chore(release): v0.30.1

fix(patch): cherry-pick 58df1c6 to release/v0.30.0-pr-20374 [CONFLICTS] (#20567 )
Co-authored-by: christine betts <chrstn@uw.edu> Co-authored-by: Gal Zahavi <38544478+galz10@users.noreply.github.com>
2026-07-23 08:10:57 -07:00 · 2026-02-27 18:27:02 +00:00 · 2026-02-27 12:55:17 -05:00 · 2026-02-25 02:58:57 +00:00 · 2026-02-24 03:10:10 +00:00 · 2026-02-24 01:57:13 +00:00
51 changed files with 1282 additions and 163 deletions
@@ -163,7 +163,8 @@ Each server configuration supports the following properties:
 - **`args`** (string[]): Command-line arguments for Stdio transport
 - **`headers`** (object): Custom HTTP headers when using `url` or `httpUrl`
 - **`env`** (object): Environment variables for the server process. Values can
-  reference environment variables using `$VAR_NAME` or `${VAR_NAME}` syntax
+  reference environment variables using `$VAR_NAME` or `${VAR_NAME}` syntax (all
+  platforms), or `%VAR_NAME%` (Windows only).
 - **`cwd`** (string): Working directory for Stdio transport
 - **`timeout`** (number): Request timeout in milliseconds (default: 600,000ms =
  10 minutes)
@@ -184,6 +185,63 @@ Each server configuration supports the following properties:
  Service Account to impersonate. Used with
  `authProviderType: 'service_account_impersonation'`.

+### Environment variable expansion
+
+Gemini CLI automatically expands environment variables in the `env` block of
+your MCP server configuration. This allows you to securely reference variables
+defined in your shell or environment without hardcoding sensitive information
+directly in your `settings.json` file.
+
+The expansion utility supports:
+
+- **POSIX/Bash syntax:** `$VARIABLE_NAME` or `${VARIABLE_NAME}` (supported on
+  all platforms)
+- **Windows syntax:** `%VARIABLE_NAME%` (supported only when running on Windows)
+
+If a variable is not defined in the current environment, it resolves to an empty
+string.
+
+**Example:**
+
+```json
+"env": {
+  "API_KEY": "$MY_EXTERNAL_TOKEN",
+  "LOG_LEVEL": "$LOG_LEVEL",
+  "TEMP_DIR": "%TEMP%"
+}
+```
+
+### Security and environment sanitization
+
+To protect your credentials, Gemini CLI performs environment sanitization when
+spawning MCP server processes.
+
+#### Automatic redaction
+
+By default, the CLI redacts sensitive environment variables from the base
+environment (inherited from the host process) to prevent unintended exposure to
+third-party MCP servers. This includes:
+
+- Core project keys: `GEMINI_API_KEY`, `GOOGLE_API_KEY`, etc.
+- Variables matching sensitive patterns: `*TOKEN*`, `*SECRET*`, `*PASSWORD*`,
+  `*KEY*`, `*AUTH*`, `*CREDENTIAL*`.
+- Certificates and private key patterns.
+
+#### Explicit overrides
+
+If an environment variable must be passed to an MCP server, you must explicitly
+state it in the `env` property of the server configuration in `settings.json`.
+Explicitly defined variables (including those from extensions) are trusted and
+are **not** subjected to the automatic redaction process.
+
+This follows the security principle that if a variable is explicitly configured
+by the user for a specific server, it constitutes informed consent to share that
+specific data with that server.
+
+> **Note:** Even when explicitly defined, you should avoid hardcoding secrets.
+> Instead, use environment variable expansion (e.g., `"MY_KEY": "$MY_KEY"`) to
+> securely pull the value from your host environment at runtime.
+
 ### OAuth support for remote MCP servers

 The Gemini CLI supports OAuth 2.0 authentication for remote MCP servers using
@@ -738,7 +796,9 @@ The MCP integration tracks several states:
 - **Trust settings:** The `trust` option bypasses all confirmation dialogs. Use
  cautiously and only for servers you completely control
 - **Access tokens:** Be security-aware when configuring environment variables
-  containing API keys or tokens
+  containing API keys or tokens. See
+  [Security and environment sanitization](#security-and-environment-sanitization)
+  for details on how Gemini CLI protects your credentials.
 - **Sandbox compatibility:** When using sandboxing, ensure MCP servers are
  available within the sandbox environment
 - **Private data:** Using broadly scoped personal access tokens can lead to
@@ -93,4 +93,4 @@ backend, these Terms of Service and Privacy Notice documents apply:

 You may opt-out from sending Gemini CLI Usage Statistics to Google by following
 the instructions available here:
-[Usage Statistics Configuration](https://github.com/google-gemini/gemini-cli/blob/main/docs/get-started/configuration.md#usage-statistics).
+[Usage Statistics Configuration](https://github.com/google-gemini/gemini-cli/blob/main/docs/reference/configuration.md#usage-statistics).
@@ -75,6 +75,10 @@ const baseConfig = {
  write: true,
 };

+const commonAliases = {
+  punycode: 'punycode/',
+};
+
 const cliConfig = {
  ...baseConfig,
  banner: {
@@ -88,6 +92,7 @@ const cliConfig = {
  plugins: createWasmPlugins(),
  alias: {
    'is-in-ci': path.resolve(__dirname, 'packages/cli/src/patches/is-in-ci.ts'),
+    ...commonAliases,
  },
  metafile: true,
 };
@@ -103,6 +108,7 @@ const a2aServerConfig = {
    'process.env.CLI_VERSION': JSON.stringify(pkg.version),
  },
  plugins: createWasmPlugins(),
+  alias: commonAliases,
 };

 Promise.allSettled([
@@ -1,12 +1,12 @@
 {
  "name": "@google/gemini-cli",
-  "version": "0.30.0-nightly.20260210.a2174751d",
+  "version": "0.30.1",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@google/gemini-cli",
-      "version": "0.30.0-nightly.20260210.a2174751d",
+      "version": "0.30.1",
      "workspaces": [
        "packages/*"
      ],
@@ -14,6 +14,7 @@
        "ink": "npm:@jrichman/ink@6.4.10",
        "latest-version": "^9.0.0",
        "proper-lockfile": "^4.1.2",
+        "punycode": "^2.3.1",
        "simple-git": "^3.28.0"
      },
      "bin": {
@@ -7474,9 +7475,36 @@
      }
    },
    "node_modules/dotenv": {
-      "version": "17.1.0",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.1.0.tgz",
-      "integrity": "sha512-tG9VUTJTuju6GcXgbdsOuRhupE8cb4mRgY5JLRCh4MtGoVo3/gfGUtOMwmProM6d0ba2mCFvv+WrpYJV6qgJXQ==",
+      "version": "17.2.4",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.2.4.tgz",
+      "integrity": "sha512-mudtfb4zRB4bVvdj0xRo+e6duH1csJRM8IukBqfTRvHotn9+LBXB8ynAidP9zHqoRC/fsllXgk4kCKlR21fIhw==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
+    "node_modules/dotenv-expand": {
+      "version": "12.0.3",
+      "resolved": "https://registry.npmjs.org/dotenv-expand/-/dotenv-expand-12.0.3.tgz",
+      "integrity": "sha512-uc47g4b+4k/M/SeaW1y4OApx+mtLWl92l5LMPP0GNXctZqELk+YGgOPIIC5elYmUH4OuoK3JLhuRUYegeySiFA==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "dotenv": "^16.4.5"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
+    "node_modules/dotenv-expand/node_modules/dotenv": {
+      "version": "16.6.1",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
+      "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
      "license": "BSD-2-Clause",
      "engines": {
        "node": ">=12"
@@ -13547,7 +13575,6 @@
      "version": "2.3.1",
      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
-      "devOptional": true,
      "license": "MIT",
      "engines": {
        "node": ">=6"
@@ -17254,7 +17281,7 @@
    },
    "packages/a2a-server": {
      "name": "@google/gemini-cli-a2a-server",
-      "version": "0.30.0-nightly.20260210.a2174751d",
+      "version": "0.30.1",
      "dependencies": {
        "@a2a-js/sdk": "^0.3.8",
        "@google-cloud/storage": "^7.16.0",
@@ -17312,7 +17339,7 @@
    },
    "packages/cli": {
      "name": "@google/gemini-cli",
-      "version": "0.30.0-nightly.20260210.a2174751d",
+      "version": "0.30.1",
      "license": "Apache-2.0",
      "dependencies": {
        "@agentclientprotocol/sdk": "^0.12.0",
@@ -17409,7 +17436,7 @@
    },
    "packages/core": {
      "name": "@google/gemini-cli-core",
-      "version": "0.30.0-nightly.20260210.a2174751d",
+      "version": "0.30.1",
      "license": "Apache-2.0",
      "dependencies": {
        "@a2a-js/sdk": "^0.3.8",
@@ -17444,6 +17471,8 @@
        "ajv-formats": "^3.0.0",
        "chardet": "^2.1.0",
        "diff": "^8.0.3",
+        "dotenv": "^17.2.4",
+        "dotenv-expand": "^12.0.3",
        "fast-levenshtein": "^2.0.6",
        "fdir": "^6.4.6",
        "fzf": "^0.5.2",
@@ -17575,7 +17604,7 @@
    },
    "packages/sdk": {
      "name": "@google/gemini-cli-sdk",
-      "version": "0.29.0-nightly.20260203.71f46f116",
+      "version": "0.30.1",
      "license": "Apache-2.0",
      "dependencies": {
        "@google/gemini-cli-core": "file:../core",
@@ -17592,7 +17621,7 @@
    },
    "packages/test-utils": {
      "name": "@google/gemini-cli-test-utils",
-      "version": "0.30.0-nightly.20260210.a2174751d",
+      "version": "0.30.1",
      "license": "Apache-2.0",
      "dependencies": {
        "@google/gemini-cli-core": "file:../core",
@@ -17609,7 +17638,7 @@
    },
    "packages/vscode-ide-companion": {
      "name": "gemini-cli-vscode-ide-companion",
-      "version": "0.30.0-nightly.20260210.a2174751d",
+      "version": "0.30.1",
      "license": "LICENSE",
      "dependencies": {
        "@modelcontextprotocol/sdk": "^1.23.0",
@@ -1,6 +1,6 @@
 {
  "name": "@google/gemini-cli",
-  "version": "0.30.0-nightly.20260210.a2174751d",
+  "version": "0.30.1",
  "engines": {
    "node": ">=20.0.0"
  },
@@ -14,7 +14,7 @@
    "url": "git+https://github.com/google-gemini/gemini-cli.git"
  },
  "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.30.0-nightly.20260210.a2174751d"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.30.1"
  },
  "scripts": {
    "start": "cross-env NODE_ENV=development node scripts/start.js",
@@ -129,6 +129,7 @@
    "ink": "npm:@jrichman/ink@6.4.10",
    "latest-version": "^9.0.0",
    "proper-lockfile": "^4.1.2",
+    "punycode": "^2.3.1",
    "simple-git": "^3.28.0"
  },
  "optionalDependencies": {
@@ -1,6 +1,6 @@
 {
  "name": "@google/gemini-cli-a2a-server",
-  "version": "0.30.0-nightly.20260210.a2174751d",
+  "version": "0.30.1",
  "description": "Gemini CLI A2A Server",
  "repository": {
    "type": "git",
@@ -1,6 +1,6 @@
 {
  "name": "@google/gemini-cli",
-  "version": "0.30.0-nightly.20260210.a2174751d",
+  "version": "0.30.1",
  "description": "Gemini CLI",
  "license": "Apache-2.0",
  "repository": {
@@ -26,7 +26,7 @@
    "dist"
  ],
  "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.30.0-nightly.20260210.a2174751d"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.30.1"
  },
  "dependencies": {
    "@agentclientprotocol/sdk": "^0.12.0",
@@ -694,6 +694,7 @@ export const AppContainer = (props: AppContainerProps) => {
        settings.setValue(scope, 'security.auth.selectedType', authType);

        try {
+          config.setRemoteAdminSettings(undefined);
          await config.refreshAuth(authType);
          setAuthState(AuthState.Authenticated);
        } catch (e) {
@@ -9,6 +9,7 @@ import { Box, Text } from 'ink';
 import { theme } from '../semantic-colors.js';
 import { GIT_COMMIT_INFO } from '../../generated/git-commit.js';
 import { useSettings } from '../contexts/SettingsContext.js';
+import { getDisplayString } from '@google/gemini-cli-core';

 interface AboutBoxProps {
  cliVersion: string;
@@ -79,7 +80,9 @@ export const AboutBox: React.FC<AboutBoxProps> = ({
          </Text>
        </Box>
        <Box>
-          <Text color={theme.text.primary}>{modelVersion}</Text>
+          <Text color={theme.text.primary}>
+            {getDisplayString(modelVersion)}
+          </Text>
        </Box>
      </Box>
      <Box flexDirection="row">
@@ -42,12 +42,14 @@ describe('<ModelDialog />', () => {
  const mockGetModel = vi.fn();
  const mockOnClose = vi.fn();
  const mockGetHasAccessToPreviewModel = vi.fn();
+  const mockGetGemini31LaunchedSync = vi.fn();

  interface MockConfig extends Partial<Config> {
    setModel: (model: string, isTemporary?: boolean) => void;
    getModel: () => string;
    getHasAccessToPreviewModel: () => boolean;
    getIdeMode: () => boolean;
+    getGemini31LaunchedSync: () => boolean;
  }

  const mockConfig: MockConfig = {
@@ -55,12 +57,14 @@ describe('<ModelDialog />', () => {
    getModel: mockGetModel,
    getHasAccessToPreviewModel: mockGetHasAccessToPreviewModel,
    getIdeMode: () => false,
+    getGemini31LaunchedSync: mockGetGemini31LaunchedSync,
  };

  beforeEach(() => {
    vi.resetAllMocks();
    mockGetModel.mockReturnValue(DEFAULT_GEMINI_MODEL_AUTO);
    mockGetHasAccessToPreviewModel.mockReturnValue(false);
+    mockGetGemini31LaunchedSync.mockReturnValue(false);

    // Default implementation for getDisplayString
    mockGetDisplayString.mockImplementation((val: string) => {
@@ -9,6 +9,7 @@ import { useCallback, useContext, useMemo, useState } from 'react';
 import { Box, Text } from 'ink';
 import {
  PREVIEW_GEMINI_MODEL,
+  PREVIEW_GEMINI_3_1_MODEL,
  PREVIEW_GEMINI_FLASH_MODEL,
  PREVIEW_GEMINI_MODEL_AUTO,
  DEFAULT_GEMINI_MODEL,
@@ -18,11 +19,14 @@ import {
  ModelSlashCommandEvent,
  logModelSlashCommand,
  getDisplayString,
+  AuthType,
+  PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL,
 } from '@google/gemini-cli-core';
 import { useKeypress } from '../hooks/useKeypress.js';
 import { theme } from '../semantic-colors.js';
 import { DescriptiveRadioButtonSelect } from './shared/DescriptiveRadioButtonSelect.js';
 import { ConfigContext } from '../contexts/ConfigContext.js';
+import { useSettings } from '../contexts/SettingsContext.js';

 interface ModelDialogProps {
  onClose: () => void;
@@ -30,6 +34,7 @@ interface ModelDialogProps {

 export function ModelDialog({ onClose }: ModelDialogProps): React.JSX.Element {
  const config = useContext(ConfigContext);
+  const settings = useSettings();
  const [view, setView] = useState<'main' | 'manual'>('main');
  const [persistMode, setPersistMode] = useState(false);

@@ -37,6 +42,10 @@ export function ModelDialog({ onClose }: ModelDialogProps): React.JSX.Element {
  const preferredModel = config?.getModel() || DEFAULT_GEMINI_MODEL_AUTO;

  const shouldShowPreviewModels = config?.getHasAccessToPreviewModel();
+  const useGemini31 = config?.getGemini31LaunchedSync?.() ?? false;
+  const selectedAuthType = settings.merged.security.auth.selectedType;
+  const useCustomToolModel =
+    useGemini31 && selectedAuthType === AuthType.USE_GEMINI;

  const manualModelSelected = useMemo(() => {
    const manualModels = [
@@ -44,6 +53,8 @@ export function ModelDialog({ onClose }: ModelDialogProps): React.JSX.Element {
      DEFAULT_GEMINI_FLASH_MODEL,
      DEFAULT_GEMINI_FLASH_LITE_MODEL,
      PREVIEW_GEMINI_MODEL,
+      PREVIEW_GEMINI_3_1_MODEL,
+      PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL,
      PREVIEW_GEMINI_FLASH_MODEL,
    ];
    if (manualModels.includes(preferredModel)) {
@@ -94,13 +105,14 @@ export function ModelDialog({ onClose }: ModelDialogProps): React.JSX.Element {
      list.unshift({
        value: PREVIEW_GEMINI_MODEL_AUTO,
        title: getDisplayString(PREVIEW_GEMINI_MODEL_AUTO),
-        description:
-          'Let Gemini CLI decide the best model for the task: gemini-3-pro, gemini-3-flash',
+        description: useGemini31
+          ? 'Let Gemini CLI decide the best model for the task: gemini-3.1-pro, gemini-3-flash'
+          : 'Let Gemini CLI decide the best model for the task: gemini-3-pro, gemini-3-flash',
        key: PREVIEW_GEMINI_MODEL_AUTO,
      });
    }
    return list;
-  }, [shouldShowPreviewModels, manualModelSelected]);
+  }, [shouldShowPreviewModels, manualModelSelected, useGemini31]);

  const manualOptions = useMemo(() => {
    const list = [
@@ -122,11 +134,19 @@ export function ModelDialog({ onClose }: ModelDialogProps): React.JSX.Element {
    ];

    if (shouldShowPreviewModels) {
+      const previewProModel = useGemini31
+        ? PREVIEW_GEMINI_3_1_MODEL
+        : PREVIEW_GEMINI_MODEL;
+
+      const previewProValue = useCustomToolModel
+        ? PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL
+        : previewProModel;
+
      list.unshift(
        {
-          value: PREVIEW_GEMINI_MODEL,
-          title: PREVIEW_GEMINI_MODEL,
-          key: PREVIEW_GEMINI_MODEL,
+          value: previewProValue,
+          title: previewProModel,
+          key: previewProModel,
        },
        {
          value: PREVIEW_GEMINI_FLASH_MODEL,
@@ -136,7 +156,7 @@ export function ModelDialog({ onClose }: ModelDialogProps): React.JSX.Element {
      );
    }
    return list;
-  }, [shouldShowPreviewModels]);
+  }, [shouldShowPreviewModels, useGemini31, useCustomToolModel]);

  const options = view === 'main' ? mainOptions : manualOptions;

@@ -23,11 +23,13 @@ import {
 import { computeSessionStats } from '../utils/computeStats.js';
 import {
  type RetrieveUserQuotaResponse,
-  VALID_GEMINI_MODELS,
+  isActiveModel,
  getDisplayString,
  isAutoModel,
+  AuthType,
 } from '@google/gemini-cli-core';
 import { useSettings } from '../contexts/SettingsContext.js';
+import { useConfig } from '../contexts/ConfigContext.js';
 import type { QuotaStats } from '../types.js';
 import { QuotaStatsInfo } from './QuotaStatsInfo.js';

@@ -82,9 +84,13 @@ const Section: React.FC<SectionProps> = ({ title, children }) => (
 const buildModelRows = (
  models: Record<string, ModelMetrics>,
  quotas?: RetrieveUserQuotaResponse,
+  useGemini3_1 = false,
+  useCustomToolModel = false,
 ) => {
  const getBaseModelName = (name: string) => name.replace('-001', '');
-  const usedModelNames = new Set(Object.keys(models).map(getBaseModelName));
+  const usedModelNames = new Set(
+    Object.keys(models).map(getBaseModelName).map(getDisplayString),
+  );

  // 1. Models with active usage
  const activeRows = Object.entries(models).map(([name, metrics]) => {
@@ -93,7 +99,7 @@ const buildModelRows = (
    const inputTokens = metrics.tokens.input;
    return {
      key: name,
-      modelName,
+      modelName: getDisplayString(modelName),
      requests: metrics.api.totalRequests,
      cachedTokens: cachedTokens.toLocaleString(),
      inputTokens: inputTokens.toLocaleString(),
@@ -109,12 +115,12 @@ const buildModelRows = (
      ?.filter(
        (b) =>
          b.modelId &&
-          VALID_GEMINI_MODELS.has(b.modelId) &&
-          !usedModelNames.has(b.modelId),
+          isActiveModel(b.modelId, useGemini3_1, useCustomToolModel) &&
+          !usedModelNames.has(getDisplayString(b.modelId)),
      )
      .map((bucket) => ({
        key: bucket.modelId!,
-        modelName: bucket.modelId!,
+        modelName: getDisplayString(bucket.modelId!),
        requests: '-',
        cachedTokens: '-',
        inputTokens: '-',
@@ -135,6 +141,8 @@ const ModelUsageTable: React.FC<{
  pooledRemaining?: number;
  pooledLimit?: number;
  pooledResetTime?: string;
+  useGemini3_1?: boolean;
+  useCustomToolModel?: boolean;
 }> = ({
  models,
  quotas,
@@ -144,8 +152,10 @@ const ModelUsageTable: React.FC<{
  pooledRemaining,
  pooledLimit,
  pooledResetTime,
+  useGemini3_1,
+  useCustomToolModel,
 }) => {
-  const rows = buildModelRows(models, quotas);
+  const rows = buildModelRows(models, quotas, useGemini3_1, useCustomToolModel);

  if (rows.length === 0) {
    return null;
@@ -401,7 +411,11 @@ export const StatsDisplay: React.FC<StatsDisplayProps> = ({
  const { models, tools, files } = metrics;
  const computed = computeSessionStats(metrics);
  const settings = useSettings();
-
+  const config = useConfig();
+  const useGemini3_1 = config.getGemini31LaunchedSync?.() ?? false;
+  const useCustomToolModel =
+    useGemini3_1 &&
+    config.getContentGeneratorConfig().authType === AuthType.USE_GEMINI;
  const pooledRemaining = quotaStats?.remaining;
  const pooledLimit = quotaStats?.limit;
  const pooledResetTime = quotaStats?.resetTime;
@@ -535,6 +549,8 @@ export const StatsDisplay: React.FC<StatsDisplayProps> = ({
        pooledRemaining={pooledRemaining}
        pooledLimit={pooledLimit}
        pooledResetTime={pooledResetTime}
+        useGemini3_1={useGemini3_1}
+        useCustomToolModel={useCustomToolModel}
      />
    </Box>
  );
@@ -7,6 +7,7 @@
 import type React from 'react';
 import { Text, Box } from 'ink';
 import { theme } from '../../semantic-colors.js';
+import { getDisplayString } from '@google/gemini-cli-core';

 interface ModelMessageProps {
  model: string;
@@ -15,7 +16,7 @@ interface ModelMessageProps {
 export const ModelMessage: React.FC<ModelMessageProps> = ({ model }) => (
  <Box marginLeft={2}>
    <Text color={theme.ui.comment} italic>
-      Responding with {model}
+      Responding with {getDisplayString(model)}
    </Text>
  </Box>
 );
@@ -15,6 +15,7 @@ import {
  MessageBusType,
  IdeClient,
  CoreToolCallStatus,
+  type SerializableConfirmationDetails,
 } from '@google/gemini-cli-core';
 import { type IndividualToolCallDisplay } from '../types.js';

@@ -182,4 +183,44 @@ describe('ToolActionsContext', () => {

    expect(result.current.isDiffingEnabled).toBe(false);
  });
+
+  it('calls local onConfirm for tools without correlationId', async () => {
+    const mockOnConfirm = vi.fn().mockResolvedValue(undefined);
+    const legacyTool: IndividualToolCallDisplay = {
+      callId: 'legacy-call',
+      name: 'legacy-tool',
+      description: 'desc',
+      status: CoreToolCallStatus.AwaitingApproval,
+      resultDisplay: undefined,
+      confirmationDetails: {
+        type: 'exec',
+        title: 'exec',
+        command: 'ls',
+        rootCommand: 'ls',
+        rootCommands: ['ls'],
+        onConfirm: mockOnConfirm,
+      } as unknown as SerializableConfirmationDetails,
+    };
+
+    const { result } = renderHook(() => useToolActions(), {
+      wrapper: ({ children }) => (
+        <ToolActionsProvider config={mockConfig} toolCalls={[legacyTool]}>
+          {children}
+        </ToolActionsProvider>
+      ),
+    });
+
+    await act(async () => {
+      await result.current.confirm(
+        'legacy-call',
+        ToolConfirmationOutcome.ProceedOnce,
+      );
+    });
+
+    expect(mockOnConfirm).toHaveBeenCalledWith(
+      ToolConfirmationOutcome.ProceedOnce,
+      undefined,
+    );
+    expect(mockMessageBus.publish).not.toHaveBeenCalled();
+  });
 });
@@ -18,10 +18,28 @@ import {
  MessageBusType,
  type Config,
  type ToolConfirmationPayload,
+  type SerializableConfirmationDetails,
  debugLogger,
 } from '@google/gemini-cli-core';
 import type { IndividualToolCallDisplay } from '../types.js';

+type LegacyConfirmationDetails = SerializableConfirmationDetails & {
+  onConfirm: (
+    outcome: ToolConfirmationOutcome,
+    payload?: ToolConfirmationPayload,
+  ) => Promise<void>;
+};
+
+function hasLegacyCallback(
+  details: SerializableConfirmationDetails | undefined,
+): details is LegacyConfirmationDetails {
+  return (
+    !!details &&
+    'onConfirm' in details &&
+    typeof details.onConfirm === 'function'
+  );
+}
+
 interface ToolActionsContextValue {
  confirm: (
    callId: string,
@@ -125,7 +143,15 @@ export const ToolActionsProvider: React.FC<ToolActionsProviderProps> = (
        return;
      }

-      debugLogger.warn(`ToolActions: No correlationId for ${callId}`);
+      // 3. Fallback: Legacy Callback
+      if (hasLegacyCallback(details)) {
+        await details.onConfirm(outcome, payload);
+        return;
+      }
+
+      debugLogger.warn(
+        `ToolActions: No correlationId or callback for ${callId}`,
+      );
    },
    [config, ideClient, toolCalls, isDiffingEnabled],
  );
@@ -155,9 +155,10 @@ describe('useQuotaAndFallback', () => {
        expect(request?.isTerminalQuotaError).toBe(true);

        const message = request!.message;
-        expect(message).toContain('Usage limit reached for gemini-pro.');
+        expect(message).toContain('Usage limit reached for all Pro models.');
        expect(message).toContain('Access resets at'); // From getResetTimeMessage
        expect(message).toContain('/stats model for usage details');
+        expect(message).toContain('/model to switch models.');
        expect(message).toContain('/auth to switch to API key.');

        expect(mockHistoryManager.addItem).not.toHaveBeenCalled();
@@ -176,6 +177,77 @@ describe('useQuotaAndFallback', () => {
        expect(mockHistoryManager.addItem).toHaveBeenCalledTimes(1);
      });

+      it('should show the model name for a terminal quota error on a non-pro model', async () => {
+        const { result } = renderHook(() =>
+          useQuotaAndFallback({
+            config: mockConfig,
+            historyManager: mockHistoryManager,
+            userTier: UserTierId.FREE,
+            setModelSwitchedFromQuotaError: mockSetModelSwitchedFromQuotaError,
+            onShowAuthSelection: mockOnShowAuthSelection,
+          }),
+        );
+
+        const handler = setFallbackHandlerSpy.mock
+          .calls[0][0] as FallbackModelHandler;
+
+        let promise: Promise<FallbackIntent | null>;
+        const error = new TerminalQuotaError(
+          'flash quota',
+          mockGoogleApiError,
+          1000 * 60 * 5,
+        );
+        act(() => {
+          promise = handler('gemini-flash', 'gemini-pro', error);
+        });
+
+        const request = result.current.proQuotaRequest;
+        expect(request).not.toBeNull();
+        expect(request?.failedModel).toBe('gemini-flash');
+
+        const message = request!.message;
+        expect(message).toContain('Usage limit reached for gemini-flash.');
+        expect(message).not.toContain('all Pro models');
+
+        act(() => {
+          result.current.handleProQuotaChoice('retry_later');
+        });
+
+        await promise!;
+      });
+
+      it('should handle terminal quota error without retry delay', async () => {
+        const { result } = renderHook(() =>
+          useQuotaAndFallback({
+            config: mockConfig,
+            historyManager: mockHistoryManager,
+            userTier: UserTierId.FREE,
+            setModelSwitchedFromQuotaError: mockSetModelSwitchedFromQuotaError,
+            onShowAuthSelection: mockOnShowAuthSelection,
+          }),
+        );
+
+        const handler = setFallbackHandlerSpy.mock
+          .calls[0][0] as FallbackModelHandler;
+
+        let promise: Promise<FallbackIntent | null>;
+        const error = new TerminalQuotaError('no delay', mockGoogleApiError);
+        act(() => {
+          promise = handler('gemini-pro', 'gemini-flash', error);
+        });
+
+        const request = result.current.proQuotaRequest;
+        const message = request!.message;
+        expect(message).not.toContain('Access resets at');
+        expect(message).toContain('Usage limit reached for all Pro models.');
+
+        act(() => {
+          result.current.handleProQuotaChoice('retry_later');
+        });
+
+        await promise!;
+      });
+
      it('should handle race conditions by stopping subsequent requests', async () => {
        const { result } = renderHook(() =>
          useQuotaAndFallback({
@@ -14,9 +14,9 @@ import {
  TerminalQuotaError,
  ModelNotFoundError,
  type UserTierId,
-  PREVIEW_GEMINI_MODEL,
-  DEFAULT_GEMINI_MODEL,
  VALID_GEMINI_MODELS,
+  isProModel,
+  getDisplayString,
 } from '@google/gemini-cli-core';
 import { useCallback, useEffect, useRef, useState } from 'react';
 import { type UseHistoryManagerReturn } from './useHistoryManager.js';
@@ -67,11 +67,9 @@ export function useQuotaAndFallback({
      let message: string;
      let isTerminalQuotaError = false;
      let isModelNotFoundError = false;
-      const usageLimitReachedModel =
-        failedModel === DEFAULT_GEMINI_MODEL ||
-        failedModel === PREVIEW_GEMINI_MODEL
-          ? 'all Pro models'
-          : failedModel;
+      const usageLimitReachedModel = isProModel(failedModel)
+        ? 'all Pro models'
+        : failedModel;
      if (error instanceof TerminalQuotaError) {
        isTerminalQuotaError = true;
        // Common part of the message for both tiers
@@ -87,7 +85,7 @@ export function useQuotaAndFallback({
        isModelNotFoundError = true;
        if (VALID_GEMINI_MODELS.has(failedModel)) {
          const messageLines = [
-            `It seems like you don't have access to ${failedModel}.`,
+            `It seems like you don't have access to ${getDisplayString(failedModel)}.`,
            `Your admin might have disabled the access. Contact them to enable the Preview Release Channel.`,
          ];
          message = messageLines.join('\n');
@@ -488,7 +488,10 @@ export class Session {
      const functionCalls: FunctionCall[] = [];

      try {
-        const model = resolveModel(this.config.getModel());
+        const model = resolveModel(
+          this.config.getModel(),
+          (await this.config.getGemini31Launched?.()) ?? false,
+        );
        const responseStream = await chat.sendMessageStream(
          { model },
          nextMessage?.parts ?? [],
@@ -1,6 +1,6 @@
 {
  "name": "@google/gemini-cli-core",
-  "version": "0.30.0-nightly.20260210.a2174751d",
+  "version": "0.30.1",
  "description": "Gemini CLI Core",
  "license": "Apache-2.0",
  "repository": {
@@ -53,6 +53,8 @@
    "ajv-formats": "^3.0.0",
    "chardet": "^2.1.0",
    "diff": "^8.0.3",
+    "dotenv": "^17.2.4",
+    "dotenv-expand": "^12.0.3",
    "fast-levenshtein": "^2.0.6",
    "fdir": "^6.4.6",
    "fzf": "^0.5.2",
@@ -12,6 +12,8 @@ import {
 } from './policyCatalog.js';
 import {
  DEFAULT_GEMINI_MODEL,
+  PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL,
+  PREVIEW_GEMINI_3_1_MODEL,
  PREVIEW_GEMINI_MODEL,
 } from '../config/models.js';

@@ -22,6 +24,27 @@ describe('policyCatalog', () => {
    expect(chain).toHaveLength(2);
  });

+  it('returns Gemini 3.1 chain when useGemini31 is true', () => {
+    const chain = getModelPolicyChain({
+      previewEnabled: true,
+      useGemini31: true,
+    });
+    expect(chain[0]?.model).toBe(PREVIEW_GEMINI_3_1_MODEL);
+    expect(chain).toHaveLength(2);
+    expect(chain[1]?.model).toBe('gemini-3-flash-preview');
+  });
+
+  it('returns Gemini 3.1 Custom Tools chain when useGemini31 and useCustomToolModel are true', () => {
+    const chain = getModelPolicyChain({
+      previewEnabled: true,
+      useGemini31: true,
+      useCustomToolModel: true,
+    });
+    expect(chain[0]?.model).toBe(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL);
+    expect(chain).toHaveLength(2);
+    expect(chain[1]?.model).toBe('gemini-3-flash-preview');
+  });
+
  it('returns default chain when preview disabled', () => {
    const chain = getModelPolicyChain({ previewEnabled: false });
    expect(chain[0]?.model).toBe(DEFAULT_GEMINI_MODEL);
@@ -16,6 +16,7 @@ import {
  DEFAULT_GEMINI_MODEL,
  PREVIEW_GEMINI_FLASH_MODEL,
  PREVIEW_GEMINI_MODEL,
+  resolveModel,
 } from '../config/models.js';
 import type { UserTierId } from '../code_assist/types.js';

@@ -28,6 +29,8 @@ type PolicyConfig = Omit<ModelPolicy, 'actions' | 'stateTransitions'> & {
 export interface ModelPolicyOptions {
  previewEnabled: boolean;
  userTier?: UserTierId;
+  useGemini31?: boolean;
+  useCustomToolModel?: boolean;
 }

 const DEFAULT_ACTIONS: ModelPolicyActionMap = {
@@ -56,11 +59,6 @@ const DEFAULT_CHAIN: ModelPolicyChain = [
  definePolicy({ model: DEFAULT_GEMINI_FLASH_MODEL, isLastResort: true }),
 ];

-const PREVIEW_CHAIN: ModelPolicyChain = [
-  definePolicy({ model: PREVIEW_GEMINI_MODEL }),
-  definePolicy({ model: PREVIEW_GEMINI_FLASH_MODEL, isLastResort: true }),
-];
-
 const FLASH_LITE_CHAIN: ModelPolicyChain = [
  definePolicy({
    model: DEFAULT_GEMINI_FLASH_LITE_MODEL,
@@ -84,7 +82,15 @@ export function getModelPolicyChain(
  options: ModelPolicyOptions,
 ): ModelPolicyChain {
  if (options.previewEnabled) {
-    return cloneChain(PREVIEW_CHAIN);
+    const previewModel = resolveModel(
+      PREVIEW_GEMINI_MODEL,
+      options.useGemini31,
+      options.useCustomToolModel,
+    );
+    return [
+      definePolicy({ model: previewModel }),
+      definePolicy({ model: PREVIEW_GEMINI_FLASH_MODEL, isLastResort: true }),
+    ];
  }

  return cloneChain(DEFAULT_CHAIN);
@@ -15,12 +15,17 @@ import type { Config } from '../config/config.js';
 import {
  DEFAULT_GEMINI_FLASH_LITE_MODEL,
  DEFAULT_GEMINI_MODEL_AUTO,
+  PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL,
+  PREVIEW_GEMINI_3_1_MODEL,
 } from '../config/models.js';
+import { AuthType } from '../core/contentGenerator.js';

 const createMockConfig = (overrides: Partial<Config> = {}): Config =>
  ({
    getUserTier: () => undefined,
    getModel: () => 'gemini-2.5-pro',
+    getGemini31LaunchedSync: () => false,
+    getContentGeneratorConfig: () => ({ authType: undefined }),
    ...overrides,
  }) as unknown as Config;

@@ -128,6 +133,27 @@ describe('policyHelpers', () => {
      expect(chain[0]?.model).toBe('gemini-2.5-pro');
      expect(chain[1]?.model).toBe('gemini-2.5-flash');
    });
+
+    it('returns Gemini 3.1 Pro chain when launched and auto-gemini-3 requested', () => {
+      const config = createMockConfig({
+        getModel: () => 'auto-gemini-3',
+        getGemini31LaunchedSync: () => true,
+      });
+      const chain = resolvePolicyChain(config);
+      expect(chain[0]?.model).toBe(PREVIEW_GEMINI_3_1_MODEL);
+      expect(chain[1]?.model).toBe('gemini-3-flash-preview');
+    });
+
+    it('returns Gemini 3.1 Pro Custom Tools chain when launched, auth is Gemini, and auto-gemini-3 requested', () => {
+      const config = createMockConfig({
+        getModel: () => 'auto-gemini-3',
+        getGemini31LaunchedSync: () => true,
+        getContentGeneratorConfig: () => ({ authType: AuthType.USE_GEMINI }),
+      });
+      const chain = resolvePolicyChain(config);
+      expect(chain[0]?.model).toBe(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL);
+      expect(chain[1]?.model).toBe('gemini-3-flash-preview');
+    });
  });

  describe('buildFallbackPolicyContext', () => {
@@ -6,6 +6,7 @@

 import type { GenerateContentConfig } from '@google/genai';
 import type { Config } from '../config/config.js';
+import { AuthType } from '../core/contentGenerator.js';
 import type {
  FailureKind,
  FallbackAction,
@@ -44,7 +45,16 @@ export function resolvePolicyChain(
  const configuredModel = config.getModel();

  let chain;
-  const resolvedModel = resolveModel(modelFromConfig);
+  const useGemini31 = config.getGemini31LaunchedSync?.() ?? false;
+  const useCustomToolModel =
+    useGemini31 &&
+    config.getContentGeneratorConfig?.()?.authType === AuthType.USE_GEMINI;
+
+  const resolvedModel = resolveModel(
+    modelFromConfig,
+    useGemini31,
+    useCustomToolModel,
+  );
  const isAutoPreferred = preferredModel ? isAutoModel(preferredModel) : false;
  const isAutoConfigured = isAutoModel(configuredModel);
  const hasAccessToPreview = config.getHasAccessToPreviewModel?.() ?? true;
@@ -64,6 +74,8 @@ export function resolvePolicyChain(
      chain = getModelPolicyChain({
        previewEnabled,
        userTier: config.getUserTier(),
+        useGemini31,
+        useCustomToolModel,
      });
    } else {
      // User requested Gemini 3 but has no access. Proactively downgrade
@@ -71,6 +83,8 @@ export function resolvePolicyChain(
      return getModelPolicyChain({
        previewEnabled: false,
        userTier: config.getUserTier(),
+        useGemini31,
+        useCustomToolModel,
      });
    }
  } else {
@@ -345,6 +345,7 @@ describe('Admin Controls', () => {
      // Should still start polling
      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
        strictModeDisabled: true,
+        adminControlsApplicable: true,
      });
      await vi.advanceTimersByTimeAsync(5 * 60 * 1000);

@@ -363,7 +364,10 @@ describe('Admin Controls', () => {
    });

    it('should fetch from server if no cachedSettings provided', async () => {
-      const serverResponse = { strictModeDisabled: false };
+      const serverResponse = {
+        strictModeDisabled: false,
+        adminControlsApplicable: true,
+      };
      (mockServer.fetchAdminControls as Mock).mockResolvedValue(serverResponse);

      const result = await fetchAdminControls(
@@ -386,31 +390,24 @@ describe('Admin Controls', () => {
      expect(mockServer.fetchAdminControls).toHaveBeenCalledTimes(1);
    });

-    it('should return empty object on fetch error and still start polling', async () => {
-      (mockServer.fetchAdminControls as Mock).mockRejectedValue(
-        new Error('Network error'),
-      );
-      const result = await fetchAdminControls(
-        mockServer,
-        undefined,
-        true,
-        mockOnSettingsChanged,
-      );
+    it('should throw error on fetch error and NOT start polling', async () => {
+      const error = new Error('Network error');
+      (mockServer.fetchAdminControls as Mock).mockRejectedValue(error);

-      expect(result).toEqual({});
+      await expect(
+        fetchAdminControls(mockServer, undefined, true, mockOnSettingsChanged),
+      ).rejects.toThrow(error);

-      // Polling should have been started and should retry
-      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
-        strictModeDisabled: false,
-      });
+      // Polling should NOT have been started
+      // Advance timers just to be absolutely sure
      await vi.advanceTimersByTimeAsync(5 * 60 * 1000);
-      expect(mockServer.fetchAdminControls).toHaveBeenCalledTimes(2); // Initial + poll
+      expect(mockServer.fetchAdminControls).toHaveBeenCalledTimes(1); // Only initial fetch
    });

-    it('should return empty object on 403 fetch error and STOP polling', async () => {
-      const error403 = new Error('Forbidden');
-      Object.assign(error403, { status: 403 });
-      (mockServer.fetchAdminControls as Mock).mockRejectedValue(error403);
+    it('should return empty object on adminControlsApplicable false and STOP polling', async () => {
+      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
+        adminControlsApplicable: false,
+      });

      const result = await fetchAdminControls(
        mockServer,
@@ -421,7 +418,7 @@ describe('Admin Controls', () => {

      expect(result).toEqual({});

-      // Advance time - should NOT poll because of 403
+      // Advance time - should NOT poll because of adminControlsApplicable: false
      await vi.advanceTimersByTimeAsync(5 * 60 * 1000);
      expect(mockServer.fetchAdminControls).toHaveBeenCalledTimes(1); // Only the initial call
    });
@@ -430,6 +427,7 @@ describe('Admin Controls', () => {
      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
        strictModeDisabled: false,
        unknownField: 'bad',
+        adminControlsApplicable: true,
      });

      const result = await fetchAdminControls(
@@ -455,7 +453,9 @@ describe('Admin Controls', () => {
    });

    it('should reset polling interval if called again', async () => {
-      (mockServer.fetchAdminControls as Mock).mockResolvedValue({});
+      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
+        adminControlsApplicable: true,
+      });

      // First call
      await fetchAdminControls(
@@ -514,6 +514,7 @@ describe('Admin Controls', () => {
      const serverResponse = {
        strictModeDisabled: true,
        unknownField: 'should be removed',
+        adminControlsApplicable: true,
      };
      (mockServer.fetchAdminControls as Mock).mockResolvedValue(serverResponse);

@@ -532,22 +533,22 @@ describe('Admin Controls', () => {
      expect(mockServer.fetchAdminControls).toHaveBeenCalledTimes(1);
    });

-    it('should return empty object on 403 fetch error', async () => {
-      const error403 = new Error('Forbidden');
-      Object.assign(error403, { status: 403 });
-      (mockServer.fetchAdminControls as Mock).mockRejectedValue(error403);
+    it('should return empty object on adminControlsApplicable false', async () => {
+      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
+        adminControlsApplicable: false,
+      });

      const result = await fetchAdminControlsOnce(mockServer, true);
      expect(result).toEqual({});
      expect(mockServer.fetchAdminControls).toHaveBeenCalledTimes(1);
    });

-    it('should return empty object on any other fetch error', async () => {
-      (mockServer.fetchAdminControls as Mock).mockRejectedValue(
-        new Error('Network error'),
+    it('should throw error on any other fetch error', async () => {
+      const error = new Error('Network error');
+      (mockServer.fetchAdminControls as Mock).mockRejectedValue(error);
+      await expect(fetchAdminControlsOnce(mockServer, true)).rejects.toThrow(
+        error,
      );
-      const result = await fetchAdminControlsOnce(mockServer, true);
-      expect(result).toEqual({});
      expect(mockServer.fetchAdminControls).toHaveBeenCalledTimes(1);
    });

@@ -555,7 +556,9 @@ describe('Admin Controls', () => {
      const setIntervalSpy = vi.spyOn(global, 'setInterval');
      const clearIntervalSpy = vi.spyOn(global, 'clearInterval');

-      (mockServer.fetchAdminControls as Mock).mockResolvedValue({});
+      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
+        adminControlsApplicable: true,
+      });
      await fetchAdminControlsOnce(mockServer, true);

      expect(setIntervalSpy).not.toHaveBeenCalled();
@@ -568,6 +571,7 @@ describe('Admin Controls', () => {
      // Initial fetch
      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
        strictModeDisabled: true,
+        adminControlsApplicable: true,
      });
      await fetchAdminControls(
        mockServer,
@@ -579,6 +583,7 @@ describe('Admin Controls', () => {
      // Update for next poll
      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
        strictModeDisabled: false,
+        adminControlsApplicable: true,
      });

      // Fast forward
@@ -598,7 +603,10 @@ describe('Admin Controls', () => {
    });

    it('should NOT emit if settings are deeply equal but not the same instance', async () => {
-      const settings = { strictModeDisabled: false };
+      const settings = {
+        strictModeDisabled: false,
+        adminControlsApplicable: true,
+      };
      (mockServer.fetchAdminControls as Mock).mockResolvedValue(settings);

      await fetchAdminControls(
@@ -613,6 +621,7 @@ describe('Admin Controls', () => {
      // Next poll returns a different object with the same values
      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
        strictModeDisabled: false,
+        adminControlsApplicable: true,
      });
      await vi.advanceTimersByTimeAsync(5 * 60 * 1000);

@@ -623,6 +632,7 @@ describe('Admin Controls', () => {
      // Initial fetch is successful
      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
        strictModeDisabled: true,
+        adminControlsApplicable: true,
      });
      await fetchAdminControls(
        mockServer,
@@ -643,6 +653,7 @@ describe('Admin Controls', () => {
      // Subsequent poll succeeds with new data
      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
        strictModeDisabled: false,
+        adminControlsApplicable: true,
      });
      await vi.advanceTimersByTimeAsync(5 * 60 * 1000);
      expect(mockServer.fetchAdminControls).toHaveBeenCalledTimes(3);
@@ -659,10 +670,11 @@ describe('Admin Controls', () => {
      });
    });

-    it('should STOP polling if server returns 403', async () => {
+    it('should STOP polling if server returns adminControlsApplicable false', async () => {
      // Initial fetch is successful
      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
        strictModeDisabled: true,
+        adminControlsApplicable: true,
      });
      await fetchAdminControls(
        mockServer,
@@ -672,10 +684,10 @@ describe('Admin Controls', () => {
      );
      expect(mockServer.fetchAdminControls).toHaveBeenCalledTimes(1);

-      // Next poll returns 403
-      const error403 = new Error('Forbidden');
-      Object.assign(error403, { status: 403 });
-      (mockServer.fetchAdminControls as Mock).mockRejectedValue(error403);
+      // Next poll returns adminControlsApplicable: false
+      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
+        adminControlsApplicable: false,
+      });

      await vi.advanceTimersByTimeAsync(5 * 60 * 1000);
      expect(mockServer.fetchAdminControls).toHaveBeenCalledTimes(2);
@@ -688,7 +700,9 @@ describe('Admin Controls', () => {

  describe('stopAdminControlsPolling', () => {
    it('should stop polling after it has started', async () => {
-      (mockServer.fetchAdminControls as Mock).mockResolvedValue({});
+      (mockServer.fetchAdminControls as Mock).mockResolvedValue({
+        adminControlsApplicable: true,
+      });

      // Start polling
      await fetchAdminControls(
@@ -80,15 +80,6 @@ export function sanitizeAdminSettings(
  };
 }

-function isGaxiosError(error: unknown): error is { status: number } {
-  return (
-    typeof error === 'object' &&
-    error !== null &&
-    'status' in error &&
-    typeof (error as { status: unknown }).status === 'number'
-  );
-}
-
 /**
 * Fetches the admin controls from the server if enabled by experiment flag.
 * Safely handles polling start/stop based on the flag and server availability.
@@ -113,7 +104,7 @@ export async function fetchAdminControls(

  // If we already have settings (e.g. from IPC during relaunch), use them
  // to avoid blocking startup with another fetch. We'll still start polling.
-  if (cachedSettings) {
+  if (cachedSettings && Object.keys(cachedSettings).length !== 0) {
    currentSettings = cachedSettings;
    startAdminControlsPolling(server, server.projectId, onSettingsChanged);
    return cachedSettings;
@@ -123,22 +114,20 @@ export async function fetchAdminControls(
    const rawSettings = await server.fetchAdminControls({
      project: server.projectId,
    });
+
+    if (rawSettings.adminControlsApplicable !== true) {
+      stopAdminControlsPolling();
+      currentSettings = undefined;
+      return {};
+    }
+
    const sanitizedSettings = sanitizeAdminSettings(rawSettings);
    currentSettings = sanitizedSettings;
    startAdminControlsPolling(server, server.projectId, onSettingsChanged);
    return sanitizedSettings;
  } catch (e) {
-    // Non-enterprise users don't have access to fetch settings.
-    if (isGaxiosError(e) && e.status === 403) {
-      stopAdminControlsPolling();
-      currentSettings = undefined;
-      return {};
-    }
    debugLogger.error('Failed to fetch admin controls: ', e);
-    // If initial fetch fails, start polling to retry.
-    currentSettings = {};
-    startAdminControlsPolling(server, server.projectId, onSettingsChanged);
-    return {};
+    throw e;
  }
 }

@@ -162,17 +151,18 @@ export async function fetchAdminControlsOnce(
    const rawSettings = await server.fetchAdminControls({
      project: server.projectId,
    });
-    return sanitizeAdminSettings(rawSettings);
-  } catch (e) {
-    // Non-enterprise users don't have access to fetch settings.
-    if (isGaxiosError(e) && e.status === 403) {
+
+    if (rawSettings.adminControlsApplicable !== true) {
      return {};
    }
+
+    return sanitizeAdminSettings(rawSettings);
+  } catch (e) {
    debugLogger.error(
      'Failed to fetch admin controls: ',
      e instanceof Error ? e.message : e,
    );
-    return {};
+    throw e;
  }
 }

@@ -192,6 +182,13 @@ function startAdminControlsPolling(
        const rawSettings = await server.fetchAdminControls({
          project,
        });
+
+        if (rawSettings.adminControlsApplicable !== true) {
+          stopAdminControlsPolling();
+          currentSettings = undefined;
+          return;
+        }
+
        const newSettings = sanitizeAdminSettings(rawSettings);

        if (!isDeepStrictEqual(newSettings, currentSettings)) {
@@ -199,12 +196,6 @@ function startAdminControlsPolling(
          onSettingsChanged(newSettings);
        }
      } catch (e) {
-        // Non-enterprise users don't have access to fetch settings.
-        if (isGaxiosError(e) && e.status === 403) {
-          stopAdminControlsPolling();
-          currentSettings = undefined;
-          return;
-        }
        debugLogger.error('Failed to poll admin controls: ', e);
      }
    },
@@ -16,6 +16,7 @@ export const ExperimentFlags = {
  MASKING_PROTECTION_THRESHOLD: 45758817,
  MASKING_PRUNABLE_THRESHOLD: 45758818,
  MASKING_PROTECT_LATEST_TURN: 45758819,
+  GEMINI_3_1_PRO_LAUNCHED: 45760185,
 } as const;

 export type ExperimentFlagName =
@@ -355,4 +355,5 @@ export const FetchAdminControlsResponseSchema = z.object({
  strictModeDisabled: z.boolean().optional(),
  mcpSetting: McpSettingSchema.optional(),
  cliFeatureSetting: CliFeatureSettingSchema.optional(),
+  adminControlsApplicable: z.boolean().optional(),
 });
@@ -2063,6 +2063,21 @@ describe('Config Quota & Preview Model Access', () => {
      expect(config.getHasAccessToPreviewModel()).toBe(true);
    });

+    it('should update hasAccessToPreviewModel to true if quota includes Gemini 3.1 preview model', async () => {
+      mockCodeAssistServer.retrieveUserQuota.mockResolvedValue({
+        buckets: [
+          {
+            modelId: 'gemini-3.1-pro-preview',
+            remainingAmount: '100',
+            remainingFraction: 1.0,
+          },
+        ],
+      });
+
+      await config.refreshUserQuota();
+      expect(config.getHasAccessToPreviewModel()).toBe(true);
+    });
+
    it('should update hasAccessToPreviewModel to false if quota does not include preview model', async () => {
      mockCodeAssistServer.retrieveUserQuota.mockResolvedValue({
        buckets: [
@@ -1041,6 +1041,12 @@ export class Config {
    // Reset availability status when switching auth (e.g. from limited key to OAuth)
    this.modelAvailabilityService.reset();

+    // Clear stale authType to ensure getGemini31LaunchedSync doesn't return stale results
+    // during the transition.
+    if (this.contentGeneratorConfig) {
+      this.contentGeneratorConfig.authType = undefined;
+    }
+
    const newContentGeneratorConfig = await createContentGeneratorConfig(
      this,
      authMethod,
@@ -1163,7 +1169,7 @@ export class Config {
    return this.remoteAdminSettings;
  }

-  setRemoteAdminSettings(settings: AdminControlsSettings): void {
+  setRemoteAdminSettings(settings: AdminControlsSettings | undefined): void {
    this.remoteAdminSettings = settings;
  }

@@ -1320,7 +1326,10 @@ export class Config {
    if (pooled.remaining !== undefined) {
      return pooled.remaining;
    }
-    const primaryModel = resolveModel(this.getModel());
+    const primaryModel = resolveModel(
+      this.getModel(),
+      this.getGemini31LaunchedSync(),
+    );
    return this.modelQuotas.get(primaryModel)?.remaining;
  }

@@ -1329,7 +1338,10 @@ export class Config {
    if (pooled.limit !== undefined) {
      return pooled.limit;
    }
-    const primaryModel = resolveModel(this.getModel());
+    const primaryModel = resolveModel(
+      this.getModel(),
+      this.getGemini31LaunchedSync(),
+    );
    return this.modelQuotas.get(primaryModel)?.limit;
  }

@@ -1338,7 +1350,10 @@ export class Config {
    if (pooled.resetTime !== undefined) {
      return pooled.resetTime;
    }
-    const primaryModel = resolveModel(this.getModel());
+    const primaryModel = resolveModel(
+      this.getModel(),
+      this.getGemini31LaunchedSync(),
+    );
    return this.modelQuotas.get(primaryModel)?.resetTime;
  }

@@ -1452,7 +1467,8 @@ export class Config {
      }

      const hasAccess =
-        quota.buckets?.some((b) => b.modelId === PREVIEW_GEMINI_MODEL) ?? false;
+        quota.buckets?.some((b) => b.modelId && isPreviewModel(b.modelId)) ??
+        false;
      this.setHasAccessToPreviewModel(hasAccess);
      return quota;
    } catch (e) {
@@ -2175,6 +2191,36 @@ export class Config {
    );
  }

+  /**
+   * Returns whether Gemini 3.1 has been launched.
+   * This method is async and ensures that experiments are loaded before returning the result.
+   */
+  async getGemini31Launched(): Promise<boolean> {
+    await this.ensureExperimentsLoaded();
+    return this.getGemini31LaunchedSync();
+  }
+
+  /**
+   * Returns whether Gemini 3.1 has been launched.
+   *
+   * Note: This method should only be called after startup, once experiments have been loaded.
+   * If you need to call this during startup or from an async context, use
+   * getGemini31Launched instead.
+   */
+  getGemini31LaunchedSync(): boolean {
+    const authType = this.contentGeneratorConfig?.authType;
+    if (
+      authType === AuthType.USE_GEMINI ||
+      authType === AuthType.USE_VERTEX_AI
+    ) {
+      return true;
+    }
+    return (
+      this.experiments?.flags[ExperimentFlags.GEMINI_3_1_PRO_LAUNCHED]
+        ?.boolValue ?? false
+    );
+  }
+
  private async ensureExperimentsLoaded(): Promise<void> {
    if (!this.experimentsPromise) {
      return;
@@ -25,8 +25,42 @@ import {
  PREVIEW_GEMINI_FLASH_MODEL,
  PREVIEW_GEMINI_MODEL_AUTO,
  DEFAULT_GEMINI_MODEL_AUTO,
+  isActiveModel,
+  PREVIEW_GEMINI_3_1_MODEL,
+  PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL,
+  isPreviewModel,
+  isProModel,
 } from './models.js';

+describe('isPreviewModel', () => {
+  it('should return true for preview models', () => {
+    expect(isPreviewModel(PREVIEW_GEMINI_MODEL)).toBe(true);
+    expect(isPreviewModel(PREVIEW_GEMINI_3_1_MODEL)).toBe(true);
+    expect(isPreviewModel(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL)).toBe(true);
+    expect(isPreviewModel(PREVIEW_GEMINI_FLASH_MODEL)).toBe(true);
+    expect(isPreviewModel(PREVIEW_GEMINI_MODEL_AUTO)).toBe(true);
+  });
+
+  it('should return false for non-preview models', () => {
+    expect(isPreviewModel(DEFAULT_GEMINI_MODEL)).toBe(false);
+    expect(isPreviewModel('gemini-1.5-pro')).toBe(false);
+  });
+});
+
+describe('isProModel', () => {
+  it('should return true for models containing "pro"', () => {
+    expect(isProModel('gemini-3-pro-preview')).toBe(true);
+    expect(isProModel('gemini-2.5-pro')).toBe(true);
+    expect(isProModel('pro')).toBe(true);
+  });
+
+  it('should return false for models without "pro"', () => {
+    expect(isProModel('gemini-3-flash-preview')).toBe(false);
+    expect(isProModel('gemini-2.5-flash')).toBe(false);
+    expect(isProModel('auto')).toBe(false);
+  });
+});
+
 describe('isCustomModel', () => {
  it('should return true for models not starting with gemini-', () => {
    expect(isCustomModel('testing')).toBe(true);
@@ -115,6 +149,12 @@ describe('getDisplayString', () => {
    );
  });

+  it('should return PREVIEW_GEMINI_3_1_MODEL for PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL', () => {
+    expect(getDisplayString(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL)).toBe(
+      PREVIEW_GEMINI_3_1_MODEL,
+    );
+  });
+
  it('should return the model name as is for other models', () => {
    expect(getDisplayString('custom-model')).toBe('custom-model');
    expect(getDisplayString(DEFAULT_GEMINI_FLASH_LITE_MODEL)).toBe(
@@ -146,6 +186,16 @@ describe('resolveModel', () => {
      expect(model).toBe(PREVIEW_GEMINI_MODEL);
    });

+    it('should return Gemini 3.1 Pro when auto-gemini-3 is requested and useGemini3_1 is true', () => {
+      const model = resolveModel(PREVIEW_GEMINI_MODEL_AUTO, true);
+      expect(model).toBe(PREVIEW_GEMINI_3_1_MODEL);
+    });
+
+    it('should return Gemini 3.1 Pro Custom Tools when auto-gemini-3 is requested, useGemini3_1 is true, and useCustomToolModel is true', () => {
+      const model = resolveModel(PREVIEW_GEMINI_MODEL_AUTO, true, true);
+      expect(model).toBe(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL);
+    });
+
    it('should return the Default Pro model when auto-gemini-2.5 is requested', () => {
      const model = resolveModel(DEFAULT_GEMINI_MODEL_AUTO);
      expect(model).toBe(DEFAULT_GEMINI_MODEL);
@@ -239,4 +289,71 @@ describe('resolveClassifierModel', () => {
      resolveClassifierModel(PREVIEW_GEMINI_MODEL_AUTO, GEMINI_MODEL_ALIAS_PRO),
    ).toBe(PREVIEW_GEMINI_MODEL);
  });
+
+  it('should return Gemini 3.1 Pro when alias is pro and useGemini3_1 is true', () => {
+    expect(
+      resolveClassifierModel(
+        PREVIEW_GEMINI_MODEL_AUTO,
+        GEMINI_MODEL_ALIAS_PRO,
+        true,
+      ),
+    ).toBe(PREVIEW_GEMINI_3_1_MODEL);
+  });
+
+  it('should return Gemini 3.1 Pro Custom Tools when alias is pro, useGemini3_1 is true, and useCustomToolModel is true', () => {
+    expect(
+      resolveClassifierModel(
+        PREVIEW_GEMINI_MODEL_AUTO,
+        GEMINI_MODEL_ALIAS_PRO,
+        true,
+        true,
+      ),
+    ).toBe(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL);
+  });
+});
+
+describe('isActiveModel', () => {
+  it('should return true for valid models when useGemini3_1 is false', () => {
+    expect(isActiveModel(DEFAULT_GEMINI_MODEL)).toBe(true);
+    expect(isActiveModel(PREVIEW_GEMINI_MODEL)).toBe(true);
+    expect(isActiveModel(DEFAULT_GEMINI_FLASH_MODEL)).toBe(true);
+  });
+
+  it('should return true for unknown models and aliases', () => {
+    expect(isActiveModel('invalid-model')).toBe(false);
+    expect(isActiveModel(GEMINI_MODEL_ALIAS_AUTO)).toBe(false);
+  });
+
+  it('should return false for PREVIEW_GEMINI_MODEL when useGemini3_1 is true', () => {
+    expect(isActiveModel(PREVIEW_GEMINI_MODEL, true)).toBe(false);
+  });
+
+  it('should return true for other valid models when useGemini3_1 is true', () => {
+    expect(isActiveModel(DEFAULT_GEMINI_MODEL, true)).toBe(true);
+  });
+
+  it('should correctly filter Gemini 3.1 models based on useCustomToolModel when useGemini3_1 is true', () => {
+    // When custom tools are preferred, standard 3.1 should be inactive
+    expect(isActiveModel(PREVIEW_GEMINI_3_1_MODEL, true, true)).toBe(false);
+    expect(
+      isActiveModel(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL, true, true),
+    ).toBe(true);
+
+    // When custom tools are NOT preferred, custom tools 3.1 should be inactive
+    expect(isActiveModel(PREVIEW_GEMINI_3_1_MODEL, true, false)).toBe(true);
+    expect(
+      isActiveModel(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL, true, false),
+    ).toBe(false);
+  });
+
+  it('should return false for both Gemini 3.1 models when useGemini3_1 is false', () => {
+    expect(isActiveModel(PREVIEW_GEMINI_3_1_MODEL, false, true)).toBe(false);
+    expect(isActiveModel(PREVIEW_GEMINI_3_1_MODEL, false, false)).toBe(false);
+    expect(
+      isActiveModel(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL, false, true),
+    ).toBe(false);
+    expect(
+      isActiveModel(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL, false, false),
+    ).toBe(false);
+  });
 });
@@ -5,6 +5,9 @@
 */

 export const PREVIEW_GEMINI_MODEL = 'gemini-3-pro-preview';
+export const PREVIEW_GEMINI_3_1_MODEL = 'gemini-3.1-pro-preview';
+export const PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL =
+  'gemini-3.1-pro-preview-customtools';
 export const PREVIEW_GEMINI_FLASH_MODEL = 'gemini-3-flash-preview';
 export const DEFAULT_GEMINI_MODEL = 'gemini-2.5-pro';
 export const DEFAULT_GEMINI_FLASH_MODEL = 'gemini-2.5-flash';
@@ -12,6 +15,8 @@ export const DEFAULT_GEMINI_FLASH_LITE_MODEL = 'gemini-2.5-flash-lite';

 export const VALID_GEMINI_MODELS = new Set([
  PREVIEW_GEMINI_MODEL,
+  PREVIEW_GEMINI_3_1_MODEL,
+  PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL,
  PREVIEW_GEMINI_FLASH_MODEL,
  DEFAULT_GEMINI_MODEL,
  DEFAULT_GEMINI_FLASH_MODEL,
@@ -37,20 +42,29 @@ export const DEFAULT_THINKING_MODE = 8192;
 * to a concrete model name.
 *
 * @param requestedModel The model alias or concrete model name requested by the user.
+ * @param useGemini3_1 Whether to use Gemini 3.1 Pro Preview for auto/pro aliases.
 * @returns The resolved concrete model name.
 */
-export function resolveModel(requestedModel: string): string {
+export function resolveModel(
+  requestedModel: string,
+  useGemini3_1: boolean = false,
+  useCustomToolModel: boolean = false,
+): string {
  switch (requestedModel) {
-    case PREVIEW_GEMINI_MODEL_AUTO: {
+    case PREVIEW_GEMINI_MODEL:
+    case PREVIEW_GEMINI_MODEL_AUTO:
+    case GEMINI_MODEL_ALIAS_AUTO:
+    case GEMINI_MODEL_ALIAS_PRO: {
+      if (useGemini3_1) {
+        return useCustomToolModel
+          ? PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL
+          : PREVIEW_GEMINI_3_1_MODEL;
+      }
      return PREVIEW_GEMINI_MODEL;
    }
    case DEFAULT_GEMINI_MODEL_AUTO: {
      return DEFAULT_GEMINI_MODEL;
    }
-    case GEMINI_MODEL_ALIAS_AUTO:
-    case GEMINI_MODEL_ALIAS_PRO: {
-      return PREVIEW_GEMINI_MODEL;
-    }
    case GEMINI_MODEL_ALIAS_FLASH: {
      return PREVIEW_GEMINI_FLASH_MODEL;
    }
@@ -73,6 +87,8 @@ export function resolveModel(requestedModel: string): string {
 export function resolveClassifierModel(
  requestedModel: string,
  modelAlias: string,
+  useGemini3_1: boolean = false,
+  useCustomToolModel: boolean = false,
 ): string {
  if (modelAlias === GEMINI_MODEL_ALIAS_FLASH) {
    if (
@@ -89,7 +105,7 @@ export function resolveClassifierModel(
    }
    return resolveModel(GEMINI_MODEL_ALIAS_FLASH);
  }
-  return resolveModel(requestedModel);
+  return resolveModel(requestedModel, useGemini3_1, useCustomToolModel);
 }
 export function getDisplayString(model: string) {
  switch (model) {
@@ -101,6 +117,8 @@ export function getDisplayString(model: string) {
      return PREVIEW_GEMINI_MODEL;
    case GEMINI_MODEL_ALIAS_FLASH:
      return PREVIEW_GEMINI_FLASH_MODEL;
+    case PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL:
+      return PREVIEW_GEMINI_3_1_MODEL;
    default:
      return model;
  }
@@ -115,11 +133,23 @@ export function getDisplayString(model: string) {
 export function isPreviewModel(model: string): boolean {
  return (
    model === PREVIEW_GEMINI_MODEL ||
+    model === PREVIEW_GEMINI_3_1_MODEL ||
+    model === PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL ||
    model === PREVIEW_GEMINI_FLASH_MODEL ||
    model === PREVIEW_GEMINI_MODEL_AUTO
  );
 }

+/**
+ * Checks if the model is a Pro model.
+ *
+ * @param model The model name to check.
+ * @returns True if the model is a Pro model.
+ */
+export function isProModel(model: string): boolean {
+  return model.toLowerCase().includes('pro');
+}
+
 /**
 * Checks if the model is a Gemini 3 model.
 *
@@ -188,3 +218,35 @@ export function isAutoModel(model: string): boolean {
 export function supportsMultimodalFunctionResponse(model: string): boolean {
  return model.startsWith('gemini-3-');
 }
+
+/**
+ * Checks if the given model is considered active based on the current configuration.
+ *
+ * @param model The model name to check.
+ * @param useGemini3_1 Whether Gemini 3.1 Pro Preview is enabled.
+ * @returns True if the model is active.
+ */
+export function isActiveModel(
+  model: string,
+  useGemini3_1: boolean = false,
+  useCustomToolModel: boolean = false,
+): boolean {
+  if (!VALID_GEMINI_MODELS.has(model)) {
+    return false;
+  }
+  if (useGemini3_1) {
+    if (model === PREVIEW_GEMINI_MODEL) {
+      return false;
+    }
+    if (useCustomToolModel) {
+      return model !== PREVIEW_GEMINI_3_1_MODEL;
+    } else {
+      return model !== PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL;
+    }
+  } else {
+    return (
+      model !== PREVIEW_GEMINI_3_1_MODEL &&
+      model !== PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL
+    );
+  }
+}
@@ -542,7 +542,10 @@ export class GeminiClient {

    // Availability logic: The configured model is the source of truth,
    // including any permanent fallbacks (config.setModel) or manual overrides.
-    return resolveModel(this.config.getActiveModel());
+    return resolveModel(
+      this.config.getActiveModel(),
+      this.config.getGemini31LaunchedSync?.() ?? false,
+    );
  }

  private async *processTurn(
@@ -146,7 +146,12 @@ export async function createContentGenerator(
      return new LoggingContentGenerator(fakeGenerator, gcConfig);
    }
    const version = await getVersion();
-    const model = resolveModel(gcConfig.getModel());
+    const model = resolveModel(
+      gcConfig.getModel(),
+      config.authType === AuthType.USE_GEMINI ||
+        config.authType === AuthType.USE_VERTEX_AI ||
+        ((await gcConfig.getGemini31Launched?.()) ?? false),
+    );
    const customHeadersEnv =
      process.env['GEMINI_CLI_CUSTOM_HEADERS'] || undefined;
    const userAgent = `GeminiCLI/${version}/${model} (${process.platform}; ${process.arch})`;
@@ -496,13 +496,14 @@ export class GeminiChat {
    const initialActiveModel = this.config.getActiveModel();

    const apiCall = async () => {
+      const useGemini3_1 = (await this.config.getGemini31Launched?.()) ?? false;
      // Default to the last used model (which respects arguments/availability selection)
-      let modelToUse = resolveModel(lastModelToUse);
+      let modelToUse = resolveModel(lastModelToUse, useGemini3_1);

      // If the active model has changed (e.g. due to a fallback updating the config),
      // we switch to the new active model.
      if (this.config.getActiveModel() !== initialActiveModel) {
-        modelToUse = resolveModel(this.config.getActiveModel());
+        modelToUse = resolveModel(this.config.getActiveModel(), useGemini3_1);
      }

      if (modelToUse !== lastModelToUse) {
@@ -58,7 +58,10 @@ export class PromptProvider {
    const enabledToolNames = new Set(toolNames);
    const approvedPlanPath = config.getApprovedPlanPath();

-    const desiredModel = resolveModel(config.getActiveModel());
+    const desiredModel = resolveModel(
+      config.getActiveModel(),
+      config.getGemini31LaunchedSync?.() ?? false,
+    );
    const isModernModel = supportsModernFeatures(desiredModel);
    const activeSnippets = isModernModel ? snippets : legacySnippets;
    const contextFilenames = getAllGeminiMdFilenames();
@@ -231,7 +234,10 @@ export class PromptProvider {
  }

  getCompressionPrompt(config: Config): string {
-    const desiredModel = resolveModel(config.getActiveModel());
+    const desiredModel = resolveModel(
+      config.getActiveModel(),
+      config.getGemini31LaunchedSync?.() ?? false,
+    );
    const isModernModel = supportsModernFeatures(desiredModel);
    const activeSnippets = isModernModel ? snippets : legacySnippets;
    return activeSnippets.getCompressionPrompt();
@@ -18,11 +18,14 @@ import {
  DEFAULT_GEMINI_MODEL,
  DEFAULT_GEMINI_MODEL_AUTO,
  PREVIEW_GEMINI_MODEL_AUTO,
+  PREVIEW_GEMINI_3_1_MODEL,
+  PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL,
 } from '../../config/models.js';
 import { promptIdContext } from '../../utils/promptIdContext.js';
 import type { Content } from '@google/genai';
 import type { ResolvedModelConfig } from '../../services/modelConfigService.js';
 import { debugLogger } from '../../utils/debugLogger.js';
+import { AuthType } from '../../core/contentGenerator.js';

 vi.mock('../../core/baseLlmClient.js');

@@ -53,6 +56,10 @@ describe('ClassifierStrategy', () => {
      },
      getModel: vi.fn().mockReturnValue(DEFAULT_GEMINI_MODEL_AUTO),
      getNumericalRoutingEnabled: vi.fn().mockResolvedValue(false),
+      getGemini31Launched: vi.fn().mockResolvedValue(false),
+      getContentGeneratorConfig: vi.fn().mockReturnValue({
+        authType: AuthType.LOGIN_WITH_GOOGLE,
+      }),
    } as unknown as Config;
    mockBaseLlmClient = {
      generateJson: vi.fn(),
@@ -339,4 +346,49 @@ describe('ClassifierStrategy', () => {
    // Since requestedModel is Pro, and choice is flash, it should resolve to Flash
    expect(decision?.model).toBe(DEFAULT_GEMINI_FLASH_MODEL);
  });
+
+  describe('Gemini 3.1 and Custom Tools Routing', () => {
+    it('should route to PREVIEW_GEMINI_3_1_MODEL when Gemini 3.1 is launched', async () => {
+      vi.mocked(mockConfig.getGemini31Launched).mockResolvedValue(true);
+      vi.mocked(mockConfig.getModel).mockReturnValue(PREVIEW_GEMINI_MODEL_AUTO);
+      const mockApiResponse = {
+        reasoning: 'Complex task',
+        model_choice: 'pro',
+      };
+      vi.mocked(mockBaseLlmClient.generateJson).mockResolvedValue(
+        mockApiResponse,
+      );
+
+      const decision = await strategy.route(
+        mockContext,
+        mockConfig,
+        mockBaseLlmClient,
+      );
+
+      expect(decision?.model).toBe(PREVIEW_GEMINI_3_1_MODEL);
+    });
+
+    it('should route to PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL when Gemini 3.1 is launched and auth is USE_GEMINI', async () => {
+      vi.mocked(mockConfig.getGemini31Launched).mockResolvedValue(true);
+      vi.mocked(mockConfig.getModel).mockReturnValue(PREVIEW_GEMINI_MODEL_AUTO);
+      vi.mocked(mockConfig.getContentGeneratorConfig).mockReturnValue({
+        authType: AuthType.USE_GEMINI,
+      });
+      const mockApiResponse = {
+        reasoning: 'Complex task',
+        model_choice: 'pro',
+      };
+      vi.mocked(mockBaseLlmClient.generateJson).mockResolvedValue(
+        mockApiResponse,
+      );
+
+      const decision = await strategy.route(
+        mockContext,
+        mockConfig,
+        mockBaseLlmClient,
+      );
+
+      expect(decision?.model).toBe(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL);
+    });
+  });
 });
@@ -21,6 +21,7 @@ import {
 } from '../../utils/messageInspectors.js';
 import { debugLogger } from '../../utils/debugLogger.js';
 import { LlmRole } from '../../telemetry/types.js';
+import { AuthType } from '../../core/contentGenerator.js';

 // The number of recent history turns to provide to the router for context.
 const HISTORY_TURNS_FOR_CONTEXT = 4;
@@ -169,9 +170,15 @@ export class ClassifierStrategy implements RoutingStrategy {

      const reasoning = routerResponse.reasoning;
      const latencyMs = Date.now() - startTime;
+      const useGemini3_1 = (await config.getGemini31Launched?.()) ?? false;
+      const useCustomToolModel =
+        useGemini3_1 &&
+        config.getContentGeneratorConfig().authType === AuthType.USE_GEMINI;
      const selectedModel = resolveClassifierModel(
        model,
        routerResponse.model_choice,
+        useGemini3_1,
+        useCustomToolModel,
      );

      return {
@@ -21,7 +21,10 @@ export class DefaultStrategy implements TerminalStrategy {
    config: Config,
    _baseLlmClient: BaseLlmClient,
  ): Promise<RoutingDecision> {
-    const defaultModel = resolveModel(config.getModel());
+    const defaultModel = resolveModel(
+      config.getModel(),
+      config.getGemini31LaunchedSync?.() ?? false,
+    );
    return {
      model: defaultModel,
      metadata: {
@@ -23,7 +23,10 @@ export class FallbackStrategy implements RoutingStrategy {
    _baseLlmClient: BaseLlmClient,
  ): Promise<RoutingDecision | null> {
    const requestedModel = context.requestedModel ?? config.getModel();
-    const resolvedModel = resolveModel(requestedModel);
+    const resolvedModel = resolveModel(
+      requestedModel,
+      config.getGemini31LaunchedSync?.() ?? false,
+    );
    const service = config.getModelAvailabilityService();
    const snapshot = service.snapshot(resolvedModel);

@@ -12,6 +12,8 @@ import type { BaseLlmClient } from '../../core/baseLlmClient.js';
 import {
  PREVIEW_GEMINI_FLASH_MODEL,
  PREVIEW_GEMINI_MODEL,
+  PREVIEW_GEMINI_3_1_MODEL,
+  PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL,
  PREVIEW_GEMINI_MODEL_AUTO,
  DEFAULT_GEMINI_MODEL_AUTO,
  DEFAULT_GEMINI_MODEL,
@@ -20,6 +22,7 @@ import { promptIdContext } from '../../utils/promptIdContext.js';
 import type { Content } from '@google/genai';
 import type { ResolvedModelConfig } from '../../services/modelConfigService.js';
 import { debugLogger } from '../../utils/debugLogger.js';
+import { AuthType } from '../../core/contentGenerator.js';

 vi.mock('../../core/baseLlmClient.js');

@@ -52,6 +55,10 @@ describe('NumericalClassifierStrategy', () => {
      getSessionId: vi.fn().mockReturnValue('control-group-id'), // Default to Control Group (Hash 71 >= 50)
      getNumericalRoutingEnabled: vi.fn().mockResolvedValue(true),
      getClassifierThreshold: vi.fn().mockResolvedValue(undefined),
+      getGemini31Launched: vi.fn().mockResolvedValue(false),
+      getContentGeneratorConfig: vi.fn().mockReturnValue({
+        authType: AuthType.LOGIN_WITH_GOOGLE,
+      }),
    } as unknown as Config;
    mockBaseLlmClient = {
      generateJson: vi.fn(),
@@ -535,4 +542,68 @@ describe('NumericalClassifierStrategy', () => {
      ),
    );
  });
+
+  describe('Gemini 3.1 and Custom Tools Routing', () => {
+    it('should route to PREVIEW_GEMINI_3_1_MODEL when Gemini 3.1 is launched', async () => {
+      vi.mocked(mockConfig.getGemini31Launched).mockResolvedValue(true);
+      const mockApiResponse = {
+        complexity_reasoning: 'Complex task',
+        complexity_score: 80,
+      };
+      vi.mocked(mockBaseLlmClient.generateJson).mockResolvedValue(
+        mockApiResponse,
+      );
+
+      const decision = await strategy.route(
+        mockContext,
+        mockConfig,
+        mockBaseLlmClient,
+      );
+
+      expect(decision?.model).toBe(PREVIEW_GEMINI_3_1_MODEL);
+    });
+    it('should route to PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL when Gemini 3.1 is launched and auth is USE_GEMINI', async () => {
+      vi.mocked(mockConfig.getGemini31Launched).mockResolvedValue(true);
+      vi.mocked(mockConfig.getContentGeneratorConfig).mockReturnValue({
+        authType: AuthType.USE_GEMINI,
+      });
+      const mockApiResponse = {
+        complexity_reasoning: 'Complex task',
+        complexity_score: 80,
+      };
+      vi.mocked(mockBaseLlmClient.generateJson).mockResolvedValue(
+        mockApiResponse,
+      );
+
+      const decision = await strategy.route(
+        mockContext,
+        mockConfig,
+        mockBaseLlmClient,
+      );
+
+      expect(decision?.model).toBe(PREVIEW_GEMINI_3_1_CUSTOM_TOOLS_MODEL);
+    });
+
+    it('should NOT route to custom tools model when auth is USE_VERTEX_AI', async () => {
+      vi.mocked(mockConfig.getGemini31Launched).mockResolvedValue(true);
+      vi.mocked(mockConfig.getContentGeneratorConfig).mockReturnValue({
+        authType: AuthType.USE_VERTEX_AI,
+      });
+      const mockApiResponse = {
+        complexity_reasoning: 'Complex task',
+        complexity_score: 80,
+      };
+      vi.mocked(mockBaseLlmClient.generateJson).mockResolvedValue(
+        mockApiResponse,
+      );
+
+      const decision = await strategy.route(
+        mockContext,
+        mockConfig,
+        mockBaseLlmClient,
+      );
+
+      expect(decision?.model).toBe(PREVIEW_GEMINI_3_1_MODEL);
+    });
+  });
 });
@@ -17,6 +17,7 @@ import { createUserContent, Type } from '@google/genai';
 import type { Config } from '../../config/config.js';
 import { debugLogger } from '../../utils/debugLogger.js';
 import { LlmRole } from '../../telemetry/types.js';
+import { AuthType } from '../../core/contentGenerator.js';

 // The number of recent history turns to provide to the router for context.
 const HISTORY_TURNS_FOR_CONTEXT = 8;
@@ -182,8 +183,16 @@ export class NumericalClassifierStrategy implements RoutingStrategy {
          config,
          config.getSessionId() || 'unknown-session',
        );
-
-      const selectedModel = resolveClassifierModel(model, modelAlias);
+      const useGemini3_1 = (await config.getGemini31Launched?.()) ?? false;
+      const useCustomToolModel =
+        useGemini3_1 &&
+        config.getContentGeneratorConfig().authType === AuthType.USE_GEMINI;
+      const selectedModel = resolveClassifierModel(
+        model,
+        modelAlias,
+        useGemini3_1,
+        useCustomToolModel,
+      );

      const latencyMs = Date.now() - startTime;

@@ -33,7 +33,10 @@ export class OverrideStrategy implements RoutingStrategy {

    // Return the overridden model name.
    return {
-      model: resolveModel(overrideModel),
+      model: resolveModel(
+        overrideModel,
+        config.getGemini31LaunchedSync?.() ?? false,
+      ),
      metadata: {
        source: this.name,
        latencyMs: 0,
@@ -29,6 +29,7 @@ import {
  DEFAULT_GEMINI_MODEL,
  PREVIEW_GEMINI_MODEL,
  PREVIEW_GEMINI_FLASH_MODEL,
+  PREVIEW_GEMINI_3_1_MODEL,
 } from '../config/models.js';
 import { PreCompressTrigger } from '../hooks/types.js';
 import { LlmRole } from '../telemetry/types.js';
@@ -101,6 +102,7 @@ export function findCompressSplitPoint(
 export function modelStringToModelConfigAlias(model: string): string {
  switch (model) {
    case PREVIEW_GEMINI_MODEL:
+    case PREVIEW_GEMINI_3_1_MODEL:
      return 'chat-compression-3-pro';
    case PREVIEW_GEMINI_FLASH_MODEL:
      return 'chat-compression-3-flash';
@@ -1696,6 +1696,114 @@ describe('mcp-client', () => {
      expect(callArgs.env!['GEMINI_CLI_EXT_VAR']).toBeUndefined();
    });

+    it('should include extension settings with defined values in environment', async () => {
+      const mockedTransport = vi
+        .spyOn(SdkClientStdioLib, 'StdioClientTransport')
+        .mockReturnValue({} as SdkClientStdioLib.StdioClientTransport);
+
+      await createTransport(
+        'test-server',
+        {
+          command: 'test-command',
+          extension: {
+            name: 'test-ext',
+            resolvedSettings: [
+              {
+                envVar: 'GEMINI_CLI_EXT_VAR',
+                value: 'defined-value',
+                sensitive: false,
+                name: 'ext-setting',
+              },
+            ],
+            version: '',
+            isActive: false,
+            path: '',
+            contextFiles: [],
+            id: '',
+          },
+        },
+        false,
+        EMPTY_CONFIG,
+      );
+
+      const callArgs = mockedTransport.mock.calls[0][0];
+      expect(callArgs.env).toBeDefined();
+      expect(callArgs.env!['GEMINI_CLI_EXT_VAR']).toBe('defined-value');
+    });
+
+    it('should resolve environment variables in mcpServerConfig.env using extension settings', async () => {
+      const mockedTransport = vi
+        .spyOn(SdkClientStdioLib, 'StdioClientTransport')
+        .mockReturnValue({} as SdkClientStdioLib.StdioClientTransport);
+
+      await createTransport(
+        'test-server',
+        {
+          command: 'test-command',
+          env: {
+            RESOLVED_VAR: '$GEMINI_CLI_EXT_VAR',
+          },
+          extension: {
+            name: 'test-ext',
+            resolvedSettings: [
+              {
+                envVar: 'GEMINI_CLI_EXT_VAR',
+                value: 'ext-value',
+                sensitive: false,
+                name: 'ext-setting',
+              },
+            ],
+            version: '',
+            isActive: false,
+            path: '',
+            contextFiles: [],
+            id: '',
+          },
+        },
+        false,
+        EMPTY_CONFIG,
+      );
+
+      const callArgs = mockedTransport.mock.calls[0][0];
+      expect(callArgs.env).toBeDefined();
+      expect(callArgs.env!['GEMINI_CLI_EXT_VAR']).toBe('ext-value');
+      expect(callArgs.env!['RESOLVED_VAR']).toBe('ext-value');
+    });
+
+    it('should expand environment variables in mcpServerConfig.env and not redact them', async () => {
+      const mockedTransport = vi
+        .spyOn(SdkClientStdioLib, 'StdioClientTransport')
+        .mockReturnValue({} as SdkClientStdioLib.StdioClientTransport);
+
+      const originalEnv = process.env;
+      process.env = {
+        ...originalEnv,
+        GEMINI_TEST_VAR: 'expanded-value',
+      };
+
+      try {
+        await createTransport(
+          'test-server',
+          {
+            command: 'test-command',
+            env: {
+              TEST_EXPANDED: 'Value is $GEMINI_TEST_VAR',
+              SECRET_KEY: 'intentional-secret-123',
+            },
+          },
+          false,
+          EMPTY_CONFIG,
+        );
+
+        const callArgs = mockedTransport.mock.calls[0][0];
+        expect(callArgs.env).toBeDefined();
+        expect(callArgs.env!['TEST_EXPANDED']).toBe('Value is expanded-value');
+        expect(callArgs.env!['SECRET_KEY']).toBe('intentional-secret-123');
+      } finally {
+        process.env = originalEnv;
+      }
+    });
+
    describe('useGoogleCredentialProvider', () => {
      beforeEach(() => {
        // Mock GoogleAuth client
@@ -34,7 +34,11 @@ import {
 } from '@modelcontextprotocol/sdk/types.js';
 import { ApprovalMode, PolicyDecision } from '../policy/types.js';
 import { parse } from 'shell-quote';
-import type { Config, MCPServerConfig } from '../config/config.js';
+import type {
+  Config,
+  MCPServerConfig,
+  GeminiCLIExtension,
+} from '../config/config.js';
 import { AuthProviderType } from '../config/config.js';
 import { GoogleCredentialProvider } from '../mcp/google-auth-provider.js';
 import { ServiceAccountImpersonationProvider } from '../mcp/sa-impersonation-provider.js';
@@ -67,6 +71,7 @@ import {
  sanitizeEnvironment,
  type EnvironmentSanitizationConfig,
 } from '../services/environmentSanitization.js';
+import { expandEnvVars } from '../utils/envExpansion.js';
 import {
  GEMINI_CLI_IDENTIFICATION_ENV_VAR,
  GEMINI_CLI_IDENTIFICATION_ENV_VAR_VALUE,
@@ -727,14 +732,31 @@ async function handleAutomaticOAuth(
 *
 * @param mcpServerConfig The MCP server configuration
 * @param headers Additional headers
+ * @param sanitizationConfig Configuration for environment sanitization
 */
 function createTransportRequestInit(
  mcpServerConfig: MCPServerConfig,
  headers: Record<string, string>,
+  sanitizationConfig: EnvironmentSanitizationConfig,
 ): RequestInit {
+  const extensionEnv = getExtensionEnvironment(mcpServerConfig.extension);
+  const expansionEnv = { ...process.env, ...extensionEnv };
+
+  const sanitizedEnv = sanitizeEnvironment(expansionEnv, {
+    ...sanitizationConfig,
+    enableEnvironmentVariableRedaction: true,
+  });
+
+  const expandedHeaders: Record<string, string> = {};
+  if (mcpServerConfig.headers) {
+    for (const [key, value] of Object.entries(mcpServerConfig.headers)) {
+      expandedHeaders[key] = expandEnvVars(value, sanitizedEnv);
+    }
+  }
+
  return {
    headers: {
-      ...mcpServerConfig.headers,
+      ...expandedHeaders,
      ...headers,
    },
  };
@@ -768,12 +790,14 @@ function createAuthProvider(
 * @param mcpServerName The name of the MCP server
 * @param mcpServerConfig The MCP server configuration
 * @param accessToken The OAuth access token
+ * @param sanitizationConfig Configuration for environment sanitization
 * @returns The transport with OAuth token, or null if creation fails
 */
 async function createTransportWithOAuth(
  mcpServerName: string,
  mcpServerConfig: MCPServerConfig,
  accessToken: string,
+  sanitizationConfig: EnvironmentSanitizationConfig,
 ): Promise<StreamableHTTPClientTransport | SSEClientTransport | null> {
  try {
    const headers: Record<string, string> = {
@@ -782,7 +806,11 @@ async function createTransportWithOAuth(
    const transportOptions:
      | StreamableHTTPClientTransportOptions
      | SSEClientTransportOptions = {
-      requestInit: createTransportRequestInit(mcpServerConfig, headers),
+      requestInit: createTransportRequestInit(
+        mcpServerConfig,
+        headers,
+        sanitizationConfig,
+      ),
    };

    return createUrlTransport(mcpServerName, mcpServerConfig, transportOptions);
@@ -1366,6 +1394,7 @@ async function showAuthRequiredMessage(serverName: string): Promise<never> {
 * @param config The MCP server configuration
 * @param accessToken The OAuth access token to use
 * @param httpReturned404 Whether the HTTP transport returned 404 (indicating SSE-only server)
+ * @param sanitizationConfig Configuration for environment sanitization
 */
 async function retryWithOAuth(
  client: Client,
@@ -1373,6 +1402,7 @@ async function retryWithOAuth(
  config: MCPServerConfig,
  accessToken: string,
  httpReturned404: boolean,
+  sanitizationConfig: EnvironmentSanitizationConfig,
 ): Promise<void> {
  if (httpReturned404) {
    // HTTP returned 404, only try SSE
@@ -1393,6 +1423,7 @@ async function retryWithOAuth(
    serverName,
    config,
    accessToken,
+    sanitizationConfig,
  );
  if (!httpTransport) {
    throw new Error(
@@ -1672,6 +1703,7 @@ export async function connectToMcpServer(
            mcpServerConfig,
            accessToken,
            httpReturned404,
+            sanitizationConfig,
          );
          return mcpClient;
        } else {
@@ -1743,6 +1775,7 @@ export async function connectToMcpServer(
              mcpServerName,
              mcpServerConfig,
              accessToken,
+              sanitizationConfig,
            );
            if (!oauthTransport) {
              throw new Error(
@@ -1890,7 +1923,11 @@ export async function createTransport(
    const transportOptions:
      | StreamableHTTPClientTransportOptions
      | SSEClientTransportOptions = {
-      requestInit: createTransportRequestInit(mcpServerConfig, headers),
+      requestInit: createTransportRequestInit(
+        mcpServerConfig,
+        headers,
+        sanitizationConfig,
+      ),
      authProvider,
    };

@@ -1898,15 +1935,37 @@ export async function createTransport(
  }

  if (mcpServerConfig.command) {
+    const extensionEnv = getExtensionEnvironment(mcpServerConfig.extension);
+    const expansionEnv = { ...process.env, ...extensionEnv };
+
+    // 1. Sanitize the base process environment to prevent unintended leaks of system-wide secrets.
+    const sanitizedEnv = sanitizeEnvironment(expansionEnv, {
+      ...sanitizationConfig,
+      enableEnvironmentVariableRedaction: true,
+    });
+
+    const finalEnv: Record<string, string> = {
+      [GEMINI_CLI_IDENTIFICATION_ENV_VAR]:
+        GEMINI_CLI_IDENTIFICATION_ENV_VAR_VALUE,
+      ...extensionEnv,
+    };
+    for (const [key, value] of Object.entries(sanitizedEnv)) {
+      if (value !== undefined) {
+        finalEnv[key] = value;
+      }
+    }
+
+    // Expand and merge explicit environment variables from the MCP configuration.
+    if (mcpServerConfig.env) {
+      for (const [key, value] of Object.entries(mcpServerConfig.env)) {
+        finalEnv[key] = expandEnvVars(value, expansionEnv);
+      }
+    }
+
    let transport: Transport = new StdioClientTransport({
      command: mcpServerConfig.command,
      args: mcpServerConfig.args || [],
-      env: {
-        ...sanitizeEnvironment(process.env, sanitizationConfig),
-        ...(mcpServerConfig.env || {}),
-        [GEMINI_CLI_IDENTIFICATION_ENV_VAR]:
-          GEMINI_CLI_IDENTIFICATION_ENV_VAR_VALUE,
-      } as Record<string, string>,
+      env: finalEnv,
      cwd: mcpServerConfig.cwd,
      stderr: 'pipe',
    });
@@ -1955,6 +2014,20 @@ interface NamedTool {
  name?: string;
 }

+function getExtensionEnvironment(
+  extension?: GeminiCLIExtension,
+): Record<string, string> {
+  const env: Record<string, string> = {};
+  if (extension?.resolvedSettings) {
+    for (const setting of extension.resolvedSettings) {
+      if (setting.value !== undefined) {
+        env[setting.envVar] = setting.value;
+      }
+    }
+  }
+  return env;
+}
+
 /** Visible for testing */
 export function isEnabled(
  funcDecl: NamedTool,
@@ -0,0 +1,117 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { expandEnvVars } from './envExpansion.js';
+
+describe('expandEnvVars', () => {
+  const defaultEnv = {
+    USER: 'morty',
+    HOME: '/home/morty',
+    TEMP: 'C:\\Temp',
+    EMPTY: '',
+  };
+
+  describe('POSIX behavior (non-Windows)', () => {
+    beforeEach(() => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin');
+    });
+
+    afterEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    it.each([
+      ['$VAR (POSIX)', 'Hello $USER', defaultEnv, 'Hello morty'],
+      [
+        '${VAR} (POSIX)',
+        'Welcome to ${HOME}',
+        defaultEnv,
+        'Welcome to /home/morty',
+      ],
+      [
+        'should NOT expand %VAR% on non-Windows',
+        'Data in %TEMP%',
+        defaultEnv,
+        'Data in %TEMP%',
+      ],
+      [
+        'mixed formats (only POSIX expanded)',
+        '$USER lives in ${HOME} on %TEMP%',
+        defaultEnv,
+        'morty lives in /home/morty on %TEMP%',
+      ],
+      [
+        'missing variables (POSIX only)',
+        'Missing $UNDEFINED and ${NONE} and %MISSING%',
+        defaultEnv,
+        'Missing  and  and %MISSING%',
+      ],
+      [
+        'empty or undefined values',
+        'Value is "$EMPTY"',
+        defaultEnv,
+        'Value is ""',
+      ],
+      [
+        'original string if no variables',
+        'No vars here',
+        defaultEnv,
+        'No vars here',
+      ],
+      ['literal values like "1234"', '1234', defaultEnv, '1234'],
+      ['empty input string', '', defaultEnv, ''],
+      [
+        'complex paths',
+        '${HOME}/bin:$PATH',
+        { ...defaultEnv, PATH: '/usr/bin' },
+        '/home/morty/bin:/usr/bin',
+      ],
+    ])('should handle %s', (_, input, env, expected) => {
+      expect(expandEnvVars(input, env)).toBe(expected);
+    });
+  });
+
+  describe('Windows behavior', () => {
+    beforeEach(() => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue('win32');
+    });
+
+    afterEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    it.each([
+      ['$VAR (POSIX)', 'Hello $USER', defaultEnv, 'Hello morty'],
+      [
+        '${VAR} (POSIX)',
+        'Welcome to ${HOME}',
+        defaultEnv,
+        'Welcome to /home/morty',
+      ],
+      [
+        'should expand %VAR% on Windows',
+        'Data in %TEMP%',
+        defaultEnv,
+        'Data in C:\\Temp',
+      ],
+      [
+        'mixed formats (both expanded)',
+        '$USER lives in ${HOME} on %TEMP%',
+        defaultEnv,
+        'morty lives in /home/morty on C:\\Temp',
+      ],
+      [
+        'missing variables (all expanded to empty)',
+        'Missing $UNDEFINED and ${NONE} and %MISSING%',
+        defaultEnv,
+        'Missing  and  and ',
+      ],
+    ])('should handle %s', (_, input, env, expected) => {
+      expect(expandEnvVars(input, env)).toBe(expected);
+    });
+  });
+});
@@ -0,0 +1,54 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { expand } from 'dotenv-expand';
+
+/**
+ * Expands environment variables in a string using the provided environment record.
+ * Uses the standard `dotenv-expand` library to handle expansion consistently with
+ * other tools.
+ *
+ * Supports POSIX/Bash syntax ($VAR, ${VAR}).
+ * Note: Windows syntax (%VAR%) is not natively supported by dotenv-expand.
+ *
+ * @param str - The string containing environment variable placeholders.
+ * @param env - A record of environment variable names and their values.
+ * @returns The string with environment variables expanded. Missing variables resolve to an empty string.
+ */
+export function expandEnvVars(
+  str: string,
+  env: Record<string, string | undefined>,
+): string {
+  if (!str) return str;
+
+  // 1. Pre-process Windows-style variables (%VAR%) since dotenv-expand only handles POSIX ($VAR).
+  // We only do this on Windows to limit the blast radius and avoid conflicts with other
+  // systems where % might be a literal character (e.g. in URLs or shell commands).
+  const isWindows = process.platform === 'win32';
+  const processedStr = isWindows
+    ? str.replace(/%(\w+)%/g, (_, name) => env[name] ?? '')
+    : str;
+
+  // 2. Use dotenv-expand for POSIX/Bash syntax ($VAR, ${VAR}).
+  // dotenv-expand is designed to process an object of key-value pairs (like a .env file).
+  // To expand a single string, we wrap it in an object with a temporary key.
+  const dummyKey = '__GCLI_EXPAND_TARGET__';
+
+  // Filter out undefined values to satisfy the Record<string, string> requirement safely
+  const processEnv: Record<string, string> = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== undefined) {
+      processEnv[key] = value;
+    }
+  }
+
+  const result = expand({
+    parsed: { [dummyKey]: processedStr },
+    processEnv,
+  });
+
+  return result.parsed?.[dummyKey] ?? '';
+}
@@ -1,6 +1,6 @@
 {
  "name": "@google/gemini-cli-sdk",
-  "version": "0.29.0-nightly.20260203.71f46f116",
+  "version": "0.30.1",
  "description": "Gemini CLI SDK",
  "license": "Apache-2.0",
  "repository": {
@@ -1,6 +1,6 @@
 {
  "name": "@google/gemini-cli-test-utils",
-  "version": "0.30.0-nightly.20260210.a2174751d",
+  "version": "0.30.1",
  "private": true,
  "main": "src/index.ts",
  "license": "Apache-2.0",
@@ -49,6 +49,9 @@ async function main() {
    define: {
      'import.meta.url': 'import_meta.url',
    },
+    alias: {
+      punycode: 'punycode/',
+    },
    plugins: [
      /* add to the end of plugins array */
      esbuildProblemMatcherPlugin,
@@ -2,7 +2,7 @@
  "name": "gemini-cli-vscode-ide-companion",
  "displayName": "Gemini CLI Companion",
  "description": "Enable Gemini CLI with direct access to your IDE workspace.",
-  "version": "0.30.0-nightly.20260210.a2174751d",
+  "version": "0.30.1",
  "publisher": "google",
  "icon": "assets/icon.png",
  "repository": {
Author	SHA1	Message	Date
gemini-cli-robot	839870b08b	chore(release): v0.30.1	2026-02-27 18:27:02 +00:00
gemini-cli-robot	0fc15382ae	fix(patch): cherry-pick `58df1c6` to release/v0.30.0-pr-20374 [CONFLICTS] (#20567 ) Co-authored-by: christine betts <chrstn@uw.edu> Co-authored-by: Gal Zahavi <38544478+galz10@users.noreply.github.com>	2026-02-27 12:55:17 -05:00
gemini-cli-robot	176b2baeef	chore(release): v0.30.0	2026-02-25 02:58:57 +00:00
gemini-cli-robot	1e3b992f69	chore(release): v0.30.0-preview.6	2026-02-24 03:10:10 +00:00
gemini-cli-robot	a24009f9c0	fix(patch): cherry-pick `d96bd05` to release/v0.30.0-preview.5-pr-19867 to patch version v0.30.0-preview.5 and create version 0.30.0-preview.6 (#20112 ) Co-authored-by: Bryan Morgan <bryanmorgan@google.com>	2026-02-24 01:57:13 +00:00
gemini-cli-robot	fdd96a0262	chore(release): v0.30.0-preview.5	2026-02-24 01:03:47 +00:00
gemini-cli-robot	10416ef426	fix(patch): cherry-pick `2c1d6f8` to release/v0.30.0-preview.4-pr-19369 to patch version v0.30.0-preview.4 and create version 0.30.0-preview.5 (#20086 ) Co-authored-by: Sandy Tao <sandytao520@icloud.com>	2026-02-23 16:11:42 -08:00
gemini-cli-robot	b96ab70d2c	chore(release): v0.30.0-preview.4	2026-02-23 20:49:11 +00:00
gemini-cli-robot	09c6514d76	fix(patch): cherry-pick `aa9163d` to release/v0.30.0-preview.3-pr-19991 to patch version v0.30.0-preview.3 and create version 0.30.0-preview.4 (#20040 ) Co-authored-by: Sehoon Shon <sshon@google.com>	2026-02-23 14:48:32 -05:00
gemini-cli-robot	0e0671f849	chore(release): v0.30.0-preview.3	2026-02-19 23:11:32 +00:00
Sehoon Shon	9ddc46c59a	update isActiveModel to return false for unknown models	2026-02-19 17:40:51 -05:00
Sehoon Shon	a2d831f1d7	only use customtoolmodel for api key users (#132 ) * only use customtoolmodel for api key users * use displaystring for showing model in about	2026-02-19 14:15:36 -05:00
Sehoon Shon	ed8f7f6766	feat(models): support Gemini 3.1 custom tool model (#131 ) * feat(models): add support for Gemini 3.1 and custom tool models * test(routing): fix classifier and numerical classifier strategy tests * test(routing): add Gemini 3.1 tests for classifier strategy * fix(models): correctly filter active Gemini 3.1 models * fix(routing): ensure useCustomToolModel is only true when Gemini 3.1 is enabled * fix(test-utils): prevent double newline in lastFrame() on Windows * fix(test-utils): surgically fix double newline in lastFrame() on Windows * use custom_tools_model string for api key only * fix(ui): correct useCustomToolModel logic and update tests * fix(ui): correct useCustomToolModel logic in StatsDisplay * fix(routing): ensure test models are active and sync useCustomToolModel logic	2026-02-19 14:13:33 -05:00
Sehoon Shon	f669adbffd	feat(core,ui): support Gemini 3.1 Pro Preview and active model filtering (#125 ) * feat(core,ui): support Gemini 3.1 Pro Preview and active model filtering * fix(core,ui): use optional chaining for config methods to support mocks * fix(core): clear stale authType in refreshAuth to avoid incorrect model resolution * do not show gemini 3.1 model when users do not have access to gemini 3.1 in stats	2026-02-19 11:47:20 -05:00
gemini-cli-robot	78f69bb545	chore(release): v0.30.0-preview.2	2026-02-19 15:36:07 +00:00
gemini-cli-robot	54a1200ef6	fix(patch): cherry-pick `c43500c` to release/v0.30.0-preview.1-pr-19502 to patch version v0.30.0-preview.1 and create version 0.30.0-preview.2 (#19521 ) Co-authored-by: Jacob Richman <jacob314@gmail.com>	2026-02-19 10:04:25 -05:00
gemini-cli-robot	abd5016123	chore(release): v0.30.0-preview.1	2026-02-19 00:53:02 +00:00
gemini-cli-robot	0114b3e58d	fix(patch): cherry-pick `261788c` to release/v0.30.0-preview.0-pr-19453 to patch version v0.30.0-preview.0 and create version 0.30.0-preview.1 (#19490 ) Co-authored-by: Shreya Keshive <shreyakeshive@google.com>	2026-02-19 00:26:04 +00:00
gemini-cli-robot	339c4984aa	chore(release): v0.30.0-preview.0	2026-02-17 23:43:14 +00:00