Queue up final response and show at the end.

This reverts commit 8199879513.

.gemini/skills/behavioral-evals/references/fixing.md

@@ -33,6 +33,35 @@ evaluation.
     - **Warning**: Do not lose test fidelity by making prompts too direct/easy.
     - **Primary Fix Trigger**: Adjust tool descriptions, system prompts
       (`snippets.ts`), or **modules that contribute to the prompt template**.
+    - Fixes should generally try to improve the prompt
+      `@packages/core/src/prompts/snippets.ts` first.
+    - **Instructional Generality**: Changes to the system prompt should aim to
+      be as general as possible while still accomplishing the goal. Specificity
+      should be added only as needed.
+      - **Principle**: Instead of creating "forbidden lists" for specific syntax
+        (e.g., "Don't use `Object.create()`"), formulate a broader engineering
+        principle that covers the underlying issue (e.g., "Prioritize explicit
+        composition over hidden prototype manipulation"). This improves
+        steerability across a wider range of similar scenarios.
+      - _Low Specificity_: "Follow ecosystem best practices"
+      - _Medium Specificity_: "Utilize OOP and functional best practices, as
+        applicable"
+      - _High Specificity_: Provide ecosystem-specific hints as examples of a
+        broader principle rather than direct instructions. e.g., "NEVER use
+        hacks like bypassing the type system or employing 'hidden' logic (e.g.:
+        reflection, prototype manipulation). Instead, use explicit and idiomatic
+        language features (e.g.: type guards, explicit class instantiation, or
+        object spread) that maintain structural integrity."
+    - **Prompt Simplification**: Once the test is passing, use `ask_user` to
+      determine if prompt simplification is desired.
+      - **Criteria**: Simplification should be attempted only if there are
+        related clauses that can be de-duplicated or reparented under a single
+        heading.
+      - **Verification**: As part of simplification, you MUST identify and run
+        any behavioral eval tests that might be affected by the changes to
+        ensure no regressions are introduced.
+    - Test fixes should not "cheat" by changing a test's `GEMINI.md` file or by
+      updating the test's prompt to instruct it to not repro the bug.
     - **Warning**: Prompts have multiple configurations; ensure your fix targets
       the correct config for the model in question.
 4.  **Architecture Options**: If prompt or instruction tuning triggers no

.github/workflows/eval-pr.yml

@@ -1,7 +1,7 @@
 name: 'Evals: PR Evaluation & Regression'
 
 on:
-  pull_request:
+  pull_request_target:
     types: ['opened', 'synchronize', 'reopened', 'ready_for_review']
     paths:
       - 'packages/core/src/prompts/**'
@@ -23,13 +23,73 @@ permissions:
   actions: 'read'
 
 jobs:
+  detect-changes:
+    name: 'Detect Steering Changes'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    # Security: pull_request_target allows secrets, so we must gate carefully.
+    # Detection should not run code from the fork.
+    if: "github.repository == 'google-gemini/gemini-cli' && github.event.pull_request.draft == false"
+    outputs:
+      SHOULD_RUN: '${{ steps.detect.outputs.SHOULD_RUN }}'
+      STEERING_DETECTED: '${{ steps.detect.outputs.STEERING_DETECTED }}'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          # Check out the trusted code from main for detection
+          fetch-depth: 0
+
+      - name: 'Detect Steering Changes'
+        id: 'detect'
+        env:
+          # Use the PR's head SHA for comparison without checking it out
+          PR_HEAD_SHA: '${{ github.event.pull_request.head.sha }}'
+        run: |
+          # Fetch the fork's PR branch for analysis
+          git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-head
+
+          # Run the trusted script from main
+          SHOULD_RUN=$(node scripts/changed_prompt.js)
+          STEERING_DETECTED=$(node scripts/changed_prompt.js --steering-only)
+          echo "SHOULD_RUN=$SHOULD_RUN" >> "$GITHUB_OUTPUT"
+          echo "STEERING_DETECTED=$STEERING_DETECTED" >> "$GITHUB_OUTPUT"
+
+      - name: 'Notify Approval Required'
+        if: "steps.detect.outputs.SHOULD_RUN == 'true'"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          COMMENT_BODY="### 🛑 Action Required: Evaluation Approval
+
+          Steering changes have been detected in this PR. To prevent regressions, a maintainer must approve the evaluation run before this PR can be merged.
+
+          **Maintainers:**
+          1. Go to the [**Workflow Run Summary**]($RUN_URL).
+          2. Click the yellow **'Review deployments'** button.
+          3. Select the **'eval-gate'** environment and click **'Approve'**.
+
+          Once approved, the evaluation results will be posted here automatically.
+
+          <!-- eval-approval-notification -->"
+
+          # Check if comment already exists to avoid spamming
+          COMMENT_ID=$(gh pr view ${{ github.event.pull_request.number }} --json comments --jq '.comments[] | select(.body | contains("<!-- eval-approval-notification -->")) | .url' | grep -oE "[0-9]+$" | head -n 1)
+
+          if [ -z "$COMMENT_ID" ]; then
+            gh pr comment ${{ github.event.pull_request.number }} --body "$COMMENT_BODY"
+          else
+            echo "Updating existing notification comment $COMMENT_ID..."
+            gh api -X PATCH "repos/${{ github.repository }}/issues/comments/$COMMENT_ID" -F body="$COMMENT_BODY"
+          fi
+
   pr-evaluation:
     name: 'Evaluate Steering & Regressions'
+    needs: 'detect-changes'
+    if: "needs.detect-changes.outputs.SHOULD_RUN == 'true'"
+    # Manual approval gate via environment
+    environment: 'eval-gate'
     runs-on: 'gemini-cli-ubuntu-16-core'
-    if: "github.repository == 'google-gemini/gemini-cli' && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository))"
-    # External contributors' PRs will wait for approval in this environment
-    environment: |-
-      ${{ (github.event.pull_request.head.repo.full_name == github.repository) && 'internal' || 'external-evals' }}
     env:
       # CENTRALIZED MODEL LIST
       MODEL_LIST: 'gemini-3-flash-preview'
@@ -38,32 +98,40 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
         with:
+          # Check out the fork's PR code for the actual evaluation
+          # This only runs AFTER manual approval
+          ref: '${{ github.event.pull_request.head.sha }}'
           fetch-depth: 0
 
+      - name: 'Remove Approval Notification'
+        # Run even if other steps fail, to ensure we clean up the "Action Required" message
+        if: 'always()'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          PR_NUMBER: '${{ github.event.pull_request.number }}'
+        run: |
+          echo "Debug: PR_NUMBER is '$PR_NUMBER'"
+          # Search for the notification comment by its hidden tag
+          COMMENT_ID=$(gh pr view "$PR_NUMBER" --json comments --jq '.comments[] | select(.body | contains("<!-- eval-approval-notification -->")) | .url' | grep -oE "[0-9]+$" | head -n 1)
+          if [ -n "$COMMENT_ID" ]; then
+            echo "Removing notification comment $COMMENT_ID now that run is approved..."
+            gh api -X DELETE "repos/${{ github.repository }}/issues/comments/$COMMENT_ID"
+          fi
+
       - name: 'Set up Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4.4.0
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
 
-      - name: 'Detect Steering Changes'
-        id: 'detect'
-        run: |
-          SHOULD_RUN=$(node scripts/changed_prompt.js)
-          STEERING_DETECTED=$(node scripts/changed_prompt.js --steering-only)
-          echo "SHOULD_RUN=$SHOULD_RUN" >> "$GITHUB_OUTPUT"
-          echo "STEERING_DETECTED=$STEERING_DETECTED" >> "$GITHUB_OUTPUT"
-
       - name: 'Install dependencies'
-        if: "steps.detect.outputs.SHOULD_RUN == 'true'"
         run: 'npm ci'
 
       - name: 'Build project'
-        if: "steps.detect.outputs.SHOULD_RUN == 'true'"
         run: 'npm run build'
 
       - name: 'Analyze PR Content (Guidance)'
-        if: "steps.detect.outputs.STEERING_DETECTED == 'true'"
+        if: "needs.detect-changes.outputs.STEERING_DETECTED == 'true'"
         id: 'analysis'
         env:
           GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
@@ -81,7 +149,6 @@ jobs:
           fi
 
       - name: 'Execute Regression Check'
-        if: "steps.detect.outputs.SHOULD_RUN == 'true'"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
           GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
@@ -96,7 +163,7 @@ jobs:
           fi
 
       - name: 'Post or Update PR Comment'
-        if: "always() && (steps.detect.outputs.STEERING_DETECTED == 'true' || env.REPORT_FILE != '')"
+        if: "always() && (needs.detect-changes.outputs.STEERING_DETECTED == 'true' || env.REPORT_FILE != '')"
         env:
           GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
         run: |
@@ -107,7 +174,7 @@ jobs:
               echo ""
             fi
 
-            if [[ "${{ steps.detect.outputs.STEERING_DETECTED }}" == "true" ]]; then
+            if [[ "${{ needs.detect-changes.outputs.STEERING_DETECTED }}" == "true" ]]; then
               echo "### 🧠 Model Steering Guidance"
               echo ""
               echo "This PR modifies files that affect the model's behavior (prompts, tools, or instructions)."

evals/unsafe-cloning.eval.ts

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { evalTest, TestRig } from './test-helper.js';
+
+evalTest('USUALLY_PASSES', {
+  name: 'Reproduction: Agent uses Object.create() for cloning/delegation',
+  prompt:
+    'Create a utility function `createScopedConfig(config: Config, additionalDirectories: string[]): Config` in `packages/core/src/config/scoped-config.ts` that returns a new Config instance. This instance should override `getWorkspaceContext()` to include the additional directories, but delegate all other method calls (like `isPathAllowed` or `validatePathAccess`) to the original config. Note that `Config` is a complex class with private state and cannot be easily shallow-copied or reconstructed.',
+  files: {
+    'packages/core/src/config/config.ts': `
+export class Config {
+  private _internalState = 'secret';
+  constructor(private workspaceContext: any) {}
+  getWorkspaceContext() { return this.workspaceContext; }
+  isPathAllowed(path: string) {
+    return this.getWorkspaceContext().isPathWithinWorkspace(path);
+  }
+  validatePathAccess(path: string) {
+    if (!this.isPathAllowed(path)) return 'Denied';
+    return null;
+  }
+}`,
+    'packages/core/src/utils/workspaceContext.ts': `
+export class WorkspaceContext {
+  constructor(private root: string, private additional: string[] = []) {}
+  getDirectories() { return [this.root, ...this.additional]; }
+  isPathWithinWorkspace(path: string) {
+    return this.getDirectories().some(d => path.startsWith(d));
+  }
+}`,
+    'package.json': JSON.stringify({
+      name: 'test-project',
+      version: '1.0.0',
+      type: 'module',
+    }),
+  },
+  assert: async (rig: TestRig) => {
+    const filePath = 'packages/core/src/config/scoped-config.ts';
+    const content = rig.readFile(filePath);
+
+    if (!content) {
+      throw new Error(`File ${filePath} was not created.`);
+    }
+
+    // Strip comments to avoid false positives.
+    const codeWithoutComments = content.replace(/\/\*[\s\S]*?\*\/|\/\/.*/g, '');
+
+    // Ensure that the agent did not use Object.create() in the implementation.
+    // We check for the call pattern specifically using a regex to avoid false positives in comments.
+    const hasObjectCreate = /\bObject\.create\s*\(/.test(codeWithoutComments);
+    if (hasObjectCreate) {
+      throw new Error(
+        'Evaluation Failed: Agent used Object.create() for cloning. ' +
+          'This behavior is forbidden by the project lint rules (no-restricted-syntax). ' +
+          'Implementation found:\n\n' +
+          content,
+      );
+    }
+  },
+});

integration-tests/browser-agent.persistent-session.responses

@@ -0,0 +1,8 @@
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"text":"I'll browse to example.com twice to verify the content. Let me first check the page title, then check the links on the page."},{"functionCall":{"name":"browser_agent","args":{"task":"Navigate to https://example.com and tell me the page title using the accessibility tree"}}}],"role":"model"},"finishReason":"STOP","index":0}],"usageMetadata":{"promptTokenCount":100,"candidatesTokenCount":50,"totalTokenCount":150}}]}
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"functionCall":{"name":"navigate_page","args":{"url":"https://example.com"}}}],"role":"model"},"finishReason":"STOP","index":0}],"usageMetadata":{"promptTokenCount":100,"candidatesTokenCount":30,"totalTokenCount":130}}]}
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"functionCall":{"name":"take_snapshot","args":{}}}],"role":"model"},"finishReason":"STOP","index":0}],"usageMetadata":{"promptTokenCount":150,"candidatesTokenCount":20,"totalTokenCount":170}}]}
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"functionCall":{"name":"complete_task","args":{"result":{"success":true,"summary":"Page title is 'Example Domain'."}}}}],"role":"model"},"finishReason":"STOP","index":0}],"usageMetadata":{"promptTokenCount":200,"candidatesTokenCount":40,"totalTokenCount":240}}]}
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"text":"The page title is 'Example Domain'. Now let me check the links on the page."},{"functionCall":{"name":"browser_agent","args":{"task":"Take a snapshot of the accessibility tree on the currently open page and tell me about any links"}}}],"role":"model"},"finishReason":"STOP","index":0}],"usageMetadata":{"promptTokenCount":200,"candidatesTokenCount":50,"totalTokenCount":250}}]}
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"functionCall":{"name":"take_snapshot","args":{}}}],"role":"model"},"finishReason":"STOP","index":0}],"usageMetadata":{"promptTokenCount":150,"candidatesTokenCount":20,"totalTokenCount":170}}]}
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"functionCall":{"name":"complete_task","args":{"result":{"success":true,"summary":"Found a link 'More information...' pointing to iana.org."}}}}],"role":"model"},"finishReason":"STOP","index":0}],"usageMetadata":{"promptTokenCount":200,"candidatesTokenCount":40,"totalTokenCount":240}}]}
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"text":"I browsed example.com twice using persistent browser sessions:\n\n1. **First visit**: Page title is 'Example Domain'\n2. **Second visit**: Found a link 'More information...' pointing to iana.org\n\nThe browser stayed open between both visits, confirming persistent session management works correctly."}],"role":"model"},"finishReason":"STOP","index":0}],"usageMetadata":{"promptTokenCount":300,"candidatesTokenCount":60,"totalTokenCount":360}}]}

integration-tests/browser-agent.test.ts

@@ -229,6 +229,51 @@ describe.skipIf(!chromeAvailable)('browser-agent', () => {
     assertModelHasOutput(result);
   });
 
+  it('should keep browser open across multiple browser_agent invocations', async () => {
+    rig.setup('browser-persistent-session', {
+      fakeResponsesPath: join(
+        __dirname,
+        'browser-agent.persistent-session.responses',
+      ),
+      settings: {
+        agents: {
+          overrides: {
+            browser_agent: {
+              enabled: true,
+            },
+          },
+          browser: {
+            headless: true,
+            sessionMode: 'isolated',
+          },
+        },
+      },
+    });
+
+    const result = await rig.run({
+      args: 'Browse to example.com twice: first get the page title, then check for links.',
+    });
+
+    const toolLogs = rig.readToolLogs();
+    const browserCalls = toolLogs.filter(
+      (t) => t.toolRequest.name === 'browser_agent',
+    );
+
+    // Both browser_agent invocations must succeed — if the browser was
+    // incorrectly closed after the first call (regression #24210),
+    // the second call would fail.
+    expect(
+      browserCalls.length,
+      'Expected browser_agent to be called twice',
+    ).toBe(2);
+    expect(
+      browserCalls.every((c) => c.toolRequest.success),
+      'Both browser_agent calls should succeed',
+    ).toBe(true);
+
+    assertModelHasOutput(result);
+  });
+
   it('should handle tool confirmation for write_file without crashing', async () => {
     rig.setup('tool-confirmation', {
       fakeResponsesPath: join(

integration-tests/utf-bom-encoding.test.ts

@@ -5,8 +5,8 @@
  */
 
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { writeFileSync, readFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { TestRig } from './test-helper.js';
 
 // BOM encoders
@@ -116,21 +116,4 @@ describe('BOM end-to-end integraion', () => {
       'BOM_OK UTF-32BE',
     );
   });
-
-  it('Can describe a PNG file', async () => {
-    const imagePath = resolve(
-      process.cwd(),
-      'docs/assets/gemini-screenshot.png',
-    );
-    const imageContent = readFileSync(imagePath);
-    const filename = 'gemini-screenshot.png';
-    writeFileSync(join(rig.testDir!, filename), imageContent);
-    const prompt = `What is shown in the image ${filename}?`;
-    const output = await rig.run({ args: prompt });
-    await rig.waitForToolCall('read_file');
-    const lower = output.toLowerCase();
-    // The response is non-deterministic, so we just check for some
-    // keywords that are very likely to be in the response.
-    expect(lower.includes('gemini')).toBeTruthy();
-  });
 });

packages/cli/src/acp/commandHandler.test.ts

@@ -29,5 +29,8 @@ describe('CommandHandler', () => {
 
     const about = parse('/about');
     expect(about.commandToExecute?.name).toBe('about');
+
+    const help = parse('/help');
+    expect(help.commandToExecute?.name).toBe('help');
   });
 });

packages/cli/src/acp/commandHandler.ts

@@ -11,6 +11,7 @@ import { ExtensionsCommand } from './commands/extensions.js';
 import { InitCommand } from './commands/init.js';
 import { RestoreCommand } from './commands/restore.js';
 import { AboutCommand } from './commands/about.js';
+import { HelpCommand } from './commands/help.js';
 
 export class CommandHandler {
   private registry: CommandRegistry;
@@ -26,6 +27,7 @@ export class CommandHandler {
     registry.register(new InitCommand());
     registry.register(new RestoreCommand());
     registry.register(new AboutCommand());
+    registry.register(new HelpCommand(registry));
     return registry;
   }
 

packages/cli/src/acp/commands/help.test.ts

@@ -0,0 +1,53 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect } from 'vitest';
+import { HelpCommand } from './help.js';
+import { CommandRegistry } from './commandRegistry.js';
+import type { Command, CommandContext } from './types.js';
+
+describe('HelpCommand', () => {
+  it('returns formatted help text with sorted commands', async () => {
+    const registry = new CommandRegistry();
+
+    const cmdB: Command = {
+      name: 'bravo',
+      description: 'Bravo command',
+      execute: async () => ({ name: 'bravo', data: '' }),
+    };
+
+    const cmdA: Command = {
+      name: 'alpha',
+      description: 'Alpha command',
+      execute: async () => ({ name: 'alpha', data: '' }),
+    };
+
+    registry.register(cmdB);
+    registry.register(cmdA);
+
+    const helpCommand = new HelpCommand(registry);
+
+    const context = {} as CommandContext;
+
+    const response = await helpCommand.execute(context, []);
+
+    expect(response.name).toBe('help');
+
+    const data = response.data as string;
+
+    expect(data).toContain('Gemini CLI Help:');
+    expect(data).toContain('### Basics');
+    expect(data).toContain('### Commands');
+
+    const lines = data.split('\n');
+    const alphaIndex = lines.findIndex((l) => l.includes('/alpha'));
+    const bravoIndex = lines.findIndex((l) => l.includes('/bravo'));
+
+    expect(alphaIndex).toBeLessThan(bravoIndex);
+    expect(alphaIndex).not.toBe(-1);
+    expect(bravoIndex).not.toBe(-1);
+  });
+});

packages/cli/src/acp/commands/help.ts

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import type {
+  Command,
+  CommandContext,
+  CommandExecutionResponse,
+} from './types.js';
+import type { CommandRegistry } from './commandRegistry.js';
+
+export class HelpCommand implements Command {
+  readonly name = 'help';
+  readonly description = 'Show available commands';
+
+  constructor(private registry: CommandRegistry) {}
+
+  async execute(
+    _context: CommandContext,
+    _args: string[] = [],
+  ): Promise<CommandExecutionResponse> {
+    const commands = this.registry
+      .getAllCommands()
+      .sort((a, b) => a.name.localeCompare(b.name));
+
+    const lines: string[] = [];
+
+    lines.push('Gemini CLI Help:');
+    lines.push('');
+    lines.push('### Basics');
+    lines.push(
+      '- **Add context**: Use `@` to specify files for context (e.g., `@src/myFile.ts`) to target specific files or folders.',
+    );
+    lines.push('');
+
+    lines.push('### Commands');
+    for (const cmd of commands) {
+      if (cmd.description) {
+        lines.push(`- **/${cmd.name}** - ${cmd.description}`);
+      }
+    }
+
+    return {
+      name: this.name,
+      data: lines.join('\n'),
+    };
+  }
+}

packages/cli/src/commands/skills/list.test.ts

@@ -4,8 +4,16 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { coreEvents, type Config } from '@google/gemini-cli-core';
+import {
+  vi,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  type MockInstance,
+} from 'vitest';
+import { type Config } from '@google/gemini-cli-core';
 import { handleList, listCommand } from './list.js';
 import { loadSettings, type LoadedSettings } from '../../config/settings.js';
 import { loadCliConfig } from '../../config/config.js';
@@ -32,12 +40,16 @@ vi.mock('../utils.js', () => ({
 describe('skills list command', () => {
   const mockLoadSettings = vi.mocked(loadSettings);
   const mockLoadCliConfig = vi.mocked(loadCliConfig);
+  let stdoutWriteSpy: MockInstance<typeof process.stdout.write>;
 
   beforeEach(async () => {
     vi.clearAllMocks();
     mockLoadSettings.mockReturnValue({
       merged: {},
     } as unknown as LoadedSettings);
+    stdoutWriteSpy = vi
+      .spyOn(process.stdout, 'write')
+      .mockImplementation(() => true);
   });
 
   afterEach(() => {
@@ -56,10 +68,7 @@ describe('skills list command', () => {
 
       await handleList({});
 
-      expect(coreEvents.emitConsoleLog).toHaveBeenCalledWith(
-        'log',
-        'No skills discovered.',
-      );
+      expect(stdoutWriteSpy).toHaveBeenCalledWith('No skills discovered.\n');
     });
 
     it('should list all discovered skills', async () => {
@@ -87,24 +96,19 @@ describe('skills list command', () => {
 
       await handleList({});
 
-      expect(coreEvents.emitConsoleLog).toHaveBeenCalledWith(
-        'log',
-        chalk.bold('Discovered Agent Skills:'),
+      expect(stdoutWriteSpy).toHaveBeenCalledWith(
+        chalk.bold('Discovered Agent Skills:') + '\n\n',
       );
-      expect(coreEvents.emitConsoleLog).toHaveBeenCalledWith(
-        'log',
+      expect(stdoutWriteSpy).toHaveBeenCalledWith(
         expect.stringContaining('skill1'),
       );
-      expect(coreEvents.emitConsoleLog).toHaveBeenCalledWith(
-        'log',
+      expect(stdoutWriteSpy).toHaveBeenCalledWith(
         expect.stringContaining(chalk.green('[Enabled]')),
       );
-      expect(coreEvents.emitConsoleLog).toHaveBeenCalledWith(
-        'log',
+      expect(stdoutWriteSpy).toHaveBeenCalledWith(
         expect.stringContaining('skill2'),
       );
-      expect(coreEvents.emitConsoleLog).toHaveBeenCalledWith(
-        'log',
+      expect(stdoutWriteSpy).toHaveBeenCalledWith(
         expect.stringContaining(chalk.red('[Disabled]')),
       );
     });
@@ -135,12 +139,10 @@ describe('skills list command', () => {
 
       // Default
       await handleList({ all: false });
-      expect(coreEvents.emitConsoleLog).toHaveBeenCalledWith(
-        'log',
+      expect(stdoutWriteSpy).toHaveBeenCalledWith(
         expect.stringContaining('regular'),
       );
-      expect(coreEvents.emitConsoleLog).not.toHaveBeenCalledWith(
-        'log',
+      expect(stdoutWriteSpy).not.toHaveBeenCalledWith(
         expect.stringContaining('builtin'),
       );
 
@@ -148,16 +150,13 @@ describe('skills list command', () => {
 
       // With all: true
       await handleList({ all: true });
-      expect(coreEvents.emitConsoleLog).toHaveBeenCalledWith(
-        'log',
+      expect(stdoutWriteSpy).toHaveBeenCalledWith(
         expect.stringContaining('regular'),
       );
-      expect(coreEvents.emitConsoleLog).toHaveBeenCalledWith(
-        'log',
+      expect(stdoutWriteSpy).toHaveBeenCalledWith(
         expect.stringContaining('builtin'),
       );
-      expect(coreEvents.emitConsoleLog).toHaveBeenCalledWith(
-        'log',
+      expect(stdoutWriteSpy).toHaveBeenCalledWith(
         expect.stringContaining(chalk.gray(' [Built-in]')),
       );
     });

packages/cli/src/commands/skills/list.ts

@@ -5,7 +5,6 @@
  */
 
 import type { CommandModule } from 'yargs';
-import { debugLogger } from '@google/gemini-cli-core';
 import { loadSettings } from '../../config/settings.js';
 import { loadCliConfig, type CliArgs } from '../../config/config.js';
 import { exitCli } from '../utils.js';
@@ -42,12 +41,11 @@ export async function handleList(args: { all?: boolean }) {
   });
 
   if (skills.length === 0) {
-    debugLogger.log('No skills discovered.');
+    process.stdout.write('No skills discovered.\n');
     return;
   }
 
-  debugLogger.log(chalk.bold('Discovered Agent Skills:'));
-  debugLogger.log('');
+  process.stdout.write(chalk.bold('Discovered Agent Skills:') + '\n\n');
 
   for (const skill of skills) {
     const status = skill.disabled
@@ -56,10 +54,11 @@ export async function handleList(args: { all?: boolean }) {
 
     const builtinSuffix = skill.isBuiltin ? chalk.gray(' [Built-in]') : '';
 
-    debugLogger.log(`${chalk.bold(skill.name)} ${status}${builtinSuffix}`);
-    debugLogger.log(`  Description: ${skill.description}`);
-    debugLogger.log(`  Location:    ${skill.location}`);
-    debugLogger.log('');
+    process.stdout.write(
+      `${chalk.bold(skill.name)} ${status}${builtinSuffix}\n`,
+    );
+    process.stdout.write(`  Description: ${skill.description}\n`);
+    process.stdout.write(`  Location:    ${skill.location}\n\n`);
   }
 }
 

packages/cli/src/config/config.ts

@@ -938,6 +938,8 @@ export async function loadCliConfig(
       : undefined,
     blockedEnvironmentVariables:
       settings.security?.environmentVariableRedaction?.blocked,
+    allowedEnvironmentVariables:
+      settings.security?.environmentVariableRedaction?.allowed,
     enableEnvironmentVariableRedaction:
       settings.security?.environmentVariableRedaction?.enabled,
     userMemory: memoryContent,

packages/cli/src/gemini.test.tsx

@@ -51,8 +51,6 @@ import {
 import { act } from 'react';
 import { type InitializationResult } from './core/initializer.js';
 import { runNonInteractive } from './nonInteractiveCli.js';
-import * as userStartupWarningsModule from './utils/userStartupWarnings.js';
-
 // Hoisted constants and mocks
 const performance = vi.hoisted(() => ({
   now: vi.fn(),
@@ -647,11 +645,13 @@ describe('gemini.tsx main function kitty protocol', () => {
       .spyOn(debugLogger, 'log')
       .mockImplementation(() => {});
 
-    vi.stubEnv('GEMINI_API_KEY', 'test-key');
+    process.env['GEMINI_API_KEY'] = 'test-key';
     try {
       await main();
     } catch (e) {
       if (!(e instanceof MockProcessExitError)) throw e;
+    } finally {
+      delete process.env['GEMINI_API_KEY'];
     }
 
     if (flag === 'listExtensions') {
@@ -710,11 +710,13 @@ describe('gemini.tsx main function kitty protocol', () => {
       }),
     );
 
-    vi.stubEnv('GEMINI_API_KEY', 'test-key');
+    process.env['GEMINI_API_KEY'] = 'test-key';
     try {
       await main();
     } catch (e) {
       if (!(e instanceof MockProcessExitError)) throw e;
+    } finally {
+      delete process.env['GEMINI_API_KEY'];
     }
 
     expect(start_sandbox).toHaveBeenCalled();
@@ -762,11 +764,13 @@ describe('gemini.tsx main function kitty protocol', () => {
 
     vi.spyOn(themeManager, 'setActiveTheme').mockReturnValue(false);
 
-    vi.stubEnv('GEMINI_API_KEY', 'test-key');
+    process.env['GEMINI_API_KEY'] = 'test-key';
     try {
       await main();
     } catch (e) {
       if (!(e instanceof MockProcessExitError)) throw e;
+    } finally {
+      delete process.env['GEMINI_API_KEY'];
     }
 
     expect(debugLoggerWarnSpy).toHaveBeenCalledWith(
@@ -985,11 +989,13 @@ describe('gemini.tsx main function kitty protocol', () => {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     (process.stdin as any).isTTY = false;
 
-    vi.stubEnv('GEMINI_API_KEY', 'test-key');
+    process.env['GEMINI_API_KEY'] = 'test-key';
     try {
       await main();
     } catch (e) {
       if (!(e instanceof MockProcessExitError)) throw e;
+    } finally {
+      delete process.env['GEMINI_API_KEY'];
     }
 
     expect(readStdinSpy).toHaveBeenCalled();
@@ -1006,71 +1012,6 @@ describe('gemini.tsx main function kitty protocol', () => {
     expect(processExitSpy).toHaveBeenCalledWith(0);
     processExitSpy.mockRestore();
   });
-
-  it.each([
-    {
-      useAlternateBuffer: false,
-      description:
-        'false when useAlternateBuffer is false (even if terminal buffer is true)',
-    },
-    {
-      useAlternateBuffer: true,
-      description: 'true when useAlternateBuffer is true',
-    },
-  ])(
-    'should use getUseAlternateBuffer to evaluate isAlternateBuffer for startup warnings: $description',
-    async ({ useAlternateBuffer }) => {
-      const getUserStartupWarningsSpy = vi
-        .spyOn(userStartupWarningsModule, 'getUserStartupWarnings')
-        .mockResolvedValue([]);
-
-      vi.mocked(parseArguments).mockResolvedValue({
-        enabled: true,
-        allowedPaths: [],
-        networkAccess: false,
-        promptInteractive: false,
-      } as unknown as CliArgs);
-
-      vi.mocked(loadSettings).mockReturnValue(
-        createMockSettings({
-          merged: {
-            advanced: {},
-            security: { auth: {} },
-            ui: {},
-          },
-          workspace: { settings: {} },
-          setValue: vi.fn(),
-          forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
-        }),
-      );
-
-      const mockConfig = createMockConfig({
-        isInteractive: () => true,
-        getQuestion: () => '',
-        getSandbox: () => undefined,
-        getUseAlternateBuffer: () => useAlternateBuffer,
-        getUseTerminalBuffer: () => true, // Ensure we differentiate from isAlternateBufferEnabled
-        getScreenReader: () => false,
-      });
-
-      vi.mocked(loadCliConfig).mockResolvedValue(mockConfig);
-
-      vi.stubEnv('GEMINI_API_KEY', 'test-key');
-      try {
-        await main();
-      } catch (e) {
-        if (!(e instanceof MockProcessExitError)) throw e;
-      }
-
-      expect(getUserStartupWarningsSpy).toHaveBeenCalledWith(
-        expect.anything(),
-        undefined,
-        expect.objectContaining({ isAlternateBuffer: useAlternateBuffer }),
-      );
-
-      getUserStartupWarningsSpy.mockRestore();
-    },
-  );
 });
 
 describe('gemini.tsx main function exit codes', () => {
@@ -1191,13 +1132,15 @@ describe('gemini.tsx main function exit codes', () => {
       };
     });
 
-    vi.stubEnv('GEMINI_API_KEY', 'test-key');
+    process.env['GEMINI_API_KEY'] = 'test-key';
     try {
       await main();
       expect.fail('Should have thrown MockProcessExitError');
     } catch (e) {
       expect(e).toBeInstanceOf(MockProcessExitError);
       expect((e as MockProcessExitError).code).toBe(42);
+    } finally {
+      delete process.env['GEMINI_API_KEY'];
     }
   });
 
@@ -1222,13 +1165,15 @@ describe('gemini.tsx main function exit codes', () => {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     (process.stdin as any).isTTY = true;
 
-    vi.stubEnv('GEMINI_API_KEY', 'test-key');
+    process.env['GEMINI_API_KEY'] = 'test-key';
     try {
       await main();
       expect.fail('Should have thrown MockProcessExitError');
     } catch (e) {
       expect(e).toBeInstanceOf(MockProcessExitError);
       expect((e as MockProcessExitError).code).toBe(42);
+    } finally {
+      delete process.env['GEMINI_API_KEY'];
     }
   });
 
@@ -1265,12 +1210,13 @@ describe('gemini.tsx main function exit codes', () => {
         throw new MockProcessExitError(code);
       });
 
-    vi.stubEnv('GEMINI_API_KEY', 'test-key');
+    process.env['GEMINI_API_KEY'] = 'test-key';
     try {
       await main();
     } catch (e) {
       if (!(e instanceof MockProcessExitError)) throw e;
     } finally {
+      delete process.env['GEMINI_API_KEY'];
       processExitSpy.mockRestore();
     }
 

packages/cli/src/gemini.tsx

@@ -87,6 +87,7 @@ import {
 import { loadSandboxConfig } from './config/sandboxConfig.js';
 import { deleteSession, listSessions } from './utils/sessions.js';
 import { createPolicyUpdater } from './config/policy.js';
+import { isAlternateBufferEnabled } from './ui/hooks/useAlternateBuffer.js';
 
 import { setupTerminalAndTheme } from './utils/terminalTheme.js';
 import { runDeferredCommand } from './deferred.js';
@@ -561,8 +562,8 @@ export async function main() {
     }
 
     let input = config.getQuestion();
-    const isRealAlternateBuffer = shouldEnterAlternateScreen(
-      config.getUseAlternateBuffer(),
+    const useAlternateBuffer = shouldEnterAlternateScreen(
+      isAlternateBufferEnabled(config),
       config.getScreenReader(),
     );
     const rawStartupWarnings = await rawStartupWarningsPromise;
@@ -573,7 +574,7 @@ export async function main() {
         priority: WarningPriority.High,
       })),
       ...(await getUserStartupWarnings(settings.merged, undefined, {
-        isAlternateBuffer: isRealAlternateBuffer,
+        isAlternateBuffer: useAlternateBuffer,
       })),
     ];
 

packages/cli/src/test-utils/render.tsx

@@ -504,6 +504,8 @@ const baseMockUiState = {
   history: [],
   renderMarkdown: true,
   streamingState: StreamingState.Idle,
+  isConfigInitialized: true,
+  isAuthenticating: false,
   terminalWidth: 100,
   terminalHeight: 40,
   currentModel: 'gemini-pro',

packages/cli/src/ui/AppContainer.tsx

@@ -36,9 +36,11 @@ import {
   type ConfirmationRequest,
   type PermissionConfirmationRequest,
   type QuotaStats,
+  MessageType,
+  StreamingState,
+  type HistoryItemInfo,
 } from './types.js';
 import { checkPermissions } from './hooks/atCommandProcessor.js';
-import { MessageType, StreamingState } from './types.js';
 import { ToolActionsProvider } from './contexts/ToolActionsContext.js';
 import { MouseProvider } from './contexts/MouseContext.js';
 import { ScrollProvider } from './contexts/ScrollProvider.js';
@@ -51,6 +53,7 @@ import {
   type UserTierId,
   type GeminiUserTier,
   type UserFeedbackPayload,
+  type HookSystemMessagePayload,
   type AgentDefinition,
   type ApprovalMode,
   IdeClient,
@@ -2111,7 +2114,19 @@ Logging in with Google... Restarting Gemini CLI to continue.
       }
     };
 
+    const handleHookSystemMessage = (payload: HookSystemMessagePayload) => {
+      historyManager.addItem(
+        {
+          type: MessageType.INFO,
+          text: payload.message,
+          source: payload.hookName,
+        } as HistoryItemInfo,
+        Date.now(),
+      );
+    };
+
     coreEvents.on(CoreEvent.UserFeedback, handleUserFeedback);
+    coreEvents.on(CoreEvent.HookSystemMessage, handleHookSystemMessage);
 
     // Flush any messages that happened during startup before this component
     // mounted.
@@ -2119,6 +2134,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
 
     return () => {
       coreEvents.off(CoreEvent.UserFeedback, handleUserFeedback);
+      coreEvents.off(CoreEvent.HookSystemMessage, handleHookSystemMessage);
     };
   }, [historyManager]);
 

packages/cli/src/ui/components/AppHeader.test.tsx

@@ -10,15 +10,20 @@ import {
 } from '../../test-utils/render.js';
 import type { LoadedSettings } from '../../config/settings.js';
 import { AppHeader } from './AppHeader.js';
-import { describe, it, expect, vi } from 'vitest';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { makeFakeConfig } from '@google/gemini-cli-core';
 import crypto from 'node:crypto';
+import { _clearSessionBannersForTest } from '../hooks/useBanner.js';
 
 vi.mock('../utils/terminalSetup.js', () => ({
   getTerminalProgram: () => null,
 }));
 
 describe('<AppHeader />', () => {
+  beforeEach(() => {
+    _clearSessionBannersForTest();
+  });
+
   it('should render the banner with default text', async () => {
     const uiState = {
       history: [],

packages/cli/src/ui/components/AppHeader.tsx

@@ -59,13 +59,20 @@ const NARROW_TERMINAL_BREAKPOINT = 60;
 export const AppHeader = ({ version, showDetails = true }: AppHeaderProps) => {
   const settings = useSettings();
   const config = useConfig();
-  const { terminalWidth, bannerData, bannerVisible, updateInfo } = useUIState();
+  const {
+    terminalWidth,
+    bannerData,
+    bannerVisible,
+    updateInfo,
+    isConfigInitialized,
+    isAuthenticating,
+  } = useUIState();
 
   const { bannerText } = useBanner(bannerData);
   const { showTips } = useTips();
 
   const authType = config.getContentGeneratorConfig()?.authType;
-  const loggedOut = !authType;
+  const loggedOut = isConfigInitialized && !isAuthenticating && !authType;
 
   const showHeader = !(
     settings.merged.ui.hideBanner || config.getScreenReader()

packages/cli/src/ui/components/HistoryItemDisplay.tsx

@@ -134,6 +134,7 @@ export const HistoryItemDisplay: React.FC<HistoryItemDisplayProps> = ({
         <InfoMessage
           text={itemForDisplay.text}
           secondaryText={itemForDisplay.secondaryText}
+          source={itemForDisplay.source}
           icon={itemForDisplay.icon}
           color={itemForDisplay.color}
           marginBottom={itemForDisplay.marginBottom}

packages/cli/src/ui/components/InputPrompt.test.tsx

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { renderWithProviders } from '../../test-utils/render.js';
+import { renderWithProviders, cleanup } from '../../test-utils/render.js';
 import { createMockSettings } from '../../test-utils/settings.js';
 import { makeFakeConfig } from '@google/gemini-cli-core';
 import { waitFor } from '../../test-utils/async.js';
@@ -23,6 +23,7 @@ import {
 import {
   ApprovalMode,
   debugLogger,
+  coreEvents,
   type Config,
 } from '@google/gemini-cli-core';
 import * as path from 'node:path';
@@ -93,6 +94,8 @@ vi.mock('ink', async (importOriginal) => {
 
 afterEach(() => {
   vi.restoreAllMocks();
+  vi.useRealTimers();
+  cleanup();
 });
 
 const mockSlashCommands: SlashCommand[] = [
@@ -236,6 +239,7 @@ describe('InputPrompt', () => {
 
   beforeEach(() => {
     vi.resetAllMocks();
+    coreEvents.removeAllListeners();
     vi.spyOn(
       terminalCapabilityManager,
       'isKittyProtocolEnabled',

packages/cli/src/ui/components/InputPrompt.tsx

@@ -432,7 +432,7 @@ export const InputPrompt: React.FC<InputPromptProps> = ({
             slashCommands,
           );
           if (commandToExecute?.isSafeConcurrent) {
-            inputHistory.handleSubmit(trimmedMessage);
+            handleSubmitAndClear(trimmedMessage);
             return;
           }
         }
@@ -450,6 +450,7 @@ export const InputPrompt: React.FC<InputPromptProps> = ({
       streamingState,
       setQueueErrorMessage,
       slashCommands,
+      handleSubmitAndClear,
     ],
   );
 

packages/cli/src/ui/components/MainContent.test.tsx

@@ -6,7 +6,11 @@
 
 import { renderWithProviders } from '../../test-utils/render.js';
 import { createMockSettings } from '../../test-utils/settings.js';
-import { makeFakeConfig, CoreToolCallStatus } from '@google/gemini-cli-core';
+import {
+  makeFakeConfig,
+  CoreToolCallStatus,
+  UPDATE_TOPIC_TOOL_NAME,
+} from '@google/gemini-cli-core';
 import { waitFor } from '../../test-utils/async.js';
 import { MainContent } from './MainContent.js';
 import { getToolGroupBorderAppearance } from '../utils/borderStyles.js';
@@ -728,6 +732,158 @@ describe('MainContent', () => {
     unmount();
   });
 
+  describe('Narration Suppression', () => {
+    const settingsWithNarration = createMockSettings({
+      merged: {
+        ui: { inlineThinkingMode: 'expanded' },
+        experimental: { topicUpdateNarration: true },
+      },
+    });
+
+    it('suppresses thinking ALWAYS when narration is enabled', async () => {
+      mockUseSettings.mockReturnValue(settingsWithNarration);
+      const uiState = {
+        ...defaultMockUiState,
+        history: [
+          { id: 1, type: 'user' as const, text: 'Hello' },
+          {
+            id: 2,
+            type: 'thinking' as const,
+            thought: {
+              subject: 'Thinking...',
+              description: 'Thinking about hello',
+            },
+          },
+          { id: 3, type: 'gemini' as const, text: 'I am helping.' },
+        ],
+      };
+
+      const { lastFrame, unmount } = await renderWithProviders(
+        <MainContent />,
+        {
+          uiState: uiState as Partial<UIState>,
+          settings: settingsWithNarration,
+        },
+      );
+
+      const output = lastFrame();
+      expect(output).not.toContain('Thinking...');
+      expect(output).toContain('I am helping.');
+      unmount();
+    });
+
+    it('suppresses text in intermediate turns (contains non-topic tools)', async () => {
+      mockUseSettings.mockReturnValue(settingsWithNarration);
+      const uiState = {
+        ...defaultMockUiState,
+        history: [
+          { id: 100, type: 'user' as const, text: 'Search' },
+          {
+            id: 101,
+            type: 'gemini' as const,
+            text: 'I will now search the files.',
+          },
+          {
+            id: 102,
+            type: 'tool_group' as const,
+            tools: [
+              {
+                callId: '1',
+                name: 'ls',
+                args: { path: '.' },
+                status: CoreToolCallStatus.Success,
+              },
+            ],
+          },
+        ],
+      };
+
+      const { lastFrame, unmount } = await renderWithProviders(
+        <MainContent />,
+        {
+          uiState: uiState as Partial<UIState>,
+          settings: settingsWithNarration,
+        },
+      );
+
+      const output = lastFrame();
+      expect(output).not.toContain('I will now search the files.');
+      unmount();
+    });
+
+    it('suppresses text that precedes a topic tool in the same turn', async () => {
+      mockUseSettings.mockReturnValue(settingsWithNarration);
+      const uiState = {
+        ...defaultMockUiState,
+        history: [
+          { id: 200, type: 'user' as const, text: 'Hello' },
+          { id: 201, type: 'gemini' as const, text: 'I will now help you.' },
+          {
+            id: 202,
+            type: 'tool_group' as const,
+            tools: [
+              {
+                callId: '1',
+                name: UPDATE_TOPIC_TOOL_NAME,
+                args: { title: 'Helping', summary: 'Helping the user' },
+                status: CoreToolCallStatus.Success,
+              },
+            ],
+          },
+        ],
+      };
+
+      const { lastFrame, unmount } = await renderWithProviders(
+        <MainContent />,
+        {
+          uiState: uiState as Partial<UIState>,
+          settings: settingsWithNarration,
+        },
+      );
+
+      const output = lastFrame();
+      expect(output).not.toContain('I will now help you.');
+      expect(output).toContain('Helping');
+      expect(output).toContain('Helping the user');
+      unmount();
+    });
+
+    it('shows text in the final turn if it comes AFTER the topic tool', async () => {
+      mockUseSettings.mockReturnValue(settingsWithNarration);
+      const uiState = {
+        ...defaultMockUiState,
+        history: [
+          { id: 300, type: 'user' as const, text: 'Hello' },
+          {
+            id: 301,
+            type: 'tool_group' as const,
+            tools: [
+              {
+                callId: '1',
+                name: UPDATE_TOPIC_TOOL_NAME,
+                args: { title: 'Final Answer', summary: 'I have finished' },
+                status: CoreToolCallStatus.Success,
+              },
+            ],
+          },
+          { id: 302, type: 'gemini' as const, text: 'Here is your answer.' },
+        ],
+      };
+
+      const { lastFrame, unmount } = await renderWithProviders(
+        <MainContent />,
+        {
+          uiState: uiState as Partial<UIState>,
+          settings: settingsWithNarration,
+        },
+      );
+
+      const output = lastFrame();
+      expect(output).toContain('Here is your answer.');
+      unmount();
+    });
+  });
+
   it('renders multiple thinking messages sequentially correctly', async () => {
     mockUseSettings.mockReturnValue({
       merged: {

packages/cli/src/ui/components/MainContent.tsx

@@ -91,20 +91,47 @@ export const MainContent = () => {
     const flags = new Array<boolean>(combinedHistory.length).fill(false);
 
     if (topicUpdateNarrationEnabled) {
-      let toolGroupInTurn = false;
+      let turnIsIntermediate = false;
+      let hasTopicToolInTurn = false;
+
       for (let i = combinedHistory.length - 1; i >= 0; i--) {
         const item = combinedHistory[i];
         if (item.type === 'user' || item.type === 'user_shell') {
-          toolGroupInTurn = false;
+          turnIsIntermediate = false;
+          hasTopicToolInTurn = false;
         } else if (item.type === 'tool_group') {
-          toolGroupInTurn = item.tools.some((t) => isTopicTool(t.name));
+          const hasTopic = item.tools.some((t) => isTopicTool(t.name));
+          const hasNonTopic = item.tools.some((t) => !isTopicTool(t.name));
+          if (hasTopic) {
+            hasTopicToolInTurn = true;
+          }
+          if (hasNonTopic) {
+            turnIsIntermediate = true;
+          }
         } else if (
-          (item.type === 'thinking' ||
-            item.type === 'gemini' ||
-            item.type === 'gemini_content') &&
-          toolGroupInTurn
+          item.type === 'thinking' ||
+          item.type === 'gemini' ||
+          item.type === 'gemini_content'
         ) {
-          flags[i] = true;
+          // Rule 1: Always suppress thinking when narration is enabled to avoid
+          // "flashing" as the model starts its response, and because the Topic
+          // UI provides the necessary high-level intent.
+          if (item.type === 'thinking') {
+            flags[i] = true;
+            continue;
+          }
+
+          // Rule 2: Suppress text in intermediate turns (turns containing non-topic
+          // tools) to hide mechanical narration.
+          if (turnIsIntermediate) {
+            flags[i] = true;
+          }
+
+          // Rule 3: Suppress text that precedes a topic tool in the same turn,
+          // as the topic tool "replaces" it.
+          if (hasTopicToolInTurn) {
+            flags[i] = true;
+          }
         }
       }
     }
@@ -336,6 +363,10 @@ export const MainContent = () => {
     isAlternateBuffer,
   ]);
 
+  if (!uiState.isConfigInitialized) {
+    return null;
+  }
+
   if (isAlternateBufferOrTerminalBuffer) {
     return scrollableList;
   }

packages/cli/src/ui/components/messages/InfoMessage.tsx

@@ -12,6 +12,7 @@ import { RenderInline } from '../../utils/InlineMarkdownRenderer.js';
 interface InfoMessageProps {
   text: string;
   secondaryText?: string;
+  source?: string;
   icon?: string;
   color?: string;
   marginBottom?: number;
@@ -20,6 +21,7 @@ interface InfoMessageProps {
 export const InfoMessage: React.FC<InfoMessageProps> = ({
   text,
   secondaryText,
+  source,
   icon,
   color,
   marginBottom,
@@ -40,6 +42,9 @@ export const InfoMessage: React.FC<InfoMessageProps> = ({
             {index === text.split('\n').length - 1 && secondaryText && (
               <Text color={theme.text.secondary}> {secondaryText}</Text>
             )}
+            {index === text.split('\n').length - 1 && source && (
+              <Text color={theme.text.secondary}> [{source}]</Text>
+            )}
           </Text>
         ))}
       </Box>

packages/cli/src/ui/components/messages/ToolGroupMessage.test.tsx

@@ -258,15 +258,42 @@ describe('<ToolGroupMessage />', () => {
       unmount();
     });
 
-    it('renders update_topic tool call prioritizing summary over strategic_intent', async () => {
+    it('renders update_topic tool call using TopicMessage', async () => {
       const toolCalls = [
         createToolCall({
-          callId: 'topic-tool-priority',
+          callId: 'topic-tool',
+          name: UPDATE_TOPIC_TOOL_NAME,
+          args: {
+            [TOPIC_PARAM_TITLE]: 'Testing Topic',
+            [TOPIC_PARAM_STRATEGIC_INTENT]: 'This is the description',
+          },
+        }),
+      ];
+      const item = createItem(toolCalls);
+
+      const { lastFrame, unmount } = await renderWithProviders(
+        <ToolGroupMessage {...baseProps} item={item} toolCalls={toolCalls} />,
+        {
+          config: baseMockConfig,
+          settings: fullVerbositySettings,
+        },
+      );
+
+      const output = lastFrame();
+      expect(output).toContain('Testing Topic: ');
+      expect(output).toContain('This is the description');
+      expect(output).toMatchSnapshot('update_topic_tool');
+      unmount();
+    });
+
+    it('renders update_topic tool call with summary instead of strategic_intent', async () => {
+      const toolCalls = [
+        createToolCall({
+          callId: 'topic-tool-summary',
           name: UPDATE_TOPIC_TOOL_NAME,
           args: {
             [TOPIC_PARAM_TITLE]: 'Testing Topic',
             [TOPIC_PARAM_SUMMARY]: 'This is the summary',
-            [TOPIC_PARAM_STRATEGIC_INTENT]: 'This should be ignored',
           },
         }),
       ];
@@ -283,34 +310,6 @@ describe('<ToolGroupMessage />', () => {
       const output = lastFrame();
       expect(output).toContain('Testing Topic: ');
       expect(output).toContain('This is the summary');
-      expect(output).not.toContain('This should be ignored');
-      unmount();
-    });
-
-    it('renders update_topic tool call falling back to strategic_intent', async () => {
-      const toolCalls = [
-        createToolCall({
-          callId: 'topic-tool-fallback',
-          name: UPDATE_TOPIC_TOOL_NAME,
-          args: {
-            [TOPIC_PARAM_TITLE]: 'Testing Topic',
-            [TOPIC_PARAM_STRATEGIC_INTENT]: 'Fallback intent',
-          },
-        }),
-      ];
-      const item = createItem(toolCalls);
-
-      const { lastFrame, unmount } = await renderWithProviders(
-        <ToolGroupMessage {...baseProps} item={item} toolCalls={toolCalls} />,
-        {
-          config: baseMockConfig,
-          settings: fullVerbositySettings,
-        },
-      );
-
-      const output = lastFrame();
-      expect(output).toContain('Testing Topic: ');
-      expect(output).toContain('Fallback intent');
       unmount();
     });
 
@@ -321,7 +320,7 @@ describe('<ToolGroupMessage />', () => {
           name: UPDATE_TOPIC_TOOL_NAME,
           args: {
             [TOPIC_PARAM_TITLE]: 'Testing Topic',
-            [TOPIC_PARAM_SUMMARY]: 'This is the summary',
+            [TOPIC_PARAM_STRATEGIC_INTENT]: 'This is the description',
           },
         }),
         createToolCall({

packages/cli/src/ui/components/messages/TopicMessage.test.tsx

@@ -0,0 +1,114 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import { TopicMessage } from './TopicMessage.js';
+import { renderWithProviders } from '../../../test-utils/render.js';
+import {
+  TOPIC_PARAM_TITLE,
+  TOPIC_PARAM_SUMMARY,
+  TOPIC_PARAM_STRATEGIC_INTENT,
+  CoreToolCallStatus,
+  UPDATE_TOPIC_TOOL_NAME,
+} from '@google/gemini-cli-core';
+
+describe('<TopicMessage />', () => {
+  const baseArgs = {
+    [TOPIC_PARAM_TITLE]: 'Test Topic',
+    [TOPIC_PARAM_STRATEGIC_INTENT]: 'This is the strategic intent.',
+    [TOPIC_PARAM_SUMMARY]:
+      'This is the detailed summary that should be expandable.',
+  };
+
+  const renderTopic = async (
+    args: Record<string, unknown>,
+    height?: number,
+    toolActions?: {
+      isExpanded?: (callId: string) => boolean;
+      toggleExpansion?: (callId: string) => void;
+    },
+  ) =>
+    renderWithProviders(
+      <TopicMessage
+        args={args}
+        terminalWidth={80}
+        availableTerminalHeight={height}
+        callId="test-topic"
+        name={UPDATE_TOPIC_TOOL_NAME}
+        description="Updating topic"
+        status={CoreToolCallStatus.Success}
+        confirmationDetails={undefined}
+        resultDisplay={undefined}
+      />,
+      { toolActions, mouseEventsEnabled: true },
+    );
+
+  it('renders title and intent by default (collapsed)', async () => {
+    const { lastFrame } = await renderTopic(baseArgs, 40);
+    const frame = lastFrame();
+    expect(frame).toContain('Test Topic:');
+    expect(frame).toContain('This is the strategic intent.');
+    expect(frame).not.toContain('This is the detailed summary');
+    expect(frame).not.toContain('(ctrl+o to expand)');
+  });
+
+  it('renders summary when globally expanded (Ctrl+O)', async () => {
+    const { lastFrame } = await renderTopic(baseArgs, undefined);
+    const frame = lastFrame();
+    expect(frame).toContain('Test Topic:');
+    expect(frame).toContain('This is the strategic intent.');
+    expect(frame).toContain('This is the detailed summary');
+    expect(frame).not.toContain('(ctrl+o to collapse)');
+  });
+
+  it('renders summary when selectively expanded via context', async () => {
+    const isExpanded = vi.fn((id) => id === 'test-topic');
+    const { lastFrame } = await renderTopic(baseArgs, 40, { isExpanded });
+    const frame = lastFrame();
+    expect(frame).toContain('Test Topic:');
+    expect(frame).toContain('This is the detailed summary');
+    expect(frame).not.toContain('(ctrl+o to collapse)');
+  });
+
+  it('calls toggleExpansion when clicked', async () => {
+    const toggleExpansion = vi.fn();
+    const { simulateClick } = await renderTopic(baseArgs, 40, {
+      toggleExpansion,
+    });
+
+    // In renderWithProviders, the component is wrapped in a Box with terminalWidth.
+    // The TopicMessage has marginLeft={2}.
+    // So col 5 should definitely hit the text content.
+    // row 1 is the first line of the TopicMessage.
+    await simulateClick(5, 1);
+
+    expect(toggleExpansion).toHaveBeenCalledWith('test-topic');
+  });
+
+  it('falls back to summary if strategic_intent is missing', async () => {
+    const args = {
+      [TOPIC_PARAM_TITLE]: 'Test Topic',
+      [TOPIC_PARAM_SUMMARY]: 'Only summary is present.',
+    };
+    const { lastFrame } = await renderTopic(args, 40);
+    const frame = lastFrame();
+    expect(frame).toContain('Test Topic:');
+    expect(frame).toContain('Only summary is present.');
+    expect(frame).not.toContain('(ctrl+o to expand)');
+  });
+
+  it('renders only strategic_intent if summary is missing', async () => {
+    const args = {
+      [TOPIC_PARAM_TITLE]: 'Test Topic',
+      [TOPIC_PARAM_STRATEGIC_INTENT]: 'Only intent is present.',
+    };
+    const { lastFrame } = await renderTopic(args, 40);
+    const frame = lastFrame();
+    expect(frame).toContain('Test Topic:');
+    expect(frame).toContain('Only intent is present.');
+    expect(frame).not.toContain('(ctrl+o to expand)');
+  });
+});

packages/cli/src/ui/components/messages/TopicMessage.tsx

@@ -5,7 +5,8 @@
  */
 
 import type React from 'react';
-import { Box, Text } from 'ink';
+import { useEffect, useId, useRef, useCallback } from 'react';
+import { Box, Text, type DOMElement } from 'ink';
 import {
   UPDATE_TOPIC_TOOL_NAME,
   UPDATE_TOPIC_DISPLAY_NAME,
@@ -15,32 +16,103 @@ import {
 } from '@google/gemini-cli-core';
 import type { IndividualToolCallDisplay } from '../../types.js';
 import { theme } from '../../semantic-colors.js';
+import { useOverflowActions } from '../../contexts/OverflowContext.js';
+import { useToolActions } from '../../contexts/ToolActionsContext.js';
+import { useMouseClick } from '../../hooks/useMouseClick.js';
 
 interface TopicMessageProps extends IndividualToolCallDisplay {
   terminalWidth: number;
+  availableTerminalHeight?: number;
+  isExpandable?: boolean;
 }
 
 export const isTopicTool = (name: string): boolean =>
   name === UPDATE_TOPIC_TOOL_NAME || name === UPDATE_TOPIC_DISPLAY_NAME;
 
-export const TopicMessage: React.FC<TopicMessageProps> = ({ args }) => {
+export const TopicMessage: React.FC<TopicMessageProps> = ({
+  callId,
+  args,
+  availableTerminalHeight,
+  isExpandable = true,
+}) => {
+  const { isExpanded: isExpandedInContext, toggleExpansion } = useToolActions();
+
+  // Expansion is active if either:
+  // 1. The individual callId is expanded in the ToolActionsContext
+  // 2. The entire turn is expanded (Ctrl+O) which sets availableTerminalHeight to undefined
+  const isExpanded =
+    (isExpandedInContext ? isExpandedInContext(callId) : false) ||
+    availableTerminalHeight === undefined;
+
+  const overflowActions = useOverflowActions();
+  const uniqueId = useId();
+  const overflowId = `topic-${uniqueId}`;
+  const containerRef = useRef<DOMElement>(null);
+
   const rawTitle = args?.[TOPIC_PARAM_TITLE];
   const title = typeof rawTitle === 'string' ? rawTitle : undefined;
-  const rawDescription =
-    args?.[TOPIC_PARAM_SUMMARY] || args?.[TOPIC_PARAM_STRATEGIC_INTENT];
-  const description =
-    typeof rawDescription === 'string' ? rawDescription : undefined;
+
+  const rawStrategicIntent = args?.[TOPIC_PARAM_STRATEGIC_INTENT];
+  const strategicIntent =
+    typeof rawStrategicIntent === 'string' ? rawStrategicIntent : undefined;
+
+  const rawSummary = args?.[TOPIC_PARAM_SUMMARY];
+  const summary = typeof rawSummary === 'string' ? rawSummary : undefined;
+
+  // Top line intent: prefer strategic_intent, fallback to summary
+  const intent = strategicIntent || summary;
+
+  // Extra summary: only if both exist and are different (or just summary if we want to show it below)
+  const hasExtraSummary = !!(
+    strategicIntent &&
+    summary &&
+    strategicIntent !== summary
+  );
+
+  const handleToggle = useCallback(() => {
+    if (toggleExpansion && hasExtraSummary) {
+      toggleExpansion(callId);
+    }
+  }, [toggleExpansion, hasExtraSummary, callId]);
+
+  useMouseClick(containerRef, handleToggle, {
+    isActive: isExpandable && hasExtraSummary,
+  });
+
+  useEffect(() => {
+    // Only register if there is more content (summary) and it's currently hidden
+    const hasHiddenContent = isExpandable && hasExtraSummary && !isExpanded;
+
+    if (hasHiddenContent && overflowActions) {
+      overflowActions.addOverflowingId(overflowId);
+    } else if (overflowActions) {
+      overflowActions.removeOverflowingId(overflowId);
+    }
+
+    return () => {
+      overflowActions?.removeOverflowingId(overflowId);
+    };
+  }, [isExpandable, hasExtraSummary, isExpanded, overflowActions, overflowId]);
 
   return (
-    <Box flexDirection="row" marginLeft={2} flexWrap="wrap">
-      <Text color={theme.text.primary} bold wrap="truncate-end">
-        {title || 'Topic'}
-        {description && <Text>: </Text>}
-      </Text>
-      {description && (
-        <Text color={theme.text.secondary} wrap="wrap">
-          {description}
+    <Box ref={containerRef} flexDirection="column" marginLeft={2}>
+      <Box flexDirection="row" flexWrap="wrap">
+        <Text color={theme.text.primary} bold wrap="truncate-end">
+          {title || 'Topic'}
+          {intent && <Text>: </Text>}
         </Text>
+        {intent && (
+          <Text color={theme.text.secondary} wrap="wrap">
+            {intent}
+          </Text>
+        )}
+      </Box>
+      {isExpanded && hasExtraSummary && summary && (
+        <Box marginTop={1} marginLeft={0}>
+          <Text color={theme.text.secondary} wrap="wrap">
+            {summary}
+          </Text>
+        </Box>
       )}
     </Box>
   );

packages/cli/src/ui/components/messages/__snapshots__/ToolGroupMessage.test.tsx.snap

@@ -78,7 +78,7 @@ exports[`<ToolGroupMessage /> > Golden Snapshots > renders header when scrolled
 
 exports[`<ToolGroupMessage /> > Golden Snapshots > renders mixed tool calls including update_topic 1`] = `
 "
-  Testing Topic: This is the summary
+  Testing Topic: This is the description
 
 ╭──────────────────────────────────────────────────────────────────────────╮
 │ ✓  read_file Read a file                                                 │
@@ -142,6 +142,12 @@ exports[`<ToolGroupMessage /> > Golden Snapshots > renders two tool groups where
 "
 `;
 
+exports[`<ToolGroupMessage /> > Golden Snapshots > renders update_topic tool call using TopicMessage > update_topic_tool 1`] = `
+"
+  Testing Topic: This is the description
+"
+`;
+
 exports[`<ToolGroupMessage /> > Golden Snapshots > renders with limited terminal height 1`] = `
 "╭──────────────────────────────────────────────────────────────────────────╮
 │ ✓  tool-with-result Tool with output                                     │

packages/cli/src/ui/hooks/useBanner.test.ts

@@ -13,7 +13,7 @@ import {
   type MockedFunction,
 } from 'vitest';
 import { renderHook } from '../../test-utils/render.js';
-import { useBanner } from './useBanner.js';
+import { useBanner, _clearSessionBannersForTest } from './useBanner.js';
 import { persistentState } from '../../utils/persistentState.js';
 import crypto from 'node:crypto';
 
@@ -56,6 +56,7 @@ describe('useBanner', () => {
 
   beforeEach(() => {
     vi.resetAllMocks();
+    _clearSessionBannersForTest();
 
     // Default persistentState behavior: return empty object (no counts)
     mockedPersistentStateGet.mockReturnValue({});
@@ -101,13 +102,18 @@ describe('useBanner', () => {
     );
   });
 
-  it('should NOT increment count if warning text is shown instead', async () => {
+  it('should increment count if warning text is shown instead', async () => {
     const data = { defaultText: 'Standard', warningText: 'Warning' };
 
     await renderHook(() => useBanner(data));
 
-    // Since warning text takes precedence, default banner logic (and increment) is skipped
-    expect(mockedPersistentStateSet).not.toHaveBeenCalled();
+    // Warning text now also gets counted
+    expect(mockedPersistentStateSet).toHaveBeenCalledWith(
+      'defaultBannerShownCount',
+      {
+        [crypto.createHash('sha256').update(data.warningText).digest('hex')]: 1,
+      },
+    );
   });
 
   it('should handle newline replacements', async () => {

packages/cli/src/ui/hooks/useBanner.ts

@@ -4,12 +4,21 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { useState, useEffect, useRef } from 'react';
+import { useState, useEffect } from 'react';
 import { persistentState } from '../../utils/persistentState.js';
 import crypto from 'node:crypto';
 
 const DEFAULT_MAX_BANNER_SHOWN_COUNT = 5;
 
+// Track banners incremented during this session to prevent multiple increments
+// on React unmounts/remounts
+const sessionIncrementedBanners = new Set<string>();
+
+// For testing purposes
+export function _clearSessionBannersForTest() {
+  sessionIncrementedBanners.clear();
+}
+
 interface BannerData {
   defaultText: string;
   warningText: string;
@@ -22,25 +31,25 @@ export function useBanner(bannerData: BannerData) {
     () => persistentState.get('defaultBannerShownCount') || {},
   );
 
+  const activeText = warningText ? warningText : defaultText;
+
   const hashedText = crypto
     .createHash('sha256')
-    .update(defaultText)
+    .update(activeText)
     .digest('hex');
 
   const currentBannerCount = bannerCounts[hashedText] || 0;
 
-  const showDefaultBanner =
-    warningText === '' && currentBannerCount < DEFAULT_MAX_BANNER_SHOWN_COUNT;
+  const showBanner =
+    activeText !== '' && currentBannerCount < DEFAULT_MAX_BANNER_SHOWN_COUNT;
 
-  const rawBannerText = showDefaultBanner ? defaultText : warningText;
+  const rawBannerText = showBanner ? activeText : '';
   const bannerText = rawBannerText.replace(/\\n/g, '\n');
 
-  const lastIncrementedKey = useRef<string | null>(null);
-
   useEffect(() => {
-    if (showDefaultBanner && defaultText) {
-      if (lastIncrementedKey.current !== defaultText) {
-        lastIncrementedKey.current = defaultText;
+    if (showBanner && activeText) {
+      if (!sessionIncrementedBanners.has(activeText)) {
+        sessionIncrementedBanners.add(activeText);
 
         const allCounts = persistentState.get('defaultBannerShownCount') || {};
         const current = allCounts[hashedText] || 0;
@@ -51,7 +60,7 @@ export function useBanner(bannerData: BannerData) {
         });
       }
     }
-  }, [showDefaultBanner, defaultText, hashedText]);
+  }, [showBanner, activeText, hashedText]);
 
   return {
     bannerText,

packages/cli/src/ui/hooks/useGeminiStream.test.tsx

@@ -66,6 +66,7 @@ import { MessageType, StreamingState } from '../types.js';
 import type { LoadedSettings } from '../../config/settings.js';
 import { findLastSafeSplitPoint } from '../utils/markdownUtilities.js';
 import { theme } from '../semantic-colors.js';
+import { createMockSettings } from '../../test-utils/mockConfig.js';
 
 // --- MOCKS ---
 const mockSendMessageStream = vi
@@ -4240,4 +4241,100 @@ describe('useGeminiStream', () => {
     });
     expect(spanMetadata.input).toBe('telemetry test query');
   });
+
+  describe('topicUpdateNarration blocking', () => {
+    it('should block text updates while streaming and show them at the end if no tools are called', async () => {
+      const settings = createMockSettings({
+        merged: {
+          experimental: { topicUpdateNarration: true },
+          ui: { compactToolOutput: true },
+        },
+      });
+
+      mockSendMessageStream.mockReturnValue(
+        (async function* () {
+          yield { type: ServerGeminiEventType.Content, value: 'Hello ' };
+          yield { type: ServerGeminiEventType.Content, value: 'world!' };
+        })(),
+      );
+
+      const { result } = await renderTestHook([], undefined, settings);
+
+      await act(async () => {
+        await result.current.submitQuery('Hi');
+      });
+
+      // During streaming, addItem should NOT have been called with 'gemini' type.
+      // However, it IS called at the end of the turn because there are no tool calls.
+      expect(mockAddItem).toHaveBeenCalledWith(
+        expect.objectContaining({ type: 'gemini', text: 'Hello world!' }),
+        expect.any(Number),
+      );
+    });
+
+    it('should discard text updates if tool calls are present in the turn', async () => {
+      const settings = createMockSettings({
+        merged: {
+          experimental: { topicUpdateNarration: true },
+          ui: { compactToolOutput: true },
+        },
+      });
+
+      mockSendMessageStream.mockReturnValue(
+        (async function* () {
+          yield {
+            type: ServerGeminiEventType.Content,
+            value: 'I will call a tool.',
+          };
+          yield {
+            type: ServerGeminiEventType.ToolCallRequest,
+            value: { callId: '1', name: 'some_tool', args: {} },
+          };
+        })(),
+      );
+
+      const { result } = await renderTestHook([], undefined, settings);
+
+      await act(async () => {
+        await result.current.submitQuery('Hi');
+      });
+
+      // addItem should NOT have been called with 'gemini' type because there was a tool call.
+      expect(mockAddItem).not.toHaveBeenCalledWith(
+        expect.objectContaining({ type: 'gemini' }),
+        expect.any(Number),
+      );
+    });
+
+    it('should block thinking history items when narration is enabled', async () => {
+      const settings = createMockSettings({
+        merged: {
+          experimental: { topicUpdateNarration: true },
+          ui: { inlineThinkingMode: 'full' },
+        },
+      });
+
+      mockSendMessageStream.mockReturnValue(
+        (async function* () {
+          yield {
+            type: ServerGeminiEventType.Thought,
+            value: { thought: 'I am thinking...' },
+          };
+          yield { type: ServerGeminiEventType.Content, value: 'Final answer' };
+        })(),
+      );
+
+      const { result } = await renderTestHook([], undefined, settings);
+
+      await act(async () => {
+        await result.current.submitQuery('Hi');
+      });
+
+      // addItem should NOT have been called with 'thinking' type.
+      expect(mockAddItem).not.toHaveBeenCalledWith(
+        expect.objectContaining({ type: 'thinking' }),
+        expect.any(Number),
+      );
+    });
+  });
 });

packages/cli/src/ui/hooks/useGeminiStream.ts

@@ -238,6 +238,8 @@ export const useGeminiStream = (
     null,
   );
   const isLowErrorVerbosity = settings.merged.ui?.errorVerbosity !== 'full';
+  const topicUpdateNarrationEnabled =
+    settings.merged.experimental?.topicUpdateNarration === true;
   const suppressedToolErrorCountRef = useRef(0);
   const suppressedToolErrorNoteShownRef = useRef(false);
   const lowVerbosityFailureNoteShownRef = useRef(false);
@@ -1082,9 +1084,24 @@ export const useGeminiStream = (
         if (pendingHistoryItemRef.current) {
           addItem(pendingHistoryItemRef.current, userMessageTimestamp);
         }
+
+        // When narration is enabled, we block all text updates during the turn.
+        // The text is accumulated and only shown at the end of the turn if
+        // no tool calls were made.
+        if (topicUpdateNarrationEnabled) {
+          setPendingHistoryItem(null);
+          return newGeminiMessageBuffer;
+        }
+
         setPendingHistoryItem({ type: 'gemini', text: '' });
         newGeminiMessageBuffer = eventValue;
       }
+
+      // When narration is enabled, skip updating the UI with incremental text.
+      if (topicUpdateNarrationEnabled) {
+        return newGeminiMessageBuffer;
+      }
+
       // Split large messages for better rendering performance. Ideally,
       // we should maximize the amount of output sent to <Static />.
       const splitPoint = findLastSafeSplitPoint(newGeminiMessageBuffer);
@@ -1123,21 +1140,31 @@ export const useGeminiStream = (
       }
       return newGeminiMessageBuffer;
     },
-    [addItem, pendingHistoryItemRef, setPendingHistoryItem],
+    [
+      addItem,
+      pendingHistoryItemRef,
+      setPendingHistoryItem,
+      topicUpdateNarrationEnabled,
+    ],
   );
 
   const handleThoughtEvent = useCallback(
     (eventValue: ThoughtSummary, _userMessageTimestamp: number) => {
       setThought(eventValue);
 
-      if (getInlineThinkingMode(settings) === 'full') {
+      // Block thinking history items when narration is enabled to avoid
+      // UI flickering and provide a cleaner experience.
+      if (
+        !topicUpdateNarrationEnabled &&
+        getInlineThinkingMode(settings) === 'full'
+      ) {
         addItem({
           type: 'thinking',
           thought: eventValue,
         } as HistoryItemThinking);
       }
     },
-    [addItem, settings, setThought],
+    [addItem, settings, setThought, topicUpdateNarrationEnabled],
   );
 
   const handleUserCancelledEvent = useCallback(
@@ -1545,6 +1572,14 @@ export const useGeminiStream = (
           setPendingHistoryItem(null);
         }
         await scheduleToolCalls(toolCallRequests, signal);
+      } else if (
+        topicUpdateNarrationEnabled &&
+        geminiMessageBuffer.length > 0
+      ) {
+        // When narration is enabled, we only show the final text response
+        // if no tools were called in the current turn. This hides intermediate
+        // narration during multi-turn orchestration.
+        setPendingHistoryItem({ type: 'gemini', text: geminiMessageBuffer });
       }
       return StreamProcessingStatus.Completed;
     },
@@ -1567,6 +1602,7 @@ export const useGeminiStream = (
       pendingHistoryItemRef,
       setPendingHistoryItem,
       setThought,
+      topicUpdateNarrationEnabled,
     ],
   );
   const submitQuery = useCallback(

packages/cli/src/ui/types.ts

@@ -174,6 +174,7 @@ export type HistoryItemInfo = HistoryItemBase & {
   type: 'info';
   text: string;
   secondaryText?: string;
+  source?: string;
   icon?: string;
   color?: string;
   marginBottom?: number;

packages/cli/src/utils/skillUtils.test.ts

@@ -26,66 +26,49 @@ describe('skillUtils', () => {
     vi.unstubAllEnvs();
   });
 
-  const itif = (condition: boolean) => (condition ? it : it.skip);
-
   describe('linkSkill', () => {
-    // TODO: issue 19388 - Enable linkSkill tests on Windows
-    itif(process.platform !== 'win32')(
-      'should successfully link from a local directory',
-      async () => {
-        // Create a mock skill directory
-        const mockSkillSourceDir = path.join(tempDir, 'mock-skill-source');
-        const skillSubDir = path.join(mockSkillSourceDir, 'test-skill');
-        await fs.mkdir(skillSubDir, { recursive: true });
-        await fs.writeFile(
-          path.join(skillSubDir, 'SKILL.md'),
-          '---\nname: test-skill\ndescription: test\n---\nbody',
-        );
+    it('should successfully link from a local directory', async () => {
+      // Create a mock skill directory
+      const mockSkillSourceDir = path.join(tempDir, 'mock-skill-source');
+      const skillSubDir = path.join(mockSkillSourceDir, 'test-skill');
+      await fs.mkdir(skillSubDir, { recursive: true });
+      await fs.writeFile(
+        path.join(skillSubDir, 'SKILL.md'),
+        '---\nname: test-skill\ndescription: test\n---\nbody',
+      );
 
-        const skills = await linkSkill(
-          mockSkillSourceDir,
-          'workspace',
-          () => {},
-        );
-        expect(skills.length).toBe(1);
-        expect(skills[0].name).toBe('test-skill');
+      const skills = await linkSkill(mockSkillSourceDir, 'workspace', () => {});
+      expect(skills.length).toBe(1);
+      expect(skills[0].name).toBe('test-skill');
 
-        const linkedPath = path.join(tempDir, '.gemini/skills', 'test-skill');
-        const stats = await fs.lstat(linkedPath);
-        expect(stats.isSymbolicLink()).toBe(true);
+      const linkedPath = path.join(tempDir, '.gemini/skills', 'test-skill');
+      const stats = await fs.lstat(linkedPath);
+      expect(stats.isSymbolicLink()).toBe(true);
 
-        const linkTarget = await fs.readlink(linkedPath);
-        expect(path.resolve(linkTarget)).toBe(path.resolve(skillSubDir));
-      },
-    );
+      const linkTarget = await fs.readlink(linkedPath);
+      expect(path.resolve(linkTarget)).toBe(path.resolve(skillSubDir));
+    });
 
-    itif(process.platform !== 'win32')(
-      'should overwrite existing skill at destination',
-      async () => {
-        const mockSkillSourceDir = path.join(tempDir, 'mock-skill-source');
-        const skillSubDir = path.join(mockSkillSourceDir, 'test-skill');
-        await fs.mkdir(skillSubDir, { recursive: true });
-        await fs.writeFile(
-          path.join(skillSubDir, 'SKILL.md'),
-          '---\nname: test-skill\ndescription: test\n---\nbody',
-        );
+    it('should overwrite existing skill at destination', async () => {
+      const mockSkillSourceDir = path.join(tempDir, 'mock-skill-source');
+      const skillSubDir = path.join(mockSkillSourceDir, 'test-skill');
+      await fs.mkdir(skillSubDir, { recursive: true });
+      await fs.writeFile(
+        path.join(skillSubDir, 'SKILL.md'),
+        '---\nname: test-skill\ndescription: test\n---\nbody',
+      );
 
-        const targetDir = path.join(tempDir, '.gemini/skills');
-        await fs.mkdir(targetDir, { recursive: true });
-        const existingPath = path.join(targetDir, 'test-skill');
-        await fs.mkdir(existingPath);
+      const targetDir = path.join(tempDir, '.gemini/skills');
+      await fs.mkdir(targetDir, { recursive: true });
+      const existingPath = path.join(targetDir, 'test-skill');
+      await fs.mkdir(existingPath);
 
-        const skills = await linkSkill(
-          mockSkillSourceDir,
-          'workspace',
-          () => {},
-        );
-        expect(skills.length).toBe(1);
+      const skills = await linkSkill(mockSkillSourceDir, 'workspace', () => {});
+      expect(skills.length).toBe(1);
 
-        const stats = await fs.lstat(existingPath);
-        expect(stats.isSymbolicLink()).toBe(true);
-      },
-    );
+      const stats = await fs.lstat(existingPath);
+      expect(stats.isSymbolicLink()).toBe(true);
+    });
 
     it('should abort linking if consent is rejected', async () => {
       const mockSkillSourceDir = path.join(tempDir, 'mock-skill-source');
@@ -237,39 +220,40 @@ describe('skillUtils', () => {
       expect(result).toBeNull();
     });
 
-    itif(process.platform !== 'win32')(
-      'should successfully uninstall a skill even if its name was updated after linking',
-      async () => {
-        // 1. Create source skill
-        const sourceDir = path.join(tempDir, 'source-skill');
-        await fs.mkdir(sourceDir, { recursive: true });
-        const skillMdPath = path.join(sourceDir, 'SKILL.md');
-        await fs.writeFile(
-          skillMdPath,
-          '---\nname: original-name\ndescription: test\n---\nbody',
-        );
+    it('should successfully uninstall a skill even if its name was updated after linking', async () => {
+      // 1. Create source skill
+      const sourceDir = path.join(tempDir, 'source-skill');
+      await fs.mkdir(sourceDir, { recursive: true });
+      const skillMdPath = path.join(sourceDir, 'SKILL.md');
+      await fs.writeFile(
+        skillMdPath,
+        '---\nname: original-name\ndescription: test\n---\nbody',
+      );
 
-        // 2. Link it
-        const skillsDir = path.join(tempDir, '.gemini/skills');
-        await fs.mkdir(skillsDir, { recursive: true });
-        const destPath = path.join(skillsDir, 'original-name');
-        await fs.symlink(sourceDir, destPath, 'dir');
+      // 2. Link it
+      const skillsDir = path.join(tempDir, '.gemini/skills');
+      await fs.mkdir(skillsDir, { recursive: true });
+      const destPath = path.join(skillsDir, 'original-name');
+      await fs.symlink(
+        sourceDir,
+        destPath,
+        process.platform === 'win32' ? 'junction' : 'dir',
+      );
 
-        // 3. Update name in source
-        await fs.writeFile(
-          skillMdPath,
-          '---\nname: updated-name\ndescription: test\n---\nbody',
-        );
+      // 3. Update name in source
+      await fs.writeFile(
+        skillMdPath,
+        '---\nname: updated-name\ndescription: test\n---\nbody',
+      );
 
-        // 4. Uninstall by NEW name (this is the bug fix)
-        const result = await uninstallSkill('updated-name', 'user');
-        expect(result).not.toBeNull();
-        expect(result?.location).toBe(destPath);
+      // 4. Uninstall by NEW name (this is the bug fix)
+      const result = await uninstallSkill('updated-name', 'user');
+      expect(result).not.toBeNull();
+      expect(result?.location).toBe(destPath);
 
-        const exists = await fs.lstat(destPath).catch(() => null);
-        expect(exists).toBeNull();
-      },
-    );
+      const exists = await fs.lstat(destPath).catch(() => null);
+      expect(exists).toBeNull();
+    });
 
     it('should successfully uninstall a skill by directory name if metadata is missing (fallback)', async () => {
       const skillsDir = path.join(tempDir, '.gemini/skills');

packages/cli/src/utils/skillUtils.ts

@@ -248,7 +248,13 @@ export async function linkSkill(
       await fs.rm(destPath, { recursive: true, force: true });
     }
 
-    await fs.symlink(skillSourceDir, destPath, 'dir');
+    // Use 'junction' on Windows to avoid EPERM errors — junctions don't
+    // require elevated privileges or Developer Mode (fixes #24816)
+    await fs.symlink(
+      skillSourceDir,
+      destPath,
+      process.platform === 'win32' ? 'junction' : 'dir',
+    );
     linkedSkills.push({ name: skillName, location: destPath });
   }
 

packages/core/src/agents/browser/browserAgentFactory.ts

@@ -32,11 +32,11 @@ import { createAnalyzeScreenshotTool } from './analyzeScreenshot.js';
 import { injectAutomationOverlay } from './automationOverlay.js';
 import { injectInputBlocker } from './inputBlocker.js';
 import { debugLogger } from '../../utils/debugLogger.js';
+import { recordBrowserAgentToolDiscovery } from '../../telemetry/metrics.js';
 import {
-  recordBrowserAgentToolDiscovery,
-  recordBrowserAgentVisionStatus,
-  recordBrowserAgentCleanup,
-} from '../../telemetry/metrics.js';
+  logBrowserAgentVisionStatus,
+  logBrowserAgentCleanup,
+} from '../../telemetry/loggers.js';
 import {
   PolicyDecision,
   PRIORITY_SUBAGENT_TOOL,
@@ -248,7 +248,7 @@ export async function createBrowserAgentDefinition(
   const allTools: AnyDeclarativeTool[] = [...mcpTools];
   const visionDisabledReason = getVisionDisabledReason();
 
-  recordBrowserAgentVisionStatus(config, {
+  logBrowserAgentVisionStatus(config, {
     enabled: !visionDisabledReason,
     disabled_reason: visionDisabledReason?.code,
   });
@@ -299,13 +299,13 @@ export async function cleanupBrowserAgent(
   const startMs = Date.now();
   try {
     await browserManager.close();
-    recordBrowserAgentCleanup(config, Date.now() - startMs, {
+    logBrowserAgentCleanup(config, Date.now() - startMs, {
       session_mode: sessionMode,
       success: true,
     });
     debugLogger.log('Browser agent cleanup complete');
   } catch (error) {
-    recordBrowserAgentCleanup(config, Date.now() - startMs, {
+    logBrowserAgentCleanup(config, Date.now() - startMs, {
       session_mode: sessionMode,
       success: false,
     });

packages/core/src/agents/browser/browserAgentInvocation.test.ts

@@ -742,7 +742,7 @@ describe('BrowserAgentInvocation', () => {
       );
     });
 
-    it('should call cleanupBrowserAgent with correct params', async () => {
+    it('should not call cleanupBrowserAgent (cleanup is handled by BrowserManager.resetAll)', async () => {
       const invocation = new BrowserAgentInvocation(
         mockConfig,
         mockParams,
@@ -750,11 +750,7 @@ describe('BrowserAgentInvocation', () => {
       );
       await invocation.execute(new AbortController().signal, vi.fn());
 
-      expect(cleanupBrowserAgent).toHaveBeenCalledWith(
-        expect.anything(),
-        mockConfig,
-        'persistent',
-      );
+      expect(cleanupBrowserAgent).not.toHaveBeenCalled();
     });
   });
 

packages/core/src/agents/browser/browserAgentInvocation.ts

@@ -34,12 +34,9 @@ import {
   isToolActivityError,
 } from '../types.js';
 import type { MessageBus } from '../../confirmation-bus/message-bus.js';
-import {
-  createBrowserAgentDefinition,
-  cleanupBrowserAgent,
-} from './browserAgentFactory.js';
+import { createBrowserAgentDefinition } from './browserAgentFactory.js';
 import { removeInputBlocker } from './inputBlocker.js';
-import { recordBrowserAgentTaskOutcome } from '../../telemetry/metrics.js';
+import { logBrowserAgentTaskOutcome } from '../../telemetry/loggers.js';
 import {
   sanitizeThoughtContent,
   sanitizeToolArgs,
@@ -400,7 +397,7 @@ ${output.result}`;
         },
       };
     } finally {
-      recordBrowserAgentTaskOutcome(this.config, {
+      logBrowserAgentTaskOutcome(this.config, {
         success: taskSuccess,
         session_mode: sessionMode,
         vision_enabled: visionEnabled,
@@ -444,7 +441,6 @@ ${output.result}`;
         } catch {
           // Ignore errors for removing the overlays.
         }
-        await cleanupBrowserAgent(browserManager, this.config, sessionMode);
       }
     }
   }

packages/core/src/agents/browser/browserManager.test.ts

@@ -373,6 +373,7 @@ describe('BrowserManager', () => {
           session_mode: 'persistent',
           headless: false,
           success: true,
+          tool_count: 4,
         },
       );
     });

packages/core/src/agents/browser/browserManager.ts

@@ -30,7 +30,7 @@ import * as path from 'node:path';
 import * as fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { injectAutomationOverlay } from './automationOverlay.js';
-import { recordBrowserAgentConnection } from '../../telemetry/metrics.js';
+import { logBrowserAgentConnection } from '../../telemetry/loggers.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -563,7 +563,9 @@ export class BrowserManager {
     // Add optional settings from config.
     // Force headless in seatbelt sandbox since Chrome profile/display access
     // may be restricted, and the user is running in a sandboxed environment.
-    if (browserConfig.customConfig.headless || isSeatbeltSandbox) {
+    const effectiveHeadless =
+      !!browserConfig.customConfig.headless || isSeatbeltSandbox;
+    if (effectiveHeadless) {
       mcpArgs.push('--headless');
     }
     if (browserConfig.customConfig.profilePath) {
@@ -667,15 +669,12 @@ export class BrowserManager {
           // clear the action counter for each connection
           this.actionCounter = 0;
 
-          recordBrowserAgentConnection(
-            this.config,
-            Date.now() - connectStartMs,
-            {
-              session_mode: sessionMode,
-              headless: !!browserConfig.customConfig.headless,
-              success: true,
-            },
-          );
+          logBrowserAgentConnection(this.config, Date.now() - connectStartMs, {
+            session_mode: sessionMode,
+            headless: effectiveHeadless,
+            success: true,
+            tool_count: this.discoveredTools.length,
+          });
         })(),
         new Promise<never>((_, reject) => {
           timeoutId = setTimeout(
@@ -696,9 +695,9 @@ export class BrowserManager {
         error instanceof Error ? error.message : String(error);
       const errorType = BrowserManager.classifyConnectionError(rawErrorMessage);
 
-      recordBrowserAgentConnection(this.config, Date.now() - connectStartMs, {
+      logBrowserAgentConnection(this.config, Date.now() - connectStartMs, {
         session_mode: sessionMode,
-        headless: !!browserConfig.customConfig.headless,
+        headless: effectiveHeadless,
         success: false,
         error_type: errorType,
       });

packages/core/src/config/config.ts

@@ -908,8 +908,8 @@ export class Config implements McpContext, AgentLoopContext {
   private readonly acceptRawOutputRisk: boolean;
   private readonly dynamicModelConfiguration: boolean;
   private pendingIncludeDirectories: string[];
-  private readonly enableHooks: boolean;
   private readonly enableHooksUI: boolean;
+  private readonly enableHooks: boolean;
 
   private hooks: { [K in HookEventName]?: HookDefinition[] } | undefined;
   private projectHooks:

packages/core/src/core/__snapshots__/prompts.test.ts.snap

@@ -42,7 +42,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -219,7 +220,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -369,6 +371,8 @@ exports[`Core System Prompt (prompts.ts) > ApprovalMode in System Prompt > shoul
 - **Libraries/Frameworks:** NEVER assume a library/framework is available or appropriate. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', 'build.gradle', etc., or observe neighboring files) before employing it.
 - **Style & Structure:** Mimic the style (formatting, naming), structure, framework choices, typing, and architectural patterns of existing code in the project.
 - **Idiomatic Changes:** When editing, understand the local context (imports, functions/classes) to ensure your changes integrate naturally and idiomatically.
+- **Types, Warnings & Linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Comments:** Add code comments sparingly. Focus on *why* something is done, especially for complex logic, rather than *what* is done. Only add high-value comments if necessary for clarity or if requested by the user. Do not edit comments that are separate from the code you are changing. *NEVER* talk to the user or describe your changes through comments.
 - **Proactiveness:** Fulfill the user's request thoroughly. When adding features or fixing bugs, this includes adding tests to ensure quality. Consider all created files, especially tests, to be permanent artifacts unless the user says otherwise.
 - **User Hints:** During execution, the user may provide real-time hints (marked as "User hint:" or "User hints:"). Treat these as high-priority but scope-preserving course corrections: apply the minimal plan change needed, keep unaffected user tasks active, and never cancel/skip tasks unless cancellation is explicit for those tasks. Hints may add new tasks, modify one or more tasks, cancel specific tasks, or provide extra context only. If scope is ambiguous, ask for clarification before dropping work.
@@ -515,7 +519,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -692,7 +697,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -867,7 +873,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, you must work autonomously as no further user input is available. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -994,7 +1001,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, you must work autonomously as no further user input is available. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -1088,6 +1096,8 @@ exports[`Core System Prompt (prompts.ts) > should handle git instructions when i
 - **Libraries/Frameworks:** NEVER assume a library/framework is available or appropriate. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', 'build.gradle', etc., or observe neighboring files) before employing it.
 - **Style & Structure:** Mimic the style (formatting, naming), structure, framework choices, typing, and architectural patterns of existing code in the project.
 - **Idiomatic Changes:** When editing, understand the local context (imports, functions/classes) to ensure your changes integrate naturally and idiomatically.
+- **Types, Warnings & Linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Comments:** Add code comments sparingly. Focus on *why* something is done, especially for complex logic, rather than *what* is done. Only add high-value comments if necessary for clarity or if requested by the user. Do not edit comments that are separate from the code you are changing. *NEVER* talk to the user or describe your changes through comments.
 - **Proactiveness:** Fulfill the user's request thoroughly. When adding features or fixing bugs, this includes adding tests to ensure quality. Consider all created files, especially tests, to be permanent artifacts unless the user says otherwise.
 - **User Hints:** During execution, the user may provide real-time hints (marked as "User hint:" or "User hints:"). Treat these as high-priority but scope-preserving course corrections: apply the minimal plan change needed, keep unaffected user tasks active, and never cancel/skip tasks unless cancellation is explicit for those tasks. Hints may add new tasks, modify one or more tasks, cancel specific tasks, or provide extra context only. If scope is ambiguous, ask for clarification before dropping work.
@@ -1201,6 +1211,8 @@ exports[`Core System Prompt (prompts.ts) > should handle git instructions when i
 - **Libraries/Frameworks:** NEVER assume a library/framework is available or appropriate. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', 'build.gradle', etc., or observe neighboring files) before employing it.
 - **Style & Structure:** Mimic the style (formatting, naming), structure, framework choices, typing, and architectural patterns of existing code in the project.
 - **Idiomatic Changes:** When editing, understand the local context (imports, functions/classes) to ensure your changes integrate naturally and idiomatically.
+- **Types, Warnings & Linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Comments:** Add code comments sparingly. Focus on *why* something is done, especially for complex logic, rather than *what* is done. Only add high-value comments if necessary for clarity or if requested by the user. Do not edit comments that are separate from the code you are changing. *NEVER* talk to the user or describe your changes through comments.
 - **Proactiveness:** Fulfill the user's request thoroughly. When adding features or fixing bugs, this includes adding tests to ensure quality. Consider all created files, especially tests, to be permanent artifacts unless the user says otherwise.
 - **User Hints:** During execution, the user may provide real-time hints (marked as "User hint:" or "User hints:"). Treat these as high-priority but scope-preserving course corrections: apply the minimal plan change needed, keep unaffected user tasks active, and never cancel/skip tasks unless cancellation is explicit for those tasks. Hints may add new tasks, modify one or more tasks, cancel specific tasks, or provide extra context only. If scope is ambiguous, ask for clarification before dropping work.
@@ -1332,6 +1344,8 @@ exports[`Core System Prompt (prompts.ts) > should include approved plan instruct
 - **Libraries/Frameworks:** NEVER assume a library/framework is available or appropriate. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', 'build.gradle', etc., or observe neighboring files) before employing it.
 - **Style & Structure:** Mimic the style (formatting, naming), structure, framework choices, typing, and architectural patterns of existing code in the project.
 - **Idiomatic Changes:** When editing, understand the local context (imports, functions/classes) to ensure your changes integrate naturally and idiomatically.
+- **Types, Warnings & Linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Comments:** Add code comments sparingly. Focus on *why* something is done, especially for complex logic, rather than *what* is done. Only add high-value comments if necessary for clarity or if requested by the user. Do not edit comments that are separate from the code you are changing. *NEVER* talk to the user or describe your changes through comments.
 - **Proactiveness:** Fulfill the user's request thoroughly. When adding features or fixing bugs, this includes adding tests to ensure quality. Consider all created files, especially tests, to be permanent artifacts unless the user says otherwise.
 - **User Hints:** During execution, the user may provide real-time hints (marked as "User hint:" or "User hints:"). Treat these as high-priority but scope-preserving course corrections: apply the minimal plan change needed, keep unaffected user tasks active, and never cancel/skip tasks unless cancellation is explicit for those tasks. Hints may add new tasks, modify one or more tasks, cancel specific tasks, or provide extra context only. If scope is ambiguous, ask for clarification before dropping work.
@@ -1435,6 +1449,8 @@ exports[`Core System Prompt (prompts.ts) > should include available_skills when
 - **Libraries/Frameworks:** NEVER assume a library/framework is available or appropriate. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', 'build.gradle', etc., or observe neighboring files) before employing it.
 - **Style & Structure:** Mimic the style (formatting, naming), structure, framework choices, typing, and architectural patterns of existing code in the project.
 - **Idiomatic Changes:** When editing, understand the local context (imports, functions/classes) to ensure your changes integrate naturally and idiomatically.
+- **Types, Warnings & Linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Comments:** Add code comments sparingly. Focus on *why* something is done, especially for complex logic, rather than *what* is done. Only add high-value comments if necessary for clarity or if requested by the user. Do not edit comments that are separate from the code you are changing. *NEVER* talk to the user or describe your changes through comments.
 - **Proactiveness:** Fulfill the user's request thoroughly. When adding features or fixing bugs, this includes adding tests to ensure quality. Consider all created files, especially tests, to be permanent artifacts unless the user says otherwise.
 - **User Hints:** During execution, the user may provide real-time hints (marked as "User hint:" or "User hints:"). Treat these as high-priority but scope-preserving course corrections: apply the minimal plan change needed, keep unaffected user tasks active, and never cancel/skip tasks unless cancellation is explicit for those tasks. Hints may add new tasks, modify one or more tasks, cancel specific tasks, or provide extra context only. If scope is ambiguous, ask for clarification before dropping work.
@@ -1594,7 +1610,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -1765,7 +1782,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -1927,7 +1945,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2089,7 +2108,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2247,7 +2267,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2405,7 +2426,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2557,7 +2579,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2714,7 +2737,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2839,6 +2863,8 @@ exports[`Core System Prompt (prompts.ts) > should include the TASK MANAGEMENT PR
 - **Libraries/Frameworks:** NEVER assume a library/framework is available or appropriate. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', 'build.gradle', etc., or observe neighboring files) before employing it.
 - **Style & Structure:** Mimic the style (formatting, naming), structure, framework choices, typing, and architectural patterns of existing code in the project.
 - **Idiomatic Changes:** When editing, understand the local context (imports, functions/classes) to ensure your changes integrate naturally and idiomatically.
+- **Types, Warnings & Linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Comments:** Add code comments sparingly. Focus on *why* something is done, especially for complex logic, rather than *what* is done. Only add high-value comments if necessary for clarity or if requested by the user. Do not edit comments that are separate from the code you are changing. *NEVER* talk to the user or describe your changes through comments.
 - **Proactiveness:** Fulfill the user's request thoroughly. When adding features or fixing bugs, this includes adding tests to ensure quality. Consider all created files, especially tests, to be permanent artifacts unless the user says otherwise.
 - **User Hints:** During execution, the user may provide real-time hints (marked as "User hint:" or "User hints:"). Treat these as high-priority but scope-preserving course corrections: apply the minimal plan change needed, keep unaffected user tasks active, and never cancel/skip tasks unless cancellation is explicit for those tasks. Hints may add new tasks, modify one or more tasks, cancel specific tasks, or provide extra context only. If scope is ambiguous, ask for clarification before dropping work.
@@ -2997,7 +3023,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -3134,6 +3161,8 @@ exports[`Core System Prompt (prompts.ts) > should match snapshot on Windows 1`]
 - **Libraries/Frameworks:** NEVER assume a library/framework is available or appropriate. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', 'build.gradle', etc., or observe neighboring files) before employing it.
 - **Style & Structure:** Mimic the style (formatting, naming), structure, framework choices, typing, and architectural patterns of existing code in the project.
 - **Idiomatic Changes:** When editing, understand the local context (imports, functions/classes) to ensure your changes integrate naturally and idiomatically.
+- **Types, Warnings & Linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Comments:** Add code comments sparingly. Focus on *why* something is done, especially for complex logic, rather than *what* is done. Only add high-value comments if necessary for clarity or if requested by the user. Do not edit comments that are separate from the code you are changing. *NEVER* talk to the user or describe your changes through comments.
 - **Proactiveness:** Fulfill the user's request thoroughly. When adding features or fixing bugs, this includes adding tests to ensure quality. Consider all created files, especially tests, to be permanent artifacts unless the user says otherwise.
 - **User Hints:** During execution, the user may provide real-time hints (marked as "User hint:" or "User hints:"). Treat these as high-priority but scope-preserving course corrections: apply the minimal plan change needed, keep unaffected user tasks active, and never cancel/skip tasks unless cancellation is explicit for those tasks. Hints may add new tasks, modify one or more tasks, cancel specific tasks, or provide extra context only. If scope is ambiguous, ask for clarification before dropping work.
@@ -3247,6 +3276,8 @@ exports[`Core System Prompt (prompts.ts) > should render hierarchical memory wit
 - **Libraries/Frameworks:** NEVER assume a library/framework is available or appropriate. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', 'build.gradle', etc., or observe neighboring files) before employing it.
 - **Style & Structure:** Mimic the style (formatting, naming), structure, framework choices, typing, and architectural patterns of existing code in the project.
 - **Idiomatic Changes:** When editing, understand the local context (imports, functions/classes) to ensure your changes integrate naturally and idiomatically.
+- **Types, Warnings & Linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Comments:** Add code comments sparingly. Focus on *why* something is done, especially for complex logic, rather than *what* is done. Only add high-value comments if necessary for clarity or if requested by the user. Do not edit comments that are separate from the code you are changing. *NEVER* talk to the user or describe your changes through comments.
 - **Proactiveness:** Fulfill the user's request thoroughly. When adding features or fixing bugs, this includes adding tests to ensure quality. Consider all created files, especially tests, to be permanent artifacts unless the user says otherwise.
 - **Conflict Resolution:** Instructions are provided in hierarchical context tags: \`<global_context>\`, \`<extension_context>\`, and \`<project_context>\`. In case of contradictory instructions, follow this priority: \`<project_context>\` (highest) > \`<extension_context>\` > \`<global_context>\` (lowest).
@@ -3408,7 +3439,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -3566,7 +3598,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -3691,6 +3724,8 @@ exports[`Core System Prompt (prompts.ts) > should return the interactive avoidan
 - **Libraries/Frameworks:** NEVER assume a library/framework is available or appropriate. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', 'build.gradle', etc., or observe neighboring files) before employing it.
 - **Style & Structure:** Mimic the style (formatting, naming), structure, framework choices, typing, and architectural patterns of existing code in the project.
 - **Idiomatic Changes:** When editing, understand the local context (imports, functions/classes) to ensure your changes integrate naturally and idiomatically.
+- **Types, Warnings & Linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Comments:** Add code comments sparingly. Focus on *why* something is done, especially for complex logic, rather than *what* is done. Only add high-value comments if necessary for clarity or if requested by the user. Do not edit comments that are separate from the code you are changing. *NEVER* talk to the user or describe your changes through comments.
 - **Proactiveness:** Fulfill the user's request thoroughly. When adding features or fixing bugs, this includes adding tests to ensure quality. Consider all created files, especially tests, to be permanent artifacts unless the user says otherwise.
 - **User Hints:** During execution, the user may provide real-time hints (marked as "User hint:" or "User hints:"). Treat these as high-priority but scope-preserving course corrections: apply the minimal plan change needed, keep unaffected user tasks active, and never cancel/skip tasks unless cancellation is explicit for those tasks. Hints may add new tasks, modify one or more tasks, cancel specific tasks, or provide extra context only. If scope is ambiguous, ask for clarification before dropping work.
@@ -3836,7 +3871,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -3994,7 +4030,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -4119,6 +4156,8 @@ exports[`Core System Prompt (prompts.ts) > should use legacy system prompt for n
 - **Libraries/Frameworks:** NEVER assume a library/framework is available or appropriate. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', 'build.gradle', etc., or observe neighboring files) before employing it.
 - **Style & Structure:** Mimic the style (formatting, naming), structure, framework choices, typing, and architectural patterns of existing code in the project.
 - **Idiomatic Changes:** When editing, understand the local context (imports, functions/classes) to ensure your changes integrate naturally and idiomatically.
+- **Types, Warnings & Linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Comments:** Add code comments sparingly. Focus on *why* something is done, especially for complex logic, rather than *what* is done. Only add high-value comments if necessary for clarity or if requested by the user. Do not edit comments that are separate from the code you are changing. *NEVER* talk to the user or describe your changes through comments.
 - **Proactiveness:** Fulfill the user's request thoroughly. When adding features or fixing bugs, this includes adding tests to ensure quality. Consider all created files, especially tests, to be permanent artifacts unless the user says otherwise.
 - **User Hints:** During execution, the user may provide real-time hints (marked as "User hint:" or "User hints:"). Treat these as high-priority but scope-preserving course corrections: apply the minimal plan change needed, keep unaffected user tasks active, and never cancel/skip tasks unless cancellation is explicit for those tasks. Hints may add new tasks, modify one or more tasks, cancel specific tasks, or provide extra context only. If scope is ambiguous, ask for clarification before dropping work.

packages/core/src/core/geminiChat.ts

@@ -597,6 +597,21 @@ export class GeminiChat {
           );
         }
 
+        if (beforeModelResult.modifiedModel) {
+          modelToUse = resolveModel(
+            beforeModelResult.modifiedModel,
+            useGemini3_1,
+            useGemini3_1FlashLite,
+            false,
+            hasAccessToPreview,
+            this.context.config,
+          );
+          lastModelToUse = modelToUse;
+          // Re-evaluate contentsToUse based on the new model's feature support
+          contentsToUse = supportsModernFeatures(modelToUse)
+            ? [...contentsForPreviewModel]
+            : [...requestContents];
+        }
         if (beforeModelResult.modifiedConfig) {
           Object.assign(config, beforeModelResult.modifiedConfig);
         }

packages/core/src/hooks/hookEventHandler.ts

@@ -458,6 +458,15 @@ export class HookEventHandler {
       );
 
       logHookCall(this.context.config, hookCallEvent);
+
+      // Emit structured system message event for UI display
+      if (result.output?.systemMessage && result.outputFormat === 'json') {
+        coreEvents.emitHookSystemMessage({
+          hookName,
+          eventName,
+          message: result.output.systemMessage,
+        });
+      }
     }
 
     // Log individual errors

packages/core/src/hooks/hookRunner.test.ts

@@ -204,7 +204,11 @@ describe('HookRunner', () => {
       };
 
       it('should execute command hook successfully', async () => {
-        const mockOutput = { decision: 'allow', reason: 'All good' };
+        const mockOutput = {
+          decision: 'allow',
+          reason: 'All good',
+          format: 'json',
+        };
 
         // Mock successful execution
         mockSpawn.mockStdoutOn.mockImplementation(
@@ -623,6 +627,7 @@ describe('HookRunner', () => {
         hookSpecificOutput: {
           additionalContext: 'Context from hook 1',
         },
+        format: 'json',
       };
 
       let hookCallCount = 0;
@@ -803,6 +808,7 @@ describe('HookRunner', () => {
       expect(result.success).toBe(true);
       expect(result.exitCode).toBe(0);
       // Should convert plain text to structured output
+      expect(result.outputFormat).toBe('text');
       expect(result.output).toEqual({
         decision: 'allow',
         systemMessage: invalidJson,
@@ -835,6 +841,7 @@ describe('HookRunner', () => {
       );
 
       expect(result.success).toBe(true);
+      expect(result.outputFormat).toBe('text');
       expect(result.output).toEqual({
         decision: 'allow',
         systemMessage: malformedJson,
@@ -868,6 +875,7 @@ describe('HookRunner', () => {
 
       expect(result.success).toBe(false);
       expect(result.exitCode).toBe(1);
+      expect(result.outputFormat).toBe('text');
       expect(result.output).toEqual({
         decision: 'allow',
         systemMessage: `Warning: ${invalidJson}`,
@@ -901,6 +909,7 @@ describe('HookRunner', () => {
 
       expect(result.success).toBe(false);
       expect(result.exitCode).toBe(2);
+      expect(result.outputFormat).toBe('text');
       expect(result.output).toEqual({
         decision: 'deny',
         reason: invalidJson,
@@ -936,7 +945,11 @@ describe('HookRunner', () => {
     });
 
     it('should handle double-encoded JSON string', async () => {
-      const mockOutput = { decision: 'allow', reason: 'All good' };
+      const mockOutput = {
+        decision: 'allow',
+        reason: 'All good',
+        format: 'json',
+      };
       const doubleEncodedJson = JSON.stringify(JSON.stringify(mockOutput));
 
       mockSpawn.mockStdoutOn.mockImplementation(

packages/core/src/hooks/hookRunner.ts

@@ -447,6 +447,7 @@ export class HookRunner {
 
         // Parse output
         let output: HookOutput | undefined;
+        let outputFormat: 'json' | 'text' | undefined;
 
         const textToParse = stdout.trim() || stderr.trim();
         if (textToParse) {
@@ -460,6 +461,7 @@ export class HookRunner {
             if (parsed && typeof parsed === 'object') {
               // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
               output = parsed as HookOutput;
+              outputFormat = 'json';
             }
           } catch {
             // Not JSON, convert plain text to structured output
@@ -467,6 +469,7 @@ export class HookRunner {
               textToParse,
               exitCode || EXIT_CODE_SUCCESS,
             );
+            outputFormat = 'text';
           }
         }
 
@@ -475,6 +478,7 @@ export class HookRunner {
           eventName,
           success: exitCode === EXIT_CODE_SUCCESS,
           output,
+          outputFormat,
           stdout,
           stderr,
           exitCode: exitCode || EXIT_CODE_SUCCESS,
@@ -523,7 +527,7 @@ export class HookRunner {
     exitCode: number,
   ): HookOutput {
     if (exitCode === EXIT_CODE_SUCCESS) {
-      // Success - treat as system message or additional context
+      // Success
       return {
         decision: 'allow',
         systemMessage: text,

packages/core/src/hooks/hookSystem.ts

@@ -48,6 +48,8 @@ export interface BeforeModelHookResult {
   reason?: string;
   /** Synthetic response to return instead of calling the model (if blocked) */
   syntheticResponse?: GenerateContentResponse;
+  /** Modified model override (if not blocked) */
+  modifiedModel?: string;
   /** Modified config (if not blocked) */
   modifiedConfig?: GenerateContentConfig;
   /** Modified contents (if not blocked) */
@@ -292,6 +294,7 @@ export class HookSystem {
           beforeModelOutput.applyLLMRequestModifications(llmRequest);
         return {
           blocked: false,
+          modifiedModel: modifiedRequest?.model,
           modifiedConfig: modifiedRequest?.config,
           modifiedContents: modifiedRequest?.contents,
         };

packages/core/src/hooks/types.ts

@@ -734,6 +734,8 @@ export interface HookExecutionResult {
   exitCode?: number;
   duration: number;
   error?: Error;
+  /** The format of the output provided by the hook */
+  outputFormat?: 'json' | 'text';
 }
 
 /**

packages/core/src/policy/policies/plan.toml

@@ -107,7 +107,8 @@ toolName = [
   "activate_skill",
   "codebase_investigator",
   "cli_help",
-  "get_internal_docs"
+  "get_internal_docs",
+  "complete_task"
 ]
 decision = "allow"
 priority = 70

packages/core/src/policy/policies/sandbox-default.toml

@@ -2,7 +2,7 @@
 network = false
 readonly = true
 approvedTools = []
-allowOverrides = false
+allowOverrides = true
 
 [modes.default]
 network = false
@@ -17,4 +17,3 @@ approvedTools = ['sed', 'grep', 'awk', 'perl', 'cat', 'echo', 'Add-Content', 'Se
 allowOverrides = true
 
 [commands]
-

packages/core/src/policy/sandboxPolicyManager.ts

@@ -64,7 +64,7 @@ export class SandboxPolicyManager {
                 network: false,
                 readonly: true,
                 approvedTools: [],
-                allowOverrides: false,
+                allowOverrides: true,
               },
               default: {
                 network: false,

packages/core/src/prompts/snippets.legacy.ts

@@ -177,6 +177,8 @@ export function renderCoreMandates(options?: CoreMandatesOptions): string {
 - **Libraries/Frameworks:** NEVER assume a library/framework is available or appropriate. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', 'build.gradle', etc., or observe neighboring files) before employing it.
 - **Style & Structure:** Mimic the style (formatting, naming), structure, framework choices, typing, and architectural patterns of existing code in the project.
 - **Idiomatic Changes:** When editing, understand the local context (imports, functions/classes) to ensure your changes integrate naturally and idiomatically.
+- **Types, Warnings & Linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Comments:** Add code comments sparingly. Focus on *why* something is done, especially for complex logic, rather than *what* is done. Only add high-value comments if necessary for clarity or if requested by the user. Do not edit comments that are separate from the code you are changing. *NEVER* talk to the user or describe your changes through comments.
 - **Proactiveness:** Fulfill the user's request thoroughly. When adding features or fixing bugs, this includes adding tests to ensure quality. Consider all created files, especially tests, to be permanent artifacts unless the user says otherwise.${mandateConflictResolution(options.hasHierarchicalMemory)}
 - **User Hints:** During execution, the user may provide real-time hints (marked as "User hint:" or "User hints:"). Treat these as high-priority but scope-preserving course corrections: apply the minimal plan change needed, keep unaffected user tasks active, and never cancel/skip tasks unless cancellation is explicit for those tasks. Hints may add new tasks, modify one or more tasks, cancel specific tasks, or provide extra context only. If scope is ambiguous, ask for clarification before dropping work.

packages/core/src/prompts/snippets.ts

@@ -229,7 +229,8 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in ${formattedFilenames} files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
-- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings, bypassing the type system (e.g.: casts in TypeScript), or employing "hidden" logic (e.g.: reflection, prototype manipulation) unless explicitly instructed to by the user. Instead, use explicit and idiomatic language features (e.g.: type guards, explicit class instantiation, or object spread) that maintain structural integrity and type safety.
+- **Design Patterns:** Prioritize explicit composition and delegation (e.g.: wrapper classes, proxies, or factory functions) over complex inheritance or prototype-based cloning. When extending or modifying existing classes, prefer patterns that are easily traceable and type-safe.
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. ${options.interactive ? 'For Directives, only clarify if critically underspecified; otherwise, work autonomously.' : 'For Directives, you must work autonomously as no further user input is available.'} You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.

packages/core/src/sandbox/linux/LinuxSandboxManager.ts

@@ -27,11 +27,16 @@ import {
   verifySandboxOverrides,
   getCommandName,
 } from '../utils/commandUtils.js';
+import { assertValidPathString } from '../../utils/paths.js';
 import {
   isKnownSafeCommand,
   isDangerousCommand,
 } from '../utils/commandSafety.js';
-import { parsePosixSandboxDenials } from '../utils/sandboxDenialUtils.js';
+import {
+  parsePosixSandboxDenials,
+  createSandboxDenialCache,
+  type SandboxDenialCache,
+} from '../utils/sandboxDenialUtils.js';
 import { handleReadWriteCommands } from '../utils/sandboxReadWriteUtils.js';
 import { buildBwrapArgs } from './bwrapArgsBuilder.js';
 
@@ -108,6 +113,7 @@ function getSeccompBpfPath(): string {
  * Ensures a file or directory exists.
  */
 function touch(filePath: string, isDirectory: boolean) {
+  assertValidPathString(filePath);
   try {
     // If it exists (even as a broken symlink), do nothing
     if (fs.lstatSync(filePath)) return;
@@ -129,6 +135,7 @@ function touch(filePath: string, isDirectory: boolean) {
 
 export class LinuxSandboxManager implements SandboxManager {
   private static maskFilePath: string | undefined;
+  private readonly denialCache: SandboxDenialCache = createSandboxDenialCache();
 
   constructor(private readonly options: GlobalSandboxOptions) {}
 
@@ -141,7 +148,7 @@ export class LinuxSandboxManager implements SandboxManager {
   }
 
   parseDenials(result: ShellExecutionResult): ParsedSandboxDenial | undefined {
-    return parsePosixSandboxDenials(result);
+    return parsePosixSandboxDenials(result, this.denialCache);
   }
 
   getWorkspace(): string {

packages/core/src/sandbox/macos/MacOsSandboxManager.ts

@@ -32,10 +32,16 @@ import {
   getCommandName as getFullCommandName,
   isStrictlyApproved,
 } from '../utils/commandUtils.js';
-import { parsePosixSandboxDenials } from '../utils/sandboxDenialUtils.js';
+import {
+  parsePosixSandboxDenials,
+  createSandboxDenialCache,
+  type SandboxDenialCache,
+} from '../utils/sandboxDenialUtils.js';
 import { handleReadWriteCommands } from '../utils/sandboxReadWriteUtils.js';
 
 export class MacOsSandboxManager implements SandboxManager {
+  private readonly denialCache: SandboxDenialCache = createSandboxDenialCache();
+
   constructor(private readonly options: GlobalSandboxOptions) {}
 
   isKnownSafeCommand(args: string[]): boolean {
@@ -52,7 +58,7 @@ export class MacOsSandboxManager implements SandboxManager {
   }
 
   parseDenials(result: ShellExecutionResult): ParsedSandboxDenial | undefined {
-    return parsePosixSandboxDenials(result);
+    return parsePosixSandboxDenials(result, this.denialCache);
   }
 
   getWorkspace(): string {

packages/core/src/sandbox/utils/fsUtils.test.ts

@@ -0,0 +1,52 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { tryRealpath } from './fsUtils.js';
+
+describe('fsUtils', () => {
+  let tempDir: string;
+  let realTempDir: string;
+
+  beforeAll(() => {
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'fs-utils-test-'));
+    realTempDir = fs.realpathSync(tempDir);
+  });
+
+  afterAll(() => {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  describe('tryRealpath', () => {
+    it('should throw error for paths with null bytes', () => {
+      expect(() => tryRealpath(path.join(tempDir, 'foo\0bar'))).toThrow(
+        'Invalid path',
+      );
+    });
+
+    it('should resolve existing paths', () => {
+      const resolved = tryRealpath(tempDir);
+      expect(resolved).toBe(realTempDir);
+    });
+
+    it('should handle non-existent paths by resolving parent', () => {
+      const nonExistentPath = path.join(tempDir, 'non-existent-file-12345');
+      const expected = path.join(realTempDir, 'non-existent-file-12345');
+      const resolved = tryRealpath(nonExistentPath);
+      expect(resolved).toBe(expected);
+    });
+
+    it('should handle nested non-existent paths', () => {
+      const nonExistentPath = path.join(tempDir, 'dir1', 'dir2', 'file');
+      const expected = path.join(realTempDir, 'dir1', 'dir2', 'file');
+      const resolved = tryRealpath(nonExistentPath);
+      expect(resolved).toBe(expected);
+    });
+  });
+});

packages/core/src/sandbox/utils/fsUtils.ts

@@ -6,12 +6,14 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import { assertValidPathString } from '../../utils/paths.js';
 
 export function isErrnoException(e: unknown): e is NodeJS.ErrnoException {
   return e instanceof Error && 'code' in e;
 }
 
 export function tryRealpath(p: string): string {
+  assertValidPathString(p);
   try {
     return fs.realpathSync(p);
   } catch (e) {

packages/core/src/sandbox/utils/sandboxDenialUtils.test.ts

@@ -5,7 +5,10 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { parsePosixSandboxDenials } from './sandboxDenialUtils.js';
+import {
+  parsePosixSandboxDenials,
+  createSandboxDenialCache,
+} from './sandboxDenialUtils.js';
 import type { ShellExecutionResult } from '../../services/shellExecutionService.js';
 
 describe('parsePosixSandboxDenials', () => {
@@ -116,4 +119,109 @@ EACCES: permission denied, mkdir '/Users/galzahavi/.pnpm-store/v3'
     expect(parsed).toBeDefined();
     expect(parsed?.filePaths).toContain('/Users/galzahavi/.pnpm-store/v3');
   });
+
+  it('should detect Python PermissionError and extract path accurately', () => {
+    const output = `Caught exception: [Errno 13] Permission denied: '/etc/test_sandbox_denial'
+Traceback (most recent call last):
+  File "/usr/local/google/home/davidapierce/gemini-cli/repro_sandbox.py", line 9, in <module>
+    raise e
+  File "/usr/local/google/home/davidapierce/gemini-cli/repro_sandbox.py", line 5, in <module>
+    with open('/etc/test_sandbox_denial', 'w') as f:
+         ~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+PermissionError: [Errno 13] Permission denied: '/etc/test_sandbox_denial'`;
+
+    const parsed = parsePosixSandboxDenials({
+      output,
+      exitCode: 1,
+      error: null,
+    } as unknown as ShellExecutionResult);
+
+    expect(parsed?.filePaths).toEqual(['/etc/test_sandbox_denial']);
+  });
+
+  it('should detect new keywords like "access denied" and "forbidden"', () => {
+    const parsed1 = parsePosixSandboxDenials({
+      output: 'Access denied to /var/log/syslog',
+      exitCode: 1,
+      error: null,
+    } as unknown as ShellExecutionResult);
+    expect(parsed1?.filePaths).toContain('/var/log/syslog');
+
+    const parsed2 = parsePosixSandboxDenials({
+      output: 'Forbidden: access to /root/secret is not allowed',
+      exitCode: 1,
+      error: null,
+    } as unknown as ShellExecutionResult);
+    expect(parsed2?.filePaths).toContain('/root/secret');
+  });
+
+  it('should detect read-only file system error', () => {
+    const parsed = parsePosixSandboxDenials({
+      output: 'rm: cannot remove /mnt/usb/test: Read-only file system',
+      exitCode: 1,
+      error: null,
+    } as unknown as ShellExecutionResult);
+    expect(parsed?.filePaths).toContain('/mnt/usb/test');
+  });
+
+  it('should reject paths with directory traversal', () => {
+    const output = 'ls: /etc/shadow/../../etc/passwd: Operation not permitted';
+    const parsed = parsePosixSandboxDenials({
+      output,
+    } as unknown as ShellExecutionResult);
+    expect(parsed?.filePaths || []).not.toContain(
+      '/etc/shadow/../../etc/passwd',
+    );
+  });
+
+  it('should reject home-relative paths with directory traversal', () => {
+    const output = "Operation not permitted, open '~/../../etc/shadow'";
+    const parsed = parsePosixSandboxDenials({
+      output,
+    } as unknown as ShellExecutionResult);
+    expect(parsed?.filePaths || []).not.toContain('~/../../etc/shadow');
+  });
+
+  it('should reject paths with null bytes', () => {
+    const output = "Operation not permitted, open '/etc/passwd\0/foo'";
+    const parsed = parsePosixSandboxDenials({
+      output,
+    } as unknown as ShellExecutionResult);
+    expect(parsed?.filePaths || []).not.toContain('/etc/passwd\0/foo');
+  });
+
+  it('should reject paths with internal tildes', () => {
+    const output = "Operation not permitted, open '/home/user/~/config'";
+    const parsed = parsePosixSandboxDenials({
+      output,
+    } as unknown as ShellExecutionResult);
+    expect(parsed?.filePaths || []).not.toContain('/home/user/~/config');
+  });
+
+  it('should suppress redundant denials if cache is provided', () => {
+    const cache = createSandboxDenialCache();
+    const result = {
+      output: 'ls: /root: Operation not permitted',
+    } as unknown as ShellExecutionResult;
+
+    // First call: should process
+    const parsed1 = parsePosixSandboxDenials(result, cache);
+    expect(parsed1).toBeDefined();
+
+    // Second call: should be suppressed
+    const parsed2 = parsePosixSandboxDenials(result, cache);
+    expect(parsed2).toBeUndefined();
+  });
+
+  it('should not suppress denials if no cache is provided', () => {
+    const result = {
+      output: 'ls: /root: Operation not permitted',
+    } as unknown as ShellExecutionResult;
+
+    const parsed1 = parsePosixSandboxDenials(result);
+    expect(parsed1).toBeDefined();
+
+    const parsed2 = parsePosixSandboxDenials(result);
+    expect(parsed2).toBeDefined();
+  });
 });

packages/core/src/sandbox/utils/sandboxDenialUtils.ts

@@ -4,8 +4,58 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import { LRUCache } from 'mnemonist';
 import { type ParsedSandboxDenial } from '../../services/sandboxManager.js';
 import type { ShellExecutionResult } from '../../services/shellExecutionService.js';
+import { isValidPathString } from '../../utils/paths.js';
+
+/**
+ * Type for the sandbox denial error cache.
+ * Stores normalized error output to prevent redundant processing.
+ */
+export type SandboxDenialCache = LRUCache<string, boolean>;
+
+/**
+ * Creates a new sandbox denial cache with a standard LRU policy.
+ */
+export function createSandboxDenialCache(maxSize = 10): SandboxDenialCache {
+  return new LRUCache<string, boolean>(maxSize);
+}
+
+/**
+ * Sanitizes extracted paths to prevent path traversal vulnerabilities.
+ * Filters out paths containing '..' or null bytes.
+ */
+export function sanitizeExtractedPath(p: string): string | undefined {
+  if (!isValidPathString(p)) return undefined;
+
+  // Reject paths with directory traversal components
+  const parts = p.split(/[/\\]/);
+  if (parts.includes('..')) {
+    return undefined;
+  }
+
+  // Reject paths with internal tildes (tilde should only be at the beginning)
+  if (p.indexOf('~') > 0) {
+    return undefined;
+  }
+
+  // Basic normalization without resolving symlinks or accessing the file system
+  let normalized = p;
+
+  // Collapse multiple slashes
+  normalized = normalized.replace(/\/+/g, '/');
+
+  // Remove single dot segments
+  normalized = normalized.replace(/\/\.\//g, '/');
+
+  // Remove trailing slashes (unless it's exactly '/')
+  if (normalized.length > 1 && normalized.endsWith('/')) {
+    normalized = normalized.slice(0, -1);
+  }
+
+  return normalized;
+}
 
 /**
  * Common POSIX-style sandbox denial detection.
@@ -13,10 +63,18 @@ import type { ShellExecutionResult } from '../../services/shellExecutionService.
  */
 export function parsePosixSandboxDenials(
   result: ShellExecutionResult,
+  cache?: SandboxDenialCache,
 ): ParsedSandboxDenial | undefined {
   const output = result.output || '';
   const errorOutput = result.error?.message;
-  const combined = (output + ' ' + (errorOutput || '')).toLowerCase();
+  const fullText = output + '\n' + (errorOutput || '');
+  const combined = fullText.toLowerCase();
+
+  // Cache by the first 200 characters of the error to handle variable data (timestamps, PIDs)
+  const cacheKey = combined.trim().slice(0, 200);
+  if (cacheKey && cache?.has(cacheKey)) {
+    return undefined;
+  }
 
   const isFileDenial = [
     'operation not permitted',
@@ -27,6 +85,12 @@ export function parsePosixSandboxDenials(
     'should be read/write',
     'sandbox_apply',
     'sandbox: ',
+    'access denied',
+    'read-only file system',
+    'permissionerror',
+    'fs.permissiondenied',
+    'forbidden',
+    'system.unauthorizedaccessexception',
   ].some((keyword) => combined.includes(keyword));
 
   const isNetworkDenial = [
@@ -46,6 +110,8 @@ export function parsePosixSandboxDenials(
     'err_pnpm_fetch',
     'err_pnpm_no_matching_version',
     "syscall: 'listen'",
+    'socketexception',
+    'networkaccessdenied',
   ].some((keyword) => combined.includes(keyword));
 
   if (!isFileDenial && !isNetworkDenial) {
@@ -57,27 +123,28 @@ export function parsePosixSandboxDenials(
   // Extract denied paths (POSIX absolute paths or home-relative paths starting with ~)
   const regexes = [
     // format: /path: operation not permitted
-    /(?:^|\s)['"]?((?:\/|~)[\w.\-/:~]+)['"]?:\s*[Oo]peration not permitted/gi,
+    /(?:^|\s)['"]?((?:\/|~)(?:[\w.\-/:~]*[\w.\-/~])?)['"]?[\s:,'"[\]]*operation not permitted/gi,
     // format: operation not permitted, open '/path'
-    /[Oo]peration not permitted,\s*open\s*['"]?((?:\/|~)[\w.\-/:~]+)['"]?/gi,
+    /operation not permitted[\s:,'"[\]]*open[\s:,'"[\]]*['"]?((?:\/|~)(?:[\w.\-/:~]*[\w.\-/~])?)['"]?/gi,
     // format: permission denied, open '/path'
-    /[Pp]ermission denied,\s*open\s*['"]?((?:\/|~)[\w.\-/:~]+)['"]?/gi,
+    /permission denied[\s:,'"[\]]*open[\s:,'"[\]]*['"]?((?:\/|~)(?:[\w.\-/:~]*[\w.\-/~])?)['"]?/gi,
     // format: npm error path /path or npm ERR! path /path
-    /npm\s+(?:error|ERR!)\s+path\s+((?:\/|~)[\w.\-/:~]+)/gi,
-    // format: EACCES: permission denied, mkdir '/path'
-    /EACCES:\s*permission denied,\s*\w+\s*['"]?((?:\/|~)[\w.\-/:~]+)['"]?/gi,
+    /npm[\s!]*[A-Za-z]*err[A-Za-z!]*[\s!]+path[\s!]*((?:\/|~)(?:[\w.\-/:~]*[\w.\-/~])?)/gi,
+    // format: eacces: permission denied, mkdir '/path'
+    /eacces[\s:,'"[\]]*permission denied[\s:,'"[\]]*\w+[\s:,'"[\]]*['"]?((?:\/|~)[\w.\-/:~]*[\w.\-/~])?/gi,
+    // format: PermissionError: [Errno 13] Permission denied: '/path'
+    /permissionerror[\s:,'"[\]]*(?:[^'"]*)['"]((?:\/|~)[\w.\-/:~]*[\w.\-/~])?['"]/gi,
+    // format: FileNotFoundError: [Errno 2] No such file or directory: '/path' (sometimes returned in sandbox denials if directory is hidden)
+    /filenotfounderror[\s:,'"[\]]*(?:[^'"]*)['"]((?:\/|~)[\w.\-/:~]*[\w.\-/~])?['"]/gi,
+    // format: Error: EACCES: permission denied, open '/path'
+    /error[\s:,'"[\]]*eacces[\s:,'"[\]]*permission denied[\s:,'"[\]]*(?:[^'"]*)['"]((?:\/|~)[\w.\-/:~]*[\w.\-/~])?['"]/gi,
   ];
 
   for (const regex of regexes) {
     let match;
-    while ((match = regex.exec(output)) !== null) {
-      filePaths.add(match[1]);
-    }
-    if (errorOutput) {
-      regex.lastIndex = 0; // Reset for next use
-      while ((match = regex.exec(errorOutput)) !== null) {
-        filePaths.add(match[1]);
-      }
+    while ((match = regex.exec(fullText)) !== null) {
+      const sanitized = sanitizeExtractedPath(match[1]);
+      if (sanitized) filePaths.add(sanitized);
     }
   }
 
@@ -86,22 +153,16 @@ export function parsePosixSandboxDenials(
     const fallbackRegex =
       /(?:^|[\s"'[\]])(\/[a-zA-Z0-9_.-]+(?:\/[a-zA-Z0-9_.-]+)+)(?:$|[\s"'[\]:])/gi;
     let m;
-    while ((m = fallbackRegex.exec(output)) !== null) {
-      const p = m[1];
-      if (p && !p.startsWith('/bin/') && !p.startsWith('/usr/bin/')) {
-        filePaths.add(p);
-      }
-    }
-    if (errorOutput) {
-      while ((m = fallbackRegex.exec(errorOutput)) !== null) {
-        const p = m[1];
-        if (p && !p.startsWith('/bin/') && !p.startsWith('/usr/bin/')) {
-          filePaths.add(p);
-        }
-      }
+    while ((m = fallbackRegex.exec(fullText)) !== null) {
+      const sanitized = sanitizeExtractedPath(m[1]);
+      if (sanitized) filePaths.add(sanitized);
     }
   }
 
+  if (cacheKey && cache) {
+    cache.set(cacheKey, true);
+  }
+
   return {
     network: isNetworkDenial || undefined,
     filePaths: filePaths.size > 0 ? Array.from(filePaths) : undefined,

packages/core/src/sandbox/utils/sandboxReadWriteUtils.ts

@@ -8,6 +8,7 @@ import {
   type SandboxPermissions,
   type SandboxRequest,
 } from '../../services/sandboxManager.js';
+import { isValidPathString } from '../../utils/paths.js';
 
 /**
  * Validates if the requested paths are within the allowed workspace or allowed paths.
@@ -18,6 +19,9 @@ function validatePaths(
   allowedPaths: string[],
 ): boolean {
   for (const p of paths) {
+    if (!isValidPathString(p)) {
+      return false; // Reject malicious paths
+    }
     const resolvedPath = path.resolve(p);
     const resolvedWorkspace = path.resolve(workspace);
     const isInsideWorkspace =

packages/core/src/sandbox/windows/WindowsSandboxManager.ts

@@ -35,7 +35,15 @@ import {
 } from './commandSafety.js';
 import { verifySandboxOverrides } from '../utils/commandUtils.js';
 import { parseWindowsSandboxDenials } from './windowsSandboxDenialUtils.js';
-import { isSubpath, resolveToRealPath } from '../../utils/paths.js';
+import {
+  isSubpath,
+  resolveToRealPath,
+  assertValidPathString,
+} from '../../utils/paths.js';
+import {
+  type SandboxDenialCache,
+  createSandboxDenialCache,
+} from '../utils/sandboxDenialUtils.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -54,6 +62,7 @@ export class WindowsSandboxManager implements SandboxManager {
   private initialized = false;
   private readonly allowedCache = new Set<string>();
   private readonly deniedCache = new Set<string>();
+  private readonly denialCache: SandboxDenialCache = createSandboxDenialCache();
 
   constructor(private readonly options: GlobalSandboxOptions) {
     this.helperPath = path.resolve(__dirname, WindowsSandboxManager.HELPER_EXE);
@@ -73,7 +82,7 @@ export class WindowsSandboxManager implements SandboxManager {
   }
 
   parseDenials(result: ShellExecutionResult): ParsedSandboxDenial | undefined {
-    return parseWindowsSandboxDenials(result);
+    return parseWindowsSandboxDenials(result, this.denialCache);
   }
 
   getWorkspace(): string {
@@ -88,6 +97,7 @@ export class WindowsSandboxManager implements SandboxManager {
    * Ensures a file or directory exists.
    */
   private touch(filePath: string, isDirectory: boolean): void {
+    assertValidPathString(filePath);
     try {
       // If it exists (even as a broken symlink), do nothing
       if (fs.lstatSync(filePath)) return;

packages/core/src/sandbox/windows/windowsSandboxDenialUtils.ts

@@ -6,6 +6,10 @@
 
 import { type ParsedSandboxDenial } from '../../services/sandboxManager.js';
 import type { ShellExecutionResult } from '../../services/shellExecutionService.js';
+import {
+  type SandboxDenialCache,
+  sanitizeExtractedPath,
+} from '../utils/sandboxDenialUtils.js';
 
 /**
  * Windows-specific sandbox denial detection.
@@ -13,10 +17,18 @@ import type { ShellExecutionResult } from '../../services/shellExecutionService.
  */
 export function parseWindowsSandboxDenials(
   result: ShellExecutionResult,
+  cache?: SandboxDenialCache,
 ): ParsedSandboxDenial | undefined {
   const output = result.output || '';
   const errorOutput = result.error?.message;
-  const combined = (output + ' ' + (errorOutput || '')).toLowerCase();
+  const fullText = output + '\n' + (errorOutput || '');
+  const combined = fullText.toLowerCase();
+
+  // Cache by the first 200 characters of the error to handle variable data (timestamps, PIDs)
+  const cacheKey = combined.trim().slice(0, 200);
+  if (cacheKey && cache?.has(cacheKey)) {
+    return undefined;
+  }
 
   const isFileDenial = [
     'access is denied',
@@ -46,30 +58,24 @@ export function parseWindowsSandboxDenials(
 
   // 1. Quoted paths: 'C:\Foo Bar' or "C:\Foo Bar"
   const quotedRegex = /['"]((?:\\\\(?:\?|\.)\\)?[a-zA-Z]:[\\/][^'"]+)['"]/g;
-  for (const match of output.matchAll(quotedRegex)) {
-    filePaths.add(match[1]);
-  }
-  if (errorOutput) {
-    for (const match of errorOutput.matchAll(quotedRegex)) {
-      filePaths.add(match[1]);
-    }
+  for (const match of fullText.matchAll(quotedRegex)) {
+    const sanitized = sanitizeExtractedPath(match[1]);
+    if (sanitized) filePaths.add(sanitized);
   }
 
   // 2. Unquoted paths or paths in PowerShell error format: PermissionDenied: (C:\path:String)
   const generalRegex =
     /(?:^|[\s(])((?:\\\\(?:\?|\.)\\)?[a-zA-Z]:[\\/][^"'\s()<>|?*]+)/g;
-  for (const match of output.matchAll(generalRegex)) {
+  for (const match of fullText.matchAll(generalRegex)) {
     // Clean up trailing colon which might be part of the error message rather than the path
     let p = match[1];
     if (p.endsWith(':')) p = p.slice(0, -1);
-    filePaths.add(p);
+    const sanitized = sanitizeExtractedPath(p);
+    if (sanitized) filePaths.add(sanitized);
   }
-  if (errorOutput) {
-    for (const match of errorOutput.matchAll(generalRegex)) {
-      let p = match[1];
-      if (p.endsWith(':')) p = p.slice(0, -1);
-      filePaths.add(p);
-    }
+
+  if (cacheKey && cache) {
+    cache.set(cacheKey, true);
   }
 
   return {

packages/core/src/services/sandboxManager.integration.test.ts

@@ -105,7 +105,8 @@ function ensureSandboxAvailable(): boolean {
   if (platform === 'win32') {
     // Windows sandboxing relies on icacls, which is a core system utility and
     // always available.
-    return true;
+    // TODO: reenable once flakiness is addressed
+    return false;
   }
 
   if (platform === 'darwin') {

packages/core/src/telemetry/clearcut-logger/clearcut-logger.test.ts

@@ -1692,4 +1692,187 @@ describe('ClearcutLogger', () => {
       ]);
     });
   });
+
+  describe('logBrowserAgentConnectionEvent', () => {
+    it('logs a successful connection event', () => {
+      const { logger } = setup();
+      logger?.logBrowserAgentConnectionEvent({
+        session_mode: 'isolated',
+        headless: true,
+        success: true,
+        duration_ms: 1500,
+      });
+
+      const events = getEvents(logger!);
+      expect(events.length).toBe(1);
+      expect(events[0]).toHaveEventName(EventNames.BROWSER_AGENT_CONNECTION);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SESSION_MODE,
+        'isolated',
+      ]);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_HEADLESS,
+        'true',
+      ]);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SUCCESS,
+        'true',
+      ]);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_DURATION_MS,
+        '1500',
+      ]);
+    });
+
+    it('logs a failed connection event with error_type', () => {
+      const { logger } = setup();
+      logger?.logBrowserAgentConnectionEvent({
+        session_mode: 'persistent',
+        headless: false,
+        success: false,
+        duration_ms: 30000,
+        error_type: 'timeout',
+      });
+
+      const events = getEvents(logger!);
+      expect(events.length).toBe(1);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SUCCESS,
+        'false',
+      ]);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_ERROR_TYPE,
+        'timeout',
+      ]);
+    });
+
+    it('logs tool_count when provided', () => {
+      const { logger } = setup();
+      logger?.logBrowserAgentConnectionEvent({
+        session_mode: 'existing',
+        headless: true,
+        success: true,
+        duration_ms: 800,
+        tool_count: 12,
+      });
+
+      const events = getEvents(logger!);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_TOOL_COUNT,
+        '12',
+      ]);
+    });
+  });
+
+  describe('logBrowserAgentVisionStatusEvent', () => {
+    it('logs vision enabled', () => {
+      const { logger } = setup();
+      logger?.logBrowserAgentVisionStatusEvent({ enabled: true });
+
+      const events = getEvents(logger!);
+      expect(events.length).toBe(1);
+      expect(events[0]).toHaveEventName(EventNames.BROWSER_AGENT_VISION_STATUS);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_VISION_ENABLED,
+        'true',
+      ]);
+    });
+
+    it('logs vision disabled with reason', () => {
+      const { logger } = setup();
+      logger?.logBrowserAgentVisionStatusEvent({
+        enabled: false,
+        disabled_reason: 'no_visual_model',
+      });
+
+      const events = getEvents(logger!);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_VISION_ENABLED,
+        'false',
+      ]);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_VISION_DISABLED_REASON,
+        'no_visual_model',
+      ]);
+    });
+  });
+
+  describe('logBrowserAgentTaskOutcomeEvent', () => {
+    it('logs a task outcome event with all attributes', () => {
+      const { logger } = setup();
+      logger?.logBrowserAgentTaskOutcomeEvent({
+        success: true,
+        session_mode: 'isolated',
+        vision_enabled: true,
+        headless: true,
+        duration_ms: 5000,
+      });
+
+      const events = getEvents(logger!);
+      expect(events.length).toBe(1);
+      expect(events[0]).toHaveEventName(EventNames.BROWSER_AGENT_TASK_OUTCOME);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SUCCESS,
+        'true',
+      ]);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SESSION_MODE,
+        'isolated',
+      ]);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_VISION_ENABLED,
+        'true',
+      ]);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_HEADLESS,
+        'true',
+      ]);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_DURATION_MS,
+        '5000',
+      ]);
+    });
+  });
+
+  describe('logBrowserAgentCleanupEvent', () => {
+    it('logs a cleanup event with all attributes', () => {
+      const { logger } = setup();
+      logger?.logBrowserAgentCleanupEvent({
+        session_mode: 'isolated',
+        success: true,
+        duration_ms: 200,
+      });
+
+      const events = getEvents(logger!);
+      expect(events.length).toBe(1);
+      expect(events[0]).toHaveEventName(EventNames.BROWSER_AGENT_CLEANUP);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SESSION_MODE,
+        'isolated',
+      ]);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SUCCESS,
+        'true',
+      ]);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_DURATION_MS,
+        '200',
+      ]);
+    });
+
+    it('logs a failed cleanup event', () => {
+      const { logger } = setup();
+      logger?.logBrowserAgentCleanupEvent({
+        session_mode: 'persistent',
+        success: false,
+        duration_ms: 5000,
+      });
+
+      const events = getEvents(logger!);
+      expect(events[0]).toHaveMetadataValue([
+        EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SUCCESS,
+        'false',
+      ]);
+    });
+  });
 });

packages/core/src/telemetry/clearcut-logger/clearcut-logger.ts

@@ -135,6 +135,10 @@ export enum EventNames {
   OVERAGE_OPTION_SELECTED = 'overage_option_selected',
   EMPTY_WALLET_MENU_SHOWN = 'empty_wallet_menu_shown',
   CREDIT_PURCHASE_CLICK = 'credit_purchase_click',
+  BROWSER_AGENT_CONNECTION = 'browser_agent_connection',
+  BROWSER_AGENT_VISION_STATUS = 'browser_agent_vision_status',
+  BROWSER_AGENT_TASK_OUTCOME = 'browser_agent_task_outcome',
+  BROWSER_AGENT_CLEANUP = 'browser_agent_cleanup',
 }
 
 export interface LogResponse {
@@ -1935,6 +1939,146 @@ export class ClearcutLogger {
     this.flushIfNeeded();
   }
 
+  // ==========================================================================
+  // Browser Agent Events
+  // ==========================================================================
+
+  logBrowserAgentConnectionEvent(attrs: {
+    session_mode: string;
+    headless: boolean;
+    success: boolean;
+    duration_ms: number;
+    error_type?: string;
+    tool_count?: number;
+  }): void {
+    const data: EventValue[] = [
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SESSION_MODE,
+        value: attrs.session_mode,
+      },
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_HEADLESS,
+        value: attrs.headless.toString(),
+      },
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SUCCESS,
+        value: attrs.success.toString(),
+      },
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_DURATION_MS,
+        value: attrs.duration_ms.toString(),
+      },
+    ];
+
+    if (attrs.error_type) {
+      data.push({
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_ERROR_TYPE,
+        value: attrs.error_type,
+      });
+    }
+
+    if (attrs.tool_count !== undefined) {
+      data.push({
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_TOOL_COUNT,
+        value: attrs.tool_count.toString(),
+      });
+    }
+
+    this.enqueueLogEvent(
+      this.createLogEvent(EventNames.BROWSER_AGENT_CONNECTION, data),
+    );
+    this.flushIfNeeded();
+  }
+
+  logBrowserAgentVisionStatusEvent(attrs: {
+    enabled: boolean;
+    disabled_reason?: string;
+  }): void {
+    const data: EventValue[] = [
+      {
+        gemini_cli_key:
+          EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_VISION_ENABLED,
+        value: attrs.enabled.toString(),
+      },
+    ];
+
+    if (attrs.disabled_reason) {
+      data.push({
+        gemini_cli_key:
+          EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_VISION_DISABLED_REASON,
+        value: attrs.disabled_reason,
+      });
+    }
+
+    this.enqueueLogEvent(
+      this.createLogEvent(EventNames.BROWSER_AGENT_VISION_STATUS, data),
+    );
+    this.flushIfNeeded();
+  }
+
+  logBrowserAgentTaskOutcomeEvent(attrs: {
+    success: boolean;
+    session_mode: string;
+    vision_enabled: boolean;
+    headless: boolean;
+    duration_ms: number;
+  }): void {
+    const data: EventValue[] = [
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SUCCESS,
+        value: attrs.success.toString(),
+      },
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SESSION_MODE,
+        value: attrs.session_mode,
+      },
+      {
+        gemini_cli_key:
+          EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_VISION_ENABLED,
+        value: attrs.vision_enabled.toString(),
+      },
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_HEADLESS,
+        value: attrs.headless.toString(),
+      },
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_DURATION_MS,
+        value: attrs.duration_ms.toString(),
+      },
+    ];
+
+    this.enqueueLogEvent(
+      this.createLogEvent(EventNames.BROWSER_AGENT_TASK_OUTCOME, data),
+    );
+    this.flushIfNeeded();
+  }
+
+  logBrowserAgentCleanupEvent(attrs: {
+    session_mode: string;
+    success: boolean;
+    duration_ms: number;
+  }): void {
+    const data: EventValue[] = [
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SESSION_MODE,
+        value: attrs.session_mode,
+      },
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_SUCCESS,
+        value: attrs.success.toString(),
+      },
+      {
+        gemini_cli_key: EventMetadataKey.GEMINI_CLI_BROWSER_AGENT_DURATION_MS,
+        value: attrs.duration_ms.toString(),
+      },
+    ];
+
+    this.enqueueLogEvent(
+      this.createLogEvent(EventNames.BROWSER_AGENT_CLEANUP, data),
+    );
+    this.flushIfNeeded();
+  }
+
   /**
    * Adds default fields to data, and returns a new data array.  This fields
    * should exist on all log events.

packages/core/src/telemetry/clearcut-logger/event-metadata-key.ts

@@ -7,7 +7,7 @@
 // Defines valid event metadata keys for Clearcut logging.
 export enum EventMetadataKey {
   // Deleted enums: 24
-  // Next ID: 195
+  // Next ID: 203
 
   GEMINI_CLI_KEY_UNKNOWN = 0,
 
@@ -725,4 +725,32 @@ export enum EventMetadataKey {
 
   // Logs the duration of the onboarding process in milliseconds.
   GEMINI_CLI_ONBOARDING_DURATION_MS = 194,
+
+  // ==========================================================================
+  // Browser Agent Event Keys
+  // ==========================================================================
+
+  // Logs the browser agent session mode (persistent, isolated, existing).
+  GEMINI_CLI_BROWSER_AGENT_SESSION_MODE = 195,
+
+  // Logs whether the browser agent ran in headless mode.
+  GEMINI_CLI_BROWSER_AGENT_HEADLESS = 196,
+
+  // Logs whether the browser agent operation was successful.
+  GEMINI_CLI_BROWSER_AGENT_SUCCESS = 197,
+
+  // Logs the error type for a browser agent connection failure.
+  GEMINI_CLI_BROWSER_AGENT_ERROR_TYPE = 198,
+
+  // Logs the duration in milliseconds for a browser agent operation.
+  GEMINI_CLI_BROWSER_AGENT_DURATION_MS = 199,
+
+  // Logs whether vision mode was enabled for the browser agent.
+  GEMINI_CLI_BROWSER_AGENT_VISION_ENABLED = 200,
+
+  // Logs the reason vision mode was disabled for the browser agent.
+  GEMINI_CLI_BROWSER_AGENT_VISION_DISABLED_REASON = 201,
+
+  // Logs the number of tools discovered from the MCP server.
+  GEMINI_CLI_BROWSER_AGENT_TOOL_COUNT = 202,
 }

packages/core/src/telemetry/loggers.ts

@@ -83,6 +83,10 @@ import {
   recordInvalidChunk,
   recordOnboardingStart,
   recordOnboardingSuccess,
+  recordBrowserAgentConnection,
+  recordBrowserAgentVisionStatus,
+  recordBrowserAgentTaskOutcome,
+  recordBrowserAgentCleanup,
 } from './metrics.js';
 import { bufferTelemetryEvent } from './sdk.js';
 import { uiTelemetryService, type UiEvent } from './uiTelemetry.js';
@@ -939,3 +943,90 @@ export function logBillingEvent(
     }
   }
 }
+
+// ==========================================================================
+// Browser Agent Events
+// ==========================================================================
+
+export function logBrowserAgentConnection(
+  config: Config,
+  durationMs: number,
+  attributes: {
+    session_mode: 'persistent' | 'isolated' | 'existing';
+    headless: boolean;
+    success: boolean;
+    error_type?:
+      | 'profile_locked'
+      | 'timeout'
+      | 'connection_refused'
+      | 'unknown';
+    tool_count?: number;
+  },
+): void {
+  ClearcutLogger.getInstance(config)?.logBrowserAgentConnectionEvent({
+    session_mode: attributes.session_mode,
+    headless: attributes.headless,
+    success: attributes.success,
+    duration_ms: durationMs,
+    error_type: attributes.error_type,
+    tool_count: attributes.tool_count,
+  });
+
+  recordBrowserAgentConnection(config, durationMs, attributes);
+}
+
+export function logBrowserAgentVisionStatus(
+  config: Config,
+  attributes: {
+    enabled: boolean;
+    disabled_reason?:
+      | 'no_visual_model'
+      | 'missing_visual_tools'
+      | 'blocked_auth_type';
+  },
+): void {
+  ClearcutLogger.getInstance(config)?.logBrowserAgentVisionStatusEvent({
+    enabled: attributes.enabled,
+    disabled_reason: attributes.disabled_reason,
+  });
+
+  recordBrowserAgentVisionStatus(config, attributes);
+}
+
+export function logBrowserAgentTaskOutcome(
+  config: Config,
+  attributes: {
+    success: boolean;
+    session_mode: 'persistent' | 'isolated' | 'existing';
+    vision_enabled: boolean;
+    headless: boolean;
+    duration_ms: number;
+  },
+): void {
+  ClearcutLogger.getInstance(config)?.logBrowserAgentTaskOutcomeEvent({
+    success: attributes.success,
+    session_mode: attributes.session_mode,
+    vision_enabled: attributes.vision_enabled,
+    headless: attributes.headless,
+    duration_ms: attributes.duration_ms,
+  });
+
+  recordBrowserAgentTaskOutcome(config, attributes);
+}
+
+export function logBrowserAgentCleanup(
+  config: Config,
+  durationMs: number,
+  attributes: {
+    session_mode: 'persistent' | 'isolated' | 'existing';
+    success: boolean;
+  },
+): void {
+  ClearcutLogger.getInstance(config)?.logBrowserAgentCleanupEvent({
+    session_mode: attributes.session_mode,
+    success: attributes.success,
+    duration_ms: durationMs,
+  });
+
+  recordBrowserAgentCleanup(config, durationMs, attributes);
+}

packages/core/src/telemetry/metrics.test.ts

@@ -1687,6 +1687,29 @@ describe('Telemetry Metrics', () => {
         expect(mockCounterAddFn).not.toHaveBeenCalled();
       });
 
+      it('records tool_count on success when provided', () => {
+        initializeMetricsModule(mockConfig);
+        mockCounterAddFn.mockClear();
+        mockHistogramRecordFn.mockClear();
+
+        recordBrowserAgentConnectionModule(mockConfig, 1200, {
+          session_mode: 'isolated',
+          headless: false,
+          success: true,
+          tool_count: 5,
+        });
+
+        expect(mockHistogramRecordFn).toHaveBeenCalledWith(1200, {
+          'session.id': 'test-session-id',
+          'installation.id': 'test-installation-id',
+          'user.email': 'test@example.com',
+          session_mode: 'isolated',
+          headless: false,
+          success: true,
+          tool_count: 5,
+        });
+      });
+
       it('records connection duration and failure counter on error', () => {
         initializeMetricsModule(mockConfig);
         mockCounterAddFn.mockClear();

packages/core/src/telemetry/metrics.ts

@@ -1624,6 +1624,7 @@ export function recordBrowserAgentConnection(
       | 'timeout'
       | 'connection_refused'
       | 'unknown';
+    tool_count?: number;
   },
 ): void {
   if (!isMetricsInitialized) return;
@@ -1635,6 +1636,7 @@ export function recordBrowserAgentConnection(
     session_mode: attributes.session_mode,
     headless: attributes.headless,
     success: attributes.success,
+    tool_count: attributes.tool_count,
   });
 
   if (!attributes.success && browserAgentConnectionFailureCounter) {

packages/core/src/utils/compatibility.test.ts

@@ -289,19 +289,6 @@ describe('compatibility', () => {
       );
     });
 
-    it('should return tmux warning when detected and in alternate buffer', () => {
-      vi.stubEnv('TMUX', '/tmp/tmux-1001/default,1,0');
-
-      const warnings = getCompatibilityWarnings({ isAlternateBuffer: true });
-      expect(warnings).toContainEqual(
-        expect.objectContaining({
-          id: 'tmux-alternate-buffer',
-          message: expect.stringContaining('tmux detected'),
-          priority: WarningPriority.High,
-        }),
-      );
-    });
-
     it('should return low-color tmux warning when detected', () => {
       vi.stubEnv('TERM', 'screen');
       vi.stubEnv('TMUX', '1');

packages/core/src/utils/compatibility.ts

@@ -145,15 +145,6 @@ export function getCompatibilityWarnings(options?: {
     });
   }
 
-  if (isTmux() && options?.isAlternateBuffer) {
-    warnings.push({
-      id: 'tmux-alternate-buffer',
-      message:
-        'Warning: tmux detected — alternate buffer mode may cause unexpected scrollback loss and flickering. If you experience issues, disable it in /settings → "Use Alternate Screen Buffer".\n    Tip: Use Ctrl-b [ to access tmux copy mode for scrolling history.',
-      priority: WarningPriority.High,
-    });
-  }
-
   if (isLowColorTmux()) {
     warnings.push({
       id: 'low-color-tmux',

packages/core/src/utils/events.ts

@@ -109,6 +109,13 @@ export interface HookEndPayload extends HookPayload {
   success: boolean;
 }
 
+/**
+ * Payload for the 'hook-system-message' event.
+ */
+export interface HookSystemMessagePayload extends HookPayload {
+  message: string;
+}
+
 /**
  * Payload for the 'retry-attempt' event.
  */
@@ -183,6 +190,7 @@ export enum CoreEvent {
   SettingsChanged = 'settings-changed',
   HookStart = 'hook-start',
   HookEnd = 'hook-end',
+  HookSystemMessage = 'hook-system-message',
   AgentsRefreshed = 'agents-refreshed',
   AdminSettingsChanged = 'admin-settings-changed',
   RetryAttempt = 'retry-attempt',
@@ -217,6 +225,7 @@ export interface CoreEvents extends ExtensionEvents {
   [CoreEvent.SettingsChanged]: never[];
   [CoreEvent.HookStart]: [HookStartPayload];
   [CoreEvent.HookEnd]: [HookEndPayload];
+  [CoreEvent.HookSystemMessage]: [HookSystemMessagePayload];
   [CoreEvent.AgentsRefreshed]: never[];
   [CoreEvent.AdminSettingsChanged]: never[];
   [CoreEvent.RetryAttempt]: [RetryAttemptPayload];
@@ -339,6 +348,13 @@ export class CoreEventEmitter extends EventEmitter<CoreEvents> {
     this.emit(CoreEvent.HookEnd, payload);
   }
 
+  /**
+   * Notifies subscribers that a hook has provided a system message.
+   */
+  emitHookSystemMessage(payload: HookSystemMessagePayload): void {
+    this.emit(CoreEvent.HookSystemMessage, payload);
+  }
+
   /**
    * Notifies subscribers that agents have been refreshed.
    */

packages/core/src/utils/paths.ts

@@ -369,6 +369,22 @@ export function isSubpath(parentPath: string, childPath: string): boolean {
   );
 }
 
+/**
+ * Type guard to verify a value is a string and does not contain null bytes.
+ */
+export function isValidPathString(p: unknown): p is string {
+  return typeof p === 'string' && !p.includes('\0');
+}
+
+/**
+ * Asserts that a value is a valid path string, throwing an Error otherwise.
+ */
+export function assertValidPathString(p: unknown): asserts p is string {
+  if (!isValidPathString(p)) {
+    throw new Error(`Invalid path: ${String(p)}`);
+  }
+}
+
 /**
  * Resolves a path to its real path, sanitizing it first.
  * - Removes 'file://' protocol if present.
@@ -379,6 +395,7 @@ export function isSubpath(parentPath: string, childPath: string): boolean {
  * @returns The resolved real path.
  */
 export function resolveToRealPath(pathStr: string): string {
+  assertValidPathString(pathStr);
   let resolvedPath = pathStr;
 
   try {

scripts/changed_prompt.js

@@ -36,7 +36,8 @@ function main() {
     });
 
     // Get changed files using the triple-dot syntax which correctly handles merge commits
-    const changedFiles = execSync(`git diff --name-only FETCH_HEAD...HEAD`, {
+    const head = process.env.PR_HEAD_SHA || 'HEAD';
+    const changedFiles = execSync(`git diff --name-only FETCH_HEAD...${head}`, {
       encoding: 'utf-8',
     })
       .split('\n')
@@ -70,7 +71,7 @@ function main() {
       if (coreChanges.length > 0) {
         // Get the actual diff content for core files
         const diff = execSync(
-          `git diff -U0 FETCH_HEAD...HEAD -- packages/core/src/`,
+          `git diff -U0 FETCH_HEAD...${head} -- packages/core/src/`,
           { encoding: 'utf-8' },
         );
         for (const sig of STEERING_SIGNATURES) {