId`, `agent_start` / `agent_end`, and top-level event projection
+
+3. `SubagentTools` (custom `BaseTool` implementations)
+- subagents invoke the same shared runtime core as the main agent
+- the only difference is the type mapping at the boundary (projecting child activity into parent-facing `tool_update` / `tool_response` or `threadId`-scoped events)
+- `AgentTool` is explicitly rejected — it creates a fully isolated runner/session, which conflicts with the shared-core goal
+- custom `BaseTool` wrappers allow subagents to share policy, routing, tool definitions, and config with the parent while keeping the door open for future resumability and richer state sharing
+
+4. `ApprovalBridge`
+- phase-1 callback bridge for approvals / elicitation using existing callbacks
+- clearly documented as temporary and non-native
+- eventual migration to full elicitation bidi format
+
+5. `GcliFileSessionService`
+- file-backed persistence wrapping existing `ChatRecordingService`
+- implements 4 abstract methods from `BaseSessionService`
+- inherits state-merging (app/user/temp prefixes) for free
+- single-writer model — concurrent runs per session are forbidden
+
+### Subagent architecture decision
+
+`AgentTool` is not the right abstraction for this migration. It creates an isolated runner with its own `InMemorySessionService`, meaning:
+- state is NOT shared with the parent
+- events are NOT projected into the parent stream
+- policy, routing, and config are NOT inherited
+
+The core requirement is that subagents use the same core loop functionality as the main agent — the only difference is how results are mapped back to the parent. Custom `BaseTool` implementations that invoke the shared `AdkRuntimeCore` achieve this. This also positions subagents for future complexity (resumability, richer state sharing, MCP-scoped tool sets) without fighting AgentTool's isolation model.
+
+### Session conclusion
+
+Main agent and subagents can share the same underlying runtime core.
+
+But they should not necessarily share the exact same public adapter.
+
+The right formulation is:
+- same core runtime
+- different event/session projections depending on embedding context
+
+## Section-by-Section Unified Review
+
+### 3.1 Authentication Flexibility
+
+Assessment: implementable, but the design doc’s approach is wrong for Coast Assist.
+
+Keep:
+- ADK `Gemini` does not natively accept the CLI’s auth shape
+
+Change:
+- `GcliAgentModel` must extend `BaseLlm` directly, not wrap `Gemini` — Coast Assist uses `AuthClient.request()` against a non-standard backend, not `GoogleGenAI`
+- fix `request.headers` to `llmRequest.config.httpOptions.headers` (C1)
+- define two transport paths: API-key (standard Gemini) and OAuth (Code Assist)
+- token refresh is transparent via `OAuth2Client` — this works as-is
+- browser-based OAuth runs before agent session starts — no blocking concern
+
+### 3.2 Model Steering and Mid-Stream Injection
+
+Assessment: next-turn steering is plausible now; true live interruption is still blocked.
+
+Required change:
+- split “next-step steering” from “true mid-turn interruption”
+- define temporary user-visible behavior until live input-stream support exists
+
+### 3.3 State Management and Token Compaction
+
+Assessment: plausible, but too wrapper-centric.
+
+Required change:
+- specify whether compaction operates on persisted history, outgoing request history, or both
+- define recursion guards and utility-call isolation
+- define artifact ownership across sessions and subagents
+
+### 3.4 Model Configuration and Hierarchical Overrides
+
+Assessment: under-specified.
+
+Required change:
+- model config resolution should remain request-scoped
+- preserve scoped overrides and retry-aware behavior
+- explain subagent and utility-call override behavior
+
+### 3.5 Universal Policy Enforcement
+
+Assessment: acceptable as a bridge, not as full parity.
+
+Required change:
+- explicitly document reduced phase-1 semantics
+- list policy inputs lost unless extra context plumbing is added
+- separate short-term callback bridge from long-term native confirmation flow
+
+### 3.6 Telemetry and Observability (Clearcut)
+
+Assessment: fully implementable, but the stream-interceptor approach must be replaced with a `BasePlugin`.
+
+Required change:
+- replace stream interception with `ClearcutTelemetryPlugin extends BasePlugin`
+- use `afterModelCallback` for token counts (`LlmResponse.usageMetadata` is available)
+- use `beforeToolCallback`/`afterToolCallback` with `functionCallId` for per-tool timing
+- capture HTTP-level metrics (status code, duration) in `GcliAgentModel` wrapper
+- ~70% of Clearcut metrics stay in their current call sites unchanged — document which
+- replace fake API examples with a telemetry parity matrix showing capture mechanism per metric
+
+### 3.7 Dynamic Model Routing and Configurability
+
+Assessment: partly feasible, materially overstated.
+
+Required change:
+- remove “100% possible today”
+- separate alias rewrite, fallback selection, classifier routing, and banning/rejection behavior
+- define a real `RoutingContextBuilder`
+
+### 3.8 Fallbacks and Availability Management
+
+Assessment: incomplete.
+
+Required change:
+- split preflight fallback from post-failure transition behavior
+- define retry safety
+- define main-call vs utility-call fallback ownership
+
+### 3.9 State-Driven Mode Switching
+
+Assessment: too narrow.
+
+Required change:
+- define a single mode state source of truth
+- enumerate all consumers: prompt, toolset, policy, router, UI
+
+### 3.10 Tool Output Masking
+
+Assessment: one of the stronger sections.
+
+Required change:
+- define whether masking mutates persisted history or only outgoing request history
+- define ordering and idempotence relative to compaction
+- define file/artifact lifecycle
+
+### 4. SDK Facade / Stateful Orchestration
+
+Assessment: this should become the architectural center of the document.
+
+Required change:
+- expand ownership boundaries
+- describe the shared runtime plus adapter model
+- document temporary approval/elicitation limitations explicitly
+
+### 4.1 Hybrid Tool Instantiation
+
+Assessment: directionally good.
+
+Required change:
+- include message bus derivation
+- include MCP discovery scoping
+- include recursion prevention and tool isolation details
+
+### 4.2 Custom File-Based Persistence
+
+Assessment: straightforward for storage, but rewind semantics need work.
+
+The storage layer itself is low-risk — `GcliFileSessionService` wraps existing `ChatRecordingService` and implements 4 abstract methods. DB concerns (locking, stale-writer, crash recovery) don't apply to a single-user CLI.
+
+Required change:
+- define rewind as event-log truncation + state recomputation (not just file truncation)
+- state that concurrent runs per session are forbidden (single-writer)
+- define how app/user/temp state prefixes map to existing workspace JSON
+
+### 4.3 Decomposing `AgentLoopContext`
+
+Assessment: right instinct, incomplete decomposition.
+
+Required change:
+- account for message bus / confirmation routing
+- account for injection queues
+- account for prompt/resource registries and MCP scoping
+
+### 5.1 Real-Time User Message Injections
+
+Assessment: blocker analysis is incomplete.
+
+Required change:
+- mention TS live runtime gaps directly
+- describe temporary UX until true interruption exists
+
+### 5.2 Conversation Rewind and State Reversal
+
+Assessment: too shallow today.
+
+Required change:
+- define rewind as event-log truncation plus state rollback semantics
+- define confirmation/auth rollback semantics
+- define artifact/version rollback expectations
+
+### 5.3 Concurrent Sessions
+
+Assessment: a single-user CLI does not need DB-level locking.
+
+Required change:
+- state that concurrent runs per session are forbidden (single-writer model)
+- this is sufficient for a CLI — no further locking design needed
+
+## Corrections to Earlier Reviews
+
+### Auth is implementable, not blocked
+API-key auth works via `httpOptions.headers`. Coast Assist / `LOGIN_WITH_GOOGLE` requires `GcliAgentModel` to extend `BaseLlm` directly with its own transport (using `AuthClient.request()`), not wrap `Gemini`. The OAuth flow, token refresh, and credential caching all work as-is — the issue was the design doc's assumption about the inner model, not auth capability.
+
+### Persistence is simpler than initially claimed
+DB-level concerns (PESSIMISTIC_WRITE, stale-writer detection, concurrent append policy) come from `DatabaseSessionService` and don't apply. The file-backed service wraps existing `ChatRecordingService`. Only rewind semantics need deeper design.
+
+### Interactive PR findings are rollout-risk evidence, not architecture defects
+The branch-stack dependency, hook-order risk, and `_meta.legacyState` leakage in PR #24297 are real but secondary to the core architecture gaps above.
+
+## What To Change Before Principal Review
+
+1. **Fix the 4 compilation blockers** (C1-C4) — these will be the first thing reviewers check
+2. **Add an explicit ADK→AgentProtocol translation architecture section** — this is the real design center
+3. **Add the shared-core subagent architecture** — custom `BaseTool` over shared runtime, not `AgentTool`
+4. **Use `BaseContextCompactor`** for compaction instead of embedding it in the model layer
+5. **Replace “100% possible today” and similar language** with explicit labels: native / bridgeable / blocked
+6. **Add a parity matrix** (feature | ADK mechanism | status | bridge workaround | long-term target)
+
+## Phased Migration Plan
+
+### Phase 0: Foundation (current state → near-term)
+**Goal:** Establish the shared runtime core and translation layer.
+
+- [ ] Fix compilation blockers (C1-C4) in design doc code samples
+- [ ] Implement `AdkRuntimeCore` wrapping ADK `Runner` + `LlmAgent`
+- [ ] Implement `AdkEventTranslator` (ADK `Event` → gemini-cli `AgentEvent`)
+- [ ] Implement `GcliAgentModel extends BaseLlm` with dual transport (API-key via `httpOptions.headers`, Coast Assist via `AuthClient.request()`)
+- [ ] Implement `GcliFileSessionService extends BaseSessionService` wrapping `ChatRecordingService`
+- [ ] Implement `GcliContextCompactor implements BaseContextCompactor` wrapping `ChatCompressionService`
+- [ ] Wire behind `experimental.adk` feature gate
+
+**Non-goals for Phase 0:**
+- No interactive flow changes
+- No subagent support
+- No live/bidi connections
+- No resumable approvals
+
+**Exit criteria:** Non-interactive flow produces identical output behind feature gate.
+
+### Phase 1: Non-Interactive Parity
+**Goal:** Feature-gated non-interactive flow matches legacy behavior.
+
+- [ ] Tool output masking via `BaseLlmRequestProcessor`
+- [ ] Model routing via `beforeModelCallback` + `RoutingContextBuilder` adapter
+- [ ] Policy enforcement via `beforeToolCallback` using existing callbacks (temporary bridge)
+- [ ] Quota/availability handling via `beforeModelCallback`
+- [ ] `ClearcutTelemetryPlugin extends BasePlugin` for token counts (`afterModelCallback`), per-tool timing (`beforeToolCallback`/`afterToolCallback` with `functionCallId`), agent lifecycle, model errors
+- [ ] HTTP-level telemetry (status code, duration) captured in `GcliAgentModel` wrapper
+- [ ] Verify ~70% of existing Clearcut call sites work unchanged
+
+**Non-goals for Phase 1:**
+- No interactive UI changes
+- No plan mode switching
+- No subagents
+- Approvals are callback-based, not resumable
+
+**Exit criteria:** Non-interactive tests pass with `experimental.adk.enabled = true`. Legacy path remains default.
+
+### Phase 2: Interactive Flow Migration
+**Goal:** Interactive flow uses the same ADK runtime behind `TopLevelSessionAdapter`.
+
+- [ ] `TopLevelSessionAdapter` exposing runtime as `AgentProtocol` / `AgentSession`
+- [ ] Stream lifecycle (`agent_start` / `agent_end` / `streamId` ownership)
+- [ ] Replay/reattach semantics matching current `AgentSession.stream()` behavior
+- [ ] Plan mode via dynamic `BaseToolset` + `InstructionProvider` + mode state
+- [ ] `ApprovalBridge` for tool confirmations using existing UI callbacks
+- [ ] Elicitation via existing callbacks (not yet bidi)
+- [ ] `_meta.legacyState` bridge for UI rendering (documented as temporary)
+
+**Non-goals for Phase 2:**
+- No live/bidi parity (`runLiveImpl` is still a stub in ADK TS)
+- No true mid-turn interruption (steering limited to once-per-LLM-call)
+- No resumable approvals across process death
+- No concurrent multi-stream sessions
+
+**Exit criteria:** Interactive flow works behind feature gate. Legacy path remains default.
+
+### Phase 3: Subagents and SDK Readiness
+**Goal:** Subagents share the core runtime. The architecture is SDK-reusable.
+
+- [ ] Custom `BaseTool` subagent wrappers over shared `AdkRuntimeCore`
+- [ ] `threadId`-scoped event projection for child activity
+- [ ] Shared policy, routing, and config inheritance
+- [ ] Remove `_meta.legacyState` — replace with proper event/adapter separation
+- [ ] Migrate approval bridge to native ADK elicitation/bidi (when available)
+- [ ] Define SDK public API surface
+
+**Non-goals for Phase 3:**
+- Full ADK Dev UI compatibility
+- Agent-to-agent transfer via ADK's native mechanism
+
+**Exit criteria:** Subagent invocation works. Architecture is documented for SDK consumers.
+
+## Positive Signals
+
+- Feature-gating behind `experimental.adk` is the right rollout pattern
+- Tool output masking maps cleanly to request-preprocessing
+- Dynamic toolset + `InstructionProvider` for plan mode is a good ADK-native fit
+- The phased migration checklist with tracking issues shows good engineering discipline
+- The doc correctly identifies 3 known ADK gaps (sections 5.1-5.3)
+- `AgentProtocol` / `AgentSession` is the right consumer-facing boundary
+- The policy adapter pattern is directionally sound even with reduced phase-1 semantics
+
+## Concern Decomposition
+
+| Concern | Level | ADK Mechanism |
+|---|---|---|
+| Auth (API key) | Transport | `BaseLlm` constructor / `httpOptions.headers` |
+| Auth (Coast Assist) | Transport | `BaseLlm` direct — custom transport via `AuthClient.request()` |
+| Model rewrite | Transport | `BaseLlm.generateContentAsync` model override |
+| Model routing | Agent | `beforeModelCallback` + `RoutingContextBuilder` |
+| Token compaction | Agent | `BaseContextCompactor` (native ADK) |
+| Quota/availability | Agent | `beforeModelCallback` |
+| Tool masking | Agent | `BaseLlmRequestProcessor` |
+| Tool confirmations | Agent+Consumer | `beforeToolCallback` + existing callbacks (phase 1) |
+| Telemetry (lifecycle) | Agent | `ClearcutTelemetryPlugin` — `afterModelCallback`, `beforeToolCallback`/`afterToolCallback` |
+| Telemetry (HTTP) | Transport | `GcliAgentModel` wrapper (status code, duration) |
+| Telemetry (CLI) | Consumer | Existing call sites (~70% of Clearcut metrics, unchanged) |
+| UI rendering | Consumer | Event subscriber / adapter |
+| Subagent invocation | Agent | Custom `BaseTool` over shared runtime core |
+
+## Final Verdict
+
+The design is architecturally correct in its goal. To be principal-review ready:
+
+1. Fix the 4 compilation blockers
+2. Add the ADK→AgentProtocol translation architecture as the design center
+3. Adopt native `BaseContextCompactor` instead of model-layer compaction
+4. Use custom `BaseTool` subagents over shared core (not `AgentTool`)
+5. Downgrade parity claims to match reality
+6. Add the phased plan with explicit non-goals per phase
+
+The migration path is: shared runtime core → translation layer → adapters (top-level session, subagent tools, approval bridge). Each phase ships independently behind the feature gate.

docs/admin/enterprise-controls.md

@@ -106,6 +106,67 @@ organization.
   ensures users maintain final control over which permitted servers are actually
   active in their environment.
 
+#### Required MCP Servers (preview)
+
+**Default**: empty
+
+Allows administrators to define MCP servers that are **always injected** into
+the user's environment. Unlike the allowlist (which filters user-configured
+servers), required servers are automatically added regardless of the user's
+local configuration.
+
+**Required Servers Format:**
+
+```json
+{
+  "requiredMcpServers": {
+    "corp-compliance-tool": {
+      "url": "https://mcp.corp/compliance",
+      "type": "http",
+      "trust": true,
+      "description": "Corporate compliance tool"
+    },
+    "internal-registry": {
+      "url": "https://registry.corp/mcp",
+      "type": "sse",
+      "authProviderType": "google_credentials",
+      "oauth": {
+        "scopes": ["https://www.googleapis.com/auth/scope"]
+      }
+    }
+  }
+}
+```
+
+**Supported Fields:**
+
+- `url`: (Required) The full URL of the MCP server endpoint.
+- `type`: (Required) The connection type (`sse` or `http`).
+- `trust`: (Optional) If set to `true`, tool execution will not require user
+  approval. Defaults to `true` for required servers.
+- `description`: (Optional) Human-readable description of the server.
+- `authProviderType`: (Optional) Authentication provider (`dynamic_discovery`,
+  `google_credentials`, or `service_account_impersonation`).
+- `oauth`: (Optional) OAuth configuration including `scopes`, `clientId`, and
+  `clientSecret`.
+- `targetAudience`: (Optional) OAuth target audience for service-to-service
+  auth.
+- `targetServiceAccount`: (Optional) Service account email to impersonate.
+- `headers`: (Optional) Additional HTTP headers to send with requests.
+- `includeTools` / `excludeTools`: (Optional) Tool filtering lists.
+- `timeout`: (Optional) Timeout in milliseconds for MCP requests.
+
+**Client Enforcement Logic:**
+
+- Required servers are injected **after** allowlist filtering, so they are
+  always available even if the allowlist is active.
+- If a required server has the **same name** as a locally configured server, the
+  admin configuration **completely overrides** the local one.
+- Required servers only support remote transports (`sse`, `http`). Local
+  execution fields (`command`, `args`, `env`, `cwd`) are not supported.
+- Required servers can coexist with allowlisted servers — both features work
+  independently.
+
 ### Unmanaged Capabilities
 
 **Enabled/Disabled** | Default: disabled

docs/changelogs/index.md

@@ -18,6 +18,66 @@ on GitHub.
 | [Preview](preview.md) | Experimental features ready for early feedback. |
 | [Stable](latest.md)   | Stable, recommended for general use.            |
 
+## Announcements: v0.36.0 - 2026-04-01
+
+- **Multi-Registry Architecture and Sandboxing:** Introduced a multi-registry
+  architecture and implemented native macOS Seatbelt and Windows sandboxing for
+  enhanced subagent security
+  ([#22712](https://github.com/google-gemini/gemini-cli/pull/22712),
+  [#22718](https://github.com/google-gemini/gemini-cli/pull/22718) by @akh64bit,
+  [#22832](https://github.com/google-gemini/gemini-cli/pull/22832) by @ehedlund,
+  [#21807](https://github.com/google-gemini/gemini-cli/pull/21807) by
+  @mattKorwel).
+- **Refreshed Composer UX:** Implemented a refreshed user experience for the
+  Composer layout and improved terminal interaction robustness
+  ([#21212](https://github.com/google-gemini/gemini-cli/pull/21212),
+  [#23286](https://github.com/google-gemini/gemini-cli/pull/23286) by
+  @jwhelangoog).
+- **Git Worktree Support:** Added native support for Git worktrees, allowing for
+  isolated parallel sessions
+  ([#22973](https://github.com/google-gemini/gemini-cli/pull/22973),
+  [#23265](https://github.com/google-gemini/gemini-cli/pull/23265) by @jerop).
+- **Subagent Context and Feedback:** Enhanced subagents with JIT context
+  injection and resilient tool rejection with contextual feedback
+  ([#23032](https://github.com/google-gemini/gemini-cli/pull/23032),
+  [#22951](https://github.com/google-gemini/gemini-cli/pull/22951) by
+  @abhipatel12).
+
+## Announcements: v0.35.0 - 2026-03-24
+
+- **Customizable Keyboard Shortcuts:** Users can now customize their keyboard
+  shortcuts, including support for literal character keybindings and the
+  extended Kitty protocol
+  ([#21945](https://github.com/google-gemini/gemini-cli/pull/21945),
+  [#21972](https://github.com/google-gemini/gemini-cli/pull/21972) by
+  @scidomino).
+- **Vim Mode Improvements:** Added missing motions (X, ~, r, f/F/t/T) and
+  yank/paste support with the unnamed register
+  ([#21932](https://github.com/google-gemini/gemini-cli/pull/21932),
+  [#22026](https://github.com/google-gemini/gemini-cli/pull/22026) by @aanari).
+- **Tool Isolation and Sandboxing:** Introduced `SandboxManager` to isolate
+  process-spawning tools and added Linux bubblewrap/seccomp sandboxing support
+  ([#21774](https://github.com/google-gemini/gemini-cli/pull/21774),
+  [#22231](https://github.com/google-gemini/gemini-cli/pull/22231) by @galz10,
+  [#22680](https://github.com/google-gemini/gemini-cli/pull/22680) by
+  @DavidAPierce).
+- **JIT Context Discovery:** Implemented Just-In-Time context discovery for file
+  system tools to improve model performance and accuracy
+  ([#22082](https://github.com/google-gemini/gemini-cli/pull/22082),
+  [#22736](https://github.com/google-gemini/gemini-cli/pull/22736) by
+  @SandyTao520).
+
+## Announcements: v0.34.0 - 2026-03-17
+
+- **Plan Mode Enabled by Default:** Plan Mode is now enabled by default to help
+  you break down complex tasks and execute them systematically
+  ([#21713](https://github.com/google-gemini/gemini-cli/pull/21713) by @jerop).
+- **Sandboxing Enhancements:** We've added native gVisor (runsc) and
+  experimental LXC container sandboxing support for safer execution environments
+  ([#21062](https://github.com/google-gemini/gemini-cli/pull/21062) by
+  @Zheyuan-Lin, [#20735](https://github.com/google-gemini/gemini-cli/pull/20735)
+  by @h30s).
+
 ## Announcements: v0.33.0 - 2026-03-11
 
 - **Agent Architecture Enhancements:** Introduced HTTP authentication for A2A
@@ -125,10 +185,6 @@ on GitHub.
 
 ## Announcements: v0.28.0 - 2026-02-10
 
-- **Slash Command:** We've added a new `/prompt-suggest` slash command to help
-  you generate prompt suggestions
-  ([#17264](https://github.com/google-gemini/gemini-cli/pull/17264) by
-  @NTaylorMullen).
 - **IDE Support:** Gemini CLI now supports the Positron IDE
   ([#15047](https://github.com/google-gemini/gemini-cli/pull/15047) by
   @kapsner).
@@ -168,8 +224,8 @@ on GitHub.
   ([#16638](https://github.com/google-gemini/gemini-cli/pull/16638) by
   @joshualitt).
 - **UI/UX Improvements:** You can now "Rewind" through your conversation history
-  ([#15717](https://github.com/google-gemini/gemini-cli/pull/15717) by @Adib234)
-  and use a new `/introspect` command for debugging.
+  ([#15717](https://github.com/google-gemini/gemini-cli/pull/15717) by
+  @Adib234).
 - **Core and Scheduler Refactoring:** The core scheduler has been significantly
   refactored to improve performance and reliability
   ([#16895](https://github.com/google-gemini/gemini-cli/pull/16895) by

docs/changelogs/latest.md

@@ -1,6 +1,6 @@
-# Latest stable release: v0.33.1
+# Latest stable release: v0.36.0
 
-Released: March 12, 2026
+Released: April 1, 2026
 
 For most users, our latest stable release is the recommended release. Install
 the latest stable version with:
@@ -11,224 +11,372 @@ npm install -g @google/gemini-cli
 
 ## Highlights
 
-- **Agent Architecture Enhancements:** Introduced HTTP authentication support
-  for A2A remote agents, authenticated A2A agent card discovery, and directly
-  indicated auth-required states.
-- **Plan Mode Updates:** Expanded Plan Mode capabilities with built-in research
-  subagents, annotation support for feedback during iteration, and a new `copy`
-  subcommand.
-- **CLI UX Improvements:** Redesigned the header to be compact with an ASCII
-  icon, inverted the context window display to show usage, and allowed sub-agent
-  confirmation requests in the UI while preventing background flicker.
-- **ACP & MCP Integrations:** Implemented slash command handling in ACP for
-  `/memory`, `/init`, `/extensions`, and `/restore`, added an MCPOAuthProvider,
-  and introduced a `set models` interface for ACP.
-- **Admin & Core Stability:** Enabled a 30-day default retention for chat
-  history, added tool name validation in TOML policy files, and improved tool
-  parameter extraction.
+- **Multi-Registry Architecture and Tool Isolation:** Introduced a
+  multi-registry architecture for subagents and implemented strict sandboxing
+  for macOS (Seatbelt) and Windows to enhance security and isolation.
+- **Improved Subagent Coordination:** Enhanced subagents with local execution
+  capabilities, JIT context injection (upward traversal capped at git root), and
+  resilient tool rejection with contextual feedback.
+- **Enhanced UI and UX:** Implemented a refreshed UX for the Composer layout,
+  improved terminal fallback warnings, and resolved various UI flickering and
+  state persistence issues.
+- **Git Worktree Support:** Added support for Git worktrees to enable isolated
+  parallel sessions within the same repository.
+- **Plan Mode Improvements:** Plan mode now supports non-interactive execution
+  and includes hardened sandbox path resolution to prevent hallucinations.
 
 ## What's Changed
 
-- fix(patch): cherry-pick 8432bce to release/v0.33.0-pr-22069 to patch version
-  v0.33.0 and create version 0.33.1 by @gemini-cli-robot in
-  [#22206](https://github.com/google-gemini/gemini-cli/pull/22206)
-- Docs: Update model docs to remove Preview Features. by @jkcinouye in
-  [#20084](https://github.com/google-gemini/gemini-cli/pull/20084)
-- docs: fix typo in installation documentation by @AdityaSharma-Git3207 in
-  [#20153](https://github.com/google-gemini/gemini-cli/pull/20153)
-- docs: add Windows PowerShell equivalents for environments and scripting by
-  @scidomino in [#20333](https://github.com/google-gemini/gemini-cli/pull/20333)
-- fix(core): parse raw ASCII buffer strings in Gaxios errors by @sehoon38 in
-  [#20626](https://github.com/google-gemini/gemini-cli/pull/20626)
-- chore(release): bump version to 0.33.0-nightly.20260227.ba149afa0 by @galz10
-  in [#20637](https://github.com/google-gemini/gemini-cli/pull/20637)
-- fix(github): use robot PAT for automated PRs to pass CLA check by @galz10 in
-  [#20641](https://github.com/google-gemini/gemini-cli/pull/20641)
-- chore/release: bump version to 0.33.0-nightly.20260228.1ca5c05d0 by
-  @gemini-cli-robot in
-  [#20644](https://github.com/google-gemini/gemini-cli/pull/20644)
-- Changelog for v0.31.0 by @gemini-cli-robot in
-  [#20634](https://github.com/google-gemini/gemini-cli/pull/20634)
-- fix: use full paths for ACP diff payloads by @JagjeevanAK in
-  [#19539](https://github.com/google-gemini/gemini-cli/pull/19539)
-- Changelog for v0.32.0-preview.0 by @gemini-cli-robot in
-  [#20627](https://github.com/google-gemini/gemini-cli/pull/20627)
-- fix: acp/zed race condition between MCP initialisation and prompt by
-  @kartikangiras in
-  [#20205](https://github.com/google-gemini/gemini-cli/pull/20205)
-- fix(cli): reset themeManager between tests to ensure isolation by
-  @NTaylorMullen in
-  [#20598](https://github.com/google-gemini/gemini-cli/pull/20598)
-- refactor(core): Extract tool parameter names as constants by @SandyTao520 in
-  [#20460](https://github.com/google-gemini/gemini-cli/pull/20460)
-- fix(cli): resolve autoThemeSwitching when background hasn't changed but theme
-  mismatches by @sehoon38 in
-  [#20706](https://github.com/google-gemini/gemini-cli/pull/20706)
-- feat(skills): add github-issue-creator skill by @sehoon38 in
-  [#20709](https://github.com/google-gemini/gemini-cli/pull/20709)
-- fix(cli): allow sub-agent confirmation requests in UI while preventing
-  background flicker by @abhipatel12 in
-  [#20722](https://github.com/google-gemini/gemini-cli/pull/20722)
-- Merge User and Agent Card Descriptions #20849 by @adamfweidman in
-  [#20850](https://github.com/google-gemini/gemini-cli/pull/20850)
-- fix(core): reduce LLM-based loop detection false positives by @SandyTao520 in
-  [#20701](https://github.com/google-gemini/gemini-cli/pull/20701)
-- fix(plan): deflake plan mode integration tests by @Adib234 in
-  [#20477](https://github.com/google-gemini/gemini-cli/pull/20477)
-- Add /unassign support by @scidomino in
-  [#20864](https://github.com/google-gemini/gemini-cli/pull/20864)
-- feat(core): implement HTTP authentication support for A2A remote agents by
+- Changelog for v0.33.2 by @gemini-cli-robot in
+  [#22730](https://github.com/google-gemini/gemini-cli/pull/22730)
+- feat(core): multi-registry architecture and tool filtering for subagents by
+  @akh64bit in [#22712](https://github.com/google-gemini/gemini-cli/pull/22712)
+- Changelog for v0.34.0-preview.4 by @gemini-cli-robot in
+  [#22752](https://github.com/google-gemini/gemini-cli/pull/22752)
+- fix(devtools): use theme-aware text colors for console warnings and errors by
   @SandyTao520 in
-  [#20510](https://github.com/google-gemini/gemini-cli/pull/20510)
-- feat(core): centralize read_file limits and update gemini-3 description by
-  @aishaneeshah in
-  [#20619](https://github.com/google-gemini/gemini-cli/pull/20619)
-- Do not block CI on evals by @gundermanc in
-  [#20870](https://github.com/google-gemini/gemini-cli/pull/20870)
-- document node limitation for shift+tab by @scidomino in
-  [#20877](https://github.com/google-gemini/gemini-cli/pull/20877)
-- Add install as an option when extension is selected. by @DavidAPierce in
-  [#20358](https://github.com/google-gemini/gemini-cli/pull/20358)
-- Update CODEOWNERS for README.md reviewers by @g-samroberts in
-  [#20860](https://github.com/google-gemini/gemini-cli/pull/20860)
-- feat(core): truncate large MCP tool output by @SandyTao520 in
-  [#19365](https://github.com/google-gemini/gemini-cli/pull/19365)
-- Subagent activity UX. by @gundermanc in
-  [#17570](https://github.com/google-gemini/gemini-cli/pull/17570)
-- style(cli) : Dialog pattern for /hooks Command by @AbdulTawabJuly in
-  [#17930](https://github.com/google-gemini/gemini-cli/pull/17930)
-- feat: redesign header to be compact with ASCII icon by @keithguerin in
-  [#18713](https://github.com/google-gemini/gemini-cli/pull/18713)
-- fix(core): ensure subagents use qualified MCP tool names by @abhipatel12 in
-  [#20801](https://github.com/google-gemini/gemini-cli/pull/20801)
-- feat(core): support authenticated A2A agent card discovery by @SandyTao520 in
-  [#20622](https://github.com/google-gemini/gemini-cli/pull/20622)
-- refactor(cli): fully remove React anti patterns, improve type safety and fix
-  UX oversights in SettingsDialog.tsx by @psinha40898 in
-  [#18963](https://github.com/google-gemini/gemini-cli/pull/18963)
-- Adding MCPOAuthProvider implementing the MCPSDK OAuthClientProvider by
-  @Nayana-Parameswarappa in
-  [#20121](https://github.com/google-gemini/gemini-cli/pull/20121)
-- feat(core): add tool name validation in TOML policy files by @allenhutchison
-  in [#19281](https://github.com/google-gemini/gemini-cli/pull/19281)
-- docs: fix broken markdown links in main README.md by @Hamdanbinhashim in
-  [#20300](https://github.com/google-gemini/gemini-cli/pull/20300)
-- refactor(core): replace manual syncPlanModeTools with declarative policy rules
-  by @jerop in [#20596](https://github.com/google-gemini/gemini-cli/pull/20596)
-- fix(core): increase default headers timeout to 5 minutes by @gundermanc in
-  [#20890](https://github.com/google-gemini/gemini-cli/pull/20890)
-- feat(admin): enable 30 day default retention for chat history & remove warning
-  by @skeshive in
-  [#20853](https://github.com/google-gemini/gemini-cli/pull/20853)
-- feat(plan): support annotating plans with feedback for iteration by @Adib234
-  in [#20876](https://github.com/google-gemini/gemini-cli/pull/20876)
-- Add some dos and don'ts to behavioral evals README. by @gundermanc in
-  [#20629](https://github.com/google-gemini/gemini-cli/pull/20629)
-- fix(core): skip telemetry logging for AbortError exceptions by @yunaseoul in
-  [#19477](https://github.com/google-gemini/gemini-cli/pull/19477)
-- fix(core): restrict "System: Please continue" invalid stream retry to Gemini 2
-  models by @SandyTao520 in
-  [#20897](https://github.com/google-gemini/gemini-cli/pull/20897)
-- ci(evals): only run evals in CI if prompts or tools changed by @gundermanc in
-  [#20898](https://github.com/google-gemini/gemini-cli/pull/20898)
-- Build binary by @aswinashok44 in
-  [#18933](https://github.com/google-gemini/gemini-cli/pull/18933)
-- Code review fixes as a pr by @jacob314 in
-  [#20612](https://github.com/google-gemini/gemini-cli/pull/20612)
-- fix(ci): handle empty APP_ID in stale PR closer by @bdmorgan in
-  [#20919](https://github.com/google-gemini/gemini-cli/pull/20919)
-- feat(cli): invert context window display to show usage by @keithguerin in
-  [#20071](https://github.com/google-gemini/gemini-cli/pull/20071)
-- fix(plan): clean up session directories and plans on deletion by @jerop in
-  [#20914](https://github.com/google-gemini/gemini-cli/pull/20914)
-- fix(core): enforce optionality for API response fields in code_assist by
-  @sehoon38 in [#20714](https://github.com/google-gemini/gemini-cli/pull/20714)
-- feat(extensions): add support for plan directory in extension manifest by
-  @mahimashanware in
-  [#20354](https://github.com/google-gemini/gemini-cli/pull/20354)
-- feat(plan): enable built-in research subagents in plan mode by @Adib234 in
-  [#20972](https://github.com/google-gemini/gemini-cli/pull/20972)
-- feat(agents): directly indicate auth required state by @adamfweidman in
-  [#20986](https://github.com/google-gemini/gemini-cli/pull/20986)
-- fix(cli): wait for background auto-update before relaunching by @scidomino in
-  [#20904](https://github.com/google-gemini/gemini-cli/pull/20904)
-- fix: pre-load @scripts/copy_files.js references from external editor prompts
-  by @kartikangiras in
-  [#20963](https://github.com/google-gemini/gemini-cli/pull/20963)
-- feat(evals): add behavioral evals for ask_user tool by @Adib234 in
-  [#20620](https://github.com/google-gemini/gemini-cli/pull/20620)
-- refactor common settings logic for skills,agents by @ishaanxgupta in
-  [#17490](https://github.com/google-gemini/gemini-cli/pull/17490)
-- Update docs-writer skill with new resource by @g-samroberts in
-  [#20917](https://github.com/google-gemini/gemini-cli/pull/20917)
-- fix(cli): pin clipboardy to ~5.2.x by @scidomino in
-  [#21009](https://github.com/google-gemini/gemini-cli/pull/21009)
-- feat: Implement slash command handling in ACP for
-  `/memory`,`/init`,`/extensions` and `/restore` by @sripasg in
-  [#20528](https://github.com/google-gemini/gemini-cli/pull/20528)
-- Docs/add hooks reference by @AadithyaAle in
-  [#20961](https://github.com/google-gemini/gemini-cli/pull/20961)
-- feat(plan): add copy subcommand to plan (#20491) by @ruomengz in
-  [#20988](https://github.com/google-gemini/gemini-cli/pull/20988)
-- fix(core): sanitize and length-check MCP tool qualified names by @abhipatel12
-  in [#20987](https://github.com/google-gemini/gemini-cli/pull/20987)
-- Format the quota/limit style guide. by @g-samroberts in
-  [#21017](https://github.com/google-gemini/gemini-cli/pull/21017)
-- fix(core): send shell output to model on cancel by @devr0306 in
-  [#20501](https://github.com/google-gemini/gemini-cli/pull/20501)
-- remove hardcoded tiername when missing tier by @sehoon38 in
-  [#21022](https://github.com/google-gemini/gemini-cli/pull/21022)
-- feat(acp): add set models interface by @skeshive in
-  [#20991](https://github.com/google-gemini/gemini-cli/pull/20991)
-- fix(patch): cherry-pick 0659ad1 to release/v0.33.0-preview.0-pr-21042 to patch
-  version v0.33.0-preview.0 and create version 0.33.0-preview.1 by
+  [#22181](https://github.com/google-gemini/gemini-cli/pull/22181)
+- Add support for dynamic model Resolution to ModelConfigService by @kevinjwang1
+  in [#22578](https://github.com/google-gemini/gemini-cli/pull/22578)
+- chore(release): bump version to 0.36.0-nightly.20260317.2f90b4653 by
   @gemini-cli-robot in
-  [#21047](https://github.com/google-gemini/gemini-cli/pull/21047)
-- fix(patch): cherry-pick 173376b to release/v0.33.0-preview.1-pr-21157 to patch
-  version v0.33.0-preview.1 and create version 0.33.0-preview.2 by
+  [#22858](https://github.com/google-gemini/gemini-cli/pull/22858)
+- fix(cli): use active sessionId in useLogger and improve resume robustness by
+  @mattKorwel in
+  [#22606](https://github.com/google-gemini/gemini-cli/pull/22606)
+- fix(cli): expand tilde in policy paths from settings.json by @abhipatel12 in
+  [#22772](https://github.com/google-gemini/gemini-cli/pull/22772)
+- fix(core): add actionable warnings for terminal fallbacks (#14426) by
+  @spencer426 in
+  [#22211](https://github.com/google-gemini/gemini-cli/pull/22211)
+- feat(tracker): integrate task tracker protocol into core system prompt by
+  @anj-s in [#22442](https://github.com/google-gemini/gemini-cli/pull/22442)
+- chore: add posttest build hooks and fix missing dependencies by @NTaylorMullen
+  in [#22865](https://github.com/google-gemini/gemini-cli/pull/22865)
+- feat(a2a): add agent acknowledgment command and enhance registry discovery by
+  @alisa-alisa in
+  [#22389](https://github.com/google-gemini/gemini-cli/pull/22389)
+- fix(cli): automatically add all VSCode workspace folders to Gemini context by
+  @sakshisemalti in
+  [#21380](https://github.com/google-gemini/gemini-cli/pull/21380)
+- feat: add 'blocked' status to tasks and todos by @anj-s in
+  [#22735](https://github.com/google-gemini/gemini-cli/pull/22735)
+- refactor(cli): remove extra newlines in ShellToolMessage.tsx by @NTaylorMullen
+  in [#22868](https://github.com/google-gemini/gemini-cli/pull/22868)
+- fix(cli): lazily load settings in onModelChange to prevent stale closure data
+  loss by @KumarADITHYA123 in
+  [#20403](https://github.com/google-gemini/gemini-cli/pull/20403)
+- feat(core): subagent local execution and tool isolation by @akh64bit in
+  [#22718](https://github.com/google-gemini/gemini-cli/pull/22718)
+- fix(cli): resolve subagent grouping and UI state persistence by @abhipatel12
+  in [#22252](https://github.com/google-gemini/gemini-cli/pull/22252)
+- refactor(ui): extract SessionBrowser search and navigation components by
+  @abhipatel12 in
+  [#22377](https://github.com/google-gemini/gemini-cli/pull/22377)
+- fix: updates Docker image reference for GitHub MCP server by @jhhornn in
+  [#22938](https://github.com/google-gemini/gemini-cli/pull/22938)
+- refactor(cli): group subagent trajectory deletion and use native filesystem
+  testing by @abhipatel12 in
+  [#22890](https://github.com/google-gemini/gemini-cli/pull/22890)
+- refactor(cli): simplify keypress and mouse providers and update tests by
+  @scidomino in [#22853](https://github.com/google-gemini/gemini-cli/pull/22853)
+- Changelog for v0.34.0 by @gemini-cli-robot in
+  [#22860](https://github.com/google-gemini/gemini-cli/pull/22860)
+- test(cli): simplify createMockSettings calls by @scidomino in
+  [#22952](https://github.com/google-gemini/gemini-cli/pull/22952)
+- feat(ui): format multi-line banner warnings with a bold title by @keithguerin
+  in [#22955](https://github.com/google-gemini/gemini-cli/pull/22955)
+- Docs: Remove references to stale Gemini CLI file structure info by
+  @g-samroberts in
+  [#22976](https://github.com/google-gemini/gemini-cli/pull/22976)
+- feat(ui): remove write todo list tool from UI tips by @aniruddhaadak80 in
+  [#22281](https://github.com/google-gemini/gemini-cli/pull/22281)
+- Fix issue where subagent thoughts are appended. by @gundermanc in
+  [#22975](https://github.com/google-gemini/gemini-cli/pull/22975)
+- Feat/browser privacy consent by @kunal-10-cloud in
+  [#21119](https://github.com/google-gemini/gemini-cli/pull/21119)
+- fix(core): explicitly map execution context in LocalAgentExecutor by @akh64bit
+  in [#22949](https://github.com/google-gemini/gemini-cli/pull/22949)
+- feat(plan): support plan mode in non-interactive mode by @ruomengz in
+  [#22670](https://github.com/google-gemini/gemini-cli/pull/22670)
+- feat(core): implement strict macOS sandboxing using Seatbelt allowlist by
+  @ehedlund in [#22832](https://github.com/google-gemini/gemini-cli/pull/22832)
+- docs: add additional notes by @abhipatel12 in
+  [#23008](https://github.com/google-gemini/gemini-cli/pull/23008)
+- fix(cli): resolve duplicate footer on tool cancel via ESC (#21743) by
+  @ruomengz in [#21781](https://github.com/google-gemini/gemini-cli/pull/21781)
+- Changelog for v0.35.0-preview.1 by @gemini-cli-robot in
+  [#23012](https://github.com/google-gemini/gemini-cli/pull/23012)
+- fix(ui): fix flickering on small terminal heights by @devr0306 in
+  [#21416](https://github.com/google-gemini/gemini-cli/pull/21416)
+- fix(acp): provide more meta in tool_call_update by @Mervap in
+  [#22663](https://github.com/google-gemini/gemini-cli/pull/22663)
+- docs: add FAQ entry for checking Gemini CLI version by @surajsahani in
+  [#21271](https://github.com/google-gemini/gemini-cli/pull/21271)
+- feat(core): resilient subagent tool rejection with contextual feedback by
+  @abhipatel12 in
+  [#22951](https://github.com/google-gemini/gemini-cli/pull/22951)
+- fix(cli): correctly handle auto-update for standalone binaries by @bdmorgan in
+  [#23038](https://github.com/google-gemini/gemini-cli/pull/23038)
+- feat(core): add content-utils by @adamfweidman in
+  [#22984](https://github.com/google-gemini/gemini-cli/pull/22984)
+- fix: circumvent genai sdk requirement for api key when using gateway auth via
+  ACP by @sripasg in
+  [#23042](https://github.com/google-gemini/gemini-cli/pull/23042)
+- fix(core): don't persist browser consent sentinel in non-interactive mode by
+  @jasonmatthewsuhari in
+  [#23073](https://github.com/google-gemini/gemini-cli/pull/23073)
+- fix(core): narrow browser agent description to prevent stealing URL tasks from
+  web_fetch by @gsquared94 in
+  [#23086](https://github.com/google-gemini/gemini-cli/pull/23086)
+- feat(cli): Partial threading of AgentLoopContext. by @joshualitt in
+  [#22978](https://github.com/google-gemini/gemini-cli/pull/22978)
+- fix(browser-agent): enable "Allow all server tools" session policy by
+  @cynthialong0-0 in
+  [#22343](https://github.com/google-gemini/gemini-cli/pull/22343)
+- refactor(cli): integrate real config loading into async test utils by
+  @scidomino in [#23040](https://github.com/google-gemini/gemini-cli/pull/23040)
+- feat(core): inject memory and JIT context into subagents by @abhipatel12 in
+  [#23032](https://github.com/google-gemini/gemini-cli/pull/23032)
+- Fix logging and virtual list. by @jacob314 in
+  [#23080](https://github.com/google-gemini/gemini-cli/pull/23080)
+- feat(core): cap JIT context upward traversal at git root by @SandyTao520 in
+  [#23074](https://github.com/google-gemini/gemini-cli/pull/23074)
+- Docs: Minor style updates from initial docs audit. by @g-samroberts in
+  [#22872](https://github.com/google-gemini/gemini-cli/pull/22872)
+- feat(core): add experimental memory manager agent to replace save_memory tool
+  by @SandyTao520 in
+  [#22726](https://github.com/google-gemini/gemini-cli/pull/22726)
+- Changelog for v0.35.0-preview.2 by @gemini-cli-robot in
+  [#23142](https://github.com/google-gemini/gemini-cli/pull/23142)
+- Update website issue template for label and title by @g-samroberts in
+  [#23036](https://github.com/google-gemini/gemini-cli/pull/23036)
+- fix: upgrade ACP SDK from 0.12 to 0.16.1 by @sripasg in
+  [#23132](https://github.com/google-gemini/gemini-cli/pull/23132)
+- Update callouts to work on github. by @g-samroberts in
+  [#22245](https://github.com/google-gemini/gemini-cli/pull/22245)
+- feat: ACP: Add token usage metadata to the `send` method's return value by
+  @sripasg in [#23148](https://github.com/google-gemini/gemini-cli/pull/23148)
+- fix(plan): clarify that plan mode policies are combined with normal mode by
+  @ruomengz in [#23158](https://github.com/google-gemini/gemini-cli/pull/23158)
+- Add ModelChain support to ModelConfigService and make ModelDialog dynamic by
+  @kevinjwang1 in
+  [#22914](https://github.com/google-gemini/gemini-cli/pull/22914)
+- Ensure that copied extensions are writable in the user's local directory by
+  @kevinjwang1 in
+  [#23016](https://github.com/google-gemini/gemini-cli/pull/23016)
+- feat(core): implement native Windows sandboxing by @mattKorwel in
+  [#21807](https://github.com/google-gemini/gemini-cli/pull/21807)
+- feat(core): add support for admin-forced MCP server installations by
+  @gsquared94 in
+  [#23163](https://github.com/google-gemini/gemini-cli/pull/23163)
+- chore(lint): ignore .gemini directory and recursive node_modules by
+  @mattKorwel in
+  [#23211](https://github.com/google-gemini/gemini-cli/pull/23211)
+- feat(cli): conditionally exclude ask_user tool in ACP mode by @nmcnamara-eng
+  in [#23045](https://github.com/google-gemini/gemini-cli/pull/23045)
+- feat(core): introduce AgentSession and rename stream events to agent events by
+  @mbleigh in [#23159](https://github.com/google-gemini/gemini-cli/pull/23159)
+- feat(worktree): add Git worktree support for isolated parallel sessions by
+  @jerop in [#22973](https://github.com/google-gemini/gemini-cli/pull/22973)
+- Add support for linking in the extension registry by @kevinjwang1 in
+  [#23153](https://github.com/google-gemini/gemini-cli/pull/23153)
+- feat(extensions): add --skip-settings flag to install command by @Ratish1 in
+  [#17212](https://github.com/google-gemini/gemini-cli/pull/17212)
+- feat(telemetry): track if session is running in a Git worktree by @jerop in
+  [#23265](https://github.com/google-gemini/gemini-cli/pull/23265)
+- refactor(core): use absolute paths in GEMINI.md context markers by
+  @SandyTao520 in
+  [#23135](https://github.com/google-gemini/gemini-cli/pull/23135)
+- fix(core): add sanitization to sub agent thoughts and centralize utilities by
+  @devr0306 in [#22828](https://github.com/google-gemini/gemini-cli/pull/22828)
+- feat(core): refine User-Agent for VS Code traffic (unified format) by
+  @sehoon38 in [#23256](https://github.com/google-gemini/gemini-cli/pull/23256)
+- Fix schema for ModelChains by @kevinjwang1 in
+  [#23284](https://github.com/google-gemini/gemini-cli/pull/23284)
+- test(cli): refactor tests for async render utilities by @scidomino in
+  [#23252](https://github.com/google-gemini/gemini-cli/pull/23252)
+- feat(core): add security prompt for browser agent by @cynthialong0-0 in
+  [#23241](https://github.com/google-gemini/gemini-cli/pull/23241)
+- refactor(ide): replace dynamic undici import with static fetch import by
+  @cocosheng-g in
+  [#23268](https://github.com/google-gemini/gemini-cli/pull/23268)
+- test(cli): address unresolved feedback from PR #23252 by @scidomino in
+  [#23303](https://github.com/google-gemini/gemini-cli/pull/23303)
+- feat(browser): add sensitive action controls and read-only noise reduction by
+  @cynthialong0-0 in
+  [#22867](https://github.com/google-gemini/gemini-cli/pull/22867)
+- Disabling failing test while investigating by @alisa-alisa in
+  [#23311](https://github.com/google-gemini/gemini-cli/pull/23311)
+- fix broken extension link in hooks guide by @Indrapal-70 in
+  [#21728](https://github.com/google-gemini/gemini-cli/pull/21728)
+- fix(core): fix agent description indentation by @abhipatel12 in
+  [#23315](https://github.com/google-gemini/gemini-cli/pull/23315)
+- Wrap the text under TOML rule for easier readability in policy-engine.md… by
+  @CogitationOps in
+  [#23076](https://github.com/google-gemini/gemini-cli/pull/23076)
+- fix(extensions): revert broken extension removal behavior by @ehedlund in
+  [#23317](https://github.com/google-gemini/gemini-cli/pull/23317)
+- feat(core): set up onboarding telemetry by @yunaseoul in
+  [#23118](https://github.com/google-gemini/gemini-cli/pull/23118)
+- Retry evals on API error. by @gundermanc in
+  [#23322](https://github.com/google-gemini/gemini-cli/pull/23322)
+- fix(evals): remove tool restrictions and add compile-time guards by
+  @SandyTao520 in
+  [#23312](https://github.com/google-gemini/gemini-cli/pull/23312)
+- fix(hooks): support 'ask' decision for BeforeTool hooks by @gundermanc in
+  [#21146](https://github.com/google-gemini/gemini-cli/pull/21146)
+- feat(browser): add warning message for session mode 'existing' by
+  @cynthialong0-0 in
+  [#23288](https://github.com/google-gemini/gemini-cli/pull/23288)
+- chore(lint): enforce zero warnings and cleanup syntax restrictions by
+  @alisa-alisa in
+  [#22902](https://github.com/google-gemini/gemini-cli/pull/22902)
+- fix(cli): add Esc instruction to HooksDialog footer by @abhipatel12 in
+  [#23258](https://github.com/google-gemini/gemini-cli/pull/23258)
+- Disallow and suppress misused spread operator. by @gundermanc in
+  [#23294](https://github.com/google-gemini/gemini-cli/pull/23294)
+- fix(core): refine CliHelpAgent description for better delegation by
+  @abhipatel12 in
+  [#23310](https://github.com/google-gemini/gemini-cli/pull/23310)
+- fix(core): enable global session and persistent approval for web_fetch by
+  @NTaylorMullen in
+  [#23295](https://github.com/google-gemini/gemini-cli/pull/23295)
+- fix(plan): add state transition override to prevent plan mode freeze by
+  @Adib234 in [#23020](https://github.com/google-gemini/gemini-cli/pull/23020)
+- fix(cli): record skill activation tool calls in chat history by @NTaylorMullen
+  in [#23203](https://github.com/google-gemini/gemini-cli/pull/23203)
+- fix(core): ensure subagent tool updates apply configuration overrides
+  immediately by @abhipatel12 in
+  [#23161](https://github.com/google-gemini/gemini-cli/pull/23161)
+- fix(cli): resolve flicker at boundaries of list in BaseSelectionList by
+  @jackwotherspoon in
+  [#23298](https://github.com/google-gemini/gemini-cli/pull/23298)
+- test(cli): force generic terminal in tests to fix snapshot failures by
+  @abhipatel12 in
+  [#23499](https://github.com/google-gemini/gemini-cli/pull/23499)
+- Evals: PR Guidance adding workflow by @alisa-alisa in
+  [#23164](https://github.com/google-gemini/gemini-cli/pull/23164)
+- feat(core): refactor SandboxManager to a stateless architecture and introduce
+  explicit Deny interface by @ehedlund in
+  [#23141](https://github.com/google-gemini/gemini-cli/pull/23141)
+- feat(core): add event-translator and update agent types by @adamfweidman in
+  [#22985](https://github.com/google-gemini/gemini-cli/pull/22985)
+- perf(cli): parallelize and background startup cleanup tasks by @sehoon38 in
+  [#23545](https://github.com/google-gemini/gemini-cli/pull/23545)
+- fix: "allow always" for commands with paths by @scidomino in
+  [#23558](https://github.com/google-gemini/gemini-cli/pull/23558)
+- fix(cli): prevent terminal escape sequences from leaking on exit by
+  @mattKorwel in
+  [#22682](https://github.com/google-gemini/gemini-cli/pull/22682)
+- feat(cli): implement full "GEMINI CLI" logo for logged-out state by
+  @keithguerin in
+  [#22412](https://github.com/google-gemini/gemini-cli/pull/22412)
+- fix(plan): reserve minimum height for selection list in AskUserDialog by
+  @ruomengz in [#23280](https://github.com/google-gemini/gemini-cli/pull/23280)
+- fix(core): harden AgentSession replay semantics by @adamfweidman in
+  [#23548](https://github.com/google-gemini/gemini-cli/pull/23548)
+- test(core): migrate hook tests to scheduler by @abhipatel12 in
+  [#23496](https://github.com/google-gemini/gemini-cli/pull/23496)
+- chore(config): disable agents by default by @abhipatel12 in
+  [#23546](https://github.com/google-gemini/gemini-cli/pull/23546)
+- fix(ui): make tool confirmations take up entire terminal height by @devr0306
+  in [#22366](https://github.com/google-gemini/gemini-cli/pull/22366)
+- fix(core): prevent redundant remote agent loading on model switch by
+  @adamfweidman in
+  [#23576](https://github.com/google-gemini/gemini-cli/pull/23576)
+- refactor(core): update production type imports from coreToolScheduler by
+  @abhipatel12 in
+  [#23498](https://github.com/google-gemini/gemini-cli/pull/23498)
+- feat(cli): always prefix extension skills with colon separator by
+  @NTaylorMullen in
+  [#23566](https://github.com/google-gemini/gemini-cli/pull/23566)
+- fix(core): properly support allowRedirect in policy engine by @scidomino in
+  [#23579](https://github.com/google-gemini/gemini-cli/pull/23579)
+- fix(cli): prevent subcommand shadowing and skip auth for commands by
+  @mattKorwel in
+  [#23177](https://github.com/google-gemini/gemini-cli/pull/23177)
+- fix(test): move flaky tests to non-blocking suite by @mattKorwel in
+  [#23259](https://github.com/google-gemini/gemini-cli/pull/23259)
+- Changelog for v0.35.0-preview.3 by @gemini-cli-robot in
+  [#23574](https://github.com/google-gemini/gemini-cli/pull/23574)
+- feat(skills): add behavioral-evals skill with fixing and promoting guides by
+  @abhipatel12 in
+  [#23349](https://github.com/google-gemini/gemini-cli/pull/23349)
+- refactor(core): delete obsolete coreToolScheduler by @abhipatel12 in
+  [#23502](https://github.com/google-gemini/gemini-cli/pull/23502)
+- Changelog for v0.35.0-preview.4 by @gemini-cli-robot in
+  [#23581](https://github.com/google-gemini/gemini-cli/pull/23581)
+- feat(core): add LegacyAgentSession by @adamfweidman in
+  [#22986](https://github.com/google-gemini/gemini-cli/pull/22986)
+- feat(test-utils): add TestMcpServerBuilder and support in TestRig by
+  @abhipatel12 in
+  [#23491](https://github.com/google-gemini/gemini-cli/pull/23491)
+- fix(core)!: Force policy config to specify toolName by @kschaab in
+  [#23330](https://github.com/google-gemini/gemini-cli/pull/23330)
+- eval(save_memory): add multi-turn interactive evals for memoryManager by
+  @SandyTao520 in
+  [#23572](https://github.com/google-gemini/gemini-cli/pull/23572)
+- fix(telemetry): patch memory leak and enforce logPrompts privacy by
+  @spencer426 in
+  [#23281](https://github.com/google-gemini/gemini-cli/pull/23281)
+- perf(cli): background IDE client to speed up initialization by @sehoon38 in
+  [#23603](https://github.com/google-gemini/gemini-cli/pull/23603)
+- fix(cli): prevent Ctrl+D exit when input buffer is not empty by @wtanaka in
+  [#23306](https://github.com/google-gemini/gemini-cli/pull/23306)
+- fix: ACP: separate conversational text from execute tool command title by
+  @sripasg in [#23179](https://github.com/google-gemini/gemini-cli/pull/23179)
+- feat(evals): add behavioral evaluations for subagent routing by @Samee24 in
+  [#23272](https://github.com/google-gemini/gemini-cli/pull/23272)
+- refactor(cli,core): foundational layout, identity management, and type safety
+  by @jwhelangoog in
+  [#23286](https://github.com/google-gemini/gemini-cli/pull/23286)
+- fix(core): accurately reflect subagent tool failure in UI by @abhipatel12 in
+  [#23187](https://github.com/google-gemini/gemini-cli/pull/23187)
+- Changelog for v0.35.0-preview.5 by @gemini-cli-robot in
+  [#23606](https://github.com/google-gemini/gemini-cli/pull/23606)
+- feat(ui): implement refreshed UX for Composer layout by @jwhelangoog in
+  [#21212](https://github.com/google-gemini/gemini-cli/pull/21212)
+- fix: API key input dialog user interaction when selected Gemini API Key by
+  @kartikangiras in
+  [#21057](https://github.com/google-gemini/gemini-cli/pull/21057)
+- docs: update `/mcp refresh` to `/mcp reload` by @adamfweidman in
+  [#23631](https://github.com/google-gemini/gemini-cli/pull/23631)
+- Implementation of sandbox "Write-Protected" Governance Files by @DavidAPierce
+  in [#23139](https://github.com/google-gemini/gemini-cli/pull/23139)
+- feat(sandbox): dynamic macOS sandbox expansion and worktree support by @galz10
+  in [#23301](https://github.com/google-gemini/gemini-cli/pull/23301)
+- fix(acp): Pass the cwd to `AcpFileSystemService` to avoid looping failures in
+  asking for perms to write plan md file by @sripasg in
+  [#23612](https://github.com/google-gemini/gemini-cli/pull/23612)
+- fix(plan): sandbox path resolution in Plan Mode to prevent hallucinations by
+  @Adib234 in [#22737](https://github.com/google-gemini/gemini-cli/pull/22737)
+- feat(ui): allow immediate user input during startup by @sehoon38 in
+  [#23661](https://github.com/google-gemini/gemini-cli/pull/23661)
+- refactor(sandbox): reorganize Windows sandbox files by @galz10 in
+  [#23645](https://github.com/google-gemini/gemini-cli/pull/23645)
+- fix(core): improve remote agent streaming UI and UX by @adamfweidman in
+  [#23633](https://github.com/google-gemini/gemini-cli/pull/23633)
+- perf(cli): optimize --version startup time by @sehoon38 in
+  [#23671](https://github.com/google-gemini/gemini-cli/pull/23671)
+- refactor(core): stop gemini CLI from producing unsafe casts by @gundermanc in
+  [#23611](https://github.com/google-gemini/gemini-cli/pull/23611)
+- use enableAutoUpdate in test rig by @scidomino in
+  [#23681](https://github.com/google-gemini/gemini-cli/pull/23681)
+- feat(core): change user-facing auth type from oauth2 to oauth by @adamfweidman
+  in [#23639](https://github.com/google-gemini/gemini-cli/pull/23639)
+- chore(deps): fix npm audit vulnerabilities by @scidomino in
+  [#23679](https://github.com/google-gemini/gemini-cli/pull/23679)
+- test(evals): fix overlapping act() deadlock in app-test-helper by @Adib234 in
+  [#23666](https://github.com/google-gemini/gemini-cli/pull/23666)
+- fix(patch): cherry-pick 055ff92 to release/v0.36.0-preview.0-pr-23672 to patch
+  version v0.36.0-preview.0 and create version 0.36.0-preview.1 by
   @gemini-cli-robot in
-  [#21300](https://github.com/google-gemini/gemini-cli/pull/21300)
-- fix(patch): cherry-pick 0135b03 to release/v0.33.0-preview.2-pr-21171
-  [CONFLICTS] by @gemini-cli-robot in
-  [#21336](https://github.com/google-gemini/gemini-cli/pull/21336)
-- fix(patch): cherry-pick 7ec477d to release/v0.33.0-preview.3-pr-21305 to patch
-  version v0.33.0-preview.3 and create version 0.33.0-preview.4 by
+  [#23723](https://github.com/google-gemini/gemini-cli/pull/23723)
+- fix(patch): cherry-pick 765fb67 to release/v0.36.0-preview.5-pr-24055 to patch
+  version v0.36.0-preview.5 and create version 0.36.0-preview.6 by
   @gemini-cli-robot in
-  [#21349](https://github.com/google-gemini/gemini-cli/pull/21349)
-- fix(patch): cherry-pick 931e668 to release/v0.33.0-preview.4-pr-21425
-  [CONFLICTS] by @gemini-cli-robot in
-  [#21478](https://github.com/google-gemini/gemini-cli/pull/21478)
-- fix(patch): cherry-pick 7837194 to release/v0.33.0-preview.5-pr-21487 to patch
-  version v0.33.0-preview.5 and create version 0.33.0-preview.6 by
-  @gemini-cli-robot in
-  [#21720](https://github.com/google-gemini/gemini-cli/pull/21720)
-- fix(patch): cherry-pick 4f4431e to release/v0.33.0-preview.7-pr-21750 to patch
-  version v0.33.0-preview.7 and create version 0.33.0-preview.8 by
-  @gemini-cli-robot in
-  [#21782](https://github.com/google-gemini/gemini-cli/pull/21782)
-- fix(patch): cherry-pick 9a74271 to release/v0.33.0-preview.8-pr-21236
-  [CONFLICTS] by @gemini-cli-robot in
-  [#21788](https://github.com/google-gemini/gemini-cli/pull/21788)
-- fix(patch): cherry-pick 936f624 to release/v0.33.0-preview.9-pr-21702 to patch
-  version v0.33.0-preview.9 and create version 0.33.0-preview.10 by
-  @gemini-cli-robot in
-  [#21800](https://github.com/google-gemini/gemini-cli/pull/21800)
-- fix(patch): cherry-pick 35ee2a8 to release/v0.33.0-preview.10-pr-21713 by
-  @gemini-cli-robot in
-  [#21859](https://github.com/google-gemini/gemini-cli/pull/21859)
-- fix(patch): cherry-pick 5dd2dab to release/v0.33.0-preview.11-pr-21871 by
-  @gemini-cli-robot in
-  [#21876](https://github.com/google-gemini/gemini-cli/pull/21876)
-- fix(patch): cherry-pick e5615f4 to release/v0.33.0-preview.12-pr-21037 to
-  patch version v0.33.0-preview.12 and create version 0.33.0-preview.13 by
-  @gemini-cli-robot in
-  [#21922](https://github.com/google-gemini/gemini-cli/pull/21922)
-- fix(patch): cherry-pick 1b69637 to release/v0.33.0-preview.13-pr-21467
-  [CONFLICTS] by @gemini-cli-robot in
-  [#21930](https://github.com/google-gemini/gemini-cli/pull/21930)
-- fix(patch): cherry-pick 3ff68a9 to release/v0.33.0-preview.14-pr-21884
-  [CONFLICTS] by @gemini-cli-robot in
-  [#21952](https://github.com/google-gemini/gemini-cli/pull/21952)
+  [#24061](https://github.com/google-gemini/gemini-cli/pull/24061)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.32.1...v0.33.1
+https://github.com/google-gemini/gemini-cli/compare/v0.35.3...v0.36.0

docs/changelogs/preview.md

@@ -1,6 +1,6 @@
-# Preview release: v0.34.0-preview.1
+# Preview release: v0.37.0-preview.1
 
-Released: March 12, 2026
+Released: April 02, 2026
 
 Our preview release includes the latest, new, and experimental features. This
 release may not be as stable as our [latest weekly release](latest.md).
@@ -13,459 +13,410 @@ npm install -g @google/gemini-cli@preview
 
 ## Highlights
 
-- **Plan Mode Enabled by Default:** Plan Mode is now enabled out-of-the-box,
-  providing a structured planning workflow and keeping approved plans during
-  chat compression.
-- **Sandboxing Enhancements:** Added experimental LXC container sandbox support
-  and native gVisor (`runsc`) sandboxing for improved security and isolation.
-- **Tracker Visualization and Tools:** Introduced CRUD tools and visualization
-  for trackers, along with task tracker strategy improvements.
-- **Browser Agent Improvements:** Enhanced the browser agent with progress
-  emission, a new automation overlay, and additional integration tests.
-- **CLI and UI Updates:** Standardized semantic focus colors, polished shell
-  autocomplete rendering, unified keybinding infrastructure, and added custom
-  footer configuration options.
+- **Plan Mode Enhancements**: Plan now includes support for untrusted folders,
+  prioritized pre-approval discussions, and a resolve for sandbox-related
+  deadlocks during file creation.
+- **Browser Agent Evolved**: Significant updates to the browser agent, including
+  persistent session management, dynamic discovery of read-only tools,
+  sandbox-aware initialization, and automated reclamation of stale snapshots to
+  optimize context window usage.
+- **Advanced Sandbox Security**: Implementation of dynamic sandbox expansion for
+  both Linux and Windows, alongside secret visibility lockdown for environment
+  files and OS-specific forbidden path support.
+- **Unified Core Architecture**: Centralized context management and a new
+  `ModelConfigService` for unified model discovery, complemented by the
+  introduction of `AgentHistoryProvider` and tool-based topic grouping
+  (Chapters).
+- **UI/UX & Performance Improvements**: New Tokyo Night theme, "tab to queue"
+  message support, and compact tool output formatting, plus optimized build
+  scripts and improved layout stability for TUI components.
 
 ## What's Changed
 
-- fix(patch): cherry-pick 45faf4d to release/v0.34.0-preview.0-pr-22148
-  [CONFLICTS] by @gemini-cli-robot in
-  [#22174](https://github.com/google-gemini/gemini-cli/pull/22174)
-- feat(cli): add chat resume footer on session quit by @lordshashank in
-  [#20667](https://github.com/google-gemini/gemini-cli/pull/20667)
-- Support bold and other styles in svg snapshots by @jacob314 in
-  [#20937](https://github.com/google-gemini/gemini-cli/pull/20937)
-- fix(core): increase A2A agent timeout to 30 minutes by @adamfweidman in
-  [#21028](https://github.com/google-gemini/gemini-cli/pull/21028)
-- Cleanup old branches. by @jacob314 in
-  [#19354](https://github.com/google-gemini/gemini-cli/pull/19354)
-- chore(release): bump version to 0.34.0-nightly.20260303.34f0c1538 by
+- fix(patch): cherry-pick 64c928f to release/v0.37.0-preview.0-pr-23257 to patch
+  version v0.37.0-preview.0 and create version 0.37.0-preview.1 by
   @gemini-cli-robot in
-  [#21034](https://github.com/google-gemini/gemini-cli/pull/21034)
-- feat(ui): standardize semantic focus colors and enhance history visibility by
-  @keithguerin in
-  [#20745](https://github.com/google-gemini/gemini-cli/pull/20745)
-- fix: merge duplicate imports in packages/core (3/4) by @Nixxx19 in
-  [#20928](https://github.com/google-gemini/gemini-cli/pull/20928)
-- Add extra safety checks for proto pollution by @jacob314 in
-  [#20396](https://github.com/google-gemini/gemini-cli/pull/20396)
-- feat(core): Add tracker CRUD tools & visualization by @anj-s in
-  [#19489](https://github.com/google-gemini/gemini-cli/pull/19489)
-- Revert "fix(ui): persist expansion in AskUser dialog when navigating options"
-  by @jacob314 in
-  [#21042](https://github.com/google-gemini/gemini-cli/pull/21042)
-- Changelog for v0.33.0-preview.0 by @gemini-cli-robot in
-  [#21030](https://github.com/google-gemini/gemini-cli/pull/21030)
-- fix: model persistence for all scenarios by @sripasg in
-  [#21051](https://github.com/google-gemini/gemini-cli/pull/21051)
-- chore/release: bump version to 0.34.0-nightly.20260304.28af4e127 by
-  @gemini-cli-robot in
-  [#21054](https://github.com/google-gemini/gemini-cli/pull/21054)
-- Consistently guard restarts against concurrent auto updates by @scidomino in
-  [#21016](https://github.com/google-gemini/gemini-cli/pull/21016)
-- Defensive coding to reduce the risk of Maximum update depth errors by
-  @jacob314 in [#20940](https://github.com/google-gemini/gemini-cli/pull/20940)
-- fix(cli): Polish shell autocomplete rendering to be a little more shell native
-  feeling. by @jacob314 in
-  [#20931](https://github.com/google-gemini/gemini-cli/pull/20931)
-- Docs: Update plan mode docs by @jkcinouye in
-  [#19682](https://github.com/google-gemini/gemini-cli/pull/19682)
-- fix(mcp): Notifications/tools/list_changed support not working by @jacob314 in
-  [#21050](https://github.com/google-gemini/gemini-cli/pull/21050)
-- fix(cli): register extension lifecycle events in DebugProfiler by
-  @fayerman-source in
-  [#20101](https://github.com/google-gemini/gemini-cli/pull/20101)
-- chore(dev): update vscode settings for typescriptreact by @rohit-4321 in
-  [#19907](https://github.com/google-gemini/gemini-cli/pull/19907)
-- fix(cli): enable multi-arch docker builds for sandbox by @ru-aish in
-  [#19821](https://github.com/google-gemini/gemini-cli/pull/19821)
-- Changelog for v0.32.0 by @gemini-cli-robot in
-  [#21033](https://github.com/google-gemini/gemini-cli/pull/21033)
-- Changelog for v0.33.0-preview.1 by @gemini-cli-robot in
-  [#21058](https://github.com/google-gemini/gemini-cli/pull/21058)
-- feat(core): improve @scripts/copy_files.js autocomplete to prioritize
-  filenames by @sehoon38 in
-  [#21064](https://github.com/google-gemini/gemini-cli/pull/21064)
-- feat(sandbox): add experimental LXC container sandbox support by @h30s in
-  [#20735](https://github.com/google-gemini/gemini-cli/pull/20735)
-- feat(evals): add overall pass rate row to eval nightly summary table by
-  @gundermanc in
-  [#20905](https://github.com/google-gemini/gemini-cli/pull/20905)
-- feat(telemetry): include language in telemetry and fix accepted lines
-  computation by @gundermanc in
-  [#21126](https://github.com/google-gemini/gemini-cli/pull/21126)
-- Changelog for v0.32.1 by @gemini-cli-robot in
-  [#21055](https://github.com/google-gemini/gemini-cli/pull/21055)
-- feat(core): add robustness tests, logging, and metrics for CodeAssistServer
-  SSE parsing by @yunaseoul in
-  [#21013](https://github.com/google-gemini/gemini-cli/pull/21013)
-- feat: add issue assignee workflow by @kartikangiras in
-  [#21003](https://github.com/google-gemini/gemini-cli/pull/21003)
-- fix: improve error message when OAuth succeeds but project ID is required by
-  @Nixxx19 in [#21070](https://github.com/google-gemini/gemini-cli/pull/21070)
-- feat(loop-reduction): implement iterative loop detection and model feedback by
-  @aishaneeshah in
-  [#20763](https://github.com/google-gemini/gemini-cli/pull/20763)
-- chore(github): require prompt approvers for agent prompt files by @gundermanc
-  in [#20896](https://github.com/google-gemini/gemini-cli/pull/20896)
-- Docs: Create tools reference by @jkcinouye in
-  [#19470](https://github.com/google-gemini/gemini-cli/pull/19470)
-- fix(core, a2a-server): prevent hang during OAuth in non-interactive sessions
-  by @spencer426 in
-  [#21045](https://github.com/google-gemini/gemini-cli/pull/21045)
-- chore(cli): enable deprecated settings removal by default by @yashodipmore in
-  [#20682](https://github.com/google-gemini/gemini-cli/pull/20682)
-- feat(core): Disable fast ack helper for hints. by @joshualitt in
-  [#21011](https://github.com/google-gemini/gemini-cli/pull/21011)
-- fix(ui): suppress redundant failure note when tool error note is shown by
-  @NTaylorMullen in
-  [#21078](https://github.com/google-gemini/gemini-cli/pull/21078)
-- docs: document planning workflows with Conductor example by @jerop in
-  [#21166](https://github.com/google-gemini/gemini-cli/pull/21166)
-- feat(release): ship esbuild bundle in npm package by @genneth in
-  [#19171](https://github.com/google-gemini/gemini-cli/pull/19171)
-- fix(extensions): preserve symlinks in extension source path while enforcing
-  folder trust by @galz10 in
-  [#20867](https://github.com/google-gemini/gemini-cli/pull/20867)
-- fix(cli): defer tool exclusions to policy engine in non-interactive mode by
-  @EricRahm in [#20639](https://github.com/google-gemini/gemini-cli/pull/20639)
-- fix(ui): removed double padding on rendered content by @devr0306 in
-  [#21029](https://github.com/google-gemini/gemini-cli/pull/21029)
-- fix(core): truncate excessively long lines in grep search output by
-  @gundermanc in
-  [#21147](https://github.com/google-gemini/gemini-cli/pull/21147)
-- feat: add custom footer configuration via `/footer` by @jackwotherspoon in
-  [#19001](https://github.com/google-gemini/gemini-cli/pull/19001)
-- perf(core): fix OOM crash in long-running sessions by @WizardsForgeGames in
-  [#19608](https://github.com/google-gemini/gemini-cli/pull/19608)
-- refactor(cli): categorize built-in themes into dark/ and light/ directories by
-  @JayadityaGit in
-  [#18634](https://github.com/google-gemini/gemini-cli/pull/18634)
-- fix(core): explicitly allow codebase_investigator and cli_help in read-only
-  mode by @Adib234 in
-  [#21157](https://github.com/google-gemini/gemini-cli/pull/21157)
-- test: add browser agent integration tests by @kunal-10-cloud in
-  [#21151](https://github.com/google-gemini/gemini-cli/pull/21151)
-- fix(cli): fix enabling kitty codes on Windows Terminal by @scidomino in
-  [#21136](https://github.com/google-gemini/gemini-cli/pull/21136)
-- refactor(core): extract shared OAuth flow primitives from MCPOAuthProvider by
-  @SandyTao520 in
-  [#20895](https://github.com/google-gemini/gemini-cli/pull/20895)
-- fix(ui): add partial output to cancelled shell UI by @devr0306 in
-  [#21178](https://github.com/google-gemini/gemini-cli/pull/21178)
-- fix(cli): replace hardcoded keybinding strings with dynamic formatters by
-  @scidomino in [#21159](https://github.com/google-gemini/gemini-cli/pull/21159)
-- DOCS: Update quota and pricing page by @g-samroberts in
-  [#21194](https://github.com/google-gemini/gemini-cli/pull/21194)
-- feat(telemetry): implement Clearcut logging for startup statistics by
-  @yunaseoul in [#21172](https://github.com/google-gemini/gemini-cli/pull/21172)
-- feat(triage): add area/documentation to issue triage by @g-samroberts in
-  [#21222](https://github.com/google-gemini/gemini-cli/pull/21222)
-- Fix so shell calls are formatted by @jacob314 in
-  [#21237](https://github.com/google-gemini/gemini-cli/pull/21237)
-- feat(cli): add native gVisor (runsc) sandboxing support by @Zheyuan-Lin in
-  [#21062](https://github.com/google-gemini/gemini-cli/pull/21062)
-- docs: use absolute paths for internal links in plan-mode.md by @jerop in
-  [#21299](https://github.com/google-gemini/gemini-cli/pull/21299)
-- fix(core): prevent unhandled AbortError crash during stream loop detection by
-  @7hokerz in [#21123](https://github.com/google-gemini/gemini-cli/pull/21123)
-- fix:reorder env var redaction checks to scan values first by @kartikangiras in
-  [#21059](https://github.com/google-gemini/gemini-cli/pull/21059)
-- fix(acp): rename --experimental-acp to --acp & remove Zed-specific refrences
-  by @skeshive in
-  [#21171](https://github.com/google-gemini/gemini-cli/pull/21171)
-- feat(core): fallback to 2.5 models with no access for toolcalls by @sehoon38
-  in [#21283](https://github.com/google-gemini/gemini-cli/pull/21283)
-- test(core): improve testing for API request/response parsing by @sehoon38 in
-  [#21227](https://github.com/google-gemini/gemini-cli/pull/21227)
-- docs(links): update docs-writer skill and fix broken link by @g-samroberts in
-  [#21314](https://github.com/google-gemini/gemini-cli/pull/21314)
-- Fix code colorizer ansi escape bug. by @jacob314 in
-  [#21321](https://github.com/google-gemini/gemini-cli/pull/21321)
-- remove wildcard behavior on keybindings by @scidomino in
-  [#21315](https://github.com/google-gemini/gemini-cli/pull/21315)
-- feat(acp): Add support for AI Gateway auth by @skeshive in
-  [#21305](https://github.com/google-gemini/gemini-cli/pull/21305)
-- fix(theme): improve theme color contrast for macOS Terminal.app by @clocky in
-  [#21175](https://github.com/google-gemini/gemini-cli/pull/21175)
-- feat (core): Implement tracker related SI changes by @anj-s in
-  [#19964](https://github.com/google-gemini/gemini-cli/pull/19964)
-- Changelog for v0.33.0-preview.2 by @gemini-cli-robot in
-  [#21333](https://github.com/google-gemini/gemini-cli/pull/21333)
-- Changelog for v0.33.0-preview.3 by @gemini-cli-robot in
-  [#21347](https://github.com/google-gemini/gemini-cli/pull/21347)
-- docs: format release times as HH:MM UTC by @pavan-sh in
-  [#20726](https://github.com/google-gemini/gemini-cli/pull/20726)
-- fix(cli): implement --all flag for extensions uninstall by @sehoon38 in
-  [#21319](https://github.com/google-gemini/gemini-cli/pull/21319)
-- docs: fix incorrect relative links to command reference by @kanywst in
-  [#20964](https://github.com/google-gemini/gemini-cli/pull/20964)
-- documentiong ensures ripgrep by @Jatin24062005 in
-  [#21298](https://github.com/google-gemini/gemini-cli/pull/21298)
-- fix(core): handle AbortError thrown during processTurn by @MumuTW in
-  [#21296](https://github.com/google-gemini/gemini-cli/pull/21296)
-- docs(cli): clarify ! command output visibility in shell commands tutorial by
-  @MohammedADev in
-  [#21041](https://github.com/google-gemini/gemini-cli/pull/21041)
-- fix: logic for task tracker strategy and remove tracker tools by @anj-s in
-  [#21355](https://github.com/google-gemini/gemini-cli/pull/21355)
-- fix(partUtils): display media type and size for inline data parts by @Aboudjem
-  in [#21358](https://github.com/google-gemini/gemini-cli/pull/21358)
-- Fix(accessibility): add screen reader support to RewindViewer by @Famous077 in
-  [#20750](https://github.com/google-gemini/gemini-cli/pull/20750)
-- fix(hooks): propagate stopHookActive in AfterAgent retry path (#20426) by
-  @Aarchi-07 in [#20439](https://github.com/google-gemini/gemini-cli/pull/20439)
-- fix(core): deduplicate GEMINI.md files by device/inode on case-insensitive
-  filesystems (#19904) by @Nixxx19 in
-  [#19915](https://github.com/google-gemini/gemini-cli/pull/19915)
-- feat(core): add concurrency safety guidance for subagent delegation (#17753)
-  by @abhipatel12 in
-  [#21278](https://github.com/google-gemini/gemini-cli/pull/21278)
-- feat(ui): dynamically generate all keybinding hints by @scidomino in
-  [#21346](https://github.com/google-gemini/gemini-cli/pull/21346)
-- feat(core): implement unified KeychainService and migrate token storage by
-  @ehedlund in [#21344](https://github.com/google-gemini/gemini-cli/pull/21344)
-- fix(cli): gracefully handle --resume when no sessions exist by @SandyTao520 in
-  [#21429](https://github.com/google-gemini/gemini-cli/pull/21429)
-- fix(plan): keep approved plan during chat compression by @ruomengz in
-  [#21284](https://github.com/google-gemini/gemini-cli/pull/21284)
-- feat(core): implement generic CacheService and optimize setupUser by @sehoon38
-  in [#21374](https://github.com/google-gemini/gemini-cli/pull/21374)
-- Update quota and pricing documentation with subscription tiers by @srithreepo
-  in [#21351](https://github.com/google-gemini/gemini-cli/pull/21351)
-- fix(core): append correct OTLP paths for HTTP exporters by
-  @sebastien-prudhomme in
-  [#16836](https://github.com/google-gemini/gemini-cli/pull/16836)
-- Changelog for v0.33.0-preview.4 by @gemini-cli-robot in
-  [#21354](https://github.com/google-gemini/gemini-cli/pull/21354)
-- feat(cli): implement dot-prefixing for slash command conflicts by @ehedlund in
-  [#20979](https://github.com/google-gemini/gemini-cli/pull/20979)
-- refactor(core): standardize MCP tool naming to mcp\_ FQN format by
-  @abhipatel12 in
-  [#21425](https://github.com/google-gemini/gemini-cli/pull/21425)
-- feat(cli): hide gemma settings from display and mark as experimental by
-  @abhipatel12 in
-  [#21471](https://github.com/google-gemini/gemini-cli/pull/21471)
-- feat(skills): refine string-reviewer guidelines and description by @clocky in
-  [#20368](https://github.com/google-gemini/gemini-cli/pull/20368)
-- fix(core): whitelist TERM and COLORTERM in environment sanitization by
-  @deadsmash07 in
-  [#20514](https://github.com/google-gemini/gemini-cli/pull/20514)
-- fix(billing): fix overage strategy lifecycle and settings integration by
-  @gsquared94 in
-  [#21236](https://github.com/google-gemini/gemini-cli/pull/21236)
-- fix: expand paste placeholders in TextInput on submit by @Jefftree in
-  [#19946](https://github.com/google-gemini/gemini-cli/pull/19946)
-- fix(core): add in-memory cache to ChatRecordingService to prevent OOM by
-  @SandyTao520 in
-  [#21502](https://github.com/google-gemini/gemini-cli/pull/21502)
-- feat(cli): overhaul thinking UI by @keithguerin in
-  [#18725](https://github.com/google-gemini/gemini-cli/pull/18725)
-- fix(ui): unify Ctrl+O expansion hint experience across buffer modes by
-  @jwhelangoog in
-  [#21474](https://github.com/google-gemini/gemini-cli/pull/21474)
-- fix(cli): correct shell height reporting by @jacob314 in
-  [#21492](https://github.com/google-gemini/gemini-cli/pull/21492)
-- Make test suite pass when the GEMINI_SYSTEM_MD env variable or
-  GEMINI_WRITE_SYSTEM_MD variable happens to be set locally/ by @jacob314 in
-  [#21480](https://github.com/google-gemini/gemini-cli/pull/21480)
-- Disallow underspecified types by @gundermanc in
-  [#21485](https://github.com/google-gemini/gemini-cli/pull/21485)
-- refactor(cli): standardize on 'reload' verb for all components by @keithguerin
-  in [#20654](https://github.com/google-gemini/gemini-cli/pull/20654)
-- feat(cli): Invert quota language to 'percent used' by @keithguerin in
-  [#20100](https://github.com/google-gemini/gemini-cli/pull/20100)
-- Docs: Add documentation for notifications (experimental)(macOS) by @jkcinouye
-  in [#21163](https://github.com/google-gemini/gemini-cli/pull/21163)
-- Code review comments as a pr by @jacob314 in
-  [#21209](https://github.com/google-gemini/gemini-cli/pull/21209)
-- feat(cli): unify /chat and /resume command UX by @LyalinDotCom in
-  [#20256](https://github.com/google-gemini/gemini-cli/pull/20256)
-- docs: fix typo 'allowslisted' -> 'allowlisted' in mcp-server.md by
-  @Gyanranjan-Priyam in
-  [#21665](https://github.com/google-gemini/gemini-cli/pull/21665)
-- fix(core): display actual graph output in tracker_visualize tool by @anj-s in
-  [#21455](https://github.com/google-gemini/gemini-cli/pull/21455)
-- fix(core): sanitize SSE-corrupted JSON and domain strings in error
-  classification by @gsquared94 in
-  [#21702](https://github.com/google-gemini/gemini-cli/pull/21702)
-- Docs: Make documentation links relative by @diodesign in
-  [#21490](https://github.com/google-gemini/gemini-cli/pull/21490)
-- feat(cli): expose /tools desc as explicit subcommand for discoverability by
-  @aworki in [#21241](https://github.com/google-gemini/gemini-cli/pull/21241)
-- feat(cli): add /compact alias for /compress command by @jackwotherspoon in
-  [#21711](https://github.com/google-gemini/gemini-cli/pull/21711)
-- feat(plan): enable Plan Mode by default by @jerop in
-  [#21713](https://github.com/google-gemini/gemini-cli/pull/21713)
-- feat(core): Introduce `AgentLoopContext`. by @joshualitt in
-  [#21198](https://github.com/google-gemini/gemini-cli/pull/21198)
-- fix(core): resolve symlinks for non-existent paths during validation by
-  @Adib234 in [#21487](https://github.com/google-gemini/gemini-cli/pull/21487)
-- docs: document tool exclusion from memory via deny policy by @Abhijit-2592 in
-  [#21428](https://github.com/google-gemini/gemini-cli/pull/21428)
-- perf(core): cache loadApiKey to reduce redundant keychain access by @sehoon38
-  in [#21520](https://github.com/google-gemini/gemini-cli/pull/21520)
-- feat(cli): implement /upgrade command by @sehoon38 in
-  [#21511](https://github.com/google-gemini/gemini-cli/pull/21511)
-- Feat/browser agent progress emission by @kunal-10-cloud in
-  [#21218](https://github.com/google-gemini/gemini-cli/pull/21218)
-- fix(settings): display objects as JSON instead of [object Object] by
-  @Zheyuan-Lin in
-  [#21458](https://github.com/google-gemini/gemini-cli/pull/21458)
-- Unmarshall update by @DavidAPierce in
-  [#21721](https://github.com/google-gemini/gemini-cli/pull/21721)
-- Update mcp's list function to check for disablement. by @DavidAPierce in
-  [#21148](https://github.com/google-gemini/gemini-cli/pull/21148)
-- robustness(core): static checks to validate history is immutable by @jacob314
-  in [#21228](https://github.com/google-gemini/gemini-cli/pull/21228)
-- refactor(cli): better react patterns for BaseSettingsDialog by @psinha40898 in
-  [#21206](https://github.com/google-gemini/gemini-cli/pull/21206)
-- feat(security): implement robust IP validation and safeFetch foundation by
-  @alisa-alisa in
-  [#21401](https://github.com/google-gemini/gemini-cli/pull/21401)
-- feat(core): improve subagent result display by @joshualitt in
-  [#20378](https://github.com/google-gemini/gemini-cli/pull/20378)
-- docs: fix broken markdown syntax and anchor links in /tools by @campox747 in
-  [#20902](https://github.com/google-gemini/gemini-cli/pull/20902)
-- feat(policy): support subagent-specific policies in TOML by @akh64bit in
-  [#21431](https://github.com/google-gemini/gemini-cli/pull/21431)
-- Add script to speed up reviewing PRs adding a worktree. by @jacob314 in
-  [#21748](https://github.com/google-gemini/gemini-cli/pull/21748)
-- fix(core): prevent infinite recursion in symlink resolution by @Adib234 in
-  [#21750](https://github.com/google-gemini/gemini-cli/pull/21750)
-- fix(docs): fix headless mode docs by @ame2en in
-  [#21287](https://github.com/google-gemini/gemini-cli/pull/21287)
-- feat/redesign header compact by @jacob314 in
-  [#20922](https://github.com/google-gemini/gemini-cli/pull/20922)
-- refactor: migrate to useKeyMatchers hook by @scidomino in
-  [#21753](https://github.com/google-gemini/gemini-cli/pull/21753)
-- perf(cli): cache loadSettings to reduce redundant disk I/O at startup by
-  @sehoon38 in [#21521](https://github.com/google-gemini/gemini-cli/pull/21521)
-- fix(core): resolve Windows line ending and path separation bugs across CLI by
-  @muhammadusman586 in
-  [#21068](https://github.com/google-gemini/gemini-cli/pull/21068)
-- docs: fix heading formatting in commands.md and phrasing in tools-api.md by
-  @campox747 in [#20679](https://github.com/google-gemini/gemini-cli/pull/20679)
-- refactor(ui): unify keybinding infrastructure and support string
-  initialization by @scidomino in
-  [#21776](https://github.com/google-gemini/gemini-cli/pull/21776)
-- Add support for updating extension sources and names by @chrstnb in
-  [#21715](https://github.com/google-gemini/gemini-cli/pull/21715)
-- fix(core): handle GUI editor non-zero exit codes gracefully by @reyyanxahmed
-  in [#20376](https://github.com/google-gemini/gemini-cli/pull/20376)
-- fix(core): destroy PTY on kill() and exception to prevent fd leak by @nbardy
-  in [#21693](https://github.com/google-gemini/gemini-cli/pull/21693)
-- fix(docs): update theme screenshots and add missing themes by @ashmod in
-  [#20689](https://github.com/google-gemini/gemini-cli/pull/20689)
-- refactor(cli): rename 'return' key to 'enter' internally by @scidomino in
-  [#21796](https://github.com/google-gemini/gemini-cli/pull/21796)
-- build(release): restrict npm bundling to non-stable tags by @sehoon38 in
-  [#21821](https://github.com/google-gemini/gemini-cli/pull/21821)
-- fix(core): override toolRegistry property for sub-agent schedulers by
-  @gsquared94 in
-  [#21766](https://github.com/google-gemini/gemini-cli/pull/21766)
-- fix(cli): make footer items equally spaced by @jacob314 in
-  [#21843](https://github.com/google-gemini/gemini-cli/pull/21843)
-- docs: clarify global policy rules application in plan mode by @jerop in
-  [#21864](https://github.com/google-gemini/gemini-cli/pull/21864)
-- fix(core): ensure correct flash model steering in plan mode implementation
-  phase by @jerop in
-  [#21871](https://github.com/google-gemini/gemini-cli/pull/21871)
-- fix(core): update @a2a-js/sdk to 0.3.11 by @adamfweidman in
-  [#21875](https://github.com/google-gemini/gemini-cli/pull/21875)
-- refactor(core): improve API response error logging when retry by @yunaseoul in
-  [#21784](https://github.com/google-gemini/gemini-cli/pull/21784)
-- fix(ui): handle headless execution in credits and upgrade dialogs by
-  @gsquared94 in
-  [#21850](https://github.com/google-gemini/gemini-cli/pull/21850)
-- fix(core): treat retryable errors with >5 min delay as terminal quota errors
-  by @gsquared94 in
-  [#21881](https://github.com/google-gemini/gemini-cli/pull/21881)
-- feat(telemetry): add specific PR, issue, and custom tracking IDs for GitHub
-  Actions by @cocosheng-g in
-  [#21129](https://github.com/google-gemini/gemini-cli/pull/21129)
-- feat(core): add OAuth2 Authorization Code auth provider for A2A agents by
-  @SandyTao520 in
-  [#21496](https://github.com/google-gemini/gemini-cli/pull/21496)
-- feat(cli): give visibility to /tools list command in the TUI and follow the
-  subcommand pattern of other commands by @JayadityaGit in
-  [#21213](https://github.com/google-gemini/gemini-cli/pull/21213)
-- Handle dirty worktrees better and warn about running scripts/review.sh on
-  untrusted code. by @jacob314 in
-  [#21791](https://github.com/google-gemini/gemini-cli/pull/21791)
-- feat(policy): support auto-add to policy by default and scoped persistence by
-  @spencer426 in
-  [#20361](https://github.com/google-gemini/gemini-cli/pull/20361)
-- fix(core): handle AbortError when ESC cancels tool execution by @PrasannaPal21
-  in [#20863](https://github.com/google-gemini/gemini-cli/pull/20863)
-- fix(release): Improve Patch Release Workflow Comments: Clearer Approval
-  Guidance by @jerop in
-  [#21894](https://github.com/google-gemini/gemini-cli/pull/21894)
-- docs: clarify telemetry setup and comprehensive data map by @jerop in
-  [#21879](https://github.com/google-gemini/gemini-cli/pull/21879)
-- feat(core): add per-model token usage to stream-json output by @yongruilin in
-  [#21839](https://github.com/google-gemini/gemini-cli/pull/21839)
-- docs: remove experimental badge from plan mode in sidebar by @jerop in
-  [#21906](https://github.com/google-gemini/gemini-cli/pull/21906)
-- fix(cli): prevent race condition in loop detection retry by @skyvanguard in
-  [#17916](https://github.com/google-gemini/gemini-cli/pull/17916)
-- Add behavioral evals for tracker by @anj-s in
-  [#20069](https://github.com/google-gemini/gemini-cli/pull/20069)
-- fix(auth): update terminology to 'sign in' and 'sign out' by @clocky in
-  [#20892](https://github.com/google-gemini/gemini-cli/pull/20892)
-- docs(mcp): standardize mcp tool fqn documentation by @abhipatel12 in
-  [#21664](https://github.com/google-gemini/gemini-cli/pull/21664)
-- fix(ui): prevent empty tool-group border stubs after filtering by @Aaxhirrr in
-  [#21852](https://github.com/google-gemini/gemini-cli/pull/21852)
-- make command names consistent by @scidomino in
-  [#21907](https://github.com/google-gemini/gemini-cli/pull/21907)
-- refactor: remove agent_card_requires_auth config flag by @adamfweidman in
-  [#21914](https://github.com/google-gemini/gemini-cli/pull/21914)
-- feat(a2a): implement standardized normalization and streaming reassembly by
-  @alisa-alisa in
-  [#21402](https://github.com/google-gemini/gemini-cli/pull/21402)
-- feat(cli): enable skill activation via slash commands by @NTaylorMullen in
-  [#21758](https://github.com/google-gemini/gemini-cli/pull/21758)
-- docs(cli): mention per-model token usage in stream-json result event by
-  @yongruilin in
-  [#21908](https://github.com/google-gemini/gemini-cli/pull/21908)
-- fix(plan): prevent plan truncation in approval dialog by supporting
-  unconstrained heights by @Adib234 in
-  [#21037](https://github.com/google-gemini/gemini-cli/pull/21037)
-- feat(a2a): switch from callback-based to event-driven tool scheduler by
-  @cocosheng-g in
-  [#21467](https://github.com/google-gemini/gemini-cli/pull/21467)
-- feat(voice): implement speech-friendly response formatter by @Solventerritory
-  in [#20989](https://github.com/google-gemini/gemini-cli/pull/20989)
-- feat: add pulsating blue border automation overlay to browser agent by
-  @kunal-10-cloud in
-  [#21173](https://github.com/google-gemini/gemini-cli/pull/21173)
-- Add extensionRegistryURI setting to change where the registry is read from by
+  [#24561](https://github.com/google-gemini/gemini-cli/pull/24561)
+- feat(evals): centralize test agents into test-utils for reuse by @Samee24 in
+  [#23616](https://github.com/google-gemini/gemini-cli/pull/23616)
+- revert: chore(config): disable agents by default by @abhipatel12 in
+  [#23672](https://github.com/google-gemini/gemini-cli/pull/23672)
+- fix(plan): update telemetry attribute keys and add timestamp by @Adib234 in
+  [#23685](https://github.com/google-gemini/gemini-cli/pull/23685)
+- fix(core): prevent premature MCP discovery completion by @jackwotherspoon in
+  [#23637](https://github.com/google-gemini/gemini-cli/pull/23637)
+- feat(browser): add maxActionsPerTask for browser agent setting by
+  @cynthialong0-0 in
+  [#23216](https://github.com/google-gemini/gemini-cli/pull/23216)
+- fix(core): improve agent loader error formatting for empty paths by
+  @adamfweidman in
+  [#23690](https://github.com/google-gemini/gemini-cli/pull/23690)
+- fix(cli): only show updating spinner when auto-update is in progress by
+  @scidomino in [#23709](https://github.com/google-gemini/gemini-cli/pull/23709)
+- Refine onboarding metrics to log the duration explicitly and use the tier
+  name. by @yunaseoul in
+  [#23678](https://github.com/google-gemini/gemini-cli/pull/23678)
+- chore(tools): add toJSON to tools and invocations to reduce logging verbosity
+  by @alisa-alisa in
+  [#22899](https://github.com/google-gemini/gemini-cli/pull/22899)
+- fix(cli): stabilize copy mode to prevent flickering and cursor resets by
+  @mattKorwel in
+  [#22584](https://github.com/google-gemini/gemini-cli/pull/22584)
+- fix(test): move flaky ctrl-c-exit test to non-blocking suite by @mattKorwel in
+  [#23732](https://github.com/google-gemini/gemini-cli/pull/23732)
+- feat(skills): add ci skill for automated failure replication by @mattKorwel in
+  [#23720](https://github.com/google-gemini/gemini-cli/pull/23720)
+- feat(sandbox): implement forbiddenPaths for OS-specific sandbox managers by
+  @ehedlund in [#23282](https://github.com/google-gemini/gemini-cli/pull/23282)
+- fix(core): conditionally expose additional_permissions in shell tool by
+  @galz10 in [#23729](https://github.com/google-gemini/gemini-cli/pull/23729)
+- refactor(core): standardize OS-specific sandbox tests and extract linux helper
+  methods by @ehedlund in
+  [#23715](https://github.com/google-gemini/gemini-cli/pull/23715)
+- format recently added script by @scidomino in
+  [#23739](https://github.com/google-gemini/gemini-cli/pull/23739)
+- fix(ui): prevent over-eager slash subcommand completion by @keithguerin in
+  [#20136](https://github.com/google-gemini/gemini-cli/pull/20136)
+- Fix dynamic model routing for gemini 3.1 pro to customtools model by
   @kevinjwang1 in
-  [#20463](https://github.com/google-gemini/gemini-cli/pull/20463)
-- fix: patch gaxios v7 Array.toString() stream corruption by @gsquared94 in
-  [#21884](https://github.com/google-gemini/gemini-cli/pull/21884)
-- fix: prevent hangs in non-interactive mode and improve agent guidance by
-  @cocosheng-g in
-  [#20893](https://github.com/google-gemini/gemini-cli/pull/20893)
-- Add ExtensionDetails dialog and support install by @chrstnb in
-  [#20845](https://github.com/google-gemini/gemini-cli/pull/20845)
-- chore/release: bump version to 0.34.0-nightly.20260310.4653b126f by
-  @gemini-cli-robot in
-  [#21816](https://github.com/google-gemini/gemini-cli/pull/21816)
-- Changelog for v0.33.0-preview.13 by @gemini-cli-robot in
-  [#21927](https://github.com/google-gemini/gemini-cli/pull/21927)
-- fix(cli): stabilize prompt layout to prevent jumping when typing by
-  @NTaylorMullen in
-  [#21081](https://github.com/google-gemini/gemini-cli/pull/21081)
-- fix: preserve prompt text when cancelling streaming by @Nixxx19 in
-  [#21103](https://github.com/google-gemini/gemini-cli/pull/21103)
-- fix: robust UX for remote agent errors by @Shyam-Raghuwanshi in
-  [#20307](https://github.com/google-gemini/gemini-cli/pull/20307)
-- feat: implement background process logging and cleanup by @galz10 in
-  [#21189](https://github.com/google-gemini/gemini-cli/pull/21189)
-- Changelog for v0.33.0-preview.14 by @gemini-cli-robot in
-  [#21938](https://github.com/google-gemini/gemini-cli/pull/21938)
+  [#23641](https://github.com/google-gemini/gemini-cli/pull/23641)
+- feat(core): support inline agentCardJson for remote agents by @adamfweidman in
+  [#23743](https://github.com/google-gemini/gemini-cli/pull/23743)
+- fix(cli): skip console log/info in headless mode by @cynthialong0-0 in
+  [#22739](https://github.com/google-gemini/gemini-cli/pull/22739)
+- test(core): install bubblewrap on Linux CI for sandbox integration tests by
+  @ehedlund in [#23583](https://github.com/google-gemini/gemini-cli/pull/23583)
+- docs(reference): split tools table into category sections by @sheikhlimon in
+  [#21516](https://github.com/google-gemini/gemini-cli/pull/21516)
+- fix(browser): detect embedded URLs in query params to prevent allowedDomains
+  bypass by @tony-shi in
+  [#23225](https://github.com/google-gemini/gemini-cli/pull/23225)
+- fix(browser): add proxy bypass constraint to domain restriction system prompt
+  by @tony-shi in
+  [#23229](https://github.com/google-gemini/gemini-cli/pull/23229)
+- fix(policy): relax write_file argsPattern in plan mode to allow paths without
+  session ID by @Adib234 in
+  [#23695](https://github.com/google-gemini/gemini-cli/pull/23695)
+- docs: fix grammar in CONTRIBUTING and numbering in sandbox docs by
+  @splint-disk-8i in
+  [#23448](https://github.com/google-gemini/gemini-cli/pull/23448)
+- fix(acp): allow attachments by adding a permission prompt by @sripasg in
+  [#23680](https://github.com/google-gemini/gemini-cli/pull/23680)
+- fix(core): thread AbortSignal to chat compression requests (#20405) by
+  @SH20RAJ in [#20778](https://github.com/google-gemini/gemini-cli/pull/20778)
+- feat(core): implement Windows sandbox dynamic expansion Phase 1 and 2.1 by
+  @scidomino in [#23691](https://github.com/google-gemini/gemini-cli/pull/23691)
+- Add note about root privileges in sandbox docs by @diodesign in
+  [#23314](https://github.com/google-gemini/gemini-cli/pull/23314)
+- docs(core): document agent_card_json string literal options for remote agents
+  by @adamfweidman in
+  [#23797](https://github.com/google-gemini/gemini-cli/pull/23797)
+- fix(cli): resolve TTY hang on headless environments by unconditionally
+  resuming process.stdin before React Ink launch by @cocosheng-g in
+  [#23673](https://github.com/google-gemini/gemini-cli/pull/23673)
+- fix(ui): cleanup estimated string length hacks in composer by @keithguerin in
+  [#23694](https://github.com/google-gemini/gemini-cli/pull/23694)
+- feat(browser): dynamically discover read-only tools by @cynthialong0-0 in
+  [#23805](https://github.com/google-gemini/gemini-cli/pull/23805)
+- docs: clarify policy requirement for `general.plan.directory` in settings
+  schema by @jerop in
+  [#23784](https://github.com/google-gemini/gemini-cli/pull/23784)
+- Revert "perf(cli): optimize --version startup time (#23671)" by @scidomino in
+  [#23812](https://github.com/google-gemini/gemini-cli/pull/23812)
+- don't silence errors from wombat by @scidomino in
+  [#23822](https://github.com/google-gemini/gemini-cli/pull/23822)
+- fix(ui): prevent escape key from cancelling requests in shell mode by
+  @PrasannaPal21 in
+  [#21245](https://github.com/google-gemini/gemini-cli/pull/21245)
+- Changelog for v0.36.0-preview.0 by @gemini-cli-robot in
+  [#23702](https://github.com/google-gemini/gemini-cli/pull/23702)
+- feat(core,ui): Add experiment-gated support for gemini flash 3.1 lite by
+  @chrstnb in [#23794](https://github.com/google-gemini/gemini-cli/pull/23794)
+- Changelog for v0.36.0-preview.3 by @gemini-cli-robot in
+  [#23827](https://github.com/google-gemini/gemini-cli/pull/23827)
+- new linting check: github-actions-pinning by @alisa-alisa in
+  [#23808](https://github.com/google-gemini/gemini-cli/pull/23808)
+- fix(cli): show helpful guidance when no skills are available by @Niralisj in
+  [#23785](https://github.com/google-gemini/gemini-cli/pull/23785)
+- fix: Chat logs and errors handle tail tool calls correctly by @googlestrobe in
+  [#22460](https://github.com/google-gemini/gemini-cli/pull/22460)
+- Don't try removing a tag from a non-existent release. by @scidomino in
+  [#23830](https://github.com/google-gemini/gemini-cli/pull/23830)
+- fix(cli): allow ask question dialog to take full window height by @jacob314 in
+  [#23693](https://github.com/google-gemini/gemini-cli/pull/23693)
+- fix(core): strip leading underscores from error types in telemetry by
+  @yunaseoul in [#23824](https://github.com/google-gemini/gemini-cli/pull/23824)
+- Changelog for v0.35.0 by @gemini-cli-robot in
+  [#23819](https://github.com/google-gemini/gemini-cli/pull/23819)
+- feat(evals): add reliability harvester and 500/503 retry support by
+  @alisa-alisa in
+  [#23626](https://github.com/google-gemini/gemini-cli/pull/23626)
+- feat(sandbox): dynamic Linux sandbox expansion and worktree support by @galz10
+  in [#23692](https://github.com/google-gemini/gemini-cli/pull/23692)
+- Merge examples of use into quickstart documentation by @diodesign in
+  [#23319](https://github.com/google-gemini/gemini-cli/pull/23319)
+- fix(cli): prioritize primary name matches in slash command search by @sehoon38
+  in [#23850](https://github.com/google-gemini/gemini-cli/pull/23850)
+- Changelog for v0.35.1 by @gemini-cli-robot in
+  [#23840](https://github.com/google-gemini/gemini-cli/pull/23840)
+- fix(browser): keep input blocker active across navigations by @kunal-10-cloud
+  in [#22562](https://github.com/google-gemini/gemini-cli/pull/22562)
+- feat(core): new skill to look for duplicated code while reviewing PRs by
+  @devr0306 in [#23704](https://github.com/google-gemini/gemini-cli/pull/23704)
+- fix(core): replace hardcoded non-interactive ASK_USER denial with explicit
+  policy rules by @ruomengz in
+  [#23668](https://github.com/google-gemini/gemini-cli/pull/23668)
+- fix(plan): after exiting plan mode switches model to a flash model by @Adib234
+  in [#23885](https://github.com/google-gemini/gemini-cli/pull/23885)
+- feat(gcp): add development worker infrastructure by @mattKorwel in
+  [#23814](https://github.com/google-gemini/gemini-cli/pull/23814)
+- fix(a2a-server): A2A server should execute ask policies in interactive mode by
+  @kschaab in [#23831](https://github.com/google-gemini/gemini-cli/pull/23831)
+- feat(core): define TrajectoryProvider interface by @sehoon38 in
+  [#23050](https://github.com/google-gemini/gemini-cli/pull/23050)
+- Docs: Update quotas and pricing by @jkcinouye in
+  [#23835](https://github.com/google-gemini/gemini-cli/pull/23835)
+- fix(core): allow disabling environment variable redaction by @galz10 in
+  [#23927](https://github.com/google-gemini/gemini-cli/pull/23927)
+- feat(cli): enable notifications cross-platform via terminal bell fallback by
+  @genneth in [#21618](https://github.com/google-gemini/gemini-cli/pull/21618)
+- feat(sandbox): implement secret visibility lockdown for env files by
+  @DavidAPierce in
+  [#23712](https://github.com/google-gemini/gemini-cli/pull/23712)
+- fix(core): remove shell outputChunks buffer caching to prevent memory bloat
+  and sanitize prompt input by @spencer426 in
+  [#23751](https://github.com/google-gemini/gemini-cli/pull/23751)
+- feat(core): implement persistent browser session management by @kunal-10-cloud
+  in [#21306](https://github.com/google-gemini/gemini-cli/pull/21306)
+- refactor(core): delegate sandbox denial parsing to SandboxManager by
+  @scidomino in [#23928](https://github.com/google-gemini/gemini-cli/pull/23928)
+- dep(update) Update Ink version to 6.5.0 by @jacob314 in
+  [#23843](https://github.com/google-gemini/gemini-cli/pull/23843)
+- Docs: Update 'docs-writer' skill for relative links by @jkcinouye in
+  [#21463](https://github.com/google-gemini/gemini-cli/pull/21463)
+- Changelog for v0.36.0-preview.4 by @gemini-cli-robot in
+  [#23935](https://github.com/google-gemini/gemini-cli/pull/23935)
+- fix(acp): Update allow approval policy flow for ACP clients to fix config
+  persistence and compatible with TUI by @sripasg in
+  [#23818](https://github.com/google-gemini/gemini-cli/pull/23818)
+- Changelog for v0.35.2 by @gemini-cli-robot in
+  [#23960](https://github.com/google-gemini/gemini-cli/pull/23960)
+- ACP integration documents by @g-samroberts in
+  [#22254](https://github.com/google-gemini/gemini-cli/pull/22254)
+- fix(core): explicitly set error names to avoid bundling renaming issues by
+  @yunaseoul in [#23913](https://github.com/google-gemini/gemini-cli/pull/23913)
+- feat(core): subagent isolation and cleanup hardening by @abhipatel12 in
+  [#23903](https://github.com/google-gemini/gemini-cli/pull/23903)
+- disable extension-reload test by @scidomino in
+  [#24018](https://github.com/google-gemini/gemini-cli/pull/24018)
+- feat(core): add forbiddenPaths to GlobalSandboxOptions and refactor
+  createSandboxManager by @ehedlund in
+  [#23936](https://github.com/google-gemini/gemini-cli/pull/23936)
+- refactor(core): improve ignore resolution and fix directory-matching bug by
+  @ehedlund in [#23816](https://github.com/google-gemini/gemini-cli/pull/23816)
+- revert(core): support custom base URL via env vars by @spencer426 in
+  [#23976](https://github.com/google-gemini/gemini-cli/pull/23976)
+- Increase memory limited for eslint. by @jacob314 in
+  [#24022](https://github.com/google-gemini/gemini-cli/pull/24022)
+- fix(acp): prevent crash on empty response in ACP mode by @sripasg in
+  [#23952](https://github.com/google-gemini/gemini-cli/pull/23952)
+- feat(core): Land `AgentHistoryProvider`. by @joshualitt in
+  [#23978](https://github.com/google-gemini/gemini-cli/pull/23978)
+- fix(core): switch to subshells for shell tool wrapping to fix heredocs and
+  edge cases by @abhipatel12 in
+  [#24024](https://github.com/google-gemini/gemini-cli/pull/24024)
+- Debug command. by @jacob314 in
+  [#23851](https://github.com/google-gemini/gemini-cli/pull/23851)
+- Changelog for v0.36.0-preview.5 by @gemini-cli-robot in
+  [#24046](https://github.com/google-gemini/gemini-cli/pull/24046)
+- Fix test flakes by globally mocking ink-spinner by @jacob314 in
+  [#24044](https://github.com/google-gemini/gemini-cli/pull/24044)
+- Enable network access in sandbox configuration by @galz10 in
+  [#24055](https://github.com/google-gemini/gemini-cli/pull/24055)
+- feat(context): add configurable memoryBoundaryMarkers setting by @SandyTao520
+  in [#24020](https://github.com/google-gemini/gemini-cli/pull/24020)
+- feat(core): implement windows sandbox expansion and denial detection by
+  @scidomino in [#24027](https://github.com/google-gemini/gemini-cli/pull/24027)
+- fix(core): resolve ACP Operation Aborted Errors in grep_search by @ivanporty
+  in [#23821](https://github.com/google-gemini/gemini-cli/pull/23821)
+- fix(hooks): prevent SessionEnd from firing twice in non-interactive mode by
+  @krishdef7 in [#22139](https://github.com/google-gemini/gemini-cli/pull/22139)
+- Re-word intro to Gemini 3 page. by @g-samroberts in
+  [#24069](https://github.com/google-gemini/gemini-cli/pull/24069)
+- fix(cli): resolve layout contention and flashing loop in StatusRow by
+  @keithguerin in
+  [#24065](https://github.com/google-gemini/gemini-cli/pull/24065)
+- fix(sandbox): implement Windows Mandatory Integrity Control for GeminiSandbox
+  by @galz10 in [#24057](https://github.com/google-gemini/gemini-cli/pull/24057)
+- feat(core): implement tool-based topic grouping (Chapters) by @Abhijit-2592 in
+  [#23150](https://github.com/google-gemini/gemini-cli/pull/23150)
+- feat(cli): support 'tab to queue' for messages while generating by @gundermanc
+  in [#24052](https://github.com/google-gemini/gemini-cli/pull/24052)
+- feat(core): agnostic background task UI with CompletionBehavior by
+  @adamfweidman in
+  [#22740](https://github.com/google-gemini/gemini-cli/pull/22740)
+- UX for topic narration tool by @gundermanc in
+  [#24079](https://github.com/google-gemini/gemini-cli/pull/24079)
+- fix: shellcheck warnings in scripts by @scidomino in
+  [#24035](https://github.com/google-gemini/gemini-cli/pull/24035)
+- test(evals): add comprehensive subagent delegation evaluations by @abhipatel12
+  in [#24132](https://github.com/google-gemini/gemini-cli/pull/24132)
+- fix(a2a-server): prioritize ADC before evaluating headless constraints for
+  auth initialization by @spencer426 in
+  [#23614](https://github.com/google-gemini/gemini-cli/pull/23614)
+- Text can be added after /plan command by @rambleraptor in
+  [#22833](https://github.com/google-gemini/gemini-cli/pull/22833)
+- fix(cli): resolve missing F12 logs via global console store by @scidomino in
+  [#24235](https://github.com/google-gemini/gemini-cli/pull/24235)
+- fix broken tests by @scidomino in
+  [#24279](https://github.com/google-gemini/gemini-cli/pull/24279)
+- fix(evals): add update_topic behavioral eval by @gundermanc in
+  [#24223](https://github.com/google-gemini/gemini-cli/pull/24223)
+- feat(core): Unified Context Management and Tool Distillation. by @joshualitt
+  in [#24157](https://github.com/google-gemini/gemini-cli/pull/24157)
+- Default enable narration for the team. by @gundermanc in
+  [#24224](https://github.com/google-gemini/gemini-cli/pull/24224)
+- fix(core): ensure default agents provide tools and use model-specific schemas
+  by @abhipatel12 in
+  [#24268](https://github.com/google-gemini/gemini-cli/pull/24268)
+- feat(cli): show Flash Lite Preview model regardless of user tier by @sehoon38
+  in [#23904](https://github.com/google-gemini/gemini-cli/pull/23904)
+- feat(cli): implement compact tool output by @jwhelangoog in
+  [#20974](https://github.com/google-gemini/gemini-cli/pull/20974)
+- Add security settings for tool sandboxing by @galz10 in
+  [#23923](https://github.com/google-gemini/gemini-cli/pull/23923)
+- chore(test-utils): switch integration tests to use PREVIEW_GEMINI_MODEL by
+  @sehoon38 in [#24276](https://github.com/google-gemini/gemini-cli/pull/24276)
+- feat(core): enable topic update narration for legacy models by @Abhijit-2592
+  in [#24241](https://github.com/google-gemini/gemini-cli/pull/24241)
+- feat(core): add project-level memory scope to save_memory tool by @SandyTao520
+  in [#24161](https://github.com/google-gemini/gemini-cli/pull/24161)
+- test(integration): fix plan mode write denial test false positive by @sehoon38
+  in [#24299](https://github.com/google-gemini/gemini-cli/pull/24299)
+- feat(plan): support `Plan` mode in untrusted folders by @Adib234 in
+  [#17586](https://github.com/google-gemini/gemini-cli/pull/17586)
+- fix(core): enable mid-stream retries for all models and re-enable compression
+  test by @sehoon38 in
+  [#24302](https://github.com/google-gemini/gemini-cli/pull/24302)
+- Changelog for v0.36.0-preview.6 by @gemini-cli-robot in
+  [#24082](https://github.com/google-gemini/gemini-cli/pull/24082)
+- Changelog for v0.35.3 by @gemini-cli-robot in
+  [#24083](https://github.com/google-gemini/gemini-cli/pull/24083)
+- feat(cli): add auth info to footer by @sehoon38 in
+  [#24042](https://github.com/google-gemini/gemini-cli/pull/24042)
+- fix(browser): reset action counter for each agent session and let it ignore
+  internal actions by @cynthialong0-0 in
+  [#24228](https://github.com/google-gemini/gemini-cli/pull/24228)
+- feat(plan): promote planning feature to stable by @ruomengz in
+  [#24282](https://github.com/google-gemini/gemini-cli/pull/24282)
+- fix(browser): terminate subagent immediately on domain restriction violations
+  by @gsquared94 in
+  [#24313](https://github.com/google-gemini/gemini-cli/pull/24313)
+- feat(cli): add UI to update extensions by @ruomengz in
+  [#23682](https://github.com/google-gemini/gemini-cli/pull/23682)
+- Fix(browser): terminate immediately for "browser is already running" error by
+  @cynthialong0-0 in
+  [#24233](https://github.com/google-gemini/gemini-cli/pull/24233)
+- docs: Add 'plan' option to approval mode in CLI reference by @YifanRuan in
+  [#24134](https://github.com/google-gemini/gemini-cli/pull/24134)
+- fix(core): batch macOS seatbelt rules into a profile file to prevent ARG_MAX
+  errors by @ehedlund in
+  [#24255](https://github.com/google-gemini/gemini-cli/pull/24255)
+- fix(core): fix race condition between browser agent and main closing process
+  by @cynthialong0-0 in
+  [#24340](https://github.com/google-gemini/gemini-cli/pull/24340)
+- perf(build): optimize build scripts for parallel execution and remove
+  redundant checks by @sehoon38 in
+  [#24307](https://github.com/google-gemini/gemini-cli/pull/24307)
+- ci: install bubblewrap on Linux for release workflows by @ehedlund in
+  [#24347](https://github.com/google-gemini/gemini-cli/pull/24347)
+- chore(release): allow bundling for all builds, including stable by @sehoon38
+  in [#24305](https://github.com/google-gemini/gemini-cli/pull/24305)
+- Revert "Add security settings for tool sandboxing" by @jerop in
+  [#24357](https://github.com/google-gemini/gemini-cli/pull/24357)
+- docs: update subagents docs to not be experimental by @abhipatel12 in
+  [#24343](https://github.com/google-gemini/gemini-cli/pull/24343)
+- fix(core): implement **read and **write commands in sandbox managers by
+  @galz10 in [#24283](https://github.com/google-gemini/gemini-cli/pull/24283)
+- don't try to remove tags in dry run by @scidomino in
+  [#24356](https://github.com/google-gemini/gemini-cli/pull/24356)
+- fix(config): disable JIT context loading by default by @SandyTao520 in
+  [#24364](https://github.com/google-gemini/gemini-cli/pull/24364)
+- test(sandbox): add integration test for dynamic permission expansion by
+  @galz10 in [#24359](https://github.com/google-gemini/gemini-cli/pull/24359)
+- docs(policy): remove unsupported mcpName wildcard edge case by @abhipatel12 in
+  [#24133](https://github.com/google-gemini/gemini-cli/pull/24133)
+- docs: fix broken GEMINI.md link in CONTRIBUTING.md by @Panchal-Tirth in
+  [#24182](https://github.com/google-gemini/gemini-cli/pull/24182)
+- feat(core): infrastructure for event-driven subagent history by @abhipatel12
+  in [#23914](https://github.com/google-gemini/gemini-cli/pull/23914)
+- fix(core): resolve Plan Mode deadlock during plan file creation due to sandbox
+  restrictions by @DavidAPierce in
+  [#24047](https://github.com/google-gemini/gemini-cli/pull/24047)
+- fix(core): fix browser agent UX issues and improve E2E test reliability by
+  @gsquared94 in
+  [#24312](https://github.com/google-gemini/gemini-cli/pull/24312)
+- fix(ui): wrap topic and intent fields in TopicMessage by @jwhelangoog in
+  [#24386](https://github.com/google-gemini/gemini-cli/pull/24386)
+- refactor(core): Centralize context management logic into src/context by
+  @joshualitt in
+  [#24380](https://github.com/google-gemini/gemini-cli/pull/24380)
+- fix(core): pin AuthType.GATEWAY to use Gemini 3.1 Pro/Flash Lite by default by
+  @sripasg in [#24375](https://github.com/google-gemini/gemini-cli/pull/24375)
+- feat(ui): add Tokyo Night theme by @danrneal in
+  [#24054](https://github.com/google-gemini/gemini-cli/pull/24054)
+- fix(cli): refactor test config loading and mock debugLogger in test-setup by
+  @mattKorwel in
+  [#24389](https://github.com/google-gemini/gemini-cli/pull/24389)
+- Set memoryManager to false in settings.json by @mattKorwel in
+  [#24393](https://github.com/google-gemini/gemini-cli/pull/24393)
+- ink 6.6.3 by @jacob314 in
+  [#24372](https://github.com/google-gemini/gemini-cli/pull/24372)
+- fix(core): resolve subagent chat recording gaps and directory inheritance by
+  @abhipatel12 in
+  [#24368](https://github.com/google-gemini/gemini-cli/pull/24368)
+- fix(cli): cap shell output at 10 MB to prevent RangeError crash by @ProthamD
+  in [#24168](https://github.com/google-gemini/gemini-cli/pull/24168)
+- feat(plan): conditionally add enter/exit plan mode tools based on current mode
+  by @ruomengz in
+  [#24378](https://github.com/google-gemini/gemini-cli/pull/24378)
+- feat(core): prioritize discussion before formal plan approval by @jerop in
+  [#24423](https://github.com/google-gemini/gemini-cli/pull/24423)
+- fix(ui): add accelerated scrolling on alternate buffer mode by @devr0306 in
+  [#23940](https://github.com/google-gemini/gemini-cli/pull/23940)
+- feat(core): populate sandbox forbidden paths with project ignore file contents
+  by @ehedlund in
+  [#24038](https://github.com/google-gemini/gemini-cli/pull/24038)
+- fix(core): ensure blue border overlay and input blocker to act correctly
+  depending on browser agent activities by @cynthialong0-0 in
+  [#24385](https://github.com/google-gemini/gemini-cli/pull/24385)
+- fix(ui): removed additional vertical padding for tables by @devr0306 in
+  [#24381](https://github.com/google-gemini/gemini-cli/pull/24381)
+- fix(build): upload full bundle directory archive to GitHub releases by
+  @sehoon38 in [#24403](https://github.com/google-gemini/gemini-cli/pull/24403)
+- fix(build): wire bundle:browser-mcp into bundle pipeline by @gsquared94 in
+  [#24424](https://github.com/google-gemini/gemini-cli/pull/24424)
+- feat(browser): add sandbox-aware browser agent initialization by @gsquared94
+  in [#24419](https://github.com/google-gemini/gemini-cli/pull/24419)
+- feat(core): enhance tracker task schemas for detailed titles and descriptions
+  by @anj-s in [#23902](https://github.com/google-gemini/gemini-cli/pull/23902)
+- refactor(core): Unified context management settings schema by @joshualitt in
+  [#24391](https://github.com/google-gemini/gemini-cli/pull/24391)
+- feat(core): update browser agent prompt to check open pages first when
+  bringing up by @cynthialong0-0 in
+  [#24431](https://github.com/google-gemini/gemini-cli/pull/24431)
+- fix(acp) refactor(core,cli): centralize model discovery logic in
+  ModelConfigService by @sripasg in
+  [#24392](https://github.com/google-gemini/gemini-cli/pull/24392)
+- Changelog for v0.36.0-preview.7 by @gemini-cli-robot in
+  [#24346](https://github.com/google-gemini/gemini-cli/pull/24346)
+- fix: update task tracker storage location in system prompt by @anj-s in
+  [#24034](https://github.com/google-gemini/gemini-cli/pull/24034)
+- feat(browser): supersede stale snapshots to reclaim context-window tokens by
+  @gsquared94 in
+  [#24440](https://github.com/google-gemini/gemini-cli/pull/24440)
+- docs(core): add subagent tool isolation draft doc by @akh64bit in
+  [#23275](https://github.com/google-gemini/gemini-cli/pull/23275)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.33.0-preview.15...v0.34.0-preview.1
+https://github.com/google-gemini/gemini-cli/compare/v0.36.0-preview.8...v0.37.0-preview.1

docs/cli/acp-mode.md

@@ -0,0 +1,126 @@
+# ACP Mode
+
+ACP (Agent Client Protocol) mode is a special operational mode of Gemini CLI
+designed for programmatic control, primarily for IDE and other developer tool
+integrations. It uses a JSON-RPC protocol over stdio to communicate between
+Gemini CLI agent and a client.
+
+To start Gemini CLI in ACP mode, use the `--acp` flag:
+
+```bash
+gemini --acp
+```
+
+## Agent Client Protocol (ACP)
+
+ACP is an open protocol that standardizes how AI coding agents communicate with
+code editors and IDEs. It addresses the challenge of fragmented distribution,
+where agents traditionally needed custom integrations for each client. With ACP,
+developers can implement their agent once, and it becomes compatible with any
+ACP-compliant editor.
+
+For a comprehensive introduction to ACP, including its architecture and
+benefits, refer to the official
+[ACP Introduction](https://agentclientprotocol.com/get-started/introduction)
+documentation.
+
+### Existing integrations using ACP
+
+The ACP Agent Registry simplifies the distribution and management of
+ACP-compatible agents across various IDEs. Gemini CLI is an ACP-compatible agent
+and can be found in this registry.
+
+For more general information about the registry, and how to use it with specific
+IDEs like JetBrains and Zed, refer to the
+[IDE Integration](../ide-integration/index.md) documentation.
+
+You can also find more information on the official
+[ACP Agent Registry](https://agentclientprotocol.com/get-started/registry) page.
+
+## Architecture and protocol basics
+
+ACP mode establishes a client-server relationship between your tool (the client)
+and Gemini CLI (the server).
+
+- **Communication:** The entire communication happens over standard input/output
+  (stdio) using the JSON-RPC 2.0 protocol.
+- **Client's role:** The client is responsible for sending requests (e.g.,
+  prompts) and handling responses and notifications from Gemini CLI.
+- **Gemini CLI's role:** In ACP mode, Gemini CLI listens for incoming JSON-RPC
+  requests, processes them, and sends back responses.
+
+The core of the ACP implementation can be found in
+`packages/cli/src/acp/acpClient.ts`.
+
+### Extending with MCP
+
+ACP can be used with the Model Context Protocol (MCP). This lets an ACP client
+(like an IDE) expose its own functionality as "tools" that the Gemini model can
+use.
+
+1.  The client implements an **MCP server** that advertises its tools.
+2.  During the ACP `initialize` handshake, the client provides the connection
+    details for its MCP server.
+3.  Gemini CLI connects to the MCP server, discovers the available tools, and
+    makes them available to the AI model.
+4.  When the model decides to use one of these tools, Gemini CLI sends a tool
+    call request to the MCP server.
+
+This mechanism lets for a powerful, two-way integration where the agent can
+leverage the IDE's capabilities to perform tasks. The MCP client logic is in
+`packages/core/src/tools/mcp-client.ts`.
+
+## Capabilities and supported methods
+
+The ACP protocol exposes a number of methods for ACP clients (e.g. IDEs) to
+control Gemini CLI.
+
+### Core methods
+
+- `initialize`: Establishes the initial connection and lets the client to
+  register its MCP server.
+- `authenticate`: Authenticates the user.
+- `newSession`: Starts a new chat session.
+- `loadSession`: Loads a previous session.
+- `prompt`: Sends a prompt to the agent.
+- `cancel`: Cancels an ongoing prompt.
+
+### Session control
+
+- `setSessionMode`: Allows changing the approval level for tool calls (e.g., to
+  `auto-approve`).
+- `unstable_setSessionModel`: Changes the model for the current session.
+
+### File system proxy
+
+ACP includes a proxied file system service. This means that when the agent needs
+to read or write files, it does so through the ACP client. This is a security
+feature that ensures the agent only has access to the files that the client (and
+by extension, the user) has explicitly allowed.
+
+## Debugging and telemetry
+
+You can get insights into the ACP communication and the agent's behavior through
+debugging logs and telemetry.
+
+### Debugging logs
+
+To enable general debugging logs, start Gemini CLI with the `--debug` flag:
+
+```bash
+gemini --acp --debug
+```
+
+### Telemetry
+
+For more detailed telemetry, you can use the following environment variables to
+capture telemetry data to a file:
+
+- `GEMINI_TELEMETRY_ENABLED=true`
+- `GEMINI_TELEMETRY_TARGET=local`
+- `GEMINI_TELEMETRY_OUTFILE=/path/to/your/log.json`
+
+This will write a JSON log file containing detailed information about all the
+events happening within the agent, including ACP requests and responses. The
+integration test `integration-tests/acp-telemetry.test.ts` provides a working
+example of how to set this up.

docs/cli/checkpointing.md

@@ -39,7 +39,9 @@ file in your project's temporary directory, typically located at
 The Checkpointing feature is disabled by default. To enable it, you need to edit
 your `settings.json` file.
 
-> **Note:** The `--checkpointing` command-line flag was removed in version
+<!-- prettier-ignore -->
+> [!CAUTION]
+> The `--checkpointing` command-line flag was removed in version
 > 0.11.0. Checkpointing can now only be enabled through the `settings.json`
 > configuration file.
 

docs/cli/cli-reference.md

@@ -50,8 +50,9 @@ These commands are available within the interactive REPL.
 | `--model`                        | `-m`  | string  | `auto`    | Model to use. See [Model Selection](#model-selection) for available values.                                                                                            |
 | `--prompt`                       | `-p`  | string  | -         | Prompt text. Appended to stdin input if provided. Forces non-interactive mode.                                                                                         |
 | `--prompt-interactive`           | `-i`  | string  | -         | Execute prompt and continue in interactive mode                                                                                                                        |
+| `--worktree`                     | `-w`  | string  | -         | Start Gemini in a new git worktree. If no name is provided, one is generated automatically. Requires `experimental.worktrees: true` in settings.                       |
 | `--sandbox`                      | `-s`  | boolean | `false`   | Run in a sandboxed environment for safer execution                                                                                                                     |
-| `--approval-mode`                | -     | string  | `default` | Approval mode for tool execution. Choices: `default`, `auto_edit`, `yolo`                                                                                              |
+| `--approval-mode`                | -     | string  | `default` | Approval mode for tool execution. Choices: `default`, `auto_edit`, `yolo`, `plan`                                                                                      |
 | `--yolo`                         | `-y`  | boolean | `false`   | **Deprecated.** Auto-approve all actions. Use `--approval-mode=yolo` instead.                                                                                          |
 | `--experimental-acp`             | -     | boolean | -         | Start in ACP (Agent Code Pilot) mode. **Experimental feature.**                                                                                                        |
 | `--experimental-zed-integration` | -     | boolean | -         | Run in Zed editor integration mode. **Experimental feature.**                                                                                                          |

docs/cli/custom-commands.md

@@ -30,7 +30,9 @@ separator (`/` or `\`) being converted to a colon (`:`).
 - A file at `<project>/.gemini/commands/git/commit.toml` becomes the namespaced
   command `/git:commit`.
 
-> [!TIP] After creating or modifying `.toml` command files, run
+<!-- prettier-ignore -->
+> [!TIP]
+> After creating or modifying `.toml` command files, run
 > `/commands reload` to pick up your changes without restarting the CLI.
 
 ## TOML file format (v1)
@@ -177,10 +179,10 @@ ensure that only intended commands can be run.
     automatically shell-escaped (see
     [Context-Aware Injection](#1-context-aware-injection-with-args) above).
 3.  **Robust parsing:** The parser correctly handles complex shell commands that
-    include nested braces, such as JSON payloads. **Note:** The content inside
-    `!{...}` must have balanced braces (`{` and `}`). If you need to execute a
-    command containing unbalanced braces, consider wrapping it in an external
-    script file and calling the script within the `!{...}` block.
+    include nested braces, such as JSON payloads. The content inside `!{...}`
+    must have balanced braces (`{` and `}`). If you need to execute a command
+    containing unbalanced braces, consider wrapping it in an external script
+    file and calling the script within the `!{...}` block.
 4.  **Security check and confirmation:** The CLI performs a security check on
     the final, resolved command (after arguments are escaped and substituted). A
     dialog will appear showing the exact command(s) to be executed.

docs/cli/enterprise.md

@@ -5,9 +5,11 @@ and managing Gemini CLI in an enterprise environment. By leveraging system-level
 settings, administrators can enforce security policies, manage tool access, and
 ensure a consistent experience for all users.
 
-> **A note on security:** The patterns described in this document are intended
-> to help administrators create a more controlled and secure environment for
-> using Gemini CLI. However, they should not be considered a foolproof security
+<!-- prettier-ignore -->
+> [!WARNING]
+> The patterns described in this document are intended to help
+> administrators create a more controlled and secure environment for using
+> Gemini CLI. However, they should not be considered a foolproof security
 > boundary. A determined user with sufficient privileges on their local machine
 > may still be able to circumvent these configurations. These measures are
 > designed to prevent accidental misuse and enforce corporate policy in a
@@ -280,10 +282,12 @@ environment to a blocklist.
 }
 ```
 
-**Security note:** Blocklisting with `excludeTools` is less secure than
-allowlisting with `coreTools`, as it relies on blocking known-bad commands, and
-clever users may find ways to bypass simple string-based blocks. **Allowlisting
-is the recommended approach.**
+<!-- prettier-ignore -->
+> [!WARNING]
+> Blocklisting with `excludeTools` is less secure than
+> allowlisting with `coreTools`, as it relies on blocking known-bad commands,
+> and clever users may find ways to bypass simple string-based blocks.
+> **Allowlisting is the recommended approach.**
 
 ### Disabling YOLO mode
 
@@ -494,8 +498,10 @@ other events. For more information, see the
 }
 ```
 
-**Note:** Ensure that `logPrompts` is set to `false` in an enterprise setting to
-avoid collecting potentially sensitive information from user prompts.
+<!-- prettier-ignore -->
+> [!NOTE]
+> Ensure that `logPrompts` is set to `false` in an enterprise setting to
+> avoid collecting potentially sensitive information from user prompts.
 
 ## Authentication
 

docs/cli/git-worktrees.md

@@ -0,0 +1,107 @@
+# Git Worktrees (experimental)
+
+When working on multiple tasks at once, you can use Git worktrees to give each
+Gemini session its own copy of the codebase. Git worktrees create separate
+working directories that each have their own files and branch while sharing the
+same repository history. This prevents changes in one session from colliding
+with another.
+
+Learn more about [session management](./session-management.md).
+
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is an experimental feature currently under active development. Your
+> feedback is invaluable as we refine this feature. If you have ideas,
+> suggestions, or encounter issues:
+>
+> - [Open an issue](https://github.com/google-gemini/gemini-cli/issues/new?template=bug_report.yml) on GitHub.
+> - Use the **/bug** command within Gemini CLI to file an issue.
+
+Learn more in the official Git worktree
+[documentation](https://git-scm.com/docs/git-worktree).
+
+## How to enable Git worktrees
+
+Git worktrees are an experimental feature. You must enable them in your settings
+using the `/settings` command or by manually editing your `settings.json` file.
+
+1.  Use the `/settings` command.
+2.  Search for and set **Enable Git Worktrees** to `true`.
+
+Alternatively, add the following to your `settings.json`:
+
+```json
+{
+  "experimental": {
+    "worktrees": true
+  }
+}
+```
+
+## How to use Git worktrees
+
+Use the `--worktree` (`-w`) flag to create an isolated worktree and start Gemini
+CLI in it.
+
+- **Start with a specific name:** The value you pass becomes both the directory
+  name (within `.gemini/worktrees/`) and the branch name.
+
+  ```bash
+  gemini --worktree feature-search
+  ```
+
+- **Start with a random name:** If you omit the name, Gemini generates a random
+  one automatically (for example, `worktree-a1b2c3d4`).
+
+  ```bash
+  gemini --worktree
+  ```
+
+<!-- prettier-ignore -->
+> [!NOTE]
+> Remember to initialize your development environment in each new
+> worktree according to your project's setup. Depending on your stack, this
+> might include running dependency installation (`npm install`, `yarn`), setting
+> up virtual environments, or following your project's standard build process.
+
+## How to exit a Git worktree session
+
+When you exit a worktree session (using `/quit` or `Ctrl+C`), Gemini leaves the
+worktree intact so your work is not lost. This includes your uncommitted changes
+(modified files, staged changes, or untracked files) and any new commits you
+have made.
+
+Gemini prioritizes a fast and safe exit: it **does not automatically delete**
+your worktree or branch. You are responsible for cleaning up your worktrees
+manually once you are finished with them.
+
+When you exit, Gemini displays instructions on how to resume your work or how to
+manually remove the worktree if you no longer need it.
+
+## Resuming work in a Git worktree
+
+To resume a session in a worktree, navigate to the worktree directory and start
+Gemini CLI with the `--resume` flag and the session ID:
+
+```bash
+cd .gemini/worktrees/feature-search
+gemini --resume <session_id>
+```
+
+## Managing Git worktrees manually
+
+For more control over worktree location and branch configuration, or to clean up
+a preserved worktree, you can use Git directly:
+
+- **Clean up a preserved Git worktree:**
+  ```bash
+  git worktree remove .gemini/worktrees/feature-search --force
+  git branch -D worktree-feature-search
+  ```
+- **Create a Git worktree manually:**
+  ```bash
+  git worktree add ../project-feature-search -b feature-search
+  cd ../project-feature-search && gemini
+  ```
+
+[Open an issue]: https://github.com/google-gemini/gemini-cli/issues

docs/cli/model-steering.md

@@ -4,9 +4,10 @@ Model steering lets you provide real-time guidance and feedback to Gemini CLI
 while it is actively executing a task. This lets you correct course, add missing
 context, or skip unnecessary steps without having to stop and restart the agent.
 
-> **Note:** This is a preview feature under active development. Preview features
-> may only be available in the **Preview** channel or may need to be enabled
-> under `/settings`.
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is an experimental feature currently under active development and
+> may need to be enabled under `/settings`.
 
 Model steering is particularly useful during complex [Plan Mode](./plan-mode.md)
 workflows or long-running subagent executions where you want to ensure the agent

docs/cli/model.md

@@ -5,7 +5,9 @@ used by Gemini CLI, giving you more control over your results. Use **Pro**
 models for complex tasks and reasoning, **Flash** models for high speed results,
 or the (recommended) **Auto** setting to choose the best model for your tasks.
 
-> **Note:** The `/model` command (and the `--model` flag) does not override the
+<!-- prettier-ignore -->
+> [!NOTE]
+> The `/model` command (and the `--model` flag) does not override the
 > model used by sub-agents. Consequently, even when using the `/model` flag you
 > may see other models used in your model usage reports.
 

docs/cli/notifications.md

@@ -4,9 +4,10 @@ Gemini CLI can send system notifications to alert you when a session completes
 or when it needs your attention, such as when it's waiting for you to approve a
 tool call.
 
-> **Note:** This is a preview feature currently under active development.
-> Preview features may be available on the **Preview** channel or may need to be
-> enabled under `/settings`.
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is an experimental feature currently under active development and
+> may need to be enabled under `/settings`.
 
 Notifications are particularly useful when running long-running tasks or using
 [Plan Mode](./plan-mode.md), letting you switch to other windows while Gemini
@@ -14,14 +15,14 @@ CLI works in the background.
 
 ## Requirements
 
-Currently, system notifications are only supported on macOS.
-
 ### Terminal support
 
 The CLI uses the OSC 9 terminal escape sequence to trigger system notifications.
-This is supported by several modern terminal emulators. If your terminal does
-not support OSC 9 notifications, Gemini CLI falls back to a system alert sound
-to get your attention.
+This is supported by several modern terminal emulators including iTerm2,
+WezTerm, Ghostty, and Kitty. If your terminal does not support OSC 9
+notifications, Gemini CLI falls back to a terminal bell (BEL) to get your
+attention. Most terminals respond to BEL with a taskbar flash or system alert
+sound.
 
 ## Enable notifications
 

docs/cli/plan-mode.md

@@ -35,19 +35,19 @@ To launch Gemini CLI in Plan Mode once:
 To start Plan Mode while using Gemini CLI:
 
 - **Keyboard shortcut:** Press `Shift+Tab` to cycle through approval modes
-  (`Default` -> `Auto-Edit` -> `Plan`).
+  (`Default` -> `Auto-Edit` -> `Plan`). Plan Mode is automatically removed from
+  the rotation when Gemini CLI is actively processing or showing confirmation
+  dialogs.
 
-  > **Note:** Plan Mode is automatically removed from the rotation when Gemini
-  > CLI is actively processing or showing confirmation dialogs.
-
-- **Command:** Type `/plan` in the input box.
+- **Command:** Type `/plan [goal]` in the input box. The `[goal]` is optional;
+  for example, `/plan implement authentication` will switch to Plan Mode and
+  immediately submit the prompt to the model.
 
 - **Natural Language:** Ask Gemini CLI to "start a plan for...". Gemini CLI
   calls the
   [`enter_plan_mode`](../tools/planning.md#1-enter_plan_mode-enterplanmode) tool
-  to switch modes.
-  > **Note:** This tool is not available when Gemini CLI is in
-  > [YOLO mode](../reference/configuration.md#command-line-arguments).
+  to switch modes. This tool is not available when Gemini CLI is in
+  [YOLO mode](../reference/configuration.md#command-line-arguments).
 
 ## How to use Plan Mode
 
@@ -56,19 +56,21 @@ Gemini CLI takes action.
 
 1.  **Provide a goal:** Start by describing what you want to achieve. Gemini CLI
     will then enter Plan Mode (if it's not already) to research the task.
-2.  **Review research and provide input:** As Gemini CLI analyzes your codebase,
-    it may ask you questions or present different implementation options using
-    [`ask_user`](../tools/ask-user.md). Provide your preferences to help guide
-    the design.
-3.  **Review the plan:** Once Gemini CLI has a proposed strategy, it creates a
-    detailed implementation plan as a Markdown file in your plans directory.
+2.  **Discuss and agree on strategy:** As Gemini CLI analyzes your codebase, it
+    will discuss its findings and proposed strategy with you to ensure
+    alignment. It may ask you questions or present different implementation
+    options using [`ask_user`](../tools/ask-user.md). **Gemini CLI will stop and
+    wait for your confirmation** before drafting the formal plan. You should
+    reach an informal agreement on the approach before proceeding.
+3.  **Review the plan:** Once you've agreed on the strategy, Gemini CLI creates
+    a detailed implementation plan as a Markdown file in your plans directory.
     - **View:** You can open and read this file to understand the proposed
       changes.
     - **Edit:** Press `Ctrl+X` to open the plan directly in your configured
       external editor.
 
 4.  **Approve or iterate:** Gemini CLI will present the finalized plan for your
-    approval.
+    formal approval.
     - **Approve:** If you're satisfied with the plan, approve it to start the
       implementation immediately: **Yes, automatically accept edits** or **Yes,
       manually accept edits**.
@@ -120,7 +122,9 @@ These are the only allowed tools:
   [`list_directory`](../tools/file-system.md#1-list_directory-readfolder),
   [`glob`](../tools/file-system.md#4-glob-findfiles)
 - **Search:** [`grep_search`](../tools/file-system.md#5-grep_search-searchtext),
-  [`google_web_search`](../tools/web-search.md)
+  [`google_web_search`](../tools/web-search.md),
+  [`web_fetch`](../tools/web-fetch.md) (requires explicit confirmation),
+  [`get_internal_docs`](../tools/internal-docs.md)
 - **Research Subagents:**
   [`codebase_investigator`](../core/subagents.md#codebase-investigator),
   [`cli_help`](../core/subagents.md#cli-help-agent)
@@ -177,9 +181,16 @@ As described in the
 rule that does not explicitly specify `modes` is considered "always active" and
 will apply to Plan Mode as well.
 
-If you want a rule to apply to other modes but _not_ to Plan Mode, you must
-explicitly specify the target modes. For example, to allow `npm test` in default
-and Auto-Edit modes but not in Plan Mode:
+To maintain the integrity of Plan Mode as a safe research environment,
+persistent tool approvals are context-aware. Approvals granted in modes like
+Default or Auto-Edit do not apply to Plan Mode, ensuring that tools trusted for
+implementation don't automatically execute while you're researching. However,
+approvals granted while in Plan Mode are treated as intentional choices for
+global trust and apply to all modes.
+
+If you want to manually restrict a rule to other modes but _not_ to Plan Mode,
+you must explicitly specify the target modes. For example, to allow `npm test`
+in default and Auto-Edit modes but not in Plan Mode:
 
 ```toml
 [[rule]]
@@ -201,6 +212,7 @@ your specific environment.
 
 ```toml
 [[rule]]
+toolName = "*"
 mcpName = "*"
 toolAnnotations = { readOnlyHint = true }
 decision = "allow"
@@ -406,7 +418,9 @@ To build a custom planning workflow, you can use:
   [custom plan directories](#custom-plan-directory-and-policies) and
   [custom policies](#custom-policies).
 
-> **Note:** Use [Conductor] as a reference when building your own custom
+<!-- prettier-ignore -->
+> [!TIP]
+> Use [Conductor] as a reference when building your own custom
 > planning workflow.
 
 By using Plan Mode as its execution environment, your custom methodology can
@@ -459,6 +473,26 @@ Manual deletion also removes all associated artifacts:
 If you use a [custom plans directory](#custom-plan-directory-and-policies),
 those files are not automatically deleted and must be managed manually.
 
+## Non-interactive execution
+
+When running Gemini CLI in non-interactive environments (such as headless
+scripts or CI/CD pipelines), Plan Mode optimizes for automated workflows:
+
+- **Automatic transitions:** The policy engine automatically approves the
+  `enter_plan_mode` and `exit_plan_mode` tools without prompting for user
+  confirmation.
+- **Automated implementation:** When exiting Plan Mode to execute the plan,
+  Gemini CLI automatically switches to
+  [YOLO mode](../reference/policy-engine.md#approval-modes) instead of the
+  standard Default mode. This allows the CLI to execute the implementation steps
+  automatically without hanging on interactive tool approvals.
+
+**Example:**
+
+```bash
+gemini --approval-mode plan -p "Analyze telemetry and suggest improvements"
+```
+
 [`plan.toml`]:
   https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/policy/policies/plan.toml
 [Conductor]: https://github.com/gemini-cli-extensions/conductor

docs/cli/sandbox.md

@@ -50,7 +50,25 @@ Cross-platform sandboxing with complete process isolation.
 **Note**: Requires building the sandbox image locally or using a published image
 from your organization's registry.
 
-### 3. gVisor / runsc (Linux only)
+### 3. Windows Native Sandbox (Windows only)
+
+... **Troubleshooting and Side Effects:**
+
+The Windows Native sandbox uses the `icacls` command to set a "Low Mandatory
+Level" on files and directories it needs to write to.
+
+- **Persistence**: These integrity level changes are persistent on the
+  filesystem. Even after the sandbox session ends, files created or modified by
+  the sandbox will retain their "Low" integrity level.
+- **Manual Reset**: If you need to reset the integrity level of a file or
+  directory, you can use:
+  ```powershell
+  icacls "C:\path\to\dir" /setintegritylevel Medium
+  ```
+- **System Folders**: The sandbox manager automatically skips setting integrity
+  levels on system folders (like `C:\Windows`) for safety.
+
+### 4. gVisor / runsc (Linux only)
 
 Strongest isolation available: runs containers inside a user-space kernel via
 [gVisor](https://github.com/google/gvisor). gVisor intercepts all container
@@ -74,7 +92,7 @@ To set up runsc:
 2.  Configure the Docker daemon to use the runsc runtime.
 3.  Verify the installation.
 
-### 4. LXC/LXD (Linux only, experimental)
+### 5. LXC/LXD (Linux only, experimental)
 
 Full-system container sandboxing using LXC/LXD. Unlike Docker/Podman, LXC
 containers run a complete Linux system with `systemd`, `snapd`, and other system
@@ -118,6 +136,58 @@ gemini -p "build the snap"
   absolute path — the path must be writable inside the container.
 - Used with tools like Snapcraft or Rockcraft that require a full system.
 
+## Tool sandboxing
+
+Tool-level sandboxing provides granular isolation for individual tool executions
+(like `shell_exec` and `write_file`) instead of sandboxing the entire Gemini CLI
+process.
+
+This approach offers better integration with your local environment for non-tool
+tasks (like UI rendering and configuration loading) while still providing
+security for tool-driven operations.
+
+### How to turn off tool sandboxing
+
+If you experience issues with tool sandboxing or prefer full-process isolation,
+you can disable it by setting `security.toolSandboxing` to `false` in your
+`settings.json` file.
+
+```json
+{
+  "security": {
+    "toolSandboxing": false
+  }
+}
+```
+
+<!-- prettier-ignore -->
+> [!NOTE]
+> Changing the `security.toolSandboxing` setting requires a restart of Gemini
+> CLI to take effect.
+
+## Sandbox expansion
+
+Sandbox expansion is a dynamic permission system that lets Gemini CLI request
+additional permissions for a command when needed.
+
+When a sandboxed command fails due to permission restrictions (like restricted
+file paths or network access), or when a command is proactively identified as
+requiring extra permissions (like `npm install`), Gemini CLI will present you
+with a "Sandbox Expansion Request."
+
+### How sandbox expansion works
+
+1.  **Detection**: Gemini CLI detects a sandbox denial or proactively identifies
+    a command that requires extra permissions.
+2.  **Request**: A modal dialog is shown, explaining which additional
+    permissions (e.g., specific directories or network access) are required.
+3.  **Approval**: If you approve the expansion, the command is executed with the
+    extended permissions for that specific run.
+
+This mechanism ensures you don't have to manually re-run commands with more
+permissive sandbox settings, while still maintaining control over what the AI
+can access.
+
 ## Quickstart
 
 ```bash
@@ -253,9 +323,11 @@ $env:SANDBOX_SET_UID_GID="false"  # Disable UID/GID mapping
 DEBUG=1 gemini -s -p "debug command"
 ```
 
-**Note:** If you have `DEBUG=true` in a project's `.env` file, it won't affect
-gemini-cli due to automatic exclusion. Use `.gemini/.env` files for gemini-cli
-specific debug settings.
+<!-- prettier-ignore -->
+> [!NOTE]
+> If you have `DEBUG=true` in a project's `.env` file, it won't affect
+> gemini-cli due to automatic exclusion. Use `.gemini/.env` files for
+> gemini-cli specific debug settings.
 
 ### Inspect sandbox
 

docs/cli/session-management.md

@@ -96,6 +96,12 @@ Compatibility aliases:
 - `/chat ...` works for the same commands.
 - `/resume checkpoints ...` also remains supported during migration.
 
+## Parallel sessions with Git worktrees
+
+When working on multiple tasks at once, you can use
+[Git worktrees](./git-worktrees.md) to give each Gemini session its own copy of
+the codebase. This prevents changes in one session from colliding with another.
+
 ## Managing sessions
 
 You can list and delete sessions to keep your history organized and manage disk

docs/cli/settings.md

@@ -11,7 +11,9 @@ locations:
 - **User settings**: `~/.gemini/settings.json`
 - **Workspace settings**: `your-project/.gemini/settings.json`
 
-Note: Workspace settings override user settings.
+<!-- prettier-ignore -->
+> [!IMPORTANT]
+> Workspace settings override user settings.
 
 ## Settings reference
 
@@ -27,8 +29,9 @@ they appear in the UI.
 | Vim Mode                | `general.vimMode`                  | Enable Vim keybindings                                                                                                                                                                                                                                        | `false`     |
 | Default Approval Mode   | `general.defaultApprovalMode`      | The default approval mode for tool execution. 'default' prompts for approval, 'auto_edit' auto-approves edit tools, and 'plan' is read-only mode. YOLO mode (auto-approve all actions) can only be enabled via command line (--yolo or --approval-mode=yolo). | `"default"` |
 | Enable Auto Update      | `general.enableAutoUpdate`         | Enable automatic updates.                                                                                                                                                                                                                                     | `true`      |
-| Enable Notifications    | `general.enableNotifications`      | Enable run-event notifications for action-required prompts and session completion. Currently macOS only.                                                                                                                                                      | `false`     |
-| Plan Directory          | `general.plan.directory`           | The directory where planning artifacts are stored. If not specified, defaults to the system temporary directory.                                                                                                                                              | `undefined` |
+| Enable Notifications    | `general.enableNotifications`      | Enable run-event notifications for action-required prompts and session completion.                                                                                                                                                                            | `false`     |
+| Enable Plan Mode        | `general.plan.enabled`             | Enable Plan Mode for read-only safety during planning.                                                                                                                                                                                                        | `true`      |
+| Plan Directory          | `general.plan.directory`           | The directory where planning artifacts are stored. If not specified, defaults to the system temporary directory. A custom directory requires a policy to allow write access in Plan Mode.                                                                     | `undefined` |
 | Plan Model Routing      | `general.plan.modelRouting`        | Automatically switch between Pro and Flash models based on Plan Mode status. Uses Pro for the planning phase and Flash for the implementation phase.                                                                                                          | `true`      |
 | Retry Fetch Errors      | `general.retryFetchErrors`         | Retry on "exception TypeError: fetch failed sending request" errors.                                                                                                                                                                                          | `true`      |
 | Max Chat Model Attempts | `general.maxAttempts`              | Maximum number of attempts for requests to the main chat model. Cannot exceed 10.                                                                                                                                                                             | `10`        |
@@ -44,38 +47,41 @@ they appear in the UI.
 
 ### UI
 
-| UI Label                             | Setting                                | Description                                                                                                                                                       | Default  |
-| ------------------------------------ | -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
-| Auto Theme Switching                 | `ui.autoThemeSwitching`                | Automatically switch between default light and dark themes based on terminal background color.                                                                    | `true`   |
-| Terminal Background Polling Interval | `ui.terminalBackgroundPollingInterval` | Interval in seconds to poll the terminal background color.                                                                                                        | `60`     |
-| Hide Window Title                    | `ui.hideWindowTitle`                   | Hide the window title bar                                                                                                                                         | `false`  |
-| Inline Thinking                      | `ui.inlineThinkingMode`                | Display model thinking inline: off or full.                                                                                                                       | `"off"`  |
-| Show Thoughts in Title               | `ui.showStatusInTitle`                 | Show Gemini CLI model thoughts in the terminal window title during the working phase                                                                              | `false`  |
-| Dynamic Window Title                 | `ui.dynamicWindowTitle`                | Update the terminal window title with current status icons (Ready: ◇, Action Required: ✋, Working: ✦)                                                            | `true`   |
-| Show Home Directory Warning          | `ui.showHomeDirectoryWarning`          | Show a warning when running Gemini CLI in the home directory.                                                                                                     | `true`   |
-| Show Compatibility Warnings          | `ui.showCompatibilityWarnings`         | Show warnings about terminal or OS compatibility issues.                                                                                                          | `true`   |
-| Hide Tips                            | `ui.hideTips`                          | Hide helpful tips in the UI                                                                                                                                       | `false`  |
-| Escape Pasted @ Symbols              | `ui.escapePastedAtSymbols`             | When enabled, @ symbols in pasted text are escaped to prevent unintended @path expansion.                                                                         | `false`  |
-| Show Shortcuts Hint                  | `ui.showShortcutsHint`                 | Show the "? for shortcuts" hint above the input.                                                                                                                  | `true`   |
-| Hide Banner                          | `ui.hideBanner`                        | Hide the application banner                                                                                                                                       | `false`  |
-| Hide Context Summary                 | `ui.hideContextSummary`                | Hide the context summary (GEMINI.md, MCP servers) above the input.                                                                                                | `false`  |
-| Hide CWD                             | `ui.footer.hideCWD`                    | Hide the current working directory in the footer.                                                                                                                 | `false`  |
-| Hide Sandbox Status                  | `ui.footer.hideSandboxStatus`          | Hide the sandbox status indicator in the footer.                                                                                                                  | `false`  |
-| Hide Model Info                      | `ui.footer.hideModelInfo`              | Hide the model name and context usage in the footer.                                                                                                              | `false`  |
-| Hide Context Window Percentage       | `ui.footer.hideContextPercentage`      | Hides the context window usage percentage.                                                                                                                        | `true`   |
-| Hide Footer                          | `ui.hideFooter`                        | Hide the footer from the UI                                                                                                                                       | `false`  |
-| Show Memory Usage                    | `ui.showMemoryUsage`                   | Display memory usage information in the UI                                                                                                                        | `false`  |
-| Show Line Numbers                    | `ui.showLineNumbers`                   | Show line numbers in the chat.                                                                                                                                    | `true`   |
-| Show Citations                       | `ui.showCitations`                     | Show citations for generated text in the chat.                                                                                                                    | `false`  |
-| Show Model Info In Chat              | `ui.showModelInfoInChat`               | Show the model name in the chat for each model turn.                                                                                                              | `false`  |
-| Show User Identity                   | `ui.showUserIdentity`                  | Show the signed-in user's identity (e.g. email) in the UI.                                                                                                        | `true`   |
-| Use Alternate Screen Buffer          | `ui.useAlternateBuffer`                | Use an alternate screen buffer for the UI, preserving shell history.                                                                                              | `false`  |
-| Use Background Color                 | `ui.useBackgroundColor`                | Whether to use background colors in the UI.                                                                                                                       | `true`   |
-| Incremental Rendering                | `ui.incrementalRendering`              | Enable incremental rendering for the UI. This option will reduce flickering but may cause rendering artifacts. Only supported when useAlternateBuffer is enabled. | `true`   |
-| Show Spinner                         | `ui.showSpinner`                       | Show the spinner during operations.                                                                                                                               | `true`   |
-| Loading Phrases                      | `ui.loadingPhrases`                    | What to show while the model is working: tips, witty comments, both, or nothing.                                                                                  | `"tips"` |
-| Error Verbosity                      | `ui.errorVerbosity`                    | Controls whether recoverable errors are hidden (low) or fully shown (full).                                                                                       | `"low"`  |
-| Screen Reader Mode                   | `ui.accessibility.screenReader`        | Render output in plain-text to be more screen reader accessible                                                                                                   | `false`  |
+| UI Label                             | Setting                                | Description                                                                                                                                                       | Default |
+| ------------------------------------ | -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| Auto Theme Switching                 | `ui.autoThemeSwitching`                | Automatically switch between default light and dark themes based on terminal background color.                                                                    | `true`  |
+| Terminal Background Polling Interval | `ui.terminalBackgroundPollingInterval` | Interval in seconds to poll the terminal background color.                                                                                                        | `60`    |
+| Hide Window Title                    | `ui.hideWindowTitle`                   | Hide the window title bar                                                                                                                                         | `false` |
+| Inline Thinking                      | `ui.inlineThinkingMode`                | Display model thinking inline: off or full.                                                                                                                       | `"off"` |
+| Show Thoughts in Title               | `ui.showStatusInTitle`                 | Show Gemini CLI model thoughts in the terminal window title during the working phase                                                                              | `false` |
+| Dynamic Window Title                 | `ui.dynamicWindowTitle`                | Update the terminal window title with current status icons (Ready: ◇, Action Required: ✋, Working: ✦)                                                            | `true`  |
+| Show Home Directory Warning          | `ui.showHomeDirectoryWarning`          | Show a warning when running Gemini CLI in the home directory.                                                                                                     | `true`  |
+| Show Compatibility Warnings          | `ui.showCompatibilityWarnings`         | Show warnings about terminal or OS compatibility issues.                                                                                                          | `true`  |
+| Hide Tips                            | `ui.hideTips`                          | Hide helpful tips in the UI                                                                                                                                       | `false` |
+| Escape Pasted @ Symbols              | `ui.escapePastedAtSymbols`             | When enabled, @ symbols in pasted text are escaped to prevent unintended @path expansion.                                                                         | `false` |
+| Show Shortcuts Hint                  | `ui.showShortcutsHint`                 | Show the "? for shortcuts" hint above the input.                                                                                                                  | `true`  |
+| Compact Tool Output                  | `ui.compactToolOutput`                 | Display tool outputs (like directory listings and file reads) in a compact, structured format.                                                                    | `true`  |
+| Hide Banner                          | `ui.hideBanner`                        | Hide the application banner                                                                                                                                       | `false` |
+| Hide Context Summary                 | `ui.hideContextSummary`                | Hide the context summary (GEMINI.md, MCP servers) above the input.                                                                                                | `false` |
+| Hide CWD                             | `ui.footer.hideCWD`                    | Hide the current working directory in the footer.                                                                                                                 | `false` |
+| Hide Sandbox Status                  | `ui.footer.hideSandboxStatus`          | Hide the sandbox status indicator in the footer.                                                                                                                  | `false` |
+| Hide Model Info                      | `ui.footer.hideModelInfo`              | Hide the model name and context usage in the footer.                                                                                                              | `false` |
+| Hide Context Window Percentage       | `ui.footer.hideContextPercentage`      | Hides the context window usage percentage.                                                                                                                        | `true`  |
+| Hide Footer                          | `ui.hideFooter`                        | Hide the footer from the UI                                                                                                                                       | `false` |
+| Show Memory Usage                    | `ui.showMemoryUsage`                   | Display memory usage information in the UI                                                                                                                        | `false` |
+| Show Line Numbers                    | `ui.showLineNumbers`                   | Show line numbers in the chat.                                                                                                                                    | `true`  |
+| Show Citations                       | `ui.showCitations`                     | Show citations for generated text in the chat.                                                                                                                    | `false` |
+| Show Model Info In Chat              | `ui.showModelInfoInChat`               | Show the model name in the chat for each model turn.                                                                                                              | `false` |
+| Show User Identity                   | `ui.showUserIdentity`                  | Show the signed-in user's identity (e.g. email) in the UI.                                                                                                        | `true`  |
+| Use Alternate Screen Buffer          | `ui.useAlternateBuffer`                | Use an alternate screen buffer for the UI, preserving shell history.                                                                                              | `false` |
+| Render Process                       | `ui.renderProcess`                     | Enable Ink render process for the UI.                                                                                                                             | `true`  |
+| Terminal Buffer                      | `ui.terminalBuffer`                    | Use the new terminal buffer architecture for rendering.                                                                                                           | `true`  |
+| Use Background Color                 | `ui.useBackgroundColor`                | Whether to use background colors in the UI.                                                                                                                       | `true`  |
+| Incremental Rendering                | `ui.incrementalRendering`              | Enable incremental rendering for the UI. This option will reduce flickering but may cause rendering artifacts. Only supported when useAlternateBuffer is enabled. | `true`  |
+| Show Spinner                         | `ui.showSpinner`                       | Show the spinner during operations.                                                                                                                               | `true`  |
+| Loading Phrases                      | `ui.loadingPhrases`                    | What to show while the model is working: tips, witty comments, all, or off.                                                                                       | `"off"` |
+| Error Verbosity                      | `ui.errorVerbosity`                    | Controls whether recoverable errors are hidden (low) or fully shown (full).                                                                                       | `"low"` |
+| Screen Reader Mode                   | `ui.accessibility.screenReader`        | Render output in plain-text to be more screen reader accessible                                                                                                   | `false` |
 
 ### IDE
 
@@ -99,6 +105,13 @@ they appear in the UI.
 | Disable Loop Detection        | `model.disableLoopDetection` | Disable automatic detection and prevention of infinite loops.                          | `false`     |
 | Skip Next Speaker Check       | `model.skipNextSpeakerCheck` | Skip the next speaker check.                                                           | `true`      |
 
+### Agents
+
+| UI Label                  | Setting                                  | Description                                                                                   | Default |
+| ------------------------- | ---------------------------------------- | --------------------------------------------------------------------------------------------- | ------- |
+| Confirm Sensitive Actions | `agents.browser.confirmSensitiveActions` | Require manual confirmation for sensitive browser actions (e.g., fill_form, evaluate_script). | `false` |
+| Block File Uploads        | `agents.browser.blockFileUploads`        | Hard-block file upload requests from the browser agent.                                       | `false` |
+
 ### Context
 
 | UI Label                             | Setting                                           | Description                                                                                                                                                                                                                                 | Default |
@@ -115,8 +128,10 @@ they appear in the UI.
 
 | UI Label                         | Setting                              | Description                                                                                                                                                                | Default |
 | -------------------------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| Sandbox Allowed Paths            | `tools.sandboxAllowedPaths`          | List of additional paths that the sandbox is allowed to access.                                                                                                            | `[]`    |
+| Sandbox Network Access           | `tools.sandboxNetworkAccess`         | Whether the sandbox is allowed to access the network.                                                                                                                      | `false` |
 | Enable Interactive Shell         | `tools.shell.enableInteractiveShell` | Use node-pty for an interactive shell experience. Fallback to child_process still applies.                                                                                 | `true`  |
-| Show Color                       | `tools.shell.showColor`              | Show color in shell output.                                                                                                                                                | `false` |
+| Show Color                       | `tools.shell.showColor`              | Show color in shell output.                                                                                                                                                | `true`  |
 | Use Ripgrep                      | `tools.useRipgrep`                   | Use ripgrep for file content search instead of the fallback implementation. Provides faster search performance.                                                            | `true`  |
 | Tool Output Truncation Threshold | `tools.truncateToolOutputThreshold`  | Maximum characters to show when truncating large tool outputs. Set to 0 or negative to disable truncation.                                                                 | `40000` |
 | Disable LLM Correction           | `tools.disableLLMCorrection`         | Disable LLM-based error correction for edit tools. When enabled, tools will fail immediately if exact string matches are not found, instead of attempting to self-correct. | `true`  |
@@ -125,7 +140,9 @@ they appear in the UI.
 
 | UI Label                              | Setting                                         | Description                                                                                                                                                                                                                          | Default |
 | ------------------------------------- | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- |
+| Tool Sandboxing                       | `security.toolSandboxing`                       | Tool-level sandboxing. Isolates individual tools instead of the entire CLI process.                                                                                                                                                  | `false` |
 | Disable YOLO Mode                     | `security.disableYoloMode`                      | Disable YOLO mode, even if enabled by a flag.                                                                                                                                                                                        | `false` |
+| Disable Always Allow                  | `security.disableAlwaysAllow`                   | Disable "Always allow" options in tool confirmation dialogs.                                                                                                                                                                         | `false` |
 | Allow Permanent Tool Approval         | `security.enablePermanentToolApproval`          | Enable the "Allow for all future sessions" option in tool confirmation dialogs.                                                                                                                                                      | `false` |
 | Auto-add to Policy by Default         | `security.autoAddToPolicyByDefault`             | When enabled, the "Allow for all future sessions" option becomes the default choice for low-risk tools in trusted workspaces.                                                                                                        | `false` |
 | Blocks extensions from Git            | `security.blockGitExtensions`                   | Blocks installing and loading extensions from Git.                                                                                                                                                                                   | `false` |
@@ -138,18 +155,21 @@ they appear in the UI.
 
 | UI Label                          | Setting                        | Description                                   | Default |
 | --------------------------------- | ------------------------------ | --------------------------------------------- | ------- |
-| Auto Configure Max Old Space Size | `advanced.autoConfigureMemory` | Automatically configure Node.js memory limits | `false` |
+| Auto Configure Max Old Space Size | `advanced.autoConfigureMemory` | Automatically configure Node.js memory limits | `true`  |
 
 ### Experimental
 
-| UI Label                   | Setting                                  | Description                                                                                                                                               | Default |
-| -------------------------- | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
-| Enable Tool Output Masking | `experimental.toolOutputMasking.enabled` | Enables tool output masking to save tokens.                                                                                                               | `true`  |
-| Use OSC 52 Paste           | `experimental.useOSC52Paste`             | Use OSC 52 for pasting. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it). | `false` |
-| Use OSC 52 Copy            | `experimental.useOSC52Copy`              | Use OSC 52 for copying. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it). | `false` |
-| Plan                       | `experimental.plan`                      | Enable Plan Mode.                                                                                                                                         | `true`  |
-| Model Steering             | `experimental.modelSteering`             | Enable model steering (user hints) to guide the model during tool execution.                                                                              | `false` |
-| Direct Web Fetch           | `experimental.directWebFetch`            | Enable web fetch behavior that bypasses LLM summarization.                                                                                                | `false` |
+| UI Label                                             | Setting                             | Description                                                                                                                                               | Default |
+| ---------------------------------------------------- | ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| Enable Git Worktrees                                 | `experimental.worktrees`            | Enable automated Git worktree management for parallel work.                                                                                               | `false` |
+| Use OSC 52 Paste                                     | `experimental.useOSC52Paste`        | Use OSC 52 for pasting. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it). | `false` |
+| Use OSC 52 Copy                                      | `experimental.useOSC52Copy`         | Use OSC 52 for copying. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it). | `false` |
+| Model Steering                                       | `experimental.modelSteering`        | Enable model steering (user hints) to guide the model during tool execution.                                                                              | `false` |
+| Direct Web Fetch                                     | `experimental.directWebFetch`       | Enable web fetch behavior that bypasses LLM summarization.                                                                                                | `false` |
+| Memory Manager Agent                                 | `experimental.memoryManager`        | Replace the built-in save_memory tool with a memory manager subagent that supports adding, removing, de-duplicating, and organizing memories.             | `false` |
+| Use the generalist profile to manage agent contexts. | `experimental.generalistProfile`    | Suitable for general coding and software development tasks.                                                                                               | `false` |
+| Enable Context Management                            | `experimental.contextManagement`    | Enable logic for context management.                                                                                                                      | `false` |
+| Topic & Update Narration                             | `experimental.topicUpdateNarration` | Enable the experimental Topic & Update communication model for reduced chattiness and structured progress reporting.                                      | `false` |
 
 ### Skills
 

docs/cli/skills.md

@@ -63,8 +63,10 @@ Use the `/skills` slash command to view and manage available expertise:
 - `/skills enable <name>`: Re-enables a disabled skill.
 - `/skills reload`: Refreshes the list of discovered skills from all tiers.
 
-_Note: `/skills disable` and `/skills enable` default to the `user` scope. Use
-`--scope workspace` to manage workspace-specific settings._
+<!-- prettier-ignore -->
+> [!NOTE]
+> `/skills disable` and `/skills enable` default to the `user` scope. Use
+> `--scope workspace` to manage workspace-specific settings.
 
 ### From the Terminal
 

docs/cli/system-prompt.md

@@ -14,7 +14,9 @@ core instructions will apply unless you include them yourself.
 This feature is intended for advanced users who need to enforce strict,
 project-specific behavior or create a customized persona.
 
-> Tip: You can export the current default system prompt to a file first, review
+<!-- prettier-ignore -->
+> [!TIP]
+> You can export the current default system prompt to a file first, review
 > it, and then selectively modify or replace it (see
 > [“Export the default prompt”](#export-the-default-prompt-recommended)).
 

docs/cli/telemetry.md

@@ -125,9 +125,11 @@ You must complete several setup steps before enabling Google Cloud telemetry.
       }
       ```
 
-      > **Note:** This setting requires **Direct export** (in-process exporters)
-      > and cannot be used when `useCollector` is `true`. If both are enabled,
-      > telemetry will be disabled.
+<!-- prettier-ignore -->
+> [!NOTE]
+> This setting requires **Direct export** (in-process exporters)
+> and cannot be used when `useCollector` is `true`. If both are enabled,
+> telemetry will be disabled.
 
 3.  Ensure your account or service account has these IAM roles:
     - Cloud Trace Agent
@@ -304,6 +306,7 @@ Emitted at startup with the CLI configuration.
 - `extension_ids` (string)
 - `extensions_count` (int)
 - `auth_type` (string)
+- `worktree_active` (boolean)
 - `github_workflow_name` (string, optional)
 - `github_repository_hash` (string, optional)
 - `github_event_name` (string, optional)
@@ -901,6 +904,20 @@ Logs keychain availability checks.
 
 - `available` (boolean)
 
+##### `gemini_cli.startup_stats`
+
+Logs detailed startup performance statistics.
+
+<details>
+<summary>Attributes</summary>
+
+- `phases` (json array of startup phases)
+- `os_platform` (string)
+- `os_release` (string)
+- `is_docker` (boolean)
+
+</details>
+
 </details>
 
 ### Metrics
@@ -917,6 +934,20 @@ Gemini CLI exports several custom metrics.
 
 Incremented once per CLI startup.
 
+##### Onboarding
+
+Tracks onboarding flow from authentication to the user
+
+- `gemini_cli.onboarding.start` (Counter, Int): Incremented when the
+  authentication flow begins.
+
+- `gemini_cli.onboarding.success` (Counter, Int): Incremented when the user
+onboarding flow completes successfully.
+<details>
+<summary>Attributes (Success)</summary>
+
+- `user_tier` (string)
+
 ##### Tools
 
 ##### `gemini_cli.tool.call.count`

docs/cli/themes.md

@@ -19,6 +19,7 @@ using the `/theme` command within Gemini CLI:
   - `Holiday`
   - `Shades Of Purple`
   - `Solarized Dark`
+  - `Tokyo Night`
 - **Light themes:**
   - `ANSI Light`
   - `Ayu Light`
@@ -36,9 +37,11 @@ using the `/theme` command within Gemini CLI:
     preview or highlight as you select.
 4.  Confirm your selection to apply the theme.
 
-**Note:** If a theme is defined in your `settings.json` file (either by name or
-by a file path), you must remove the `"theme"` setting from the file before you
-can change the theme using the `/theme` command.
+<!-- prettier-ignore -->
+> [!NOTE]
+> If a theme is defined in your `settings.json` file (either by name or
+> by a file path), you must remove the `"theme"` setting from the file before
+> you can change the theme using the `/theme` command.
 
 ### Theme persistence
 
@@ -179,11 +182,13 @@ custom theme defined in `settings.json`.
 }
 ```
 
-**Security note:** For your safety, Gemini CLI will only load theme files that
-are located within your home directory. If you attempt to load a theme from
-outside your home directory, a warning will be displayed and the theme will not
-be loaded. This is to prevent loading potentially malicious theme files from
-untrusted sources.
+<!-- prettier-ignore -->
+> [!WARNING]
+> For your safety, Gemini CLI will only load theme files that
+> are located within your home directory. If you attempt to load a theme from
+> outside your home directory, a warning will be displayed and the theme will
+> not be loaded. This is to prevent loading potentially malicious theme files
+> from untrusted sources.
 
 ### Example custom theme
 
@@ -248,6 +253,10 @@ identify their source, for example: `shades-of-green (green-extension)`.
 
 <img src="/docs/assets/theme-solarized-dark.png" alt="Solarized Dark theme" width="600">
 
+### Tokyo Night
+
+<img src="/docs/assets/theme-tokyonight-dark.png" alt="Tokyo Night theme" width="600">
+
 ## Light themes
 
 ### ANSI Light

docs/cli/tutorials/file-management.md

@@ -7,9 +7,9 @@ create files, and control what Gemini CLI can see.
 ## Prerequisites
 
 - Gemini CLI installed and authenticated.
-- A project directory to work with (e.g., a git repository).
+- A project directory to work with (for example, a git repository).
 
-## How to give the agent context (Reading files)
+## Providing context by reading files
 
 Gemini CLI will generally try to read relevant files, sometimes prompting you
 for access (depending on your settings). To ensure that Gemini CLI uses a file,
@@ -58,11 +58,13 @@ You know there's a `UserProfile` component, but you don't know where it lives.
 ```
 
 Gemini uses the `glob` or `list_directory` tools to search your project
-structure. It will return the specific path (e.g.,
+structure. It will return the specific path (for example,
 `src/components/UserProfile.tsx`), which you can then use with `@` in your next
 turn.
 
-> **Tip:** You can also ask for lists of files, like "Show me all the TypeScript
+<!-- prettier-ignore -->
+> [!TIP]
+> You can also ask for lists of files, like "Show me all the TypeScript
 > configuration files in the root directory."
 
 ## How to modify code
@@ -111,8 +113,8 @@ or, better yet, run your project's tests.
 `Run the tests for the UserProfile component.`
 ```
 
-Gemini CLI uses the `run_shell_command` tool to execute your test runner (e.g.,
-`npm test` or `jest`). This ensures the changes didn't break existing
+Gemini CLI uses the `run_shell_command` tool to execute your test runner (for
+example, `npm test` or `jest`). This ensures the changes didn't break existing
 functionality.
 
 ## Advanced: Controlling what Gemini sees

docs/cli/tutorials/mcp-setup.md

@@ -52,7 +52,7 @@ You tell Gemini about new servers by editing your `settings.json`.
         "--rm",
         "-e",
         "GITHUB_PERSONAL_ACCESS_TOKEN",
-        "ghcr.io/modelcontextprotocol/servers/github:latest"
+        "ghcr.io/github/github-mcp-server:latest"
       ],
       "env": {
         "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PERSONAL_ACCESS_TOKEN}"
@@ -62,8 +62,10 @@ You tell Gemini about new servers by editing your `settings.json`.
 }
 ```
 
-> **Note:** The `command` is `docker`, and the rest are arguments passed to it.
-> We map the local environment variable into the container so your secret isn't
+<!-- prettier-ignore -->
+> [!NOTE]
+> The `command` is `docker`, and the rest are arguments passed to it. We
+> map the local environment variable into the container so your secret isn't
 > hardcoded in the config file.
 
 ## How to verify the connection

docs/cli/tutorials/memory-management.md

@@ -11,8 +11,8 @@ persistent facts, and inspect the active context.
 
 ## Why manage context?
 
-Out of the box, Gemini CLI is smart but generic. It doesn't know your preferred
-testing framework, your indentation style, or that you hate using `any` in
+Gemini CLI is powerful but general. It doesn't know your preferred testing
+framework, your indentation style, or your preference against `any` in
 TypeScript. Context management solves this by giving the agent persistent
 memory.
 
@@ -109,11 +109,11 @@ immediately. Force a reload with:
 
 ## Best practices
 
-- **Keep it focused:** Don't dump your entire internal wiki into `GEMINI.md`.
-  Keep instructions actionable and relevant to code generation.
+- **Keep it focused:** Avoid adding excessive content to `GEMINI.md`. Keep
+  instructions actionable and relevant to code generation.
 - **Use negative constraints:** Explicitly telling the agent what _not_ to do
-  (e.g., "Do not use class components") is often more effective than vague
-  positive instructions.
+  (for example, "Do not use class components") is often more effective than
+  vague positive instructions.
 - **Review often:** Periodically check your `GEMINI.md` files to remove outdated
   rules.
 

docs/cli/tutorials/plan-mode-steering.md

@@ -5,9 +5,10 @@ structured environment with model steering's real-time feedback, you can guide
 Gemini CLI through the research and design phases to ensure the final
 implementation plan is exactly what you need.
 
-> **Note:** This is a preview feature under active development. Preview features
-> may only be available in the **Preview** channel or may need to be enabled
-> under `/settings`.
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is an experimental feature currently under active development and
+> may need to be enabled under `/settings`.
 
 ## Prerequisites
 

docs/cli/tutorials/shell-commands.md

@@ -7,7 +7,7 @@ automate complex workflows, and manage background processes safely.
 ## Prerequisites
 
 - Gemini CLI installed and authenticated.
-- Basic familiarity with your system's shell (Bash, Zsh, PowerShell, etc.).
+- Basic familiarity with your system's shell (Bash, Zsh, PowerShell, and so on).
 
 ## How to run commands directly (`!`)
 
@@ -49,7 +49,7 @@ You want to run tests and fix any failures.
 6.  Gemini uses `replace` to fix the bug.
 7.  Gemini runs `npm test` again to verify the fix.
 
-This loop turns Gemini into an autonomous engineer.
+This loop lets Gemini work autonomously.
 
 ## How to manage background processes
 
@@ -75,7 +75,7 @@ confirmation prompts) by streaming the output to you. However, for highly
 interactive tools (like `vim` or `top`), it's often better to run them yourself
 in a separate terminal window or use the `!` prefix.
 
-## Safety first
+## Safety features
 
 Giving an AI access to your shell is powerful but risky. Gemini CLI includes
 several safety layers.

docs/core/index.md

@@ -7,8 +7,8 @@ requests sent from `packages/cli`. For a general overview of Gemini CLI, see the
 
 ## Navigating this section
 
-- **[Sub-agents (experimental)](./subagents.md):** Learn how to create and use
-  specialized sub-agents for complex tasks.
+- **[Sub-agents](./subagents.md):** Learn how to create and use specialized
+  sub-agents for complex tasks.
 - **[Core tools reference](../reference/tools.md):** Information on how tools
   are defined, registered, and used by the core.
 - **[Memory Import Processor](../reference/memport.md):** Documentation for the

docs/core/remote-agents.md

@@ -1,4 +1,4 @@
-# Remote Subagents (experimental)
+# Remote Subagents
 
 Gemini CLI supports connecting to remote subagents using the Agent-to-Agent
 (A2A) protocol. This allows Gemini CLI to interact with other agents, expanding
@@ -10,17 +10,16 @@ agents in the following repositories:
 - [ADK Samples (Python)](https://github.com/google/adk-samples/tree/main/python)
 - [ADK Python Contributing Samples](https://github.com/google/adk-python/tree/main/contributing/samples)
 
-> **Note: Remote subagents are currently an experimental feature.**
+## Proxy support
 
-## Configuration
-
-To use remote subagents, you must explicitly enable them in your
-`settings.json`:
+Gemini CLI routes traffic to remote agents through an HTTP/HTTPS proxy if one is
+configured. It uses the `general.proxy` setting in your `settings.json` file or
+standard environment variables (`HTTP_PROXY`, `HTTPS_PROXY`).
 
 ```json
 {
-  "experimental": {
-    "enableAgents": true
+  "general": {
+    "proxy": "http://my-proxy:8080"
   }
 }
 ```
@@ -35,11 +34,13 @@ You can place them in:
 
 ### Configuration schema
 
-| Field            | Type   | Required | Description                                                                                                    |
-| :--------------- | :----- | :------- | :------------------------------------------------------------------------------------------------------------- |
-| `kind`           | string | Yes      | Must be `remote`.                                                                                              |
-| `name`           | string | Yes      | A unique name for the agent. Must be a valid slug (lowercase letters, numbers, hyphens, and underscores only). |
-| `agent_card_url` | string | Yes      | The URL to the agent's A2A card endpoint.                                                                      |
+| Field             | Type   | Required | Description                                                                                                    |
+| :---------------- | :----- | :------- | :------------------------------------------------------------------------------------------------------------- |
+| `kind`            | string | Yes      | Must be `remote`.                                                                                              |
+| `name`            | string | Yes      | A unique name for the agent. Must be a valid slug (lowercase letters, numbers, hyphens, and underscores only). |
+| `agent_card_url`  | string | Yes\*    | The URL to the agent's A2A card endpoint. Required if `agent_card_json` is not provided.                       |
+| `agent_card_json` | string | Yes\*    | The inline JSON string of the agent's A2A card. Required if `agent_card_url` is not provided.                  |
+| `auth`            | object | No       | Authentication configuration. See [Authentication](#authentication).                                           |
 
 ### Single-subagent example
 
@@ -67,9 +68,366 @@ Markdown file.
 ---
 ```
 
-> **Note:** Mixed local and remote agents, or multiple local agents, are not
+<!-- prettier-ignore -->
+> [!NOTE] Mixed local and remote agents, or multiple local agents, are not
 > supported in a single file; the list format is currently remote-only.
 
+### Inline Agent Card JSON
+
+<details>
+<summary>View formatting options for JSON strings</summary>
+
+If you don't have an endpoint serving the agent card, you can provide the A2A
+card directly as a JSON string using `agent_card_json`.
+
+When providing a JSON string in YAML, you must properly format it as a string
+scalar. You can use single quotes, a block scalar, or double quotes (which
+require escaping internal double quotes).
+
+#### Using single quotes
+
+Single quotes allow you to embed unescaped double quotes inside the JSON string.
+This format is useful for shorter, single-line JSON strings.
+
+```markdown
+---
+kind: remote
+name: single-quotes-agent
+agent_card_json:
+  '{ "protocolVersion": "0.3.0", "name": "Example Agent", "version": "1.0.0",
+  "url": "dummy-url" }'
+---
+```
+
+#### Using a block scalar
+
+The literal block scalar (`|`) preserves line breaks and is highly recommended
+for multiline JSON strings as it avoids quote escaping entirely. The following
+is a complete, valid Agent Card configuration using dummy values.
+
+```markdown
+---
+kind: remote
+name: block-scalar-agent
+agent_card_json: |
+  {
+    "protocolVersion": "0.3.0",
+    "name": "Example Agent Name",
+    "description": "An example agent description for documentation purposes.",
+    "version": "1.0.0",
+    "url": "dummy-url",
+    "preferredTransport": "HTTP+JSON",
+    "capabilities": {
+      "streaming": true,
+      "extendedAgentCard": false
+    },
+    "defaultInputModes": [
+      "text/plain"
+    ],
+    "defaultOutputModes": [
+      "application/json"
+    ],
+    "skills": [
+      {
+        "id": "ExampleSkill",
+        "name": "Example Skill Assistant",
+        "description": "A description of what this example skill does.",
+        "tags": [
+          "example-tag"
+        ],
+        "examples": [
+          "Show me an example."
+        ]
+      }
+    ]
+  }
+---
+```
+
+#### Using double quotes
+
+Double quotes are also supported, but any internal double quotes in your JSON
+must be escaped with a backslash.
+
+```markdown
+---
+kind: remote
+name: double-quotes-agent
+agent_card_json:
+  '{ "protocolVersion": "0.3.0", "name": "Example Agent", "version": "1.0.0",
+  "url": "dummy-url" }'
+---
+```
+
+</details>
+
+## Authentication
+
+Many remote agents require authentication. Gemini CLI supports several
+authentication methods aligned with the
+[A2A security specification](https://a2a-protocol.org/latest/specification/#451-securityscheme).
+Add an `auth` block to your agent's frontmatter to configure credentials.
+
+### Supported auth types
+
+Gemini CLI supports the following authentication types:
+
+| Type                 | Description                                                                                    |
+| :------------------- | :--------------------------------------------------------------------------------------------- |
+| `apiKey`             | Send a static API key as an HTTP header.                                                       |
+| `http`               | HTTP authentication (Bearer token, Basic credentials, or any IANA-registered scheme).          |
+| `google-credentials` | Google Application Default Credentials (ADC). Automatically selects access or identity tokens. |
+| `oauth`              | OAuth 2.0 Authorization Code flow with PKCE. Opens a browser for interactive sign-in.          |
+
+### Dynamic values
+
+For `apiKey` and `http` auth types, secret values (`key`, `token`, `username`,
+`password`, `value`) support dynamic resolution:
+
+| Format      | Description                                         | Example                    |
+| :---------- | :-------------------------------------------------- | :------------------------- |
+| `$ENV_VAR`  | Read from an environment variable.                  | `$MY_API_KEY`              |
+| `!command`  | Execute a shell command and use the trimmed output. | `!gcloud auth print-token` |
+| literal     | Use the string as-is.                               | `sk-abc123`                |
+| `$$` / `!!` | Escape prefix. `$$FOO` becomes the literal `$FOO`.  | `$$NOT_AN_ENV_VAR`         |
+
+> **Security tip:** Prefer `$ENV_VAR` or `!command` over embedding secrets
+> directly in agent files, especially for project-level agents checked into
+> version control.
+
+### API key (`apiKey`)
+
+Sends an API key as an HTTP header on every request.
+
+| Field  | Type   | Required | Description                                           |
+| :----- | :----- | :------- | :---------------------------------------------------- |
+| `type` | string | Yes      | Must be `apiKey`.                                     |
+| `key`  | string | Yes      | The API key value. Supports dynamic values.           |
+| `name` | string | No       | Header name to send the key in. Default: `X-API-Key`. |
+
+```yaml
+---
+kind: remote
+name: my-agent
+agent_card_url: https://example.com/agent-card
+auth:
+  type: apiKey
+  key: $MY_API_KEY
+---
+```
+
+### HTTP authentication (`http`)
+
+Supports Bearer tokens, Basic auth, and arbitrary IANA-registered HTTP
+authentication schemes.
+
+#### Bearer token
+
+Use the following fields to configure a Bearer token:
+
+| Field    | Type   | Required | Description                                |
+| :------- | :----- | :------- | :----------------------------------------- |
+| `type`   | string | Yes      | Must be `http`.                            |
+| `scheme` | string | Yes      | Must be `Bearer`.                          |
+| `token`  | string | Yes      | The bearer token. Supports dynamic values. |
+
+```yaml
+auth:
+  type: http
+  scheme: Bearer
+  token: $MY_BEARER_TOKEN
+```
+
+#### Basic authentication
+
+Use the following fields to configure Basic authentication:
+
+| Field      | Type   | Required | Description                            |
+| :--------- | :----- | :------- | :------------------------------------- |
+| `type`     | string | Yes      | Must be `http`.                        |
+| `scheme`   | string | Yes      | Must be `Basic`.                       |
+| `username` | string | Yes      | The username. Supports dynamic values. |
+| `password` | string | Yes      | The password. Supports dynamic values. |
+
+```yaml
+auth:
+  type: http
+  scheme: Basic
+  username: $MY_USERNAME
+  password: $MY_PASSWORD
+```
+
+#### Raw scheme
+
+For any other IANA-registered scheme (for example, Digest, HOBA), provide the
+raw authorization value.
+
+| Field    | Type   | Required | Description                                                                   |
+| :------- | :----- | :------- | :---------------------------------------------------------------------------- |
+| `type`   | string | Yes      | Must be `http`.                                                               |
+| `scheme` | string | Yes      | The scheme name (for example, `Digest`).                                      |
+| `value`  | string | Yes      | Raw value sent as `Authorization: <scheme> <value>`. Supports dynamic values. |
+
+```yaml
+auth:
+  type: http
+  scheme: Digest
+  value: $MY_DIGEST_VALUE
+```
+
+### Google Application Default Credentials (`google-credentials`)
+
+Uses
+[Google Application Default Credentials (ADC)](https://cloud.google.com/docs/authentication/application-default-credentials)
+to authenticate with Google Cloud services and Cloud Run endpoints. This is the
+recommended auth method for agents hosted on Google Cloud infrastructure.
+
+| Field    | Type     | Required | Description                                                                 |
+| :------- | :------- | :------- | :-------------------------------------------------------------------------- |
+| `type`   | string   | Yes      | Must be `google-credentials`.                                               |
+| `scopes` | string[] | No       | OAuth scopes. Defaults to `https://www.googleapis.com/auth/cloud-platform`. |
+
+```yaml
+---
+kind: remote
+name: my-gcp-agent
+agent_card_url: https://my-agent-xyz.run.app/.well-known/agent.json
+auth:
+  type: google-credentials
+---
+```
+
+#### How token selection works
+
+The provider automatically selects the correct token type based on the agent's
+host:
+
+| Host pattern       | Token type         | Use case                                    |
+| :----------------- | :----------------- | :------------------------------------------ |
+| `*.googleapis.com` | **Access token**   | Google APIs (Agent Engine, Vertex AI, etc.) |
+| `*.run.app`        | **Identity token** | Cloud Run services                          |
+
+- **Access tokens** authorize API calls to Google services. They are scoped
+  (default: `cloud-platform`) and fetched via `GoogleAuth.getClient()`.
+- **Identity tokens** prove the caller's identity to a service that validates
+  the token's audience. The audience is set to the target host. These are
+  fetched via `GoogleAuth.getIdTokenClient()`.
+
+Both token types are cached and automatically refreshed before expiry.
+
+#### Setup
+
+`google-credentials` relies on ADC, which means your environment must have
+credentials configured. Common setups:
+
+- **Local development:** Run `gcloud auth application-default login` to
+  authenticate with your Google account.
+- **CI / Cloud environments:** Use a service account. Set the
+  `GOOGLE_APPLICATION_CREDENTIALS` environment variable to the path of your
+  service account key file, or use workload identity on GKE / Cloud Run.
+
+#### Allowed hosts
+
+For security, `google-credentials` only sends tokens to known Google-owned
+hosts:
+
+- `*.googleapis.com`
+- `*.run.app`
+
+Requests to any other host will be rejected with an error. If your agent is
+hosted on a different domain, use one of the other auth types (`apiKey`, `http`,
+or `oauth`).
+
+#### Examples
+
+The following examples demonstrate how to configure Google Application Default
+Credentials.
+
+**Cloud Run agent:**
+
+```yaml
+---
+kind: remote
+name: cloud-run-agent
+agent_card_url: https://my-agent-xyz.run.app/.well-known/agent.json
+auth:
+  type: google-credentials
+---
+```
+
+**Google API with custom scopes:**
+
+```yaml
+---
+kind: remote
+name: vertex-agent
+agent_card_url: https://us-central1-aiplatform.googleapis.com/.well-known/agent.json
+auth:
+  type: google-credentials
+  scopes:
+    - https://www.googleapis.com/auth/cloud-platform
+    - https://www.googleapis.com/auth/compute
+---
+```
+
+### OAuth 2.0 (`oauth`)
+
+Performs an interactive OAuth 2.0 Authorization Code flow with PKCE. On first
+use, Gemini CLI opens your browser for sign-in and persists the resulting tokens
+for subsequent requests.
+
+| Field               | Type     | Required | Description                                                                                                                                        |
+| :------------------ | :------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `type`              | string   | Yes      | Must be `oauth`.                                                                                                                                   |
+| `client_id`         | string   | Yes\*    | OAuth client ID. Required for interactive auth.                                                                                                    |
+| `client_secret`     | string   | No\*     | OAuth client secret. Required by most authorization servers (confidential clients). Can be omitted for public clients that don't require a secret. |
+| `scopes`            | string[] | No       | Requested scopes. Can also be discovered from the agent card.                                                                                      |
+| `authorization_url` | string   | No       | Authorization endpoint. Discovered from the agent card if omitted.                                                                                 |
+| `token_url`         | string   | No       | Token endpoint. Discovered from the agent card if omitted.                                                                                         |
+
+```yaml
+---
+kind: remote
+name: oauth-agent
+agent_card_url: https://example.com/.well-known/agent.json
+auth:
+  type: oauth
+  client_id: my-client-id.apps.example.com
+---
+```
+
+If the agent card advertises an `oauth2` security scheme with
+`authorizationCode` flow, the `authorization_url`, `token_url`, and `scopes` are
+automatically discovered. You only need to provide `client_id` (and
+`client_secret` if required).
+
+Tokens are persisted to disk and refreshed automatically when they expire.
+
+### Auth validation
+
+When Gemini CLI loads a remote agent, it validates your auth configuration
+against the agent card's declared `securitySchemes`. If the agent requires
+authentication that you haven't configured, you'll see an error describing
+what's needed.
+
+`google-credentials` is treated as compatible with `http` Bearer security
+schemes, since it produces Bearer tokens.
+
+### Auth retry behavior
+
+All auth providers automatically retry on `401` and `403` responses by
+re-fetching credentials (up to 2 retries). This handles cases like expired
+tokens or rotated credentials. For `apiKey` with `!command` values, the command
+is re-executed on retry to fetch a fresh key.
+
+### Agent card fetching and auth
+
+When connecting to a remote agent, Gemini CLI first fetches the agent card
+**without** authentication. If the card endpoint returns a `401` or `403`, it
+retries the fetch **with** the configured auth headers. This lets agents have
+publicly accessible cards while protecting their task endpoints, or to protect
+both behind auth.
+
 ## Managing Subagents
 
 Users can manage subagents using the following commands within the Gemini CLI:
@@ -80,5 +438,20 @@ Users can manage subagents using the following commands within the Gemini CLI:
 - `/agents enable <agent_name>`: Enables a specific subagent.
 - `/agents disable <agent_name>`: Disables a specific subagent.
 
-> **Tip:** You can use the `@cli_help` agent within Gemini CLI for assistance
+<!-- prettier-ignore -->
+> [!TIP]
+> You can use the `@cli_help` agent within Gemini CLI for assistance
 > with configuring subagents.
+
+## Disabling remote agents
+
+Remote subagents are enabled by default. To disable them, set `enableAgents` to
+`false` in your `settings.json`:
+
+```json
+{
+  "experimental": {
+    "enableAgents": false
+  }
+}
+```

docs/core/subagents.md

@@ -1,27 +1,10 @@
-# Subagents (experimental)
+# Subagents
 
 Subagents are specialized agents that operate within your main Gemini CLI
 session. They are designed to handle specific, complex tasks—like deep codebase
 analysis, documentation lookup, or domain-specific reasoning—without cluttering
 the main agent's context or toolset.
 
-> **Note: Subagents are currently an experimental feature.**
->
-> To use custom subagents, you must explicitly enable them in your
-> `settings.json`:
->
-> ```json
-> {
->   "experimental": { "enableAgents": true }
-> }
-> ```
->
-> **Warning:** Subagents currently operate in
-> ["YOLO mode"](../reference/configuration.md#command-line-arguments), meaning
-> they may execute tools without individual user confirmation for each step.
-> Proceed with caution when defining agents with powerful tools like
-> `run_shell_command` or `write_file`.
-
 ## What are subagents?
 
 Subagents are "specialists" that the main Gemini agent can hire for a specific
@@ -38,6 +21,34 @@ main agent calls the tool, it delegates the task to the subagent. Once the
 subagent completes its task, it reports back to the main agent with its
 findings.
 
+## How to use subagents
+
+You can use subagents through automatic delegation or by explicitly forcing them
+in your prompt.
+
+### Automatic delegation
+
+Gemini CLI's main agent is instructed to use specialized subagents when a task
+matches their expertise. For example, if you ask "How does the auth system
+work?", the main agent may decide to call the `codebase_investigator` subagent
+to perform the research.
+
+### Forcing a subagent (@ syntax)
+
+You can explicitly direct a task to a specific subagent by using the `@` symbol
+followed by the subagent's name at the beginning of your prompt. This is useful
+when you want to bypass the main agent's decision-making and go straight to a
+specialist.
+
+**Example:**
+
+```bash
+@codebase_investigator Map out the relationship between the AgentRegistry and the LocalAgentExecutor.
+```
+
+When you use the `@` syntax, the CLI injects a system note that nudges the
+primary model to use that specific subagent tool immediately.
+
 ## Built-in subagents
 
 Gemini CLI comes with the following built-in subagents:
@@ -49,15 +60,17 @@ Gemini CLI comes with the following built-in subagents:
   dependencies.
 - **When to use:** "How does the authentication system work?", "Map out the
   dependencies of the `AgentRegistry` class."
-- **Configuration:** Enabled by default. You can configure it in
-  `settings.json`. Example (forcing a specific model):
+- **Configuration:** Enabled by default. You can override its settings in
+  `settings.json` under `agents.overrides`. Example (forcing a specific model
+  and increasing turns):
   ```json
   {
-    "experimental": {
-      "codebaseInvestigatorSettings": {
-        "enabled": true,
-        "maxNumTurns": 20,
-        "model": "gemini-2.5-pro"
+    "agents": {
+      "overrides": {
+        "codebase_investigator": {
+          "modelConfig": { "model": "gemini-3-flash-preview" },
+          "runConfig": { "maxTurns": 50 }
+        }
       }
     }
   }
@@ -90,16 +103,20 @@ Gemini CLI comes with the following built-in subagents:
   the pricing table from this page," "Click the login button and enter my
   credentials."
 
-> **Note:** This is a preview feature currently under active development.
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is a preview feature currently under active development.
 
 #### Prerequisites
 
 The browser agent requires:
 
-- **Chrome** version 144 or later (any recent stable release will work).
-- **Node.js** with `npx` available (used to launch the
-  [`chrome-devtools-mcp`](https://www.npmjs.com/package/chrome-devtools-mcp)
-  server).
+- **Chrome** version 144 or later (any recent stable release works).
+
+The underlying
+[`chrome-devtools-mcp`](https://www.npmjs.com/package/chrome-devtools-mcp)
+server is bundled with Gemini CLI and launched automatically — no separate
+installation is needed.
 
 #### Enabling the browser agent
 
@@ -145,26 +162,58 @@ The available modes are:
 | `isolated`   | Launches Chrome with a temporary profile that is deleted after each session. Use this for clean-state automation.                                                                           |
 | `existing`   | Attaches to an already-running Chrome instance. You must enable remote debugging first by navigating to `chrome://inspect/#remote-debugging` in Chrome. No new browser process is launched. |
 
+#### First-run consent
+
+The first time the browser agent is invoked, Gemini CLI displays a consent
+dialog. You must accept before the browser session starts. This dialog only
+appears once.
+
 #### Configuration reference
 
 All browser-specific settings go under `agents.browser` in your `settings.json`.
+For full details, see the
+[`agents.browser` configuration reference](../reference/configuration.md#agents).
 
-| Setting       | Type      | Default        | Description                                                                                     |
-| :------------ | :-------- | :------------- | :---------------------------------------------------------------------------------------------- |
-| `sessionMode` | `string`  | `"persistent"` | How Chrome is managed: `"persistent"`, `"isolated"`, or `"existing"`.                           |
-| `headless`    | `boolean` | `false`        | Run Chrome in headless mode (no visible window).                                                |
-| `profilePath` | `string`  | —              | Custom path to a browser profile directory.                                                     |
-| `visualModel` | `string`  | —              | Model override for the visual agent (for example, `"gemini-2.5-computer-use-preview-10-2025"`). |
+| Setting                   | Type       | Default        | Description                                                                     |
+| :------------------------ | :--------- | :------------- | :------------------------------------------------------------------------------ |
+| `sessionMode`             | `string`   | `"persistent"` | How Chrome is managed: `"persistent"`, `"isolated"`, or `"existing"`.           |
+| `headless`                | `boolean`  | `false`        | Run Chrome in headless mode (no visible window).                                |
+| `profilePath`             | `string`   | —              | Custom path to a browser profile directory.                                     |
+| `visualModel`             | `string`   | —              | Model override for the visual agent.                                            |
+| `allowedDomains`          | `string[]` | —              | Restrict navigation to specific domains (for example, `["github.com"]`).        |
+| `disableUserInput`        | `boolean`  | `true`         | Disable user input on the browser window during automation (non-headless only). |
+| `maxActionsPerTask`       | `number`   | `100`          | Maximum tool calls per task. The agent is terminated when the limit is reached. |
+| `confirmSensitiveActions` | `boolean`  | `false`        | Require manual confirmation for `upload_file` and `evaluate_script`.            |
+| `blockFileUploads`        | `boolean`  | `false`        | Hard-block all file upload requests from the agent.                             |
+
+#### Automation overlay and input blocking
+
+In non-headless mode, the browser agent injects a visual overlay into the
+browser window to indicate that automation is in progress. By default, user
+input (keyboard and mouse) is also blocked to prevent accidental interference.
+You can disable this by setting `disableUserInput` to `false`.
 
 #### Security
 
-The browser agent enforces the following security restrictions:
+The browser agent enforces several layers of security:
 
-- **Blocked URL patterns:** `file://`, `javascript:`, `data:text/html`,
-  `chrome://extensions`, and `chrome://settings/passwords` are always blocked.
-- **Sensitive action confirmation:** Actions like form filling, file uploads,
-  and form submissions require user confirmation through the standard policy
-  engine.
+- **Domain restrictions:** When `allowedDomains` is set, the agent can only
+  navigate to the listed domains (and their subdomains when using `*.` prefix).
+  Attempting to visit a disallowed domain throws a fatal error that immediately
+  terminates the agent. The agent also attempts to detect and block the use of
+  allowed domains as proxies (e.g., via query parameters or fragments) to access
+  restricted content.
+- **Blocked URL patterns:** The underlying MCP server blocks dangerous URL
+  schemes including `file://`, `javascript:`, `data:text/html`,
+  `chrome://extensions`, and `chrome://settings/passwords`.
+- **Sensitive action confirmation:** Form filling (`fill`, `fill_form`) always
+  requires user confirmation through the policy engine, regardless of approval
+  mode. When `confirmSensitiveActions` is `true`, `upload_file` and
+  `evaluate_script` also require confirmation.
+- **File upload blocking:** Set `blockFileUploads` to `true` to hard-block all
+  file upload requests, preventing the agent from uploading any files.
+- **Action rate limiting:** The `maxActionsPerTask` setting (default: 100)
+  limits the total number of tool calls per task to prevent runaway execution.
 
 #### Visual agent
 
@@ -193,22 +242,70 @@ captures a screenshot and sends it to the vision model for analysis. The model
 returns coordinates and element descriptions that the browser agent uses with
 the `click_at` tool for precise, coordinate-based interactions.
 
-> **Note:** The visual agent requires API key or Vertex AI authentication. It is
+<!-- prettier-ignore -->
+> [!NOTE]
+> The visual agent requires API key or Vertex AI authentication. It is
 > not available when using "Sign in with Google".
 
+#### Sandbox support
+
+The browser agent adjusts its behavior automatically when running inside a
+sandbox.
+
+##### macOS seatbelt (`sandbox-exec`)
+
+When the CLI runs under the macOS seatbelt sandbox, `persistent` and `isolated`
+session modes are forced to `isolated` with `headless` enabled. This avoids
+permission errors caused by seatbelt file-system restrictions on persistent
+browser profiles. If `sessionMode` is set to `existing`, no override is applied.
+
+##### Container sandboxes (Docker / Podman)
+
+Chrome is not available inside the container, so the browser agent is
+**disabled** unless `sessionMode` is set to `"existing"`. When enabled with
+`existing` mode, the agent automatically connects to Chrome on the host via the
+resolved IP of `host.docker.internal:9222` instead of using local pipe
+discovery. Port `9222` is currently hardcoded and cannot be customized.
+
+To use the browser agent in a Docker sandbox:
+
+1. Start Chrome on the host with remote debugging enabled:
+
+   ```bash
+   # Option A: Launch Chrome from the command line
+   google-chrome --remote-debugging-port=9222
+
+   # Option B: Enable in Chrome settings
+   # Navigate to chrome://inspect/#remote-debugging and enable
+   ```
+
+2. Configure `sessionMode` and allowed domains in your project's
+   `.gemini/settings.json`:
+
+   ```json
+   {
+     "agents": {
+       "overrides": {
+         "browser_agent": { "enabled": true }
+       },
+       "browser": {
+         "sessionMode": "existing",
+         "allowedDomains": ["example.com"]
+       }
+     }
+   }
+   ```
+
+3. Launch the CLI with port forwarding:
+
+   ```bash
+   GEMINI_SANDBOX=docker SANDBOX_PORTS=9222 gemini
+   ```
+
 ## Creating custom subagents
 
 You can create your own subagents to automate specific workflows or enforce
-specific personas. To use custom subagents, you must enable them in your
-`settings.json`:
-
-```json
-{
-  "experimental": {
-    "enableAgents": true
-  }
-}
-```
+specific personas.
 
 ### Agent definition files
 
@@ -233,7 +330,7 @@ kind: local
 tools:
   - read_file
   - grep_search
-model: gemini-2.5-pro
+model: gemini-3-flash-preview
 temperature: 0.2
 max_turns: 10
 ---
@@ -254,16 +351,175 @@ it yourself; just report it.
 
 ### Configuration schema
 
-| Field          | Type   | Required | Description                                                                                                               |
-| :------------- | :----- | :------- | :------------------------------------------------------------------------------------------------------------------------ |
-| `name`         | string | Yes      | Unique identifier (slug) used as the tool name for the agent. Only lowercase letters, numbers, hyphens, and underscores.  |
-| `description`  | string | Yes      | Short description of what the agent does. This is visible to the main agent to help it decide when to call this subagent. |
-| `kind`         | string | No       | `local` (default) or `remote`.                                                                                            |
-| `tools`        | array  | No       | List of tool names this agent can use. If omitted, it may have access to a default set.                                   |
-| `model`        | string | No       | Specific model to use (e.g., `gemini-2.5-pro`). Defaults to `inherit` (uses the main session model).                      |
-| `temperature`  | number | No       | Model temperature (0.0 - 2.0).                                                                                            |
-| `max_turns`    | number | No       | Maximum number of conversation turns allowed for this agent before it must return. Defaults to `15`.                      |
-| `timeout_mins` | number | No       | Maximum execution time in minutes. Defaults to `5`.                                                                       |
+| Field          | Type   | Required | Description                                                                                                                                                                                                   |
+| :------------- | :----- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `name`         | string | Yes      | Unique identifier (slug) used as the tool name for the agent. Only lowercase letters, numbers, hyphens, and underscores.                                                                                      |
+| `description`  | string | Yes      | Short description of what the agent does. This is visible to the main agent to help it decide when to call this subagent.                                                                                     |
+| `kind`         | string | No       | `local` (default) or `remote`.                                                                                                                                                                                |
+| `tools`        | array  | No       | List of tool names this agent can use. Supports wildcards: `*` (all tools), `mcp_*` (all MCP tools), `mcp_server_*` (all tools from a server). **If omitted, it inherits all tools from the parent session.** |
+| `mcpServers`   | object | No       | Configuration for inline Model Context Protocol (MCP) servers isolated to this specific agent.                                                                                                                |
+| `model`        | string | No       | Specific model to use (e.g., `gemini-3-preview`). Defaults to `inherit` (uses the main session model).                                                                                                        |
+| `temperature`  | number | No       | Model temperature (0.0 - 2.0). Defaults to `1`.                                                                                                                                                               |
+| `max_turns`    | number | No       | Maximum number of conversation turns allowed for this agent before it must return. Defaults to `30`.                                                                                                          |
+| `timeout_mins` | number | No       | Maximum execution time in minutes. Defaults to `10`.                                                                                                                                                          |
+
+### Tool wildcards
+
+When defining `tools` for a subagent, you can use wildcards to quickly grant
+access to groups of tools:
+
+- `*`: Grant access to all available built-in and discovered tools.
+- `mcp_*`: Grant access to all tools from all connected MCP servers.
+- `mcp_my-server_*`: Grant access to all tools from a specific MCP server named
+  `my-server`.
+
+### Isolation and recursion protection
+
+Each subagent runs in its own isolated context loop. This means:
+
+- **Independent history:** The subagent's conversation history does not bloat
+  the main agent's context.
+- **Isolated tools:** The subagent only has access to the tools you explicitly
+  grant it.
+- **Recursion protection:** To prevent infinite loops and excessive token usage,
+  subagents **cannot** call other subagents. If a subagent is granted the `*`
+  tool wildcard, it will still be unable to see or invoke other agents.
+
+## Subagent tool isolation
+
+Subagent tool isolation moves Gemini CLI away from a single global tool
+registry. By providing isolated execution environments, you can ensure that
+subagents only interact with the parts of the system they are designed for. This
+prevents unintended side effects, improves reliability by avoiding state
+contamination, and enables fine-grained permission control.
+
+With this feature, you can:
+
+- **Specify tool access:** Define exactly which tools an agent can access using
+  a `tools` list in the agent definition.
+- **Define inline MCP servers:** Configure Model Context Protocol (MCP) servers
+  (which provide a standardized way to connect AI models to external tools and
+  data sources) directly in the subagent's markdown frontmatter, isolating them
+  to that specific agent.
+- **Maintain state isolation:** Ensure that subagents only interact with their
+  own set of tools and servers, preventing side effects and state contamination.
+- **Apply subagent-specific policies:** Enforce granular rules in your
+  [Policy Engine](../reference/policy-engine.md) TOML configuration based on the
+  executing subagent's name.
+
+### Configuring isolated tools and servers
+
+You can configure tool isolation for a subagent by updating its markdown
+frontmatter. This allows you to explicitly state which tools the subagent can
+use, rather than relying on the global registry.
+
+Add an `mcpServers` object to define inline MCP servers that are unique to the
+agent.
+
+**Example:**
+
+```yaml
+---
+name: my-isolated-agent
+tools:
+  - grep_search
+  - read_file
+mcpServers:
+  my-custom-server:
+    command: 'node'
+    args: ['path/to/server.js']
+---
+```
+
+### Subagent-specific policies
+
+You can enforce fine-grained control over subagents using the
+[Policy Engine's](../reference/policy-engine.md) TOML configuration. This allows
+you to grant or restrict permissions specifically for an agent, without
+affecting the rest of your CLI session.
+
+To restrict a policy rule to a specific subagent, add the `subagent` property to
+the `[[rules]]` block in your `policy.toml` file.
+
+**Example:**
+
+```toml
+[[rules]]
+name = "Allow pr-creator to push code"
+subagent = "pr-creator"
+description = "Permit pr-creator to push branches automatically."
+action = "allow"
+toolName = "run_shell_command"
+commandPrefix = "git push"
+```
+
+In this configuration, the policy rule only triggers if the executing subagent's
+name matches `pr-creator`. Rules without the `subagent` property apply
+universally to all agents.
+
+## Managing subagents
+
+You can manage subagents interactively using the `/agents` command or
+persistently via `settings.json`.
+
+### Interactive management (/agents)
+
+If you are in an interactive CLI session, you can use the `/agents` command to
+manage subagents without editing configuration files manually. This is the
+recommended way to quickly enable, disable, or re-configure agents on the fly.
+
+For a full list of sub-commands and usage, see the
+[`/agents` command reference](../reference/commands.md#agents).
+
+### Persistent configuration (settings.json)
+
+While the `/agents` command and agent definition files provide a starting point,
+you can use `settings.json` for global, persistent overrides. This is useful for
+enforcing specific models or execution limits across all sessions.
+
+#### `agents.overrides`
+
+Use this to enable or disable specific agents or override their run
+configurations.
+
+```json
+{
+  "agents": {
+    "overrides": {
+      "security-auditor": {
+        "enabled": false,
+        "runConfig": {
+          "maxTurns": 20,
+          "maxTimeMinutes": 10
+        }
+      }
+    }
+  }
+}
+```
+
+#### `modelConfigs.overrides`
+
+You can target specific subagents with custom model settings (like system
+instruction prefixes or specific safety settings) using the `overrideScope`
+field.
+
+```json
+{
+  "modelConfigs": {
+    "overrides": [
+      {
+        "match": { "overrideScope": "security-auditor" },
+        "modelConfig": {
+          "generateContentConfig": {
+            "temperature": 0.1
+          }
+        }
+      }
+    ]
+  }
+}
+```
 
 ### Optimizing your subagent
 
@@ -290,18 +546,27 @@ If you need to further tune your subagent, you can do so by selecting the model
 to optimize for with `/model` and then asking the model why it does not think
 that your subagent was called with a specific prompt and the given description.
 
-## Remote subagents (Agent2Agent) (experimental)
+## Remote subagents (Agent2Agent)
 
 Gemini CLI can also delegate tasks to remote subagents using the Agent-to-Agent
 (A2A) protocol.
 
-> **Note: Remote subagents are currently an experimental feature.**
-
 See the [Remote Subagents documentation](remote-agents) for detailed
-configuration and usage instructions.
+configuration, authentication, and usage instructions.
 
 ## Extension subagents
 
 Extensions can bundle and distribute subagents. See the
 [Extensions documentation](../extensions/index.md#subagents) for details on how
 to package agents within an extension.
+
+## Disabling subagents
+
+Subagents are enabled by default. To disable them, set `enableAgents` to `false`
+in your `settings.json`:
+
+```json
+{
+  "experimental": { "enableAgents": false }
+}
+```

docs/extensions/reference.md

@@ -23,7 +23,7 @@ Gemini CLI creates a copy of the extension during installation. You must run
 GitHub, you must have `git` installed on your machine.
 
 ```bash
-gemini extensions install <source> [--ref <ref>] [--auto-update] [--pre-release] [--consent]
+gemini extensions install <source> [--ref <ref>] [--auto-update] [--pre-release] [--consent] [--skip-settings]
 ```
 
 - `<source>`: The GitHub URL or local path of the extension.
@@ -31,6 +31,7 @@ gemini extensions install <source> [--ref <ref>] [--auto-update] [--pre-release]
 - `--auto-update`: Enable automatic updates for this extension.
 - `--pre-release`: Enable installation of pre-release versions.
 - `--consent`: Acknowledge security risks and skip the confirmation prompt.
+- `--skip-settings`: Skip the configuration on install process.
 
 ### Uninstall an extension
 
@@ -234,7 +235,9 @@ skill definitions in a `skills/` directory. For example,
 
 ### Sub-agents
 
-> **Note:** Sub-agents are a preview feature currently under active development.
+<!-- prettier-ignore -->
+> [!NOTE]
+> Sub-agents are a preview feature currently under active development.
 
 Provide [sub-agents](../core/subagents.md) that users can delegate tasks to. Add
 agent definition files (`.md`) to an `agents/` directory in your extension root.
@@ -253,7 +256,9 @@ Rules contributed by extensions run in their own tier (tier 2), alongside
 workspace-defined policies. This tier has higher priority than the default rules
 but lower priority than user or admin policies.
 
-> **Warning:** For security, Gemini CLI ignores any `allow` decisions or `yolo`
+<!-- prettier-ignore -->
+> [!WARNING]
+> For security, Gemini CLI ignores any `allow` decisions or `yolo`
 > mode configurations in extension policies. This ensures that an extension
 > cannot automatically approve tool calls or bypass security measures without
 > your confirmation.

docs/get-started/authentication.md

@@ -4,7 +4,9 @@ To use Gemini CLI, you'll need to authenticate with Google. This guide helps you
 quickly find the best way to sign in based on your account type and how you're
 using the CLI.
 
-> **Note:** Looking for a high-level comparison of all available subscriptions?
+<!-- prettier-ignore -->
+> [!TIP]
+> Looking for a high-level comparison of all available subscriptions?
 > To compare features and find the right quota for your needs, see our
 > [Plans page](https://geminicli.com/plans/).
 
@@ -40,11 +42,11 @@ Select the authentication method that matches your situation in the table below:
 
 If you run Gemini CLI on your local machine, the simplest authentication method
 is logging in with your Google account. This method requires a web browser on a
-machine that can communicate with the terminal running Gemini CLI (e.g., your
-local machine).
+machine that can communicate with the terminal running Gemini CLI (for example,
+your local machine).
 
-> **Important:** If you are a **Google AI Pro** or **Google AI Ultra**
-> subscriber, use the Google account associated with your subscription.
+If you are a **Google AI Pro** or **Google AI Ultra** subscriber, use the Google
+account associated with your subscription.
 
 To authenticate and use Gemini CLI:
 
@@ -107,7 +109,9 @@ To authenticate and use Gemini CLI with a Gemini API key:
 
 4. Select **Use Gemini API key**.
 
-> **Warning:** Treat API keys, especially for services like Gemini, as sensitive
+<!-- prettier-ignore -->
+> [!WARNING]
+> Treat API keys, especially for services like Gemini, as sensitive
 > credentials. Protect them to prevent unauthorized access and potential misuse
 > of the service under your account.
 
@@ -130,7 +134,7 @@ For example:
 **macOS/Linux**
 
 ```bash
-# Replace with your project ID and desired location (e.g., us-central1)
+# Replace with your project ID and desired location (for example, us-central1)
 export GOOGLE_CLOUD_PROJECT="YOUR_PROJECT_ID"
 export GOOGLE_CLOUD_LOCATION="YOUR_PROJECT_LOCATION"
 ```
@@ -138,7 +142,7 @@ export GOOGLE_CLOUD_LOCATION="YOUR_PROJECT_LOCATION"
 **Windows (PowerShell)**
 
 ```powershell
-# Replace with your project ID and desired location (e.g., us-central1)
+# Replace with your project ID and desired location (for example, us-central1)
 $env:GOOGLE_CLOUD_PROJECT="YOUR_PROJECT_ID"
 $env:GOOGLE_CLOUD_LOCATION="YOUR_PROJECT_LOCATION"
 ```
@@ -150,20 +154,20 @@ To make any Vertex AI environment variable settings persistent, see
 
 Consider this authentication method if you have Google Cloud CLI installed.
 
-> **Note:** If you have previously set `GOOGLE_API_KEY` or `GEMINI_API_KEY`, you
-> must unset them to use ADC:
->
-> **macOS/Linux**
->
-> ```bash
-> unset GOOGLE_API_KEY GEMINI_API_KEY
-> ```
->
-> **Windows (PowerShell)**
->
-> ```powershell
-> Remove-Item Env:\GOOGLE_API_KEY, Env:\GEMINI_API_KEY -ErrorAction Ignore
-> ```
+If you have previously set `GOOGLE_API_KEY` or `GEMINI_API_KEY`, you must unset
+them to use ADC.
+
+**macOS/Linux**
+
+```bash
+unset GOOGLE_API_KEY GEMINI_API_KEY
+```
+
+**Windows (PowerShell)**
+
+```powershell
+Remove-Item Env:\GOOGLE_API_KEY, Env:\GEMINI_API_KEY -ErrorAction Ignore
+```
 
 1. Verify you have a Google Cloud project and Vertex AI API is enabled.
 
@@ -188,20 +192,20 @@ Consider this authentication method if you have Google Cloud CLI installed.
 Consider this method of authentication in non-interactive environments, CI/CD
 pipelines, or if your organization restricts user-based ADC or API key creation.
 
-> **Note:** If you have previously set `GOOGLE_API_KEY` or `GEMINI_API_KEY`, you
-> must unset them:
->
-> **macOS/Linux**
->
-> ```bash
-> unset GOOGLE_API_KEY GEMINI_API_KEY
-> ```
->
-> **Windows (PowerShell)**
->
-> ```powershell
-> Remove-Item Env:\GOOGLE_API_KEY, Env:\GEMINI_API_KEY -ErrorAction Ignore
-> ```
+If you have previously set `GOOGLE_API_KEY` or `GEMINI_API_KEY`, you must unset
+them:
+
+**macOS/Linux**
+
+```bash
+unset GOOGLE_API_KEY GEMINI_API_KEY
+```
+
+**Windows (PowerShell)**
+
+```powershell
+Remove-Item Env:\GOOGLE_API_KEY, Env:\GEMINI_API_KEY -ErrorAction Ignore
+```
 
 1.  [Create a service account and key](https://cloud.google.com/iam/docs/keys-create-delete)
     and download the provided JSON file. Assign the "Vertex AI User" role to the
@@ -233,8 +237,11 @@ pipelines, or if your organization restricts user-based ADC or API key creation.
     ```
 
 5.  Select **Vertex AI**.
-    > **Warning:** Protect your service account key file as it gives access to
-    > your resources.
+
+<!-- prettier-ignore -->
+> [!WARNING]
+> Protect your service account key file as it gives access to
+> your resources.
 
 #### C. Vertex AI - Google Cloud API key
 
@@ -257,10 +264,9 @@ pipelines, or if your organization restricts user-based ADC or API key creation.
     $env:GOOGLE_API_KEY="YOUR_GOOGLE_API_KEY"
     ```
 
-    > **Note:** If you see errors like
-    > `"API keys are not supported by this API..."`, your organization might
-    > restrict API key usage for this service. Try the other Vertex AI
-    > authentication methods instead.
+    If you see errors like `"API keys are not supported by this API..."`, your
+    organization might restrict API key usage for this service. Try the other
+    Vertex AI authentication methods instead.
 
 3.  [Configure your Google Cloud Project](#set-gcp).
 
@@ -274,7 +280,9 @@ pipelines, or if your organization restricts user-based ADC or API key creation.
 
 ## Set your Google Cloud project <a id="set-gcp"></a>
 
-> **Important:** Most individual Google accounts (free and paid) don't require a
+<!-- prettier-ignore -->
+> [!IMPORTANT]
+> Most individual Google accounts (free and paid) don't require a
 > Google Cloud project for authentication.
 
 When you sign in using your Google account, you may need to configure a Google
@@ -325,29 +333,31 @@ persist them with the following methods:
 1.  **Add your environment variables to your shell configuration file:** Append
     the environment variable commands to your shell's startup file.
 
-    **macOS/Linux** (e.g., `~/.bashrc`, `~/.zshrc`, or `~/.profile`):
+    **macOS/Linux** (for example, `~/.bashrc`, `~/.zshrc`, or `~/.profile`):
 
     ```bash
     echo 'export GOOGLE_CLOUD_PROJECT="YOUR_PROJECT_ID"' >> ~/.bashrc
     source ~/.bashrc
     ```
 
-    **Windows (PowerShell)** (e.g., `$PROFILE`):
+    **Windows (PowerShell)** (for example, `$PROFILE`):
 
     ```powershell
     Add-Content -Path $PROFILE -Value '$env:GOOGLE_CLOUD_PROJECT="YOUR_PROJECT_ID"'
     . $PROFILE
     ```
 
-    > **Warning:** Be aware that when you export API keys or service account
-    > paths in your shell configuration file, any process launched from that
-    > shell can read them.
+<!-- prettier-ignore -->
+> [!WARNING]
+> Be aware that when you export API keys or service account
+> paths in your shell configuration file, any process launched from that
+> shell can read them.
 
 2.  **Use a `.env` file:** Create a `.gemini/.env` file in your project
     directory or home directory. Gemini CLI automatically loads variables from
     the first `.env` file it finds, searching up from the current directory,
-    then in your home directory's `.gemini/.env` (e.g., `~/.gemini/.env` or
-    `%USERPROFILE%\.gemini\.env`).
+    then in your home directory's `.gemini/.env` (for example, `~/.gemini/.env`
+    or `%USERPROFILE%\.gemini\.env`).
 
     Example for user-wide settings:
 
@@ -388,8 +398,8 @@ on this page.
 
 ## Running in headless mode <a id="headless"></a>
 
-[Headless mode](../cli/headless) will use your existing authentication method,
-if an existing authentication credential is cached.
+[Headless mode](../cli/headless.md) will use your existing authentication
+method, if an existing authentication credential is cached.
 
 If you have not already signed in with an authentication credential, you must
 configure authentication using environment variables:

docs/get-started/examples.md

@@ -1,139 +0,0 @@
-# Gemini CLI examples
-
-Gemini CLI helps you automate common engineering tasks by combining AI reasoning
-with local system tools. This document provides examples of how to use the CLI
-for file management, code analysis, and data transformation.
-
-> **Note:** These examples demonstrate potential capabilities. Your actual
-> results can vary based on the model used and your project environment.
-
-## Rename your photographs based on content
-
-You can use Gemini CLI to automate file management tasks that require visual
-analysis. In this example, Gemini CLI renames images based on their actual
-subject matter.
-
-Scenario: You have a folder containing the following files:
-
-```bash
-photos/photo1.png
-photos/photo2.png
-photos/photo3.png
-```
-
-Give Gemini the following prompt:
-
-```cli
-Rename the photos in my "photos" directory based on their contents.
-```
-
-Result: Gemini asks for permission to rename your files.
-
-Select **Allow once** and your files are renamed:
-
-```bash
-photos/yellow_flowers.png
-photos/antique_dresser.png
-photos/green_android_robot.png
-```
-
-## Explain a repository by reading its code
-
-Gemini CLI is effective for rapid codebase exploration. The following example
-shows how to ask Gemini CLI to fetch, analyze, and summarize a remote project.
-
-Scenario: You want to understand how a popular open-source utility works by
-inspecting its code, not just its README.
-
-Give Gemini CLI the following prompt:
-
-```cli
-Clone the 'chalk' repository from https://github.com/chalk/chalk, read its key source files, and explain how it works.
-```
-
-Result: Gemini performs a sequence of actions to answer your request.
-
-1.  First, it asks for permission to run `git clone` to download the repository.
-2.  Next, it finds the important source files and asks for permission to read
-    them.
-3.  Finally, after analyzing the code, it provides a summary.
-
-Gemini CLI returns an explanation based on the actual source code:
-
-```markdown
-The `chalk` library is a popular npm package for styling terminal output with
-colors. After analyzing the source code, here's how it works:
-
-- **Core functionality:** The main file sets up a chainable API. Each color or
-  modifier (like `bold` or `italic`) is a getter that appends the corresponding
-  ANSI escape code to an internal stack.
-
-- **Chainable API:** When you call `chalk.red.bold('Hello')`, you are accessing
-  getters. The `red` getter adds the red color code, and the `bold` getter adds
-  the bold code.
-
-- **Output generation:** When the chain is treated as a string (e.g., in
-  `console.log`), a final `toString()` method is called. This method joins all
-  the stored ANSI codes, wraps them around the input string ('Hello'), and adds
-  a reset code at the end. This produces the final, styled string that the
-  terminal can render.
-```
-
-## Combine two spreadsheets into one spreadsheet
-
-Gemini CLI can process and transform data across multiple files. Use this
-capability to merge reports or reformat data sets without manual copying.
-
-Scenario: You have two .csv files: `Revenue - 2023.csv` and
-`Revenue - 2024.csv`. Each file contains monthly revenue figures.
-
-Give Gemini CLI the following prompt:
-
-```cli
-Combine the two .csv files into a single .csv file, with each year a different column.
-```
-
-Result: Gemini CLI reads each file and then asks for permission to write a new
-file. Provide your permission and Gemini CLI provides the combined data:
-
-```csv
-Month,2023,2024
-January,0,1000
-February,0,1200
-March,0,2400
-April,900,500
-May,1000,800
-June,1000,900
-July,1200,1000
-August,1800,400
-September,2000,2000
-October,2400,3400
-November,3400,1800
-December,2100,9000
-```
-
-## Run unit tests
-
-Gemini CLI can generate boilerplate code and tests based on your existing
-implementation. This example demonstrates how to request code coverage for a
-JavaScript component.
-
-Scenario: You've written a simple login page. You wish to write unit tests to
-ensure that your login page has code coverage.
-
-Give Gemini CLI the following prompt:
-
-```cli
-Write unit tests for Login.js.
-```
-
-Result: Gemini CLI asks for permission to write a new file and creates a test
-for your login page.
-
-## Next steps
-
-- Follow the [File management](../cli/tutorials/file-management.md) guide to
-  start working with your codebase.
-- Follow the [Quickstart](./index.md) to start your first session.
-- See the [Cheatsheet](../cli/cli-reference.md) for a quick reference of
-  available commands.

docs/get-started/gemini-3.md

@@ -1,8 +1,10 @@
 # Gemini 3 Pro and Gemini 3 Flash on Gemini CLI
 
-Gemini 3 Pro and Gemini 3 Flash are available on Gemini CLI for all users!
+Learn about how you can use Gemini 3 Pro and Gemini 3 Flash on Gemini CLI.
 
-> **Note:** Gemini 3.1 Pro Preview is rolling out. To determine whether you have
+<!-- prettier-ignore -->
+> [!NOTE]
+> Gemini 3.1 Pro Preview is rolling out. To determine whether you have
 > access to Gemini 3.1, use the `/model` command and select **Manual**. If you
 > have access, you will see `gemini-3.1-pro-preview`.
 >
@@ -25,7 +27,7 @@ Get started by upgrading Gemini CLI to the latest version:
 npm install -g @google/gemini-cli@latest
 ```
 
-After you’ve confirmed your version is 0.21.1 or later:
+If your version is 0.21.1 or later:
 
 1. Run `/model`.
 2. Select **Auto (Gemini 3)**.
@@ -39,7 +41,9 @@ When you encounter that limit, you’ll be given the option to switch to Gemini
 2.5 Pro, upgrade for higher limits, or stop. You’ll also be told when your usage
 limit resets and Gemini 3 Pro can be used again.
 
-> **Note:** Looking to upgrade for higher limits? To compare subscription
+<!-- prettier-ignore -->
+> [!TIP]
+> Looking to upgrade for higher limits? To compare subscription
 > options and find the right quota for your needs, see our
 > [Plans page](https://geminicli.com/plans/).
 
@@ -52,7 +56,9 @@ There may be times when the Gemini 3 Pro model is overloaded. When that happens,
 Gemini CLI will ask you to decide whether you want to keep trying Gemini 3 Pro
 or fallback to Gemini 2.5 Pro.
 
-> **Note:** The **Keep trying** option uses exponential backoff, in which Gemini
+<!-- prettier-ignore -->
+> [!NOTE]
+> The **Keep trying** option uses exponential backoff, in which Gemini
 > CLI waits longer between each retry, when the system is busy. If the retry
 > doesn't happen immediately, please wait a few minutes for the request to
 > process.
@@ -109,7 +115,7 @@ then:
 
 Restart Gemini CLI and you should have access to Gemini 3.
 
-## Need help?
+## Next steps
 
 If you need help, we recommend searching for an existing
 [GitHub issue](https://github.com/google-gemini/gemini-cli/issues). If you

docs/get-started/index.md

@@ -62,7 +62,133 @@ Once installed and authenticated, you can start using Gemini CLI by issuing
 commands and prompts in your terminal. Ask it to generate code, explain files,
 and more.
 
-To explore the power of Gemini CLI, see [Gemini CLI examples](./examples.md).
+<!-- prettier-ignore -->
+> [!NOTE]
+> These examples demonstrate potential capabilities. Your actual
+> results can vary based on the model used and your project environment.
+
+### Rename your photographs based on content
+
+You can use Gemini CLI to automate file management tasks that require visual
+analysis. In this example, Gemini CLI renames images based on their actual
+subject matter.
+
+Scenario: You have a folder containing the following files:
+
+```bash
+photos/photo1.png
+photos/photo2.png
+photos/photo3.png
+```
+
+Give Gemini the following prompt:
+
+```cli
+Rename the photos in my "photos" directory based on their contents.
+```
+
+Result: Gemini asks for permission to rename your files.
+
+Select **Allow once** and your files are renamed:
+
+```bash
+photos/yellow_flowers.png
+photos/antique_dresser.png
+photos/green_android_robot.png
+```
+
+### Explain a repository by reading its code
+
+Gemini CLI is effective for rapid codebase exploration. The following example
+shows how to ask Gemini CLI to fetch, analyze, and summarize a remote project.
+
+Scenario: You want to understand how a popular open-source utility works by
+inspecting its code, not just its README.
+
+Give Gemini CLI the following prompt:
+
+```cli
+Clone the 'chalk' repository from https://github.com/chalk/chalk, read its key source files, and explain how it works.
+```
+
+Result: Gemini performs a sequence of actions to answer your request.
+
+1.  First, it asks for permission to run `git clone` to download the repository.
+2.  Next, it finds the important source files and asks for permission to read
+    them.
+3.  Finally, after analyzing the code, it provides a summary.
+
+Gemini CLI returns an explanation based on the actual source code:
+
+```markdown
+The `chalk` library is a popular npm package for styling terminal output with
+colors. After analyzing the source code, here's how it works:
+
+- **Core functionality:** The main file sets up a chainable API. Each color or
+  modifier (like `bold` or `italic`) is a getter that appends the corresponding
+  ANSI escape code to an internal stack.
+
+- **Chainable API:** When you call `chalk.red.bold('Hello')`, you are accessing
+  getters. The `red` getter adds the red color code, and the `bold` getter adds
+  the bold code.
+
+- **Output generation:** When the chain is treated as a string (e.g., in
+  `console.log`), a final `toString()` method is called. This method joins all
+  the stored ANSI codes, wraps them around the input string ('Hello'), and adds
+  a reset code at the end. This produces the final, styled string that the
+  terminal can render.
+```
+
+### Combine two spreadsheets into one spreadsheet
+
+Gemini CLI can process and transform data across multiple files. Use this
+capability to merge reports or reformat data sets without manual copying.
+
+Scenario: You have two .csv files: `Revenue - 2023.csv` and
+`Revenue - 2024.csv`. Each file contains monthly revenue figures.
+
+Give Gemini CLI the following prompt:
+
+```cli
+Combine the two .csv files into a single .csv file, with each year a different column.
+```
+
+Result: Gemini CLI reads each file and then asks for permission to write a new
+file. Provide your permission and Gemini CLI provides the combined data:
+
+```csv
+Month,2023,2024
+January,0,1000
+February,0,1200
+March,0,2400
+April,900,500
+May,1000,800
+June,1000,900
+July,1200,1000
+August,1800,400
+September,2000,2000
+October,2400,3400
+November,3400,1800
+December,2100,9000
+```
+
+### Run unit tests
+
+Gemini CLI can generate boilerplate code and tests based on your existing
+implementation. This example demonstrates how to request code coverage for a
+JavaScript component.
+
+Scenario: You've written a simple login page. You wish to write unit tests to
+ensure that your login page has code coverage.
+
+Give Gemini CLI the following prompt:
+
+```cli
+Write unit tests for Login.js.
+```
+
+Result: Gemini CLI asks for permission to write a new file and creates a test
+for your login page.
 
 ## Check usage and quota
 

docs/get-started/installation.md

@@ -122,6 +122,13 @@ code.
   # From the root of the repository
   npm run start
   ```
+- **Production mode (React optimizations):** This method runs the CLI with React
+  production mode enabled, which is useful for testing performance without
+  development overhead.
+  ```bash
+  # From the root of the repository
+  npm run start:prod
+  ```
 - **Production-like mode (linked package):** This method simulates a global
   installation by linking your local package. It's useful for testing a local
   build in a production workflow.

docs/hooks/index.md

@@ -22,11 +22,11 @@ With hooks, you can:
 
 ### Getting started
 
-- **[Writing hooks guide](../hooks/writing-hooks)**: A tutorial on creating your
-  first hook with comprehensive examples.
-- **[Best practices](../hooks/best-practices)**: Guidelines on security,
+- **[Writing hooks guide](../hooks/writing-hooks.md)**: A tutorial on creating
+  your first hook with comprehensive examples.
+- **[Best practices](../hooks/best-practices.md)**: Guidelines on security,
   performance, and debugging.
-- **[Hooks reference](../hooks/reference)**: The definitive technical
+- **[Hooks reference](../hooks/reference.md)**: The definitive technical
   specification of I/O schemas and exit codes.
 
 ## Core concepts
@@ -143,7 +143,9 @@ Hooks are executed with a sanitized environment.
 
 ## Security and risks
 
-> **Warning: Hooks execute arbitrary code with your user privileges.** By
+<!-- prettier-ignore -->
+> [!WARNING]
+> Hooks execute arbitrary code with your user privileges. By
 > configuring hooks, you are allowing scripts to run shell commands on your
 > machine.
 
@@ -152,8 +154,8 @@ Gemini CLI **fingerprints** project hooks. If a hook's name or command changes
 (e.g., via `git pull`), it is treated as a **new, untrusted hook** and you will
 be warned before it executes.
 
-See [Security Considerations](../hooks/best-practices#using-hooks-securely) for
-a detailed threat model.
+See [Security Considerations](../hooks/best-practices.md#using-hooks-securely)
+for a detailed threat model.
 
 ## Managing hooks
 

docs/hooks/writing-hooks.md

@@ -470,5 +470,5 @@ console.error('Consolidating memories for session end...');
 
 While project-level hooks are great for specific repositories, you can share
 your hooks across multiple projects by packaging them as a
-[Gemini CLI extension](https://www.google.com/search?q=../extensions/index.md).
-This provides version control, easy distribution, and centralized management.
+[Gemini CLI extension](../extensions/index.md). This provides version control,
+easy distribution, and centralized management.

docs/ide-integration/ide-companion-spec.md

@@ -132,9 +132,11 @@ to the CLI whenever the user's context changes.
   }
   ```
 
-  **Note:** The `openFiles` list should only include files that exist on disk.
-  Virtual files (e.g., unsaved files without a path, editor settings pages)
-  **MUST** be excluded.
+<!-- prettier-ignore -->
+> [!NOTE]
+> The `openFiles` list should only include files that exist on disk.
+> Virtual files (e.g., unsaved files without a path, editor settings pages)
+> **MUST** be excluded.
 
 ### How the CLI uses this context
 

docs/ide-integration/index.md

@@ -1,15 +1,29 @@
-# IDE integration
+# IDE Integration
 
 Gemini CLI can integrate with your IDE to provide a more seamless and
 context-aware experience. This integration allows the CLI to understand your
 workspace better and enables powerful features like native in-editor diffing.
 
-Currently, the supported IDEs are [Antigravity](https://antigravity.google),
-[Visual Studio Code](https://code.visualstudio.com/), and other editors that
-support VS Code extensions. To build support for other editors, see the
-[IDE Companion Extension Spec](./ide-companion-spec.md).
+There are two primary ways to integrate Gemini CLI with an IDE:
 
-## Features
+1.  **VS Code companion extension**: Install the "Gemini CLI Companion"
+    extension on [Antigravity](https://antigravity.google),
+    [Visual Studio Code](https://code.visualstudio.com/), or other VS Code
+    compatible editors.
+2.  **Agent Client Protocol (ACP)**: An open protocol for interoperability
+    between AI coding agents and IDEs. This method is used for integrations with
+    tools like JetBrains and Zed, which leverage the ACP Agent Registry for easy
+    discovery and installation of compatible agents like Gemini CLI.
+
+## VS Code companion extension
+
+The **Gemini CLI Companion extension** grants Gemini CLI direct access to your
+VS Code compatible IDEs and improves your experience by providing real-time
+context such as open files, cursor positions, and text selection. The extension
+also enables a native diffing interface so you can seamlessly review and apply
+AI-generated code changes directly within your editor.
+
+### Features
 
 - **Workspace context:** The CLI automatically gains awareness of your workspace
   to provide more relevant and accurate responses. This context includes:
@@ -19,8 +33,8 @@ support VS Code extensions. To build support for other editors, see the
     truncated).
 
 - **Native diffing:** When Gemini suggests code modifications, you can view the
-  changes directly within your IDE's native diff viewer. This allows you to
-  review, edit, and accept or reject the suggested changes seamlessly.
+  changes directly within your IDE's native diff viewer. This lets you review,
+  edit, and accept or reject the suggested changes seamlessly.
 
 - **VS Code commands:** You can access Gemini CLI features directly from the VS
   Code Command Palette (`Cmd+Shift+P` or `Ctrl+Shift+P`):
@@ -32,18 +46,18 @@ support VS Code extensions. To build support for other editors, see the
   - `Gemini CLI: View Third-Party Notices`: Displays the third-party notices for
     the extension.
 
-## Installation and setup
+### Installation and setup
 
 There are three ways to set up the IDE integration:
 
-### 1. Automatic nudge (recommended)
+#### 1. Automatic nudge (recommended)
 
 When you run Gemini CLI inside a supported editor, it will automatically detect
 your environment and prompt you to connect. Answering "Yes" will automatically
 run the necessary setup, which includes installing the companion extension and
 enabling the connection.
 
-### 2. Manual installation from CLI
+#### 2. Manual installation from CLI
 
 If you previously dismissed the prompt or want to install the extension
 manually, you can run the following command inside Gemini CLI:
@@ -54,7 +68,7 @@ manually, you can run the following command inside Gemini CLI:
 
 This will find the correct extension for your IDE and install it.
 
-### 3. Manual installation from a marketplace
+#### 3. Manual installation from a marketplace
 
 You can also install the extension directly from a marketplace.
 
@@ -66,16 +80,18 @@ You can also install the extension directly from a marketplace.
   Follow your editor's instructions for installing extensions from this
   registry.
 
-> NOTE: The "Gemini CLI Companion" extension may appear towards the bottom of
-> search results. If you don't see it immediately, try scrolling down or sorting
-> by "Newly Published".
+<!-- prettier-ignore -->
+> [!NOTE]
+> The "Gemini CLI Companion" extension may appear towards the bottom of
+> search results. If you don't see it immediately, try scrolling down or
+> sorting by "Newly Published".
 >
 > After manually installing the extension, you must run `/ide enable` in the CLI
 > to activate the integration.
 
-## Usage
+### Usage
 
-### Enabling and disabling
+#### Enabling and disabling
 
 You can control the IDE integration from within the CLI:
 
@@ -91,7 +107,7 @@ You can control the IDE integration from within the CLI:
 When enabled, Gemini CLI will automatically attempt to connect to the IDE
 companion extension.
 
-### Checking the status
+#### Checking the status
 
 To check the connection status and see the context the CLI has received from the
 IDE, run:
@@ -103,10 +119,12 @@ IDE, run:
 If connected, this command will show the IDE it's connected to and a list of
 recently opened files it is aware of.
 
-> [!NOTE] The file list is limited to 10 recently accessed files within your
-> workspace and only includes local files on disk.)
+<!-- prettier-ignore -->
+> [!NOTE]
+> The file list is limited to 10 recently accessed files within your
+> workspace and only includes local files on disk.
 
-### Working with diffs
+#### Working with diffs
 
 When you ask Gemini to modify a file, it can open a diff view directly in your
 editor.
@@ -131,6 +149,63 @@ accepting them.
 If you select ‘Allow for this session’ in the CLI, changes will no longer show
 up in the IDE as they will be auto-accepted.
 
+## Agent Client Protocol (ACP)
+
+ACP is an open protocol that standardizes how AI coding agents communicate with
+code editors and IDEs. It addresses the challenge of fragmented distribution,
+where agents traditionally needed custom integrations for each client. With ACP,
+developers can implement their agent once, and it becomes compatible with any
+ACP-compliant editor.
+
+For a comprehensive introduction to ACP, including its architecture and
+benefits, refer to the official
+[ACP Introduction](https://agentclientprotocol.com/get-started/introduction)
+documentation.
+
+### The ACP Agent Registry
+
+Gemini CLI is officially available in the **ACP Agent Registry**. This allows
+you to install and update Gemini CLI directly within supporting IDEs and
+eliminates the need for manual downloads or IDE-specific extensions.
+
+Using the registry ensures:
+
+- **Ease of use**: Discover and install agents directly within your IDE
+  settings.
+- **Latest versions**: Ensures users always have access to the most up-to-date
+  agent implementations.
+
+For more details on how the registry works, visit the official
+[ACP Agent Registry](https://agentclientprotocol.com/get-started/registry) page.
+You can learn about how specific IDEs leverage this integration in the following
+section.
+
+### IDE-specific integration
+
+Gemini CLI is an ACP-compatible agent available in the ACP Agent Registry.
+Here’s how different IDEs leverage the ACP and the registry:
+
+#### JetBrains IDEs
+
+JetBrains IDEs (like IntelliJ IDEA, PyCharm, or GoLand) offer built-in registry
+support, allowing users to find and install ACP-compatible agents directly.
+
+For more details, refer to the official
+[JetBrains AI Blog announcement](https://blog.jetbrains.com/ai/2026/01/acp-agent-registry/).
+
+#### Zed
+
+Zed, a modern code editor, also integrates with the ACP Agent Registry. This
+allows Zed users to easily browse, install, and manage ACP agents.
+
+Learn more about Zed's integration with the ACP Registry in their
+[blog post](https://zed.dev/blog/acp-registry).
+
+#### Other ACP-compatible IDEs
+
+Any other IDE that supports the ACP Agent Registry can install Gemini CLI
+directly through their in-built registry features.
+
 ## Using with sandboxing
 
 If you are using Gemini CLI within a sandbox, please be aware of the following:
@@ -147,10 +222,9 @@ If you are using Gemini CLI within a sandbox, please be aware of the following:
 
 ## Troubleshooting
 
-If you encounter issues with IDE integration, here are some common error
-messages and how to resolve them.
+### VS Code companion extension errors
 
-### Connection errors
+#### Connection errors
 
 - **Message:**
   `🔴 Disconnected: Failed to connect to IDE companion extension in [IDE Name]. Please ensure the extension is running. To install the extension, run /ide install.`
@@ -170,7 +244,7 @@ messages and how to resolve them.
   - **Solution:** Run `/ide enable` to try and reconnect. If the issue
     continues, open a new terminal window or restart your IDE.
 
-### Manual PID override
+#### Manual PID override
 
 If automatic IDE detection fails, or if you are running Gemini CLI in a
 standalone terminal and want to manually associate it with a specific IDE
@@ -192,7 +266,7 @@ $env:GEMINI_CLI_IDE_PID=12345
 When this variable is set, Gemini CLI will skip automatic detection and attempt
 to connect using the provided PID.
 
-### Configuration errors
+#### Configuration errors
 
 - **Message:**
   `🔴 Disconnected: Directory mismatch. Gemini CLI is running in a different location than the open workspace in [IDE Name]. Please run the CLI from one of the following directories: [List of directories]`
@@ -206,7 +280,7 @@ to connect using the provided PID.
   - **Cause:** You have no workspace open in your IDE.
   - **Solution:** Open a workspace in your IDE and restart the CLI.
 
-### General errors
+#### General errors
 
 - **Message:**
   `IDE integration is not supported in your current environment. To use this feature, run Gemini CLI in one of these supported IDEs: [List of IDEs]`
@@ -216,9 +290,14 @@ to connect using the provided PID.
     IDE, like Antigravity or VS Code.
 
 - **Message:**
-  `No installer is available for IDE. Please install the Gemini CLI Companion extension manually from the marketplace.`
+  `No installer is available for IDE. Please install Gemini CLI Companion extension manually from the marketplace.`
   - **Cause:** You ran `/ide install`, but the CLI does not have an automated
     installer for your specific IDE.
   - **Solution:** Open your IDE's extension marketplace, search for "Gemini CLI
     Companion", and
     [install it manually](#3-manual-installation-from-a-marketplace).
+
+### ACP integration errors
+
+For issues related to ACP integration, please refer to the debugging and
+telemetry section in the [ACP Mode](../cli/acp-mode.md) documentation.

docs/index.md

@@ -19,8 +19,6 @@ Jump in to Gemini CLI.
   on your system.
 - **[Authentication](./get-started/authentication.md):** Setup instructions for
   personal and enterprise accounts.
-- **[Examples](./get-started/examples.md):** Practical examples of Gemini CLI in
-  action.
 - **[CLI cheatsheet](./cli/cli-reference.md):** A quick reference for common
   commands and options.
 - **[Gemini 3 on Gemini CLI](./get-started/gemini-3.md):** Learn about Gemini 3

docs/issue-and-pr-automation.md

@@ -14,7 +14,9 @@ feature), while the PR is the "how" (the implementation). This separation helps
 us track work, prioritize features, and maintain clear historical context. Our
 automation is built around this principle.
 
-> **Note:** Issues tagged as "🔒Maintainers only" are reserved for project
+<!-- prettier-ignore -->
+> [!NOTE]
+> Issues tagged as "🔒Maintainers only" are reserved for project
 > maintainers. We will not accept pull requests related to these issues.
 
 ---

docs/local-development.md

@@ -79,7 +79,9 @@ You can view traces in the Jaeger UI for local development.
 You can use an OpenTelemetry collector to forward telemetry data to Google Cloud
 Trace for custom processing or routing.
 
-> **Warning:** Ensure you complete the
+<!-- prettier-ignore -->
+> [!WARNING]
+> Ensure you complete the
 > [Google Cloud telemetry prerequisites](./cli/telemetry.md#prerequisites)
 > (Project ID, authentication, IAM roles, and APIs) before using this method.
 

docs/redirects.json

@@ -13,6 +13,7 @@
   "/docs/faq": "/docs/resources/faq",
   "/docs/get-started/configuration": "/docs/reference/configuration",
   "/docs/get-started/configuration-v1": "/docs/reference/configuration",
+  "/docs/get-started/examples": "/docs/get-started/index",
   "/docs/index": "/docs",
   "/docs/quota-and-pricing": "/docs/resources/quota-and-pricing",
   "/docs/tos-privacy": "/docs/resources/tos-privacy",

docs/reference/commands.md

@@ -14,6 +14,29 @@ Slash commands provide meta-level control over the CLI itself.
 
 - **Description:** Show version info. Share this information when filing issues.
 
+### `/agents`
+
+- **Description:** Manage local and remote subagents.
+- **Sub-commands:**
+  - **`list`**:
+    - **Description:** Lists all discovered agents, including built-in, local,
+      and remote agents.
+    - **Usage:** `/agents list`
+  - **`reload`** (alias: `refresh`):
+    - **Description:** Rescans agent directories (`~/.gemini/agents` and
+      `.gemini/agents`) and reloads the registry.
+    - **Usage:** `/agents reload`
+  - **`enable`**:
+    - **Description:** Enables a specific subagent.
+    - **Usage:** `/agents enable <agent-name>`
+  - **`disable`**:
+    - **Description:** Disables a specific subagent.
+    - **Usage:** `/agents disable <agent-name>`
+  - **`config`**:
+    - **Description:** Opens a configuration dialog for the specified agent to
+      adjust its model, temperature, or execution limits.
+    - **Usage:** `/agents config <agent-name>`
+
 ### `/auth`
 
 - **Description:** Open a dialog that lets you change the authentication method.
@@ -35,8 +58,8 @@ Slash commands provide meta-level control over the CLI itself.
     - `list` (selecting this opens the auto-saved session browser)
   - `-- checkpoints --`
     - `list`, `save`, `resume`, `delete`, `share` (manual tagged checkpoints)
-  - **Note:** Unique prefixes (for example `/cha` or `/resum`) resolve to the
-    same grouped menu.
+  - Unique prefixes (for example `/cha` or `/resu`) resolve to the same grouped
+    menu.
 - **Sub-commands:**
   - **`debug`**
     - **Description:** Export the most recent API request as a JSON payload.
@@ -225,8 +248,8 @@ Slash commands provide meta-level control over the CLI itself.
   - **`list`** or **`ls`**:
     - **Description:** List configured MCP servers and tools. This is the
       default action if no subcommand is specified.
-  - **`refresh`**:
-    - **Description:** Restarts all MCP servers and re-discovers their available
+  - **`reload`**:
+    - **Description:** Reloads all MCP servers and re-discovers their available
       tools.
   - **`schema`**:
     - **Description:** List configured MCP servers and tools with descriptions
@@ -280,7 +303,7 @@ Slash commands provide meta-level control over the CLI itself.
 - **Description:** Switch to Plan Mode (read-only) and view the current plan if
   one has been generated.
   - **Note:** This feature is enabled by default. It can be disabled via the
-    `experimental.plan` setting in your configuration.
+    `general.plan.enabled` setting in your configuration.
 - **Sub-commands:**
   - **`copy`**:
     - **Description:** Copy the currently approved plan to your clipboard.

docs/reference/keyboard-shortcuts.md

@@ -86,12 +86,13 @@ available combinations.
 
 #### Text Input
 
-| Command                    | Action                                                     | Keys                                                                                |
-| -------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------- |
-| `input.submit`             | Submit the current prompt.                                 | `Enter`                                                                             |
-| `input.newline`            | Insert a newline without submitting.                       | `Ctrl+Enter`<br />`Cmd/Win+Enter`<br />`Alt+Enter`<br />`Shift+Enter`<br />`Ctrl+J` |
-| `input.openExternalEditor` | Open the current prompt or the plan in an external editor. | `Ctrl+X`                                                                            |
-| `input.paste`              | Paste from the clipboard.                                  | `Ctrl+V`<br />`Cmd/Win+V`<br />`Alt+V`                                              |
+| Command                    | Action                                                                    | Keys                                                                                |
+| -------------------------- | ------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
+| `input.submit`             | Submit the current prompt.                                                | `Enter`                                                                             |
+| `input.queueMessage`       | Queue the current prompt to be processed after the current task finishes. | `Tab`                                                                               |
+| `input.newline`            | Insert a newline without submitting.                                      | `Ctrl+Enter`<br />`Cmd/Win+Enter`<br />`Alt+Enter`<br />`Shift+Enter`<br />`Ctrl+J` |
+| `input.openExternalEditor` | Open the current prompt or the plan in an external editor.                | `Ctrl+X`                                                                            |
+| `input.paste`              | Paste from the clipboard.                                                 | `Ctrl+V`<br />`Cmd/Win+V`<br />`Alt+V`                                              |
 
 #### App Controls
 
@@ -101,7 +102,8 @@ available combinations.
 | `app.showFullTodos`           | Toggle the full TODO list.                                                                                                                         | `Ctrl+T`           |
 | `app.showIdeContextDetail`    | Show IDE context details.                                                                                                                          | `Ctrl+G`           |
 | `app.toggleMarkdown`          | Toggle Markdown rendering.                                                                                                                         | `Alt+M`            |
-| `app.toggleCopyMode`          | Toggle copy mode when in alternate buffer mode.                                                                                                    | `Ctrl+S`           |
+| `app.toggleCopyMode`          | Toggle copy mode when in alternate buffer mode.                                                                                                    | `F9`               |
+| `app.toggleMouseMode`         | Toggle mouse mode (scrolling and clicking).                                                                                                        | `Ctrl+S`           |
 | `app.toggleYolo`              | Toggle YOLO (auto-approval) mode for tool calls.                                                                                                   | `Ctrl+Y`           |
 | `app.cycleApprovalMode`       | Cycle through approval modes: default (prompt), auto_edit (auto-approve edits), and plan (read-only). Plan mode is skipped when the agent is busy. | `Shift+Tab`        |
 | `app.showMoreLines`           | Expand and collapse blocks of content when not in alternate buffer mode.                                                                           | `Ctrl+O`           |
@@ -125,6 +127,16 @@ available combinations.
 | `background.unfocus`        | Move focus from background shell to Gemini.                        | `Shift+Tab` |
 | `background.unfocusList`    | Move focus from background shell list to Gemini.                   | `Tab`       |
 | `background.unfocusWarning` | Show warning when trying to move focus away from background shell. | `Tab`       |
+| `app.dumpFrame`             | Dump the current frame as a snapshot.                              | `F8`        |
+| `app.startRecording`        | Start recording the session.                                       | `F6`        |
+| `app.stopRecording`         | Stop recording the session.                                        | `F7`        |
+
+#### Extension Controls
+
+| Command            | Action                                      | Keys |
+| ------------------ | ------------------------------------------- | ---- |
+| `extension.update` | Update the current extension if available.  | `I`  |
+| `extension.link`   | Link the current extension to a local path. | `L`  |
 
 <!-- KEYBINDINGS-AUTOGEN:END -->
 

docs/reference/policy-engine.md

@@ -29,13 +29,12 @@ To create your first policy:
     ```toml
     [[rule]]
     toolName = "run_shell_command"
-    commandPrefix = "git status"
-    decision = "allow"
+    commandPrefix = "rm -rf"
+    decision = "deny"
     priority = 100
     ```
 3.  **Run a command** that triggers the policy (e.g., ask Gemini CLI to
-    `git status`). The tool will now execute automatically without prompting for
-    confirmation.
+    `rm -rf /`). The tool will now be blocked automatically.
 
 ## Core concepts
 
@@ -60,7 +59,7 @@ command.
 ```toml
 [[rule]]
 toolName = "run_shell_command"
-commandPrefix = "git "
+commandPrefix = "git"
 decision = "ask_user"
 priority = 100
 ```
@@ -90,6 +89,17 @@ If `argsPattern` is specified, the tool's arguments are converted to a stable
 JSON string, which is then tested against the provided regular expression. If
 the arguments don't match the pattern, the rule does not apply.
 
+#### Execution environment
+
+If `interactive` is specified, the rule will only apply if the CLI's execution
+environment matches the specified boolean value:
+
+- `true`: The rule applies only in interactive mode.
+- `false`: The rule applies only in non-interactive (headless) mode.
+
+If omitted, the rule applies to both interactive and non-interactive
+environments.
+
 ### Decisions
 
 There are three possible decisions a rule can enforce:
@@ -102,7 +112,9 @@ There are three possible decisions a rule can enforce:
 - `ask_user`: The user is prompted to approve or deny the tool call. (In
   non-interactive mode, this is treated as `deny`.)
 
-> **Note:** The `deny` decision is the recommended way to exclude tools. The
+<!-- prettier-ignore -->
+> [!NOTE]
+> The `deny` decision is the recommended way to exclude tools. The
 > legacy `tools.exclude` setting in `settings.json` is deprecated in favor of
 > policy rules with a `deny` decision.
 
@@ -130,25 +142,26 @@ engine transforms this into a final priority using the following formula:
 
 This system guarantees that:
 
-- Admin policies always override User, Workspace, and Default policies.
+- Admin policies always override User, Workspace, and Default policies (defined
+  in policy TOML files).
 - User policies override Workspace and Default policies.
 - Workspace policies override Default policies.
 - You can still order rules within a single tier with fine-grained control.
 
 For example:
 
-- A `priority: 50` rule in a Default policy file becomes `1.050`.
-- A `priority: 10` rule in a Workspace policy policy file becomes `2.010`.
-- A `priority: 100` rule in a User policy file becomes `3.100`.
-- A `priority: 20` rule in an Admin policy file becomes `4.020`.
+- A `priority: 50` rule in a Default policy TOML becomes `1.050`.
+- A `priority: 10` rule in a Workspace policy TOML becomes `2.010`.
+- A `priority: 100` rule in a User policy TOML becomes `3.100`.
+- A `priority: 20` rule in an Admin policy TOML becomes `4.020`.
 
 ### Approval modes
 
 Approval modes allow the policy engine to apply different sets of rules based on
-the CLI's operational mode. A rule can be associated with one or more modes
-(e.g., `yolo`, `autoEdit`, `plan`). The rule will only be active if the CLI is
-running in one of its specified modes. If a rule has no modes specified, it is
-always active.
+the CLI's operational mode. A rule in a TOML policy file can be associated with
+one or more modes (e.g., `yolo`, `autoEdit`, `plan`). The rule will only be
+active if the CLI is running in one of its specified modes. If a rule has no
+modes specified, it is always active.
 
 - `default`: The standard interactive mode where most write tools require
   confirmation.
@@ -158,6 +171,24 @@ always active.
   [Customizing Plan Mode Policies](../cli/plan-mode.md#customizing-policies).
 - `yolo`: A mode where all tools are auto-approved (use with extreme caution).
 
+To maintain the integrity of Plan Mode as a safe research environment,
+persistent tool approvals are context-aware. When you select **"Allow for all
+future sessions"**, the policy engine explicitly includes the current mode and
+all more permissive modes in the hierarchy (`plan` < `default` < `autoEdit` <
+`yolo`).
+
+- **Approvals in `plan` mode**: These represent an intentional choice to trust a
+  tool globally. The resulting rule explicitly includes all modes (`plan`,
+  `default`, `autoEdit`, and `yolo`).
+- **Approvals in other modes**: These only apply to the current mode and those
+  more permissive. For example:
+  - An approval granted in **`default`** mode applies to `default`, `autoEdit`,
+    and `yolo`.
+  - An approval granted in **`autoEdit`** mode applies to `autoEdit` and `yolo`.
+  - An approval granted in **`yolo`** mode applies only to `yolo`. This ensures
+    that trust flows correctly to more permissive environments while maintaining
+    the safety of more restricted modes like `plan`.
+
 ## Rule matching
 
 When a tool call is made, the engine checks it against all active rules,
@@ -166,8 +197,8 @@ outcome.
 
 A rule matches a tool call if all of its conditions are met:
 
-1.  **Tool name**: The `toolName` in the rule must match the name of the tool
-    being called.
+1.  **Tool name**: The `toolName` in the TOML rule must match the name of the
+    tool being called.
     - **Wildcards**: You can use wildcards like `*`, `mcp_server_*`, or
       `mcp_*_toolName` to match multiple tools. See [Tool Name](#tool-name) for
       details.
@@ -228,15 +259,17 @@ directory are **ignored**.
 - **Linux / macOS:** Must be owned by `root` (UID 0) and NOT writable by group
   or others (e.g., `chmod 755`).
 - **Windows:** Must be in `C:\ProgramData`. Standard users (`Users`, `Everyone`)
-  must NOT have `Write`, `Modify`, or `Full Control` permissions. _Tip: If you
-  see a security warning, use the folder properties to remove write permissions
-  for non-admin groups. You may need to "Disable inheritance" in Advanced
-  Security Settings._
+  must NOT have `Write`, `Modify`, or `Full Control` permissions. If you see a
+  security warning, use the folder properties to remove write permissions for
+  non-admin groups. You may need to "Disable inheritance" in Advanced Security
+  Settings.
 
-**Note:** Supplemental admin policies (provided via `--admin-policy` or
-`adminPolicyPaths` settings) are **NOT** subject to these strict ownership
-checks, as they are explicitly provided by the user or administrator in their
-current execution context.
+<!-- prettier-ignore -->
+> [!NOTE]
+> Supplemental admin policies (provided via `--admin-policy` or
+> `adminPolicyPaths` settings) are **NOT** subject to these strict ownership
+> checks, as they are explicitly provided by the user or administrator in their
+> current execution context.
 
 ### TOML rule schema
 
@@ -247,9 +280,9 @@ Here is a breakdown of the fields available in a TOML policy rule:
 # A unique name for the tool, or an array of names.
 toolName = "run_shell_command"
 
-# (Optional) The name of a subagent. If provided, the rule only applies to tool calls
-# made by this specific subagent.
-subagent = "generalist"
+# (Optional) The name of a subagent. If provided, the rule only applies to tool
+# calls made by this specific subagent.
+subagent = "codebase_investigator"
 
 # (Optional) The name of an MCP server. Can be combined with toolName
 # to form a composite FQN internally like "mcp_mcpName_toolName".
@@ -263,14 +296,17 @@ toolAnnotations = { readOnlyHint = true }
 argsPattern = '"command":"(git|npm)'
 
 # (Optional) A string or array of strings that a shell command must start with.
-# This is syntactic sugar for `toolName = "run_shell_command"` and an `argsPattern`.
-commandPrefix = "git "
+# This is syntactic sugar for `toolName = "run_shell_command"` and an
+# `argsPattern`.
+commandPrefix = "git"
 
 # (Optional) A regex to match against the entire shell command.
 # This is also syntactic sugar for `toolName = "run_shell_command"`.
-# Note: This pattern is tested against the JSON representation of the arguments (e.g., `{"command":"<your_command>"}`).
-# Because it prepends `"command":"`, it effectively matches from the start of the command.
-# Anchors like `^` or `$` apply to the full JSON string, so `^` should usually be avoided here.
+# Note: This pattern is tested against the JSON representation of the arguments
+# (e.g., `{"command":"<your_command>"}`). Because it prepends `"command":"`,
+# it effectively matches from the start of the command.
+# Anchors like `^` or `$` apply to the full JSON string,
+# so `^` should usually be avoided here.
 # You cannot use commandPrefix and commandRegex in the same rule.
 commandRegex = "git (commit|push)"
 
@@ -280,12 +316,27 @@ decision = "ask_user"
 # The priority of the rule, from 0 to 999.
 priority = 10
 
-# (Optional) A custom message to display when a tool call is denied by this rule.
-# This message is returned to the model and user, useful for explaining *why* it was denied.
-deny_message = "Deletion is permanent"
+# (Optional) A custom message to display when a tool call is denied by this
+# rule. This message is returned to the model and user,
+# useful for explaining *why* it was denied.
+denyMessage = "Deletion is permanent"
 
 # (Optional) An array of approval modes where this rule is active.
-modes = ["autoEdit"]
+# If omitted or empty, the rule applies to all modes.
+modes = ["default", "autoEdit", "yolo"]
+
+# (Optional) A boolean to restrict the rule to interactive (true) or
+# non-interactive (false) environments.
+# If omitted, the rule applies to both.
+interactive = true
+
+# (Optional) If true, lets shell commands use redirection operators
+# (>, >>, <, <<, <<<). By default, the policy engine asks for confirmation
+# when redirection is detected, even if a rule matches the command.
+# This permission is granular; it only applies to the specific rule it's
+# defined in. In chained commands (e.g., cmd1 > file && cmd2), each
+# individual command rule must permit redirection if it's used.
+allowRedirection = true
 ```
 
 ### Using arrays (lists)
@@ -321,7 +372,7 @@ This rule will ask for user confirmation before executing any `git` command.
 ```toml
 [[rule]]
 toolName = "run_shell_command"
-commandPrefix = "git "
+commandPrefix = "git"
 decision = "ask_user"
 priority = 100
 ```
@@ -333,7 +384,9 @@ using the `mcpName` field. **This is the recommended approach** for defining MCP
 policies, as it is much more robust than manually writing Fully Qualified Names
 (FQNs) or string wildcards.
 
-> **Warning:** Do not use underscores (`_`) in your MCP server names (e.g., use
+<!-- prettier-ignore -->
+> [!WARNING]
+> Do not use underscores (`_`) in your MCP server names (e.g., use
 > `my-server` rather than `my_server`). The policy parser splits Fully Qualified
 > Names (`mcp_server_tool`) on the _first_ underscore following the `mcp_`
 > prefix. If your server name contains an underscore, the parser will
@@ -360,13 +413,15 @@ priority = 200
 Specify only the `mcpName` to apply a rule to every tool provided by that
 server.
 
+**Note:** This applies to all decision types (`allow`, `deny`, `ask_user`).
+
 ```toml
 # Denies all tools from the `untrusted-server` MCP
 [[rule]]
 mcpName = "untrusted-server"
 decision = "deny"
 priority = 500
-deny_message = "This server is not trusted by the admin."
+denyMessage = "This server is not trusted by the admin."
 ```
 
 **3. Targeting all MCP servers**
@@ -377,25 +432,12 @@ registered MCP server. This is useful for setting category-wide defaults.
 ```toml
 # Ask user for any tool call from any MCP server
 [[rule]]
+toolName = "*"
 mcpName = "*"
 decision = "ask_user"
 priority = 10
 ```
 
-**4. Targeting a tool name across all servers**
-
-Use `mcpName = "*"` with a specific `toolName` to target that operation
-regardless of which server provides it.
-
-```toml
-# Allow the `search` tool across all connected MCP servers
-[[rule]]
-mcpName = "*"
-toolName = "search"
-decision = "allow"
-priority = 50
-```
-
 ## Default policies
 
 The Gemini CLI ships with a set of default policies to provide a safe

docs/reference/tools.md

@@ -63,29 +63,62 @@ details.
 
 ## Available tools
 
-The following table lists all available tools, categorized by their primary
-function.
+The following sections list all available tools, categorized by their primary
+function. For detailed parameter information, see the linked documentation for
+each tool.
 
-| Category    | Tool                                             | Kind          | Description                                                                                                                                                                                                                                 |
-| :---------- | :----------------------------------------------- | :------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Execution   | [`run_shell_command`](../tools/shell.md)         | `Execute`     | Executes arbitrary shell commands. Supports interactive sessions and background processes. Requires manual confirmation.<br><br>**Parameters:** `command`, `description`, `dir_path`, `is_background`                                       |
-| File System | [`glob`](../tools/file-system.md)                | `Search`      | Finds files matching specific glob patterns across the workspace.<br><br>**Parameters:** `pattern`, `dir_path`, `case_sensitive`, `respect_git_ignore`, `respect_gemini_ignore`                                                             |
-| File System | [`grep_search`](../tools/file-system.md)         | `Search`      | Searches for a regular expression pattern within file contents. Legacy alias: `search_file_content`.<br><br>**Parameters:** `pattern`, `dir_path`, `include`, `exclude_pattern`, `names_only`, `max_matches_per_file`, `total_max_matches`  |
-| File System | [`list_directory`](../tools/file-system.md)      | `Read`        | Lists the names of files and subdirectories within a specified path.<br><br>**Parameters:** `dir_path`, `ignore`, `file_filtering_options`                                                                                                  |
-| File System | [`read_file`](../tools/file-system.md)           | `Read`        | Reads the content of a specific file. Supports text, images, audio, and PDF.<br><br>**Parameters:** `file_path`, `start_line`, `end_line`                                                                                                   |
-| File System | [`read_many_files`](../tools/file-system.md)     | `Read`        | Reads and concatenates content from multiple files. Often triggered by the `@` symbol in your prompt.<br><br>**Parameters:** `include`, `exclude`, `recursive`, `useDefaultExcludes`, `file_filtering_options`                              |
-| File System | [`replace`](../tools/file-system.md)             | `Edit`        | Performs precise text replacement within a file. Requires manual confirmation.<br><br>**Parameters:** `file_path`, `instruction`, `old_string`, `new_string`, `allow_multiple`                                                              |
-| File System | [`write_file`](../tools/file-system.md)          | `Edit`        | Creates or overwrites a file with new content. Requires manual confirmation.<br><br>**Parameters:** `file_path`, `content`                                                                                                                  |
-| Interaction | [`ask_user`](../tools/ask-user.md)               | `Communicate` | Requests clarification or missing information via an interactive dialog.<br><br>**Parameters:** `questions`                                                                                                                                 |
-| Interaction | [`write_todos`](../tools/todos.md)               | `Other`       | Maintains an internal list of subtasks. The model uses this to track its own progress and display it to you.<br><br>**Parameters:** `todos`                                                                                                 |
-| Memory      | [`activate_skill`](../tools/activate-skill.md)   | `Other`       | Loads specialized procedural expertise for specific tasks from the `.gemini/skills` directory.<br><br>**Parameters:** `name`                                                                                                                |
-| Memory      | [`get_internal_docs`](../tools/internal-docs.md) | `Think`       | Accesses Gemini CLI's own documentation to provide more accurate answers about its capabilities.<br><br>**Parameters:** `path`                                                                                                              |
-| Memory      | [`save_memory`](../tools/memory.md)              | `Think`       | Persists specific facts and project details to your `GEMINI.md` file to retain context.<br><br>**Parameters:** `fact`                                                                                                                       |
-| Planning    | [`enter_plan_mode`](../tools/planning.md)        | `Plan`        | Switches the CLI to a safe, read-only "Plan Mode" for researching complex changes.<br><br>**Parameters:** `reason`                                                                                                                          |
-| Planning    | [`exit_plan_mode`](../tools/planning.md)         | `Plan`        | Finalizes a plan, presents it for review, and requests approval to start implementation.<br><br>**Parameters:** `plan`                                                                                                                      |
-| System      | `complete_task`                                  | `Other`       | Finalizes a subagent's mission and returns the result to the parent agent. This tool is not available to the user.<br><br>**Parameters:** `result`                                                                                          |
-| Web         | [`google_web_search`](../tools/web-search.md)    | `Search`      | Performs a Google Search to find up-to-date information.<br><br>**Parameters:** `query`                                                                                                                                                     |
-| Web         | [`web_fetch`](../tools/web-fetch.md)             | `Fetch`       | Retrieves and processes content from specific URLs. **Warning:** This tool can access local and private network addresses (e.g., localhost), which may pose a security risk if used with untrusted prompts.<br><br>**Parameters:** `prompt` |
+### Execution
+
+| Tool                                     | Kind      | Description                                                                                                              |
+| :--------------------------------------- | :-------- | :----------------------------------------------------------------------------------------------------------------------- |
+| [`run_shell_command`](../tools/shell.md) | `Execute` | Executes arbitrary shell commands. Supports interactive sessions and background processes. Requires manual confirmation. |
+
+### File System
+
+| Tool                                         | Kind     | Description                                                                                           |
+| :------------------------------------------- | :------- | :---------------------------------------------------------------------------------------------------- |
+| [`glob`](../tools/file-system.md)            | `Search` | Finds files matching specific glob patterns across the workspace.                                     |
+| [`grep_search`](../tools/file-system.md)     | `Search` | Searches for a regular expression pattern within file contents. Legacy alias: `search_file_content`.  |
+| [`list_directory`](../tools/file-system.md)  | `Read`   | Lists the names of files and subdirectories within a specified path.                                  |
+| [`read_file`](../tools/file-system.md)       | `Read`   | Reads the content of a specific file. Supports text, images, audio, and PDF.                          |
+| [`read_many_files`](../tools/file-system.md) | `Read`   | Reads and concatenates content from multiple files. Often triggered by the `@` symbol in your prompt. |
+| [`replace`](../tools/file-system.md)         | `Edit`   | Performs precise text replacement within a file. Requires manual confirmation.                        |
+| [`write_file`](../tools/file-system.md)      | `Edit`   | Creates or overwrites a file with new content. Requires manual confirmation.                          |
+
+### Interaction
+
+| Tool                               | Kind          | Description                                                                            |
+| :--------------------------------- | :------------ | :------------------------------------------------------------------------------------- |
+| [`ask_user`](../tools/ask-user.md) | `Communicate` | Requests clarification or missing information via an interactive dialog.               |
+| [`write_todos`](../tools/todos.md) | `Other`       | Maintains an internal list of subtasks. The model uses this to track its own progress. |
+
+### Memory
+
+| Tool                                             | Kind    | Description                                                                          |
+| :----------------------------------------------- | :------ | :----------------------------------------------------------------------------------- |
+| [`activate_skill`](../tools/activate-skill.md)   | `Other` | Loads specialized procedural expertise from the `.gemini/skills` directory.          |
+| [`get_internal_docs`](../tools/internal-docs.md) | `Think` | Accesses Gemini CLI's own documentation for accurate answers about its capabilities. |
+| [`save_memory`](../tools/memory.md)              | `Think` | Persists specific facts and project details to your `GEMINI.md` file.                |
+
+### Planning
+
+| Tool                                      | Kind   | Description                                                                              |
+| :---------------------------------------- | :----- | :--------------------------------------------------------------------------------------- |
+| [`enter_plan_mode`](../tools/planning.md) | `Plan` | Switches the CLI to a safe, read-only "Plan Mode" for researching complex changes.       |
+| [`exit_plan_mode`](../tools/planning.md)  | `Plan` | Finalizes a plan, presents it for review, and requests approval to start implementation. |
+
+### System
+
+| Tool            | Kind    | Description                                                                                                        |
+| :-------------- | :------ | :----------------------------------------------------------------------------------------------------------------- |
+| `complete_task` | `Other` | Finalizes a subagent's mission and returns the result to the parent agent. This tool is not available to the user. |
+
+### Web
+
+| Tool                                          | Kind     | Description                                                                                                                                                                                                                                                              |
+| :-------------------------------------------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [`google_web_search`](../tools/web-search.md) | `Search` | Performs a Google Search to find up-to-date information.                                                                                                                                                                                                                 |
+| [`web_fetch`](../tools/web-fetch.md)          | `Fetch`  | Retrieves and processes content from specific URLs. **Warning:** This tool can access local and private network addresses (e.g., localhost), which may pose a security risk if used with untrusted prompts. In Plan Mode, this tool requires explicit user confirmation. |
 
 ## Under the hood
 
@@ -95,7 +128,9 @@ For developers, the tool system is designed to be extensible and robust. The
 You can extend Gemini CLI with custom tools by configuring
 `tools.discoveryCommand` in your settings or by connecting to MCP servers.
 
-> **Note:** For a deep dive into the internal Tool API and how to implement your
+<!-- prettier-ignore -->
+> [!NOTE]
+> For a deep dive into the internal Tool API and how to implement your
 > own tools in the codebase, see the `packages/core/src/tools/` directory in
 > GitHub.