Update public workflow trust, readme, and run formatter.

Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com>

.dockerignore

@@ -0,0 +1,17 @@
+# Git history - not needed in build context
+.git
+
+# Root node_modules - reinstalled inside container via npm ci
+node_modules
+
+# Package-level node_modules - reinstalled inside container
+packages/*/node_modules
+
+# Development and IDE files
+.github
+.vscode
+npm-debug.log*
+
+# Misc
+.DS_Store
+*.tmp

.gcp/Dockerfile.development

@@ -0,0 +1,89 @@
+# --- STAGE 1: Base Runtime ---
+FROM docker.io/library/node:20-slim AS base
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  python3 \
+  python3-pip \
+  python3-venv \
+  curl \
+  dnsutils \
+  less \
+  jq \
+  ca-certificates \
+  git \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+# --- STAGE 2: Builder (Compile Main) ---
+FROM base AS builder
+WORKDIR /build
+COPY . .
+RUN npm ci --ignore-scripts
+RUN npm run bundle
+# Run the official release preparation script to move the bundle and assets into packages/cli
+RUN node scripts/prepare-npm-release.js
+
+# --- STAGE 3: Development Environment ---
+FROM base AS development
+
+WORKDIR /home/node/dev/main
+
+# Set up npm global package folder
+RUN mkdir -p /usr/local/share/npm-global \
+  && chown -R node:node /usr/local/share/npm-global
+ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
+ENV PATH=$PATH:/usr/local/share/npm-global/bin
+
+# Copy package.json to extract versions for global tools
+COPY package.json /tmp/package.json
+
+# Install Build Tools, Global Dev Tools (pinned), and Linters
+ARG ACTIONLINT_VER=1.7.7
+ARG SHELLCHECK_VER=0.11.0
+ARG YAMLLINT_VER=1.35.1
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  make \
+  g++ \
+  gh \
+  git \
+  unzip \
+  rsync \
+  ripgrep \
+  procps \
+  psmisc \
+  lsof \
+  socat \
+  tmux \
+  docker.io \
+  build-essential \
+  libsecret-1-dev \
+  libkrb5-dev \
+  file \
+  && curl -sSLo /tmp/actionlint.tar.gz https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VER}/actionlint_${ACTIONLINT_VER}_linux_amd64.tar.gz \
+  && tar -xzf /tmp/actionlint.tar.gz -C /usr/local/bin actionlint \
+  && curl -sSLo /tmp/shellcheck.tar.xz https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VER}/shellcheck-v${SHELLCHECK_VER}.linux.x86_64.tar.xz \
+  && tar -xf /tmp/shellcheck.tar.xz -C /usr/local/bin --strip-components=1 shellcheck-v${SHELLCHECK_VER}/shellcheck \
+  && pip3 install --break-system-packages yamllint==${YAMLLINT_VER} \
+  && export TSX_VER=$(node -p "require('/tmp/package.json').devDependencies.tsx") \
+  && export VITEST_VER=$(node -p "require('/tmp/package.json').devDependencies.vitest") \
+  && export PRETTIER_VER=$(node -p "require('/tmp/package.json').devDependencies.prettier") \
+  && export ESLINT_VER=$(node -p "require('/tmp/package.json').devDependencies.eslint") \
+  && export CROSS_ENV_VER=$(node -p "require('/tmp/package.json').devDependencies['cross-env']") \
+  && npm install -g tsx@$TSX_VER vitest@$VITEST_VER prettier@$PRETTIER_VER eslint@$ESLINT_VER cross-env@$CROSS_ENV_VER typescript@5.3.3 \
+  && npm install -g @google/gemini-cli@nightly && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-nightly \
+  && npm install -g @google/gemini-cli@preview && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-preview \
+  && npm install -g @google/gemini-cli@latest  && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-stable \
+  && apt-get purge -y build-essential libsecret-1-dev libkrb5-dev \
+  && apt-get autoremove -y \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /tmp/* /root/.npm
+
+# Copy the bundled CLI package to a permanent location and install it
+# We MUST not delete this source folder as 'npm install -g <folder>' 
+# often symlinks to it for local folder installs.
+COPY --from=builder /build/packages/cli /usr/local/lib/gemini-cli
+RUN npm install -g /usr/local/lib/gemini-cli
+
+USER node
+CMD ["/bin/bash"]

.gcp/Dockerfile.development.dockerignore

@@ -0,0 +1,10 @@
+node_modules
+.git
+.gemini/workspaces
+dist
+!packages/*/dist/*.tgz
+bundle
+out
+*.log
+.env
+.DS_Store

.gcp/development-worker.yml

@@ -0,0 +1,58 @@
+substitutions:
+  _IMAGE_NAME: 'development'
+  _ARTIFACT_REGISTRY_REPO: 'us-docker.pkg.dev/gemini-code-dev/gemini-cli'
+
+steps:
+  # Step 1: Install root dependencies
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Install Dependencies'
+    entrypoint: 'npm'
+    args: ['install']
+
+  # Step 2: Authenticate for Docker
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Authenticate docker'
+    entrypoint: 'npm'
+    args: ['run', 'auth']
+
+  # Step 3: Build workspace packages
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build packages'
+    entrypoint: 'npm'
+    args: ['run', 'build:packages']
+
+  # Step 4: Build Development Image
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build Development Image'
+    entrypoint: 'bash'
+    env:
+      - 'RAW_BRANCH_VALUE=${BRANCH_NAME}'
+    args:
+      - '-c'
+      - |-
+        IMAGE_BASE="${_ARTIFACT_REGISTRY_REPO}/${_IMAGE_NAME}"
+
+        # Determine the primary tag (branch name or 'latest' for main)
+        # Use $$ for shell variables to avoid Cloud Build attempting premature substitution
+        RAW_BRANCH="$$RAW_BRANCH_VALUE"
+        if [ "$${RAW_BRANCH}" == "main" ]; then
+          TAG_PRIMARY="latest"
+        else
+          TAG_PRIMARY=$$(echo "$${RAW_BRANCH}" | sed 's/[^a-zA-Z0-9]/-/g' | tr '[:upper:]' '[:lower:]')
+        fi
+
+        # Use SHORT_SHA if available (Cloud Build) or fallback to latest-dev
+        TAG_SHA="$${SHORT_SHA:-latest-dev}"
+
+        echo "📦 Building Development Image for: $${RAW_BRANCH} -> $${TAG_PRIMARY} ($${TAG_SHA})"
+
+        docker build -f .gcp/Dockerfile.development \
+          -t "$${IMAGE_BASE}:$${TAG_SHA}" \
+          -t "$${IMAGE_BASE}:$${TAG_PRIMARY}" .
+
+        docker push "$${IMAGE_BASE}:$${TAG_SHA}"
+        docker push "$${IMAGE_BASE}:$${TAG_PRIMARY}"
+
+options:
+  defaultLogsBucketBehavior: 'REGIONAL_USER_OWNED_BUCKET'
+  dynamicSubstitutions: true

.gemini/commands/fix-behavioral-eval.toml

@@ -1,60 +0,0 @@
-description = "Check status of nightly evals, fix failures for key models, and re-run."
-prompt = """
-You are an expert at fixing behavioral evaluations.
-
-1. **Investigate**:
-   - Use 'gh' cli to fetch the results from the latest run from the main branch: https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml.
-   - DO NOT push any changes or start any runs. The rest of your evaluation will be local.
-   - Evals are in evals/ directory and are documented by evals/README.md.
-   - The test case trajectory logs will be logged to evals/logs.
-   - You should also enable and review the verbose agent logs by setting the GEMINI_DEBUG_LOG_FILE environment variable.
-   - Identify the relevant test. Confine your investigation and validation to just this test.
-   - Proactively add logging that will aid in gathering information or validating your hypotheses.
-
-2. **Fix**:
-   - If a relevant test is failing, locate the test file and the corresponding prompt/code.
-   - It's often helpful to make an extreme, brute force change to see if you are changing the right place to make an improvement and then scope it back iteratively.
-   - Your **final** change should be **minimal and targeted**.
-   - Keep in mind the following:
-     - The prompt has multiple configurations and pieces. Take care that your changes
-       end up in the final prompt for the selected model and configuration.
-     - The prompt chosen for the eval is intentional. It's often vague or indirect
-       to see how the agent performs with ambiguous instructions. Changing it should
-       be a last resort.
-     - When changing the test prompt, carefully consider whether the prompt still tests
-       the same scenario. We don't want to lose test fidelity by making the prompts too
-       direct (i.e.: easy).
-     - Your primary mechanism for improving the agent's behavior is to make changes to
-       tool instructions, system prompt (snippets.ts), and/or modules that contribute to the prompt.
-     - If prompt and description changes are unsuccessful, use logs and debugging to
-       confirm that everything is working as expected.
-    - If unable to fix the test, you can make recommendations for architecture changes
-      that might help stablize the test. Be sure to THINK DEEPLY if offering architecture guidance.
-      Some facts that might help with this are:
-      - Agents may be composed of one or more agent loops.
-      - AgentLoop == 'context + toolset + prompt'. Subagents are one type of agent loop.
-      - Agent loops perform better when:
-        - They have direct, unambiguous, and non-contradictory prompts.
-        - They have fewer irrelevant tools.
-        - They have fewer goals or steps to perform.
-        - They have less low value or irrelevant context.
-      - You may suggest compositions of existing primitives, like subagents, or
-        propose a new one.
-      - These recommendations should be high confidence and should be grounded
-        in observed deficient behaviors rather than just parroting the facts above.
-        Investigate as needed to ground your recommendations.
-
-3. **Verify**:
-   - Run just that one test if needed to validate that it is fixed. Be sure to run vitest in non-interactive mode.
-   - Running the tests can take a long time, so consider whether you can diagnose via other means or log diagnostics before committing the time. You must minimize the number of test runs needed to diagnose the failure.
-   - After the test completes, check whether it seems to have improved.
-   - You will need to run the test 3 times for Gemini 3.0, Gemini 3 flash, and Gemini 2.5 pro to ensure that it is truly stable. Run these runs in parallel, using scripts if needed.
-   - Some flakiness is expected; if it looks like a transient issue or the test is inherently unstable but passes 2/3 times, you might decide it cannot be improved.
-
-4. **Report**:
-   - Provide a summary of the test success rate for each of the tested models.
-   - Success rate is calculated based on 3 runs per model (e.g., 3/3 = 100%).
-   - If you couldn't fix it due to persistent flakiness, explain why.
-
-{{args}}
-"""

.gemini/commands/promote-behavioral-eval.toml

@@ -1,29 +0,0 @@
-description = "Promote behavioral evals that have a 100% success rate over the last 7 nightly runs."
-prompt = """
-You are an expert at analyzing and promoting behavioral evaluations.
-
-1. **Investigate**:
-   - Use 'gh' cli to fetch the results from the most recent run from the main branch: https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml.
-   - DO NOT push any changes or start any runs. The rest of your evaluation will be local.
-   - Evals are in evals/ directory and are documented by evals/README.md.
-   - Identify tests that have passed 100% of the time for ALL enabled models across the past 7 runs in a row.
-   - NOTE: the results summary from the most recent run contains the last 7 runs test results. 100% means the test passed 3/3 times for that model and run.
-   - If a test meets this criteria, it is a candidate for promotion.
-
-2. **Promote**:
-   - For each candidate test, locate the test file in the evals/ directory.
-   - Promote the test according to the project's standard promotion process (e.g., moving it to a stable suite, updating its tags, or removing skip/flaky annotations). 
-   - Ensure you follow any guidelines in evals/README.md for stable tests.
-   - Your **final** change should be **minimal and targeted** to just promoting the test status.
-
-3. **Verify**:
-   - Run the promoted tests locally to validate that they still execute correctly. Be sure to run vitest in non-interactive mode.
-   - Check that the test is now part of the expected standard or stable test suites.
-
-4. **Report**:
-   - Provide a summary of the tests that were promoted.
-   - Include the success rate evidence (7/7 runs passed for all models) for each promoted test.
-   - If no tests met the criteria for promotion, clearly state that and summarize the closest candidates.
-
-{{args}}
-"""

.gemini/commands/strict-development-rules.md

@@ -53,11 +53,27 @@ Gemini CLI project.
   overriding values. Refer to `text-buffer.ts` for a canonical example.
 - **Logging**: Do not leave `console.log`, `console.warn`, or `console.error` in
   the code.
-- **State & Effects**: Ensure state initialization is explicit (e.g., use
-  `undefined` rather than `true` as a default if the state is truly unknown).
-  Carefully manage `useEffect` dependencies. Prefer a reducer whenever
-  practical. NEVER disable `react-hooks/exhaustive-deps`; fix the code to
-  correctly declare dependencies instead.
+- **State**: Ensure state initialization is explicit (e.g., use `undefined`
+  rather than `true` as a default if the state is truly unknown). Prefer a
+  reducer whenever practical. NEVER disable `react-hooks/exhaustive-deps`; fix
+  the code to correctly declare dependencies instead. Evaluate all the React
+  states in a component and ensure that the `useState` calls are necessary and
+  not cases where values could be derived on render. Ensure there are no stale
+  closures that are relying on a value from a previous render. React Components
+  that modify Settings should effectively use the `useSettingsStore` pattern.
+  Components that configure application Settings (e.g settings.json) are the
+  only reasonable case for unsaved changes to drive UX; in these cases, the
+  Settings store should only be written to on save. If the user experience does
+  not utilize unsaved changes because there is no option to exit without saving
+  or reverting the unsaved changes, then the component should directly read from
+  and write to the Settings store without holding pending changes in component
+  level UI state.
+- **Effect**: `useEffect` should not be used to synchronize React states, it
+  should only be used for genuine side effects that occur outside of React.
+  Contributors should be able to strongly justify the need for an effect.
+  Consider whether the effect should instead be inside an event handler, or
+  whether it is better off being computed on render. Carefully manage
+  `useEffect` dependencies.
 - **Context & Props**: Avoid excessive property drilling. Leverage existing
   providers, extend them, or propose a new one if necessary. Only use providers
   for properties that are consistent across the entire application.

.gemini/settings.json

@@ -1,8 +1,13 @@
 {
   "experimental": {
-    "plan": true,
     "extensionReloading": true,
-    "modelSteering": true
+    "modelSteering": true,
+    "autoMemory": true,
+    "topicUpdateNarration": true,
+    "voiceMode": true,
+    "adk": {
+      "agentSessionNoninteractiveEnabled": true
+    }
   },
   "general": {
     "devtools": true

.gemini/skills/agent-tui/SKILL.md

@@ -0,0 +1,330 @@
+---
+name: agent-tui
+description: >
+  Main Agents: Do NOT use this skill directly. If you need to test the TUI, invoke the `tui_tester` subagent.
+  Drive terminal UI (TUI) applications programmatically for testing, automation, and inspection.
+  Use when: automating CLI/TUI interactions, regression testing terminal apps, or verifying interactive behavior.
+  Also use when: user asks "what is agent-tui", "what does agent-tui do", "demo agent-tui", "show me agent-tui", "how does agent-tui work", or wants to see it in action.
+---
+
+## 🚨 CRITICAL: macOS Daemon Workaround & Gemini CLI Usage 🚨
+
+When using `agent-tui` in this macOS environment, the default background daemonization process crashes, causing `Connection refused (os error 61)` errors. 
+
+**You MUST start the daemon manually shielded from TTY hangups before running any `agent-tui` commands.** Using `nohup` is insufficient; you must use `tmux` to provide a fully isolated pseudo-terminal. 
+
+To support parallel runs, **only restart the daemon if it is not currently running:**
+
+```bash
+# Check if daemon is alive, start it in tmux if it is not
+if ! agent-tui sessions >/dev/null 2>&1; then
+  tmux kill-session -t agent-tui 2>/dev/null || true
+  agent-tui daemon stop 2>/dev/null || true
+  rm -f /tmp/agent-tui*
+  tmux new-session -d -s agent-tui 'agent-tui daemon start --foreground > /tmp/agent-tui-daemon.log 2>&1'
+  sleep 1
+fi
+```
+
+### Session ID vs PID (Crucial for Reconnection)
+
+When `agent-tui run` returns JSON, it includes both a `session_id` and a `pid`. The `pid` is purely informational (the OS process ID of the child command). You **do not** use the `pid` to reconnect or issue commands. You must always use the `session_id` (e.g., `--session <id>`). 
+
+If the daemon crashes (`os error 61`), the pseudo-terminal is destroyed. Even if the child `pid` survives as an orphan, you cannot reconnect to it. You must restart the daemon using the workaround above and start a completely new session.
+
+### Testing the Gemini CLI
+
+When testing the Gemini CLI with `agent-tui`, there are several strict requirements to ensure deterministic and accurate behavior:
+
+1. **Build Before Running**: `agent-tui` runs the built JS files, not TypeScript. You **MUST** run `npm run build` or `npm run build:all` after making code changes and before launching the CLI with `agent-tui`.
+2. **Bypass Trust Modals**: Always pass `GEMINI_CLI_TRUST_WORKSPACE=true` in the environment. If you don't, any new project-level agents or extensions will trigger a full-screen "Acknowledge and Enable" modal. This modal steals focus, swallows automation keystrokes, and causes `agent-tui wait` commands to time out.
+3. **Isolated Environments**: If you need to test without real user credentials or existing agents interfering, isolate the global settings using `GEMINI_CLI_HOME=<some-test-dir>`.
+4. **Testing State Deltas (e.g., Reloads)**: If you are testing features that report deltas (e.g., `/agents reload` outputting "1 new local subagent"), you **MUST**:
+   - Start the CLI *first* so it establishes its baseline registry.
+   - Use a separate shell command (outside of `agent-tui`) to write the new agent `.md`/`.toml` file.
+   - Use `agent-tui type` and `press` to trigger the `/agents reload` command inside the running session.
+   - (If you add the files before starting the CLI, they become part of the baseline and won't trigger the delta logic).
+
+```bash
+# Example: Standard isolated run (sandboxed config + bypass trust modals)
+env GEMINI_CLI_TRUST_WORKSPACE=true GEMINI_CLI_HOME=test-gemini-home agent-tui run -d "$(pwd)" node packages/cli/dist/index.js
+```
+
+# Terminal Automation Mastery
+
+## Prerequisites
+
+- **Supported OS**: macOS or Linux (Windows not supported yet).
+- **Verify install**:
+
+```bash
+agent-tui --version
+```
+
+If not installed, use one of:
+
+```bash
+# Recommended: one-line install (macOS/Linux)
+curl -fsSL https://raw.githubusercontent.com/pproenca/agent-tui/master/install.sh | sh
+```
+
+```bash
+# Package manager
+npm i -g agent-tui
+pnpm add -g agent-tui
+bun add -g agent-tui
+```
+
+```bash
+# Build from source
+cargo install --git https://github.com/pproenca/agent-tui.git --path cli/crates/agent-tui
+```
+
+If you used the install script, ensure `~/.local/bin` is on your PATH.
+
+## Philosophy: Why Terminal Automation Is Different
+
+Terminal UIs are **stateless from the observer's perspective**. Unlike web browsers with a persistent DOM, terminal automation works with a constantly-refreshed character grid. This fundamental difference shapes everything:
+
+| Web Automation | Terminal Automation |
+|----------------|---------------------|
+| DOM persists across interactions | Screen buffer is redrawn constantly |
+| Selectors are stable | Text positions may shift |
+| Query once, act many times | Must re-verify before EVERY action |
+| Network events signal completion | Must detect visual stability |
+
+**The Core Insight**: agent-tui gives you vision without memory. Each screenshot is a fresh observation. Previous state means nothing after the UI changes. This isn't a limitation—it's the nature of terminal interaction.
+
+## Mental Model: The Feedback Loop
+
+Think of terminal automation as a **closed-loop control system**:
+
+```
+    ┌──────────────────────────────────────────────┐
+    │                                              │
+    ▼                                              │
+OBSERVE ──► DECIDE ──► ACT ──► WAIT ──► VERIFY ───┘
+   │                                        │
+   │                                        │
+   └─────── NEVER skip ◄────────────────────┘
+```
+
+**Each phase is mandatory.** Skipping verification is the #1 cause of flaky automation.
+
+### The "Fresh Eyes" Principle
+
+Every time you need to interact with the UI:
+
+1. **Take a fresh screenshot** — your previous one is now stale
+2. **Locate your target visually** — text positions may have changed
+3. **Verify the state** — the UI may have changed unexpectedly
+4. **Act only when stable** — animations and loading states cause failures
+
+This feels slower, but it's the only reliable approach. Optimistic reuse of stale state causes intermittent failures that are painful to debug.
+
+## Critical Rules (Non-Negotiable)
+
+> **RULE 1: Atomic Execution (No Pipelining)**
+> You are FORBIDDEN from chaining commands with `&&` (e.g., `type "x" && press Enter && wait`). Modals or UI updates can intercept your keystrokes. You MUST execute one atomic action, wait, screenshot, and verify before taking the next action in a new turn.
+
+> **RULE 2: Re-snapshot after EVERY action**
+> The UI state is invalidated by any change. Always take a fresh screenshot before acting again.
+
+> **RULE 3: Never act on unstable UI**
+> If the UI is animating, loading, or transitioning, `wait --stable` first. Acting during transitions because race conditions.
+
+> **RULE 4: Verify before claiming success**
+> Use `wait "expected text" --assert` to confirm outcomes. Don't assume an action worked—prove it.
+
+> **RULE 5: Error Recovery**
+> If a `wait` command times out, DO NOT blindly restart or kill the session. Execute `screenshot` to visually diagnose what unexpected UI element (modal, error dialog, lost focus) intercepted the flow.
+
+> **RULE 6: Clean up sessions**
+> Always end with `agent-tui kill`. Orphaned sessions consume resources and can interfere with future runs.
+
+## Decision Framework
+
+### Which Screenshot Mode?
+
+Use `screenshot --format json` when parsing automation output, or plain `screenshot` for human readable text.
+
+### How to Wait?
+
+```
+What are you waiting for?
+│
+├─► Specific text to appear
+│   └─► `wait "text" --assert` (fails if not found)
+│
+├─► Specific text to disappear
+│   └─► `wait "text" --gone --assert`
+│
+├─► UI to stop changing (animations, loading)
+│   └─► `wait --stable`
+│
+└─► Multiple conditions
+    └─► Chain waits sequentially
+```
+
+### How to Act?
+
+```
+What do you need to do?
+│
+├─► Type text into the terminal
+│   └─► `type "text"`
+│
+├─► Send keyboard shortcuts/navigation
+│   └─► `press Ctrl+C` or `press ArrowDown Enter`
+```
+
+## Core Workflow
+
+The canonical automation loop:
+
+```bash
+# 1. START: Launch the TUI app
+agent-tui run <command> [-- args...]
+
+# 2. OBSERVE: Get current UI state
+agent-tui screenshot --format json
+
+# 3. DECIDE: Based on text, determine next action
+# (This happens in your head/code)
+
+# 4. ACT: Execute the action
+agent-tui type "text"
+agent-tui press Enter
+
+# 5. WAIT: Synchronize with UI changes
+agent-tui wait "Expected" --assert    # or wait --stable
+
+# 6. VERIFY: Confirm the outcome (often combined with step 5)
+# If verification fails, handle the error
+
+# 7. REPEAT: Go back to step 2 until done
+
+# 8. CLEANUP: Always clean up
+agent-tui kill
+```
+
+## Anti-Patterns (What NOT to Do)
+
+### ❌ Acting During Animation/Loading
+
+```bash
+# WRONG: Acting immediately on dynamic UI
+agent-tui run my-app
+agent-tui screenshot --format json    # UI might still be loading!
+agent-tui type "value"                # ❌ Might miss the input field
+
+# RIGHT: Wait for stability first
+agent-tui run my-app
+agent-tui wait --stable               # Let UI settle
+agent-tui screenshot --format json    # Now it's reliable
+agent-tui type "value"
+```
+
+### ❌ Assuming Success Without Verification
+
+```bash
+# WRONG: Assuming the type worked
+agent-tui type "value"
+agent-tui press Enter
+# ...proceed as if success...       # ❌ What if it failed silently?
+
+# RIGHT: Verify the outcome
+agent-tui type "value"
+agent-tui press Enter
+agent-tui wait "Success" --assert    # ✓ Proves the action worked
+```
+
+### ❌ Skipping Cleanup
+
+```bash
+# WRONG: Forgetting to kill the session
+agent-tui run my-app
+# ...do stuff...
+# script ends                        # ❌ Session left running!
+
+# RIGHT: Always clean up
+agent-tui run my-app
+# ...do stuff...
+agent-tui kill                       # ✓ Clean exit
+```
+
+## Before You Start: Clarify Requirements
+
+Before automating any TUI, gather this information:
+
+1. **Command**: What exactly to run? (`my-app --flag` or `npm start`?)
+2. **Success criteria**: What text/state indicates success?
+3. **Input sequence**: What keystrokes/data to enter, in what order?
+4. **Safety**: Is it safe to submit forms, delete data, etc.?
+5. **Auth**: Does it need login? Test credentials?
+6. **Live preview**: Does the user want to watch? (`agent-tui live start --open`)
+
+If any of these are unclear, ask before running.
+
+## Demo Mode: Showing What agent-tui Can Do
+
+When a user asks what agent-tui is, wants a demo, or asks "show me how it works":
+
+1. **Don't explain—demonstrate.** Actions speak louder than words.
+2. **Use the live preview** so they can watch in real-time.
+3. **Run `top`**—it's universal and shows dynamic real-time updates.
+
+**Quick demo trigger phrases:**
+- "What is agent-tui?" / "What does agent-tui do?"
+- "Demo agent-tui" / "Show me agent-tui"
+- "How does agent-tui work?" / "See it in action"
+
+## Failure Recovery
+
+| Symptom | Diagnosis | Solution |
+|---------|-----------|----------|
+| "Text not found" | Stale view or text moved | Re-snapshot, locate text again |
+| Wait times out | UI didn't reach expected state | Check screenshot, verify expectations |
+| "Daemon not running" | Daemon crashed or not started | `agent-tui daemon start` |
+| Unexpected layout | Wrong terminal size | `agent-tui resize --cols 120 --rows 40` |
+| Session unresponsive | App crashed or hung | `agent-tui kill`, then re-run |
+| Repeated failures | Something fundamentally wrong | Stop after 3-5 attempts, ask user |
+
+## Self-Discovery: Use --help
+
+You don't need to memorize every flag. The CLI is self-documenting:
+
+```bash
+agent-tui --help                     # List all commands
+agent-tui run --help                 # Options for 'run'
+agent-tui screenshot --help          # Options for 'screenshot'
+agent-tui wait --help                # Options for 'wait'
+```
+
+**When in doubt, ask the CLI.** This skill teaches *when* and *why* to use commands. For exact flags and syntax, `--help` is authoritative.
+
+## Quick Reference
+
+```bash
+# Start app
+agent-tui run <cmd> [-- args]        # Launch TUI under control
+
+# Observe
+agent-tui screenshot                  # Plain text view
+agent-tui screenshot --format json    # Machine-readable output
+
+# Act
+agent-tui press Enter                 # Press key(s)
+agent-tui press Ctrl+C                # Keyboard shortcuts
+agent-tui type "text"                 # Type text
+
+# Wait/Verify
+agent-tui wait "text" --assert        # Wait for text, fail if not found
+agent-tui wait "text" --gone --assert # Wait for text to disappear
+agent-tui wait --stable               # Wait for UI to stop changing
+
+# Manage
+agent-tui sessions                    # List active sessions
+agent-tui live start --open           # Start live preview
+agent-tui kill                        # End current session
+```

.gemini/skills/async-pr-review/scripts/async-review.sh

@@ -1,190 +1,194 @@
 #!/bin/bash
 
 notify() {
-  local title="$1"
-  local message="$2"
-  local pr="$3"
+  local title="${1}"
+  local message="${2}"
+  local pr="${3}"
   # Terminal escape sequence
-  printf "\e]9;%s | PR #%s | %s\a" "$title" "$pr" "$message"
+  printf "\e]9;%s | PR #%s | %s\a" "${title}" "${pr}" "${message}"
   # Native macOS notification
-  if [[ "$(uname)" == "Darwin" ]]; then
-    osascript -e "display notification \"$message\" with title \"$title\" subtitle \"PR #$pr\""
+  os_type="$(uname || true)"
+  if [[ "${os_type}" == "Darwin" ]]; then
+    osascript -e "display notification \"${message}\" with title \"${title}\" subtitle \"PR #${pr}\""
   fi
 }
 
-pr_number=$1
-if [[ -z "$pr_number" ]]; then
+pr_number="${1}"
+if [[ -z "${pr_number}" ]]; then
   echo "Usage: async-review <pr_number>"
   exit 1
 fi
 
-base_dir=$(git rev-parse --show-toplevel 2>/dev/null)
-if [[ -z "$base_dir" ]]; then
+base_dir="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+if [[ -z "${base_dir}" ]]; then
   echo "❌ Must be run from within a git repository."
   exit 1
 fi
 
 # Use the repository's local .gemini/tmp directory for ephemeral worktrees and logs
-pr_dir="$base_dir/.gemini/tmp/async-reviews/pr-$pr_number"
-target_dir="$pr_dir/worktree"
-log_dir="$pr_dir/logs"
+pr_dir="${base_dir}/.gemini/tmp/async-reviews/pr-${pr_number}"
+target_dir="${pr_dir}/worktree"
+log_dir="${pr_dir}/logs"
 
-cd "$base_dir" || exit 1
+cd "${base_dir}" || exit 1
 
-mkdir -p "$log_dir"
-rm -f "$log_dir/setup.exit" "$log_dir/final-assessment.exit" "$log_dir/final-assessment.md"
+mkdir -p "${log_dir}"
+rm -f "${log_dir}/setup.exit" "${log_dir}/final-assessment.exit" "${log_dir}/final-assessment.md"
 
-echo "🧹 Cleaning up previous worktree if it exists..." | tee -a "$log_dir/setup.log"
-git worktree remove -f "$target_dir" >> "$log_dir/setup.log" 2>&1 || true
-git branch -D "gemini-async-pr-$pr_number" >> "$log_dir/setup.log" 2>&1 || true
-git worktree prune >> "$log_dir/setup.log" 2>&1 || true
+echo "🧹 Cleaning up previous worktree if it exists..." | tee -a "${log_dir}/setup.log"
+git worktree remove -f "${target_dir}" >> "${log_dir}/setup.log" 2>&1 || true
+git branch -D "gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1 || true
+git worktree prune >> "${log_dir}/setup.log" 2>&1 || true
 
-echo "📡 Fetching PR #$pr_number..." | tee -a "$log_dir/setup.log"
-if ! git fetch origin -f "pull/$pr_number/head:gemini-async-pr-$pr_number" >> "$log_dir/setup.log" 2>&1; then
-  echo 1 > "$log_dir/setup.exit"
-  echo "❌ Fetch failed. Check $log_dir/setup.log"
-  notify "Async Review Failed" "Fetch failed." "$pr_number"
+echo "📡 Fetching PR #${pr_number}..." | tee -a "${log_dir}/setup.log"
+if ! git fetch origin -f "pull/${pr_number}/head:gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1; then
+  echo 1 > "${log_dir}/setup.exit"
+  echo "❌ Fetch failed. Check ${log_dir}/setup.log"
+  notify "Async Review Failed" "Fetch failed." "${pr_number}"
   exit 1
 fi
 
-if [[ ! -d "$target_dir" ]]; then
-  echo "🧹 Pruning missing worktrees..." | tee -a "$log_dir/setup.log"
-  git worktree prune >> "$log_dir/setup.log" 2>&1
-  echo "🌿 Creating worktree in $target_dir..." | tee -a "$log_dir/setup.log"
-  if ! git worktree add "$target_dir" "gemini-async-pr-$pr_number" >> "$log_dir/setup.log" 2>&1; then
-    echo 1 > "$log_dir/setup.exit"
-    echo "❌ Worktree creation failed. Check $log_dir/setup.log"
-    notify "Async Review Failed" "Worktree creation failed." "$pr_number"
+if [[ ! -d "${target_dir}" ]]; then
+  echo "🧹 Pruning missing worktrees..." | tee -a "${log_dir}/setup.log"
+  git worktree prune >> "${log_dir}/setup.log" 2>&1
+  echo "🌿 Creating worktree in ${target_dir}..." | tee -a "${log_dir}/setup.log"
+  if ! git worktree add "${target_dir}" "gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1; then
+    echo 1 > "${log_dir}/setup.exit"
+    echo "❌ Worktree creation failed. Check ${log_dir}/setup.log"
+    notify "Async Review Failed" "Worktree creation failed." "${pr_number}"
     exit 1
   fi
 else
-  echo "🌿 Worktree already exists." | tee -a "$log_dir/setup.log"
+  echo "🌿 Worktree already exists." | tee -a "${log_dir}/setup.log"
 fi
-echo 0 > "$log_dir/setup.exit"
+echo 0 > "${log_dir}/setup.exit"
 
-cd "$target_dir" || exit 1
+cd "${target_dir}" || exit 1
 
-echo "🚀 Launching background tasks. Logs saving to: $log_dir"
+echo "🚀 Launching background tasks. Logs saving to: ${log_dir}"
 
 echo "  ↳ [1/5] Grabbing PR diff..."
-rm -f "$log_dir/pr-diff.exit"
-{ gh pr diff "$pr_number" > "$log_dir/pr-diff.diff" 2>&1; echo $? > "$log_dir/pr-diff.exit"; } &
+rm -f "${log_dir}/pr-diff.exit"
+{ gh pr diff "${pr_number}" > "${log_dir}/pr-diff.diff" 2>&1; echo $? > "${log_dir}/pr-diff.exit"; } &
 
 echo "  ↳ [2/5] Starting build and lint..."
-rm -f "$log_dir/build-and-lint.exit"
-{ { npm run clean && npm ci && npm run format && npm run build && npm run lint:ci && npm run typecheck; } > "$log_dir/build-and-lint.log" 2>&1; echo $? > "$log_dir/build-and-lint.exit"; } &
+rm -f "${log_dir}/build-and-lint.exit"
+{ { npm run clean && npm ci && npm run format && npm run build && npm run lint:ci && npm run typecheck; } > "${log_dir}/build-and-lint.log" 2>&1; echo $? > "${log_dir}/build-and-lint.exit"; } &
 
 # Dynamically resolve gemini binary (fallback to your nightly path)
-GEMINI_CMD=$(which gemini || echo "$HOME/.gcli/nightly/node_modules/.bin/gemini")
+GEMINI_CMD="$(command -v gemini || echo "${HOME}/.gcli/nightly/node_modules/.bin/gemini")"
+# shellcheck disable=SC2312
 POLICY_PATH="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/policy.toml"
 
 echo "  ↳ [3/5] Starting Gemini code review..."
-rm -f "$log_dir/review.exit"
-{ "$GEMINI_CMD" --policy "$POLICY_PATH" -p "/review-frontend $pr_number" > "$log_dir/review.md" 2>&1; echo $? > "$log_dir/review.exit"; } &
+rm -f "${log_dir}/review.exit"
+{ "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "/review-frontend ${pr_number}" > "${log_dir}/review.md" 2>&1; echo $? > "${log_dir}/review.exit"; } &
 
 echo "  ↳ [4/5] Starting automated tests (waiting for build and lint)..."
-rm -f "$log_dir/npm-test.exit"
+rm -f "${log_dir}/npm-test.exit"
 { 
-  while [ ! -f "$log_dir/build-and-lint.exit" ]; do sleep 1; done
-  if [ "$(cat "$log_dir/build-and-lint.exit")" == "0" ]; then
-    gh pr checks "$pr_number" > "$log_dir/ci-checks.log" 2>&1
+  while [[ ! -f "${log_dir}/build-and-lint.exit" ]]; do sleep 1; done
+  read -r build_exit < "${log_dir}/build-and-lint.exit" || build_exit=""
+  if [[ "${build_exit}" == "0" ]]; then
+    gh pr checks "${pr_number}" > "${log_dir}/ci-checks.log" 2>&1
     ci_status=$?
     
-    if [ "$ci_status" -eq 0 ]; then
-      echo "CI checks passed. Skipping local npm tests." > "$log_dir/npm-test.log"
-      echo 0 > "$log_dir/npm-test.exit"
-    elif [ "$ci_status" -eq 8 ]; then
-      echo "CI checks are still pending. Skipping local npm tests to avoid duplicate work. Please check GitHub for final results." > "$log_dir/npm-test.log"
-      echo 0 > "$log_dir/npm-test.exit"
+    if [[ "${ci_status}" -eq 0 ]]; then
+      echo "CI checks passed. Skipping local npm tests." > "${log_dir}/npm-test.log"
+      echo 0 > "${log_dir}/npm-test.exit"
+    elif [[ "${ci_status}" -eq 8 ]]; then
+      echo "CI checks are still pending. Skipping local npm tests to avoid duplicate work. Please check GitHub for final results." > "${log_dir}/npm-test.log"
+      echo 0 > "${log_dir}/npm-test.exit"
     else
-      echo "CI checks failed. Failing checks:" > "$log_dir/npm-test.log"
-      gh pr checks "$pr_number" --json name,bucket -q '.[] | select(.bucket=="fail") | .name' >> "$log_dir/npm-test.log" 2>&1
+      echo "CI checks failed. Failing checks:" > "${log_dir}/npm-test.log"
+      gh pr checks "${pr_number}" --json name,bucket -q '.[] | select(.bucket=="fail") | .name' >> "${log_dir}/npm-test.log" 2>&1
       
-      echo "Attempting to extract failing test files from CI logs..." >> "$log_dir/npm-test.log"
-      pr_branch=$(gh pr view "$pr_number" --json headRefName -q '.headRefName' 2>/dev/null)
-      run_id=$(gh run list --branch "$pr_branch" --workflow ci.yml --json databaseId -q '.[0].databaseId' 2>/dev/null)
+      echo "Attempting to extract failing test files from CI logs..." >> "${log_dir}/npm-test.log"
+      pr_branch="$(gh pr view "${pr_number}" --json headRefName -q '.headRefName' 2>/dev/null || true)"
+      run_id="$(gh run list --branch "${pr_branch}" --workflow ci.yml --json databaseId -q '.[0].databaseId' 2>/dev/null || true)"
       
       failed_files=""
-      if [[ -n "$run_id" ]]; then
-        failed_files=$(gh run view "$run_id" --log-failed 2>/dev/null | grep -o -E '(packages/[a-zA-Z0-9_-]+|integration-tests|evals)/[a-zA-Z0-9_/-]+\.test\.ts(x)?' | sort | uniq)
+      if [[ -n "${run_id}" ]]; then
+        failed_files="$(gh run view "${run_id}" --log-failed 2>/dev/null | grep -o -E '(packages/[a-zA-Z0-9_-]+|integration-tests|evals)/[a-zA-Z0-9_/-]+\.test\.ts(x)?' | sort | uniq || true)"
       fi
       
-      if [[ -n "$failed_files" ]]; then
-        echo "Found failing test files from CI:" >> "$log_dir/npm-test.log"
-        for f in $failed_files; do echo "  - $f" >> "$log_dir/npm-test.log"; done
-        echo "Running ONLY failing tests locally..." >> "$log_dir/npm-test.log"
+      if [[ -n "${failed_files}" ]]; then
+        echo "Found failing test files from CI:" >> "${log_dir}/npm-test.log"
+        for f in ${failed_files}; do echo "  - ${f}" >> "${log_dir}/npm-test.log"; done
+        echo "Running ONLY failing tests locally..." >> "${log_dir}/npm-test.log"
         
         exit_code=0
-        for file in $failed_files; do
-           if [[ "$file" == packages/* ]]; then
-             ws_dir=$(echo "$file" | cut -d'/' -f1,2)
+        for file in ${failed_files}; do
+           if [[ "${file}" == packages/* ]]; then
+             ws_dir="$(echo "${file}" | cut -d'/' -f1,2)"
            else
-             ws_dir=$(echo "$file" | cut -d'/' -f1)
+             ws_dir="$(echo "${file}" | cut -d'/' -f1)"
            fi
-           rel_file=${file#$ws_dir/}
+           rel_file="${file#"${ws_dir}"/}"
            
-           echo "--- Running $rel_file in workspace $ws_dir ---" >> "$log_dir/npm-test.log"
-           if ! npm run test:ci -w "$ws_dir" -- "$rel_file" >> "$log_dir/npm-test.log" 2>&1; then
+           echo "--- Running ${rel_file} in workspace ${ws_dir} ---" >> "${log_dir}/npm-test.log"
+           if ! npm run test:ci -w "${ws_dir}" -- "${rel_file}" >> "${log_dir}/npm-test.log" 2>&1; then
              exit_code=1
            fi
         done
-        echo $exit_code > "$log_dir/npm-test.exit"
+        echo "${exit_code}" > "${log_dir}/npm-test.exit"
       else
-        echo "Could not extract specific failing files. Skipping full local test suite as it takes too long. Please check CI logs manually." >> "$log_dir/npm-test.log"
-        echo 1 > "$log_dir/npm-test.exit"
+        echo "Could not extract specific failing files. Skipping full local test suite as it takes too long. Please check CI logs manually." >> "${log_dir}/npm-test.log"
+        echo 1 > "${log_dir}/npm-test.exit"
       fi
     fi
   else
-    echo "Skipped due to build-and-lint failure" > "$log_dir/npm-test.log"
-    echo 1 > "$log_dir/npm-test.exit"
+    echo "Skipped due to build-and-lint failure" > "${log_dir}/npm-test.log"
+    echo 1 > "${log_dir}/npm-test.exit"
   fi
 } &
 
 echo "  ↳ [5/5] Starting Gemini test execution (waiting for build and lint)..."
-rm -f "$log_dir/test-execution.exit"
+rm -f "${log_dir}/test-execution.exit"
 { 
-  while [ ! -f "$log_dir/build-and-lint.exit" ]; do sleep 1; done
-  if [ "$(cat "$log_dir/build-and-lint.exit")" == "0" ]; then
-    "$GEMINI_CMD" --policy "$POLICY_PATH" -p "Analyze the diff for PR $pr_number using 'gh pr diff $pr_number'. Instead of running the project's automated test suite (like 'npm test'), physically exercise the newly changed code in the terminal (e.g., by writing a temporary script to call the new functions, or testing the CLI command directly). Verify the feature's behavior works as expected. IMPORTANT: Do NOT modify any source code to fix errors. Just exercise the code and log the results, reporting any failures clearly. Do not ask for user confirmation." > "$log_dir/test-execution.log" 2>&1; echo $? > "$log_dir/test-execution.exit"
+  while [[ ! -f "${log_dir}/build-and-lint.exit" ]]; do sleep 1; done
+  read -r build_exit < "${log_dir}/build-and-lint.exit" || build_exit=""
+  if [[ "${build_exit}" == "0" ]]; then
+    "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "Analyze the diff for PR ${pr_number} using 'gh pr diff ${pr_number}'. Instead of running the project's automated test suite (like 'npm test'), physically exercise the newly changed code in the terminal (e.g., by writing a temporary script to call the new functions, or testing the CLI command directly). Verify the feature's behavior works as expected. IMPORTANT: Do NOT modify any source code to fix errors. Just exercise the code and log the results, reporting any failures clearly. Do not ask for user confirmation." > "${log_dir}/test-execution.log" 2>&1; echo $? > "${log_dir}/test-execution.exit"
   else
-    echo "Skipped due to build-and-lint failure" > "$log_dir/test-execution.log"
-    echo 1 > "$log_dir/test-execution.exit"
+    echo "Skipped due to build-and-lint failure" > "${log_dir}/test-execution.log"
+    echo 1 > "${log_dir}/test-execution.exit"
   fi
 } &
 
 echo "✅ All tasks dispatched!"
-echo "You can monitor progress with: tail -f $log_dir/*.log"
-echo "Read your review later at: $log_dir/review.md"
+echo "You can monitor progress with: tail -f ${log_dir}/*.log"
+echo "Read your review later at: ${log_dir}/review.md"
 
 # Polling loop to wait for all background tasks to finish
 tasks=("pr-diff" "build-and-lint" "review" "npm-test" "test-execution")
 log_files=("pr-diff.diff" "build-and-lint.log" "review.md" "npm-test.log" "test-execution.log")
 
 declare -A task_done
-for t in "${tasks[@]}"; do task_done[$t]=0; done
+for t in "${tasks[@]}"; do task_done[${t}]=0; done
 
 all_done=0
-while [[ $all_done -eq 0 ]]; do
+while [[ "${all_done}" -eq 0 ]]; do
   clear
   echo "=================================================="
-  echo "🚀 Async PR Review Status for PR #$pr_number"
+  echo "🚀 Async PR Review Status for PR #${pr_number}"
   echo "=================================================="
   echo ""
   
   all_done=1
   for i in "${!tasks[@]}"; do
-    t="${tasks[$i]}"
+    t="${tasks[${i}]}"
     
-    if [[ -f "$log_dir/$t.exit" ]]; then
-      exit_code=$(cat "$log_dir/$t.exit")
-      if [[ "$exit_code" == "0" ]]; then
-        echo "  ✅ $t: SUCCESS"
+    if [[ -f "${log_dir}/${t}.exit" ]]; then
+      read -r task_exit < "${log_dir}/${t}.exit" || task_exit=""
+      if [[ "${task_exit}" == "0" ]]; then
+        echo "  ✅ ${t}: SUCCESS"
       else
-        echo "  ❌ $t: FAILED (exit code $exit_code)"
+        echo "  ❌ ${t}: FAILED (exit code ${task_exit})"
       fi
-      task_done[$t]=1
+      task_done[${t}]=1
     else
-      echo "  ⏳ $t: RUNNING"
+      echo "  ⏳ ${t}: RUNNING"
       all_done=0
     fi
   done
@@ -195,47 +199,47 @@ while [[ $all_done -eq 0 ]]; do
   echo "=================================================="
   
   for i in "${!tasks[@]}"; do
-    t="${tasks[$i]}"
-    log_file="${log_files[$i]}"
+    t="${tasks[${i}]}"
+    log_file="${log_files[${i}]}"
     
-    if [[ ${task_done[$t]} -eq 0 ]]; then
-      if [[ -f "$log_dir/$log_file" ]]; then
+    if [[ "${task_done[${t}]}" -eq 0 ]]; then
+      if [[ -f "${log_dir}/${log_file}" ]]; then
         echo ""
-        echo "--- $t ---"
-        tail -n 5 "$log_dir/$log_file"
+        echo "--- ${t} ---"
+        tail -n 5 "${log_dir}/${log_file}"
       fi
     fi
   done
   
-  if [[ $all_done -eq 0 ]]; then
+  if [[ "${all_done}" -eq 0 ]]; then
     sleep 3
   fi
 done
 
 clear
 echo "=================================================="
-echo "🚀 Async PR Review Status for PR #$pr_number"
+echo "🚀 Async PR Review Status for PR #${pr_number}"
 echo "=================================================="
 echo ""
 for t in "${tasks[@]}"; do
-  exit_code=$(cat "$log_dir/$t.exit")
-  if [[ "$exit_code" == "0" ]]; then
-    echo "  ✅ $t: SUCCESS"
+  read -r task_exit < "${log_dir}/${t}.exit" || task_exit=""
+  if [[ "${task_exit}" == "0" ]]; then
+    echo "  ✅ ${t}: SUCCESS"
   else
-    echo "  ❌ $t: FAILED (exit code $exit_code)"
+    echo "  ❌ ${t}: FAILED (exit code ${task_exit})"
   fi
 done
 echo ""
 
 echo "⏳ Tasks complete! Synthesizing final assessment..."
-if ! "$GEMINI_CMD" --policy "$POLICY_PATH" -p "Read the review at $log_dir/review.md, the automated test logs at $log_dir/npm-test.log, and the manual test execution logs at $log_dir/test-execution.log. Summarize the results, state whether the build and tests passed based on $log_dir/build-and-lint.exit and $log_dir/npm-test.exit, and give a final recommendation for PR $pr_number." > "$log_dir/final-assessment.md" 2>&1; then
-  echo $? > "$log_dir/final-assessment.exit"
+if ! "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "Read the review at ${log_dir}/review.md, the automated test logs at ${log_dir}/npm-test.log, and the manual test execution logs at ${log_dir}/test-execution.log. Summarize the results, state whether the build and tests passed based on ${log_dir}/build-and-lint.exit and ${log_dir}/npm-test.exit, and give a final recommendation for PR ${pr_number}." > "${log_dir}/final-assessment.md" 2>&1; then
+  echo $? > "${log_dir}/final-assessment.exit"
   echo "❌ Final assessment synthesis failed!"
-  echo "Check $log_dir/final-assessment.md for details."
-  notify "Async Review Failed" "Final assessment synthesis failed." "$pr_number"
+  echo "Check ${log_dir}/final-assessment.md for details."
+  notify "Async Review Failed" "Final assessment synthesis failed." "${pr_number}"
   exit 1
 fi
 
-echo 0 > "$log_dir/final-assessment.exit"
-echo "✅ Final assessment complete! Check $log_dir/final-assessment.md"
-notify "Async Review Complete" "Review and test execution finished successfully." "$pr_number"
+echo 0 > "${log_dir}/final-assessment.exit"
+echo "✅ Final assessment complete! Check ${log_dir}/final-assessment.md"
+notify "Async Review Complete" "Review and test execution finished successfully." "${pr_number}"

.gemini/skills/async-pr-review/scripts/check-async-review.sh

@@ -1,22 +1,22 @@
 #!/bin/bash
-pr_number=$1
+pr_number="${1}"
 
-if [[ -z "$pr_number" ]]; then
+if [[ -z "${pr_number}" ]]; then
   echo "Usage: check-async-review <pr_number>"
   exit 1
 fi
 
-base_dir=$(git rev-parse --show-toplevel 2>/dev/null)
-if [[ -z "$base_dir" ]]; then
+base_dir="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+if [[ -z "${base_dir}" ]]; then
   echo "❌ Must be run from within a git repository."
   exit 1
 fi
 
-log_dir="$base_dir/.gemini/tmp/async-reviews/pr-$pr_number/logs"
+log_dir="${base_dir}/.gemini/tmp/async-reviews/pr-${pr_number}/logs"
 
-if [[ ! -d "$log_dir" ]]; then
+if [[ ! -d "${log_dir}" ]]; then
   echo "STATUS: NOT_FOUND"
-  echo "❌ No logs found for PR #$pr_number in $log_dir"
+  echo "❌ No logs found for PR #${pr_number} in ${log_dir}"
   exit 0
 fi
 
@@ -34,32 +34,32 @@ all_done=true
 echo "STATUS: CHECKING"
 
 for task_info in "${tasks[@]}"; do
-  IFS="|" read -r task_name log_file <<< "$task_info"
+  IFS="|" read -r task_name log_file <<< "${task_info}"
   
-  file_path="$log_dir/$log_file"
-  exit_file="$log_dir/$task_name.exit"
+  file_path="${log_dir}/${log_file}"
+  exit_file="${log_dir}/${task_name}.exit"
 
-  if [[ -f "$exit_file" ]]; then
-    exit_code=$(cat "$exit_file")
-    if [[ "$exit_code" == "0" ]]; then
-      echo "✅ $task_name: SUCCESS"
+  if [[ -f "${exit_file}" ]]; then
+    read -r exit_code < "${exit_file}" || exit_code=""
+    if [[ "${exit_code}" == "0" ]]; then
+      echo "✅ ${task_name}: SUCCESS"
     else
-      echo "❌ $task_name: FAILED (exit code $exit_code)"
-      echo "   Last lines of $file_path:"
-      tail -n 3 "$file_path" | sed 's/^/      /'
+      echo "❌ ${task_name}: FAILED (exit code ${exit_code})"
+      echo "   Last lines of ${file_path}:"
+      tail -n 3 "${file_path}" | sed 's/^/      /' || true
     fi
-  elif [[ -f "$file_path" ]]; then
-    echo "⏳ $task_name: RUNNING"
+  elif [[ -f "${file_path}" ]]; then
+    echo "⏳ ${task_name}: RUNNING"
     all_done=false
   else
-    echo "➖ $task_name: NOT STARTED"
+    echo "➖ ${task_name}: NOT STARTED"
     all_done=false
   fi
 done
 
-if $all_done; then
+if [[ "${all_done}" == "true" ]]; then
   echo "STATUS: COMPLETE"
-  echo "LOG_DIR: $log_dir"
+  echo "LOG_DIR: ${log_dir}"
 else
   echo "STATUS: IN_PROGRESS"
-fi
+fi

.gemini/skills/behavioral-evals/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: behavioral-evals
+description: Guidance for creating, running, fixing, and promoting behavioral evaluations. Use when verifying agent decision logic, debugging failures, debugging prompt steering, or adding workspace regression tests.
+---
+
+# Behavioral Evals
+
+## Overview
+
+Behavioral evaluations (evals) are tests that validate the **agent's decision-making** (e.g., tool choice) rather than pure functionality. They are critical for verifying prompt changes, debugging steerability, and preventing regressions.
+
+> [!NOTE]
+> **Single Source of Truth**: For core concepts, policies, running tests, and general best practices, always refer to **[evals/README.md](file:///Users/abhipatel/code/gemini-cli/docs/evals/README.md)**.
+
+---
+
+## 🔄 Workflow Decision Tree
+
+1.  **Does a prompt/tool change need validation?**
+    *   *No* -> Normal integration tests.
+    *   *Yes* -> Continue below.
+2.  **Is it UI/Interaction heavy?**
+    *   *Yes* -> Use `appEvalTest` (`AppRig`). See **[creating.md](references/creating.md)**.
+    *   *No* -> Use `evalTest` (`TestRig`). See **[creating.md](references/creating.md)**.
+3.  **Is it a new test?**
+    *   *Yes* -> Set policy to `USUALLY_PASSES`.
+    *   *No* -> `ALWAYS_PASSES` (locks in regression).
+4.  **Are you fixing a failure or promoting a test?**
+    *   *Fixing* -> See **[fixing.md](references/fixing.md)**.
+    *   *Promoting* -> See **[promoting.md](references/promoting.md)**.
+
+---
+
+## 📋 Quick Checklist
+
+### 1. Setup Workspace
+Seed the workspace with necessary files using the `files` object to simulate a realistic scenario (e.g., NodeJS project with `package.json`).
+*   *Details in **[creating.md](references/creating.md)***
+
+### 2. Write Assertions
+Audit agent decisions using `rig.setBreakpoint()` (AppRig only) or index verification on `rig.readToolLogs()`.
+*   *Details in **[creating.md](references/creating.md)***
+
+### 3. Verify
+Run single tests locally with Vitest. Confirm stability locally before relying on CI workflows.
+*   *See **[evals/README.md](file:///Users/abhipatel/code/gemini-cli/docs/evals/README.md)** for running commands.*
+
+---
+
+## 📦 Bundled Resources
+
+Detailed procedural guides:
+*   **[creating.md](references/creating.md)**: Assertion strategies, Rig selection, Mock MCPs.
+*   **[fixing.md](references/fixing.md)**: Step-by-step automated investigation, architecture diagnosis guidelines.
+*   **[promoting.md](references/promoting.md)**: Candidate identification criteria and threshold guidelines.
+

.gemini/skills/behavioral-evals/assets/interactive_eval.ts.txt

@@ -0,0 +1,27 @@
+import { describe, expect } from 'vitest';
+import { appEvalTest } from './app-test-helper.js';
+
+describe('interactive_feature', () => {
+  // New tests MUST start as USUALLY_PASSES
+  appEvalTest('USUALLY_PASSES', {
+    name: 'should pause for user confirmation',
+    files: {
+      'package.json': JSON.stringify({ name: 'app' })
+    },
+    prompt: 'Task description here requiring approval',
+    timeout: 60000, 
+    setup: async (rig) => {
+      // ⚠️ Breakpoints are ONLY safe in appEvalTest
+      rig.setBreakpoint(['ask_user']);
+    },
+    assert: async (rig) => {
+      // 1. Wait for the breakpoint to trigger
+      const confirmation = await rig.waitForPendingConfirmation('ask_user');
+      expect(confirmation).toBeDefined();
+
+      // 2. Resolve it so the test can finish
+      await rig.resolveTool(confirmation);
+      await rig.waitForIdle();
+    },
+  });
+});

.gemini/skills/behavioral-evals/assets/standard_eval.ts.txt

@@ -0,0 +1,30 @@
+import { describe, expect } from 'vitest';
+import { evalTest } from './test-helper.js';
+
+describe('core_feature', () => {
+  // New tests MUST start as USUALLY_PASSES
+  evalTest('USUALLY_PASSES', {
+    name: 'should perform expected agent action',
+    setup: async (rig) => {
+      // For mocking offline MCP:
+      // rig.addMockMcpServer('workspace-server', 'google-workspace');
+    },
+    files: {
+      'src/app.ts': '// some code',
+    },
+    prompt: 'Task description here',
+    timeout: 60000, // 1 minute safety limit
+    assert: async (rig, result) => {
+      // 1. Audit the trajectory (Safe for standard evalTest)
+      const logs = rig.readToolLogs();
+      const hasTool = logs.some((l) => l.toolRequest.name === 'read_file');
+      expect(hasTool, 'Agent should have read the file').toBe(true);
+
+      // 2. Assert efficiency (Cost/Turn)
+      expect(logs.length).toBeLessThan(5);
+
+      // 3. Assert final output
+      expect(result).toContain('Expected Keyword');
+    },
+  });
+});

.gemini/skills/behavioral-evals/references/creating.md

@@ -0,0 +1,151 @@
+# Creating Behavioral Evals
+
+## 🔬 Rig Selection
+
+| Rig Type          | Import From            | Architecture                                                         | Use When                                                                                              |
+| :---------------- | :--------------------- | :------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------- |
+| **`evalTest`**    | `./test-helper.js`     | **Subprocess**. Runs the CLI in a separate process + waits for exit. | Standard workspace tests. **Do not use `setBreakpoint`**; auditing history (`readToolLogs`) is safer. |
+| **`appEvalTest`** | `./app-test-helper.js` | **In-Process**. Runs directly inside the runner loop.                | UI/Ink rendering. Safe for `setBreakpoint` triggers.                                                  |
+
+---
+
+## 🏗️ Scenario Design
+
+Evals must simulate realistic agent environments to effectively test
+decision-making.
+
+- **Workspace State**: Seed with standard project anchors if testing general
+  capabilities:
+  - `package.json` for NodeJS environments.
+  - Minimal configuration files (`tsconfig.json`, `GEMINI.md`).
+- **Structural Complexity**: Provide enough files to force the agent to _search_
+  or _navigate_, rather than giving the answer directly. Avoid trivial one-file
+  tests unless testing exact prompt steering.
+
+---
+
+## ❌ Fail First Principle
+
+Before asserting a new capability or locking in a fix, **verify that the test
+fails first**.
+
+- It is easy to accidentally write an eval that asserts behaviors that are
+  already met or pass by default.
+- **Process**: reproduce failure with test -> apply fix (prompt/tool) -> verify
+  test passes.
+
+---
+
+## ✋ Testing Patterns
+
+### 1. Breakpoints
+
+Verifies the agent _intends_ to use a tool BEFORE executing it. Useful for
+interactive prompts or safety checks.
+
+```typescript
+// ⚠️ Only works with appEvalTest (AppRig)
+setup: async (rig) => {
+  rig.setBreakpoint(['ask_user']);
+},
+assert: async (rig) => {
+  const confirmation = await rig.waitForPendingConfirmation('ask_user');
+  expect(confirmation).toBeDefined();
+}
+```
+
+### 2. Tool Confirmation Race
+
+When asserting multiple triggers (e.g., "enters plan mode then asks question"):
+
+```typescript
+assert: async (rig) => {
+  let confirmation = await rig.waitForPendingConfirmation([
+    'enter_plan_mode',
+    'ask_user',
+  ]);
+
+  if (confirmation?.name === 'enter_plan_mode') {
+    rig.acceptConfirmation('enter_plan_mode');
+    confirmation = await rig.waitForPendingConfirmation('ask_user');
+  }
+  expect(confirmation?.toolName).toBe('ask_user');
+};
+```
+
+### 3. Audit Tool Logs
+
+Audit exact operations to ensure efficiency (e.g., no redundant reads).
+
+```typescript
+assert: async (rig, result) => {
+  await rig.waitForTelemetryReady();
+  const toolLogs = rig.readToolLogs();
+
+  const writeCall = toolLogs.find(
+    (log) => log.toolRequest.name === 'write_file',
+  );
+  expect(writeCall).toBeDefined();
+};
+```
+
+### 4. Mock MCP Facades
+
+To evaluate tools connected via MCP without hitting live endpoints, load a mock
+server configuration in the `setup` hook.
+
+```typescript
+setup: async (rig) => {
+  rig.addMockMcpServer('workspace-server', 'google-workspace');
+},
+assert: async (rig) => {
+  await rig.waitForTelemetryReady();
+  const toolLogs = rig.readToolLogs();
+  const workspaceCall = toolLogs.find(
+    (log) => log.toolRequest.name === 'mcp_workspace-server_docs.getText'
+  );
+  expect(workspaceCall).toBeDefined();
+};
+```
+
+---
+
+## ⚠️ Safety & Efficiency Guardrails
+
+### 1. Breakpoint Deadlocks
+
+Breakpoints (`setBreakpoint`) pause execution. In standard `evalTest`,
+`rig.run()` waits for the process to exit _before_ assertions run. **This will
+hang indefinitely.**
+
+- **Use Breakpoints** for `appEvalTest` or interactive simulations.
+- **Use Audit Tool Logs** (above) for standard trajectory tests.
+
+### 2. Runaway Timeout
+
+Always set a budget boundary in the `EvalCase` to prevent runaway loops on
+quota:
+
+```typescript
+evalTest('USUALLY_PASSES', {
+  name: '...',
+  timeout: 60000, // 1 minute safety limit
+  // ...
+});
+```
+
+### 3. Efficiency Assertion (Turn limits)
+
+Check if a tool is called _early_ using index checks:
+
+```typescript
+assert: async (rig) => {
+  const toolLogs = rig.readToolLogs();
+  const toolCallIndex = toolLogs.findIndex(
+    (log) => log.toolRequest.name === 'cli_help',
+  );
+
+  expect(toolCallIndex).toBeGreaterThan(-1);
+  expect(toolCallIndex).toBeLessThan(5); // Called within first 5 turns
+};
+```

.gemini/skills/behavioral-evals/references/fixing.md

@@ -0,0 +1,100 @@
+# Fixing Behavioral Evals
+
+Use this guide when asked to debug, troubleshoot, or fix a failing behavioral
+evaluation.
+
+---
+
+## 1. 🔍 Investigate
+
+1.  **Fetch Nightly Results**: Use the `gh` CLI to inspect the latest run from
+    `evals-nightly.yml` if applicable.
+    - _Example view URL_:
+      `https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml`
+2.  **Isolate**: DO NOT push changes or start remote runs. Confine investigation
+    to the local workspace.
+3.  **Read Logs**:
+    - Eval logs live in `evals/logs/<test_name>.log`.
+    - Enable verbose debugging via `export GEMINI_DEBUG_LOG_FILE="debug.log"`.
+4.  **Diagnose**: Audit tool logs and telemetry. Note if due to setup/assert.
+    - **Tip**: Proactively add custom logging/diagnostics to check hypotheses.
+
+---
+
+## 2. 🛠️ Fix Strategy
+
+1.  **Targeted Location**: Locate the test case and the corresponding
+    prompt/code.
+2.  **Iterative Scope**: Make extreme change first to verify scope, then refine
+    to a minimal, targeted change.
+3.  **Assertion Fidelity**:
+    - Changing the test prompt is a **last resort** (prompts are often vague by
+      design).
+    - **Warning**: Do not lose test fidelity by making prompts too direct/easy.
+    - **Primary Fix Trigger**: Adjust tool descriptions, system prompts
+      (`snippets.ts`), or **modules that contribute to the prompt template**.
+    - Fixes should generally try to improve the prompt
+      `@packages/core/src/prompts/snippets.ts` first.
+    - **Instructional Generality**: Changes to the system prompt should aim to
+      be as general as possible while still accomplishing the goal. Specificity
+      should be added only as needed.
+      - **Principle**: Instead of creating "forbidden lists" for specific syntax
+        (e.g., "Don't use `Object.create()`"), formulate a broader engineering
+        principle that covers the underlying issue (e.g., "Prioritize explicit
+        composition over hidden prototype manipulation"). This improves
+        steerability across a wider range of similar scenarios.
+      - _Low Specificity_: "Follow ecosystem best practices"
+      - _Medium Specificity_: "Utilize OOP and functional best practices, as
+        applicable"
+      - _High Specificity_: Provide ecosystem-specific hints as examples of a
+        broader principle rather than direct instructions. e.g., "NEVER use
+        hacks like bypassing the type system or employing 'hidden' logic (e.g.:
+        reflection, prototype manipulation). Instead, use explicit and idiomatic
+        language features (e.g.: type guards, explicit class instantiation, or
+        object spread) that maintain structural integrity."
+    - **Prompt Simplification**: Once the test is passing, use `ask_user` to
+      determine if prompt simplification is desired.
+      - **Criteria**: Simplification should be attempted only if there are
+        related clauses that can be de-duplicated or reparented under a single
+        heading.
+      - **Verification**: As part of simplification, you MUST identify and run
+        any behavioral eval tests that might be affected by the changes to
+        ensure no regressions are introduced.
+    - Test fixes should not "cheat" by changing a test's `GEMINI.md` file or by
+      updating the test's prompt to instruct it to not repro the bug.
+    - **Warning**: Prompts have multiple configurations; ensure your fix targets
+      the correct config for the model in question.
+4.  **Architecture Options**: If prompt or instruction tuning triggers no
+    improvement, analyze loop composition.
+    - **AgentLoop**: Defined by `context + toolset + prompt`.
+    - **Enhancements**: Loops perform best with direct prompts, fewer irrelevant
+      tools, low goal density, and minimal low-value/irrelevant context.
+    - **Modifications**: Compose subagents or isolate tools. Ground in observed
+      traces.
+    - **Warning**: Think deeply before offering recommendations; avoid parroting
+      abstract design guidelines.
+
+---
+
+## 3. ✅ Verify
+
+1.  **Run Local**: Run Vitest in non-interactive mode on just the file.
+2.  **Log Audit**: Prioritize diagnosing failures via log comparison before
+    triggering heavy test runs.
+3.  **Stability Limit**: Run the test **3 times** locally on key models (can use
+    scripts to run in parallel for speed):
+    - **Gemini 3.0**
+    - **Gemini 3 Flash**
+    - **Gemini 2.5 Pro**
+4.  **Flakiness Rule**: If it passes 2/3 times, it may be inherent noise
+    difficult to improve without a structural split.
+
+---
+
+## 4. 📊 Report
+
+Provide a summary of:
+
+- Test success rate for each tested model (e.g., 3/3 = 100%).
+- Root cause identification and fix explanation.
+- If unfixed, provide high-confidence architecture recommendations.

.gemini/skills/behavioral-evals/references/promoting.md

@@ -0,0 +1,55 @@
+# Promoting Behavioral Evals
+
+Use this guide when asked to analyze nightly results and promote incubated tests
+to stable suites.
+
+---
+
+## 1. 🔍 Investigate candidates
+
+1.  **Audit Nightly Logs**: Use the `gh` CLI to fetch results from
+    `evals-nightly.yml` (Direct URL:
+    `https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml`).
+    - **Tip**: The aggregate summary from the most recent run integrates the
+      last 7 runs of history automatically.
+    - **Safety**: DO NOT push changes or start remote runs. All verification is
+      local.
+2.  **Assess Stability**: Identify tests that pass **100% of the time** across
+    ALL enabled models over the **last 7 nightly runs** in a row.
+    - _100% means the test passed 3/3 times for every model and run._
+3.  **Promotion Targets**: Tests meeting this criteria are candidates for
+    promotion from `USUALLY_PASSES` to `ALWAYS_PASSES`.
+
+---
+
+## 2. 🚥 Promotion Steps
+
+1.  **Locate File**: Locate the eval file in the `evals/` directory.
+2.  **Update Policy**: Modify the policy argument to `ALWAYS_PASSES`.
+    ```typescript
+    evalTest('ALWAYS_PASSES', { ... })
+    ```
+3.  **Targeting**: Follow guidelines in `evals/README.md` regarding stable suite
+    organization.
+4.  **Constraint**: Your final change must be **minimal and targeted** strictly
+    to promoting the test status. Do not refactor the test or setup fixtures.
+
+---
+
+## 3. ✅ Verify
+
+1.  **Run Prompted Tests**: Run the promoted test locally using non-interactive
+    Vitest to confirm structure validity.
+2.  **Verify Suite Inclusion**: Check that the test is successfully picked up by
+    standard runnable ranges.
+
+---
+
+## 4. 📊 Report
+
+Provide a summary of:
+
+- Which tests were promoted.
+- Provide the success rate evidence (e.g., 7/7 runs passed for all models).
+- If no candidates qualified, list the next closest candidates and their current
+  pass rate.

.gemini/skills/behavioral-evals/references/running.md

@@ -0,0 +1,95 @@
+# Running & Promoting Evals
+
+## 🛠️ Prerequisites
+
+Behavioral evals run against the compiled binary. You **must** build and bundle
+the project first after making changes:
+
+```bash
+npm run build && npm run bundle
+```
+
+---
+
+## 🏃‍♂️ Running Tests
+
+### 1. Configure Environment Variables
+
+Evals require a standard API key. If your `.env` file has multiple keys or
+comments, use this precise extraction setup:
+
+```bash
+export GEMINI_API_KEY=$(grep '^GEMINI_API_KEY=' .env | cut -d '=' -f2) && RUN_EVALS=1 npx vitest run --config evals/vitest.config.ts <file_name>
+```
+
+### 2. Commands
+
+| Command                             | Scope           | Description                                        |
+| :---------------------------------- | :-------------- | :------------------------------------------------- |
+| `npm run test:always_passing_evals` | `ALWAYS_PASSES` | Fast feedback, runs in CI.                         |
+| `npm run test:all_evals`            | All             | Runs nightly incubation tests. Sets `RUN_EVALS=1`. |
+
+### Target Specific File
+
+_Note: `RUN_EVALS=1` is required for incubated (`USUALLY_PASSES`) tests._
+
+```bash
+RUN_EVALS=1 npx vitest run --config evals/vitest.config.ts my_feature.eval.ts
+```
+
+---
+
+## 🐞 Debugging and Logs
+
+If a test fails, verify:
+
+- **Tool Trajectory Logs**:序列 of calls in `evals/logs/<test_name>.log`.
+- **Verbose Reasoning**: Capture raw buffer traces by setting
+  `GEMINI_DEBUG_LOG_FILE`:
+  ```bash
+  export GEMINI_DEBUG_LOG_FILE="debug.log"
+  ```
+
+---
+
+### 🎯 Verify Model Targeting
+
+- **Tip:** Standard evals benchmark against model variations. If a test passes
+  on Flash but fails on Pro (or vice versa), the issue is usually in the **tool
+  description**, not the prompt definition. Flash is sensitive to "instruction
+  bloat," while Pro is sensitive to "ambiguous intent."
+
+---
+
+## 🚥 deflaking & Promotion
+
+To maintain CI stability, all new evals follow a strict incubation period.
+
+### 1. Incubation (`USUALLY_PASSES`)
+
+New tests must be created with the `USUALLY_PASSES` policy.
+
+```typescript
+evalTest('USUALLY_PASSES', { ... })
+```
+
+They run in **Evals: Nightly** workflows and do not block PR merges.
+
+### 2. Investigate Failures
+
+If a nightly eval regresses, investigate via agent:
+
+```bash
+gemini /fix-behavioral-eval [optional-run-uri]
+```
+
+### 3. Promotion (`ALWAYS_PASSES`)
+
+Once a test scores 100% consistency over multiple nightly cycles:
+
+```bash
+gemini /promote-behavioral-eval
+```
+
+_Do not promote manually._ The command verifies trajectory logs before updating
+the file policy.

.gemini/skills/ci/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: ci
+description:
+  A specialized skill for Gemini CLI that provides high-performance, fail-fast
+  monitoring of GitHub Actions workflows and automated local verification of CI
+  failures. It handles run discovery automatically—simply provide the branch name.
+---
+
+# CI Replicate & Status
+
+This skill enables the agent to efficiently monitor GitHub Actions, triage
+failures, and bridge remote CI errors to local development. It defaults to
+**automatic replication** of failures to streamline the fix cycle.
+
+## Core Capabilities
+
+- **Automatic Replication**: Automatically monitors CI and immediately executes 
+  suggested test or lint commands locally upon failure.
+- **Real-time Monitoring**: Aggregated status line for all concurrent workflows
+  on the current branch.
+- **Fail-Fast Triage**: Immediately stops on the first job failure to provide a
+  structured report.
+
+## Workflow
+
+### 1. CI Replicate (`replicate`) - DEFAULT
+Use this as the primary path to monitor CI and **automatically** replicate 
+failures locally for immediate triage and fixing.
+- **Behavior**: When this workflow is triggered, the agent will monitor the CI
+  and **immediately and automatically execute** all suggested test or lint
+  commands (marked with 🚀) as soon as a failure is detected. 
+- **Tool**: `node .gemini/skills/ci/scripts/ci.mjs [branch]`
+- **Discovery**: The script **automatically** finds the latest active or recent
+  run for the branch. Do NOT manually search for run IDs.
+- **Goal**: Reproduce the failure locally without manual intervention, then
+  proceed to analyze and fix the code.
+
+### 1. CI Status (`status`)
+Use this when you have pushed changes and need to monitor the CI and reproduce
+any failures locally.
+- **Tool**: `node .gemini/skills/ci/scripts/ci.mjs [branch] [run_id]`
+- **Discovery**: The script **automatically** finds the latest active or recent
+  run for the branch. You should NOT manually search for \`run_id\` using \`gh run list\`
+  unless a specific historical run is requested. Simply provide the branch name.
+- **Step 1 (Monitor)**: Execute the tool with the branch name.
+- **Step 2 (Extract)**: Extract suggested \`npm test\` or \`npm run lint\` commands
+  from the output (marked with 🚀).
+- **Step 3 (Reproduce)**: Execute those commands locally to confirm the failure.
+- **Behavior**: It will poll every 15 seconds. If it detects a failure, it will
+  exit with a structured report and provide the exact commands to run locally.
+
+## Failure Categories & Actions
+
+- **Test Failures**: Agent should run the specific `npm test -w <pkg> -- <path>`
+  command suggested.
+- **Lint Errors**: Agent should run `npm run lint:all` or the specific package
+  lint command.
+- **Build Errors**: Agent should check `tsc` output or build logs to resolve
+  compilation issues.
+- **Job Errors**: Investigate `gh run view --job <job_id> --log` for
+  infrastructure or setup failures.
+
+## Noise Filtering
+The underlying scripts automatically filter noise (Git logs, NPM warnings, stack
+trace overhead). The agent should focus on the "Structured Failure Report"
+provided by the tool.

.gemini/skills/ci/scripts/ci.mjs

@@ -0,0 +1,281 @@
+#!/usr/bin/env node
+
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { execSync } from 'node:child_process';
+
+const BRANCH =
+  process.argv[2] || execSync('git branch --show-current').toString().trim();
+const RUN_ID_OVERRIDE = process.argv[3];
+
+let REPO;
+try {
+  const remoteUrl = execSync('git remote get-url origin').toString().trim();
+  REPO = remoteUrl
+    .replace(/.*github\.com[\/:]/, '')
+    .replace(/\.git$/, '')
+    .trim();
+} catch (e) {
+  REPO = 'google-gemini/gemini-cli';
+}
+
+const FAILED_FILES = new Set();
+
+function runGh(args) {
+  try {
+    return execSync(`gh ${args}`, {
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).toString();
+  } catch (e) {
+    return null;
+  }
+}
+
+function fetchFailuresViaApi(jobId) {
+  try {
+    const cmd = `gh api repos/${REPO}/actions/jobs/${jobId}/logs | grep -iE " FAIL |❌|ERROR|Lint failed|Build failed|Exception|failed with exit code"`;
+    return execSync(cmd, {
+      stdio: ['ignore', 'pipe', 'ignore'],
+      maxBuffer: 10 * 1024 * 1024,
+    }).toString();
+  } catch (e) {
+    return '';
+  }
+}
+
+function isNoise(line) {
+  const lower = line.toLowerCase();
+  return (
+    lower.includes('* [new branch]') ||
+    lower.includes('npm warn') ||
+    lower.includes('fetching updates') ||
+    lower.includes('node:internal/errors') ||
+    lower.includes('at ') || // Stack traces
+    lower.includes('checkexecsyncerror') ||
+    lower.includes('node_modules')
+  );
+}
+
+function extractTestFile(failureText) {
+  const cleanLine = failureText
+    .replace(/[|#\[\]()]/g, ' ')
+    .replace(/<[^>]*>/g, ' ')
+    .trim();
+  const fileMatch = cleanLine.match(/([\w\/._-]+\.test\.[jt]sx?)/);
+  if (fileMatch) return fileMatch[1];
+  return null;
+}
+
+function generateTestCommand(failedFilesMap) {
+  const workspaceToFiles = new Map();
+  for (const [file, info] of failedFilesMap.entries()) {
+    if (
+      ['Job Error', 'Unknown File', 'Build Error', 'Lint Error'].includes(file)
+    )
+      continue;
+    let workspace = '@google/gemini-cli';
+    let relPath = file;
+    if (file.startsWith('packages/core/')) {
+      workspace = '@google/gemini-cli-core';
+      relPath = file.replace('packages/core/', '');
+    } else if (file.startsWith('packages/cli/')) {
+      workspace = '@google/gemini-cli';
+      relPath = file.replace('packages/cli/', '');
+    }
+    relPath = relPath.replace(/^.*packages\/[^\/]+\//, '');
+    if (!workspaceToFiles.has(workspace))
+      workspaceToFiles.set(workspace, new Set());
+    workspaceToFiles.get(workspace).add(relPath);
+  }
+  const commands = [];
+  for (const [workspace, files] of workspaceToFiles.entries()) {
+    commands.push(`npm test -w ${workspace} -- ${Array.from(files).join(' ')}`);
+  }
+  return commands.join(' && ');
+}
+
+async function monitor() {
+  let targetRunIds = [];
+  if (RUN_ID_OVERRIDE) {
+    targetRunIds = [RUN_ID_OVERRIDE];
+  } else {
+    // 1. Get runs directly associated with the branch
+    const runListOutput = runGh(
+      `run list --branch "${BRANCH}" --limit 10 --json databaseId,status,workflowName,createdAt`,
+    );
+    if (runListOutput) {
+      const runs = JSON.parse(runListOutput);
+      const activeRuns = runs.filter((r) => r.status !== 'completed');
+      if (activeRuns.length > 0) {
+        targetRunIds = activeRuns.map((r) => r.databaseId);
+      } else if (runs.length > 0) {
+        const latestTime = new Date(runs[0].createdAt).getTime();
+        targetRunIds = runs
+          .filter((r) => latestTime - new Date(r.createdAt).getTime() < 60000)
+          .map((r) => r.databaseId);
+      }
+    }
+
+    // 2. Get runs associated with commit statuses (handles chained/indirect runs)
+    try {
+      const headSha = execSync(`git rev-parse "${BRANCH}"`).toString().trim();
+      const statusOutput = runGh(
+        `api repos/${REPO}/commits/${headSha}/status -q '.statuses[] | select(.target_url | contains("actions/runs/")) | .target_url'`,
+      );
+      if (statusOutput) {
+        const statusRunIds = statusOutput
+          .split('\n')
+          .filter(Boolean)
+          .map((url) => {
+            const match = url.match(/actions\/runs\/(\d+)/);
+            return match ? parseInt(match[1], 10) : null;
+          })
+          .filter(Boolean);
+
+        for (const runId of statusRunIds) {
+          if (!targetRunIds.includes(runId)) {
+            targetRunIds.push(runId);
+          }
+        }
+      }
+    } catch (e) {
+      // Ignore if branch/SHA not found or API fails
+    }
+
+    if (targetRunIds.length > 0) {
+      const runNames = [];
+      for (const runId of targetRunIds) {
+        const runInfo = runGh(`run view "${runId}" --json workflowName`);
+        if (runInfo) {
+          runNames.push(JSON.parse(runInfo).workflowName);
+        }
+      }
+      console.log(`Monitoring workflows: ${[...new Set(runNames)].join(', ')}`);
+    }
+  }
+
+  if (targetRunIds.length === 0) {
+    console.log(`No runs found for branch ${BRANCH}.`);
+    process.exit(0);
+  }
+
+  while (true) {
+    let allPassed = 0,
+      allFailed = 0,
+      allRunning = 0,
+      allQueued = 0,
+      totalJobs = 0;
+    let anyRunInProgress = false;
+    const fileToTests = new Map();
+    let failuresFoundInLoop = false;
+
+    for (const runId of targetRunIds) {
+      const runOutput = runGh(
+        `run view "${runId}" --json databaseId,status,conclusion,workflowName`,
+      );
+      if (!runOutput) continue;
+      const run = JSON.parse(runOutput);
+      if (run.status !== 'completed') anyRunInProgress = true;
+
+      const jobsOutput = runGh(`run view "${runId}" --json jobs`);
+      if (jobsOutput) {
+        const { jobs } = JSON.parse(jobsOutput);
+        totalJobs += jobs.length;
+        const failedJobs = jobs.filter((j) => j.conclusion === 'failure');
+        if (failedJobs.length > 0) {
+          failuresFoundInLoop = true;
+          for (const job of failedJobs) {
+            const failures = fetchFailuresViaApi(job.databaseId);
+            if (failures.trim()) {
+              failures.split('\n').forEach((line) => {
+                if (!line.trim() || isNoise(line)) return;
+                const file = extractTestFile(line);
+                const filePath =
+                  file ||
+                  (line.toLowerCase().includes('lint')
+                    ? 'Lint Error'
+                    : line.toLowerCase().includes('build')
+                      ? 'Build Error'
+                      : 'Unknown File');
+                let testName = line;
+                if (line.includes(' > ')) {
+                  testName = line.split(' > ').slice(1).join(' > ').trim();
+                }
+                if (!fileToTests.has(filePath))
+                  fileToTests.set(filePath, new Set());
+                fileToTests.get(filePath).add(testName);
+              });
+            } else {
+              const step =
+                job.steps?.find((s) => s.conclusion === 'failure')?.name ||
+                'unknown';
+              const category = step.toLowerCase().includes('lint')
+                ? 'Lint Error'
+                : step.toLowerCase().includes('build')
+                  ? 'Build Error'
+                  : 'Job Error';
+              if (!fileToTests.has(category))
+                fileToTests.set(category, new Set());
+              fileToTests
+                .get(category)
+                .add(`${job.name}: Failed at step "${step}"`);
+            }
+          }
+        }
+        for (const job of jobs) {
+          if (job.status === 'in_progress') allRunning++;
+          else if (job.status === 'queued') allQueued++;
+          else if (job.conclusion === 'success') allPassed++;
+          else if (job.conclusion === 'failure') allFailed++;
+        }
+      }
+    }
+
+    if (failuresFoundInLoop) {
+      console.log(
+        `\n\n❌ Failures detected across ${allFailed} job(s). Stopping monitor...`,
+      );
+      console.log('\n--- Structured Failure Report (Noise Filtered) ---');
+      for (const [file, tests] of fileToTests.entries()) {
+        console.log(`\nCategory/File: ${file}`);
+        // Limit output per file if it's too large
+        const testsArr = Array.from(tests).map((t) =>
+          t.length > 500 ? t.substring(0, 500) + '... [TRUNCATED]' : t,
+        );
+        testsArr.slice(0, 10).forEach((t) => console.log(`  - ${t}`));
+        if (testsArr.length > 10)
+          console.log(`  ... and ${testsArr.length - 10} more`);
+      }
+      const testCmd = generateTestCommand(fileToTests);
+      if (testCmd) {
+        console.log('\n🚀 Run this to verify fixes:');
+        console.log(testCmd);
+      } else if (
+        Array.from(fileToTests.keys()).some((k) => k.includes('Lint'))
+      ) {
+        console.log('\n🚀 Run this to verify lint fixes:\nnpm run lint:all');
+      }
+      console.log('---------------------------------');
+      process.exit(1);
+    }
+
+    const completed = allPassed + allFailed;
+    process.stdout.write(
+      `\r⏳ Monitoring ${targetRunIds.length} runs... ${completed}/${totalJobs} jobs (${allPassed} passed, ${allFailed} failed, ${allRunning} running, ${allQueued} queued)          `,
+    );
+    if (!anyRunInProgress) {
+      console.log('\n✅ All workflows passed!');
+      process.exit(0);
+    }
+    await new Promise((r) => setTimeout(r, 15000));
+  }
+}
+
+monitor().catch((err) => {
+  console.error('\nMonitor error:', err.message);
+  process.exit(1);
+});

.gemini/skills/docs-changelog/SKILL.md

@@ -162,5 +162,7 @@ instructions for the other section.
 
 ## Finalize
 
-- After making changes, run `npm run format` ONLY to ensure consistency.
+- After making changes, if `npm run format` fails, it may be necessary to run
+  `npm install` first to ensure all formatting dependencies are available.
+  Then, run `npm run format` to ensure consistency.
 - Delete any temporary files created during the process.

.gemini/skills/docs-writer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docs-writer
 description:
-  Always use this skill when the task involves writing, reviewing, or editing 
+  Always use this skill when the task involves writing, reviewing, or editing
   files in the `/docs` directory or any `.md` files in the repository.
 ---
 
@@ -24,7 +24,7 @@ approach.
 
 - **Perspective and tense:** Address the reader as "you." Use active voice and
   present tense (e.g., "The API returns...").
-- **Tone:** Professional, friendly, and direct. 
+- **Tone:** Professional, friendly, and direct.
 - **Clarity:** Use simple vocabulary. Avoid jargon, slang, and marketing hype.
 - **Global Audience:** Write in standard US English. Avoid idioms and cultural
   references.
@@ -47,8 +47,8 @@ Write precisely to ensure your instructions are unambiguous.
   "foo" or "bar."
 - **Quota and limit terminology:** For any content involving resource capacity
   or using the word "quota" or "limit", strictly adhere to the guidelines in
-  the `quota-limit-style-guide.md` resource file. Generally, Use "quota" for the
-  administrative bucket and "limit" for the numerical ceiling.
+  the `quota-limit-style-guide.md` resource file. Generally, Use "quota" for
+  the administrative bucket and "limit" for the numerical ceiling.
 
 ### Formatting and syntax
 Apply consistent formatting to make documentation visually organized and
@@ -65,35 +65,85 @@ accessible.
 - **UI and code:** Use **bold** for UI elements and `code font` for filenames,
   snippets, commands, and API elements. Focus on the task when discussing
   interaction.
-- **Links:** Use descriptive anchor text; avoid "click here." Ensure the link
-  makes sense out of context.
 - **Accessibility:** Use semantic HTML elements correctly (headings, lists, 
   tables).
 - **Media:** Use lowercase hyphenated filenames. Provide descriptive alt text
   for all images.
+- **Details section:** Use the `<details>` tag to create a collapsible section.
+  This is useful for supplementary or data-heavy information that isn't critical
+  to the main flow.
+
+  Example:
+
+  <details>
+  <summary>Title</summary>
+
+  - First entry
+  - Second entry
+
+  </details>
+
+- **Callouts**: Use GitHub-flavored markdown alerts to highlight important
+  information. To ensure the formatting is preserved by `npm run format`, place
+  an empty line, then a prettier ignore comment directly before the callout
+  block. Use `<!-- prettier-ignore -->` for standard Markdown files (`.md`) and
+  `{/* prettier-ignore */}` for MDX files (`.mdx`). The callout type (`[!TYPE]`)
+  should be on the first line, followed by a newline, and then the content, with
+  each subsequent line of content starting with `>`. Available types are `NOTE`,
+  `TIP`, `IMPORTANT`, `WARNING`, and `CAUTION`.
+
+  Example (.md):
+
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is an example of a multi-line note that will be preserved
+> by Prettier.
+
+  Example (.mdx):
+
+{/* prettier-ignore */}
+> [!NOTE]
+> This is an example of a multi-line note that will be preserved
+> by Prettier.
+
+### Links
+- **Accessibility:** Use descriptive anchor text; avoid "click here." Ensure the
+  link makes sense out of context, such as when being read by a screen reader.
+- **Use relative links in docs:** Use relative links in documentation (`/docs/`)
+  to ensure portability. Use paths relative to the current file's directory
+  (for example, `../tools/` from `docs/cli/`). Do not include the `/docs/`
+  section of a path, but do verify that the resulting relative link exists. This
+  does not apply to meta files such as README.MD and CONTRIBUTING.MD.
+- **When changing headings, check for deep links:** If a user is changing a
+  heading, check for deep links to that heading in other pages and update
+  accordingly.
 
 ### Structure
 - **BLUF:** Start with an introduction explaining what to expect.
 - **Experimental features:** If a feature is clearly noted as experimental,
-add the following note immediately after the introductory paragraph:
-  `> **Note:** This is a preview feature currently under active development.`
+  add the following note immediately after the introductory paragraph:
+
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is an experimental feature currently under active development.
+(Note: Use `{/* prettier-ignore */}` if editing an `.mdx` file.)
+
 - **Headings:** Use hierarchical headings to support the user journey.
-- **Procedures:** 
+- **Procedures:**
   - Introduce lists of steps with a complete sentence.
   - Start each step with an imperative verb.
   - Number sequential steps; use bullets for non-sequential lists.
   - Put conditions before instructions (e.g., "On the Settings page, click...").
   - Provide clear context for where the action takes place.
   - Indicate optional steps clearly (e.g., "Optional: ...").
-- **Elements:** Use bullet lists, tables, notes (`> **Note:**`), and warnings 
-  (`> **Warning:**`).
+- **Elements:** Use bullet lists, tables, details, and callouts.
 - **Avoid using a table of contents:** If a table of contents is present, remove
   it.
 - **Next steps:** Conclude with a "Next steps" section if applicable.
 
 ## Phase 2: Preparation
 Before modifying any documentation, thoroughly investigate the request and the
-surrounding context. 
+surrounding context.
 
 1.  **Clarify:** Understand the core request. Differentiate between writing new
     content and editing existing content. If the request is ambiguous (e.g.,
@@ -104,6 +154,8 @@ surrounding context.
 4.  **Connect:** Identify all referencing pages if changing behavior. Check if
     `docs/sidebar.json` needs updates.
 5.  **Plan:** Create a step-by-step plan before making changes.
+6.  **Audit Docset:** If asked to audit the documentation, follow the procedural
+    guide in [docs-auditing.md](./references/docs-auditing.md).
 
 ## Phase 3: Execution
 Implement your plan by either updating existing files or creating new ones
@@ -116,7 +168,7 @@ documentation.
 
 - **Gaps:** Identify areas where the documentation is incomplete or no longer
   reflects existing code.
-- **Structure:** Apply "Structure (New Docs)" rules (BLUF, headings, etc.) when 
+- **Structure:** Apply "Structure (New Docs)" rules (BLUF, headings, etc.) when
   adding new sections to existing pages.
 - **Headers**: If you change a header, you must check for links that lead to
   that header and update them.
@@ -126,17 +178,17 @@ documentation.
 - **Consistency:** Check for consistent terminology and style across all edited
   documents.
 
-
 ## Phase 4: Verification and finalization
-Perform a final quality check to ensure that all changes are correctly formatted
-and that all links are functional.
+Perform a final quality check to ensure that all changes are correctly
+formatted and that all links are functional.
 
 1.  **Accuracy:** Ensure content accurately reflects the implementation and
   technical behavior.
 2.  **Self-review:** Re-read changes for formatting, correctness, and flow.
-3.  **Link check:** Verify all new and existing links leading to or from modified
-    pages. If you changed a header, ensure that any links that lead to it are
-    updated.
-4.  **Format:** Once all changes are complete, ask to execute `npm run format`
-    to ensure consistent formatting across the project. If the user confirms,
-    execute the command.
+3.  **Link check:** Verify all new and existing links leading to or from
+    modified pages. If you changed a header, ensure that any links that lead to
+    it are updated.
+4.  **Format:** If `npm run format` fails, it may be necessary to run `npm
+    install` first to ensure all formatting dependencies are available. Once all
+    changes are complete, ask to execute `npm run format` to ensure consistent
+    formatting across the project. If the user confirms, execute the command.

.gemini/skills/docs-writer/references/docs-auditing.md

@@ -0,0 +1,195 @@
+# Procedural Guide: Auditing the Docset
+
+This guide outlines the process for auditing the Gemini CLI documentation for
+correctness and adherence to style guidelines. This process involves both an
+"Editor" and "Technical Writer" phase.
+
+## Objective
+
+To ensure all public-facing documentation is accurate, up-to-date, adheres to
+the Gemini CLI documentation style guide, and reflects the current state of the
+codebase.
+
+## Phase 1: Editor Audit
+
+**Role:** The editor is responsible for identifying potential issues based on
+style guide violations and technical inaccuracies.
+
+### Steps
+
+1.  **Identify Documentation Scope:**
+    - Read `docs/sidebar.json` to get a list of all viewable documentation
+      pages.
+    - For each entry with a `slug`, convert it into a file path (e.g., `docs` ->
+      `docs/index.md`, `docs/get-started` -> `docs/get-started.md`). Ignore
+      entries with `link` properties.
+
+2.  **Prepare Audit Results File:**
+    - Create a new Markdown file named `audit-results-[YYYY-MM-DD].md` (e.g.,
+      `audit-results-2026-03-13.md`). This file will contain all identified
+      violations and recommendations.
+
+3.  **Retrieve Style Guidelines:**
+    - Familiarize yourself with the `docs-writer` skill instructions and the
+      included style guidelines.
+
+4.  **Audit Each Document:**
+    - For each documentation file identified in Step 1, read its content.
+    - **Review against Style Guide:**
+      - **Voice and Tone Violations:**
+        - **Unprofessional Tone:** Identify phrasing that is overly casual,
+          defensive, or lacks a professional and friendly demeanor.
+        - **Indirectness or Vagueness:** Identify sentences that are
+          unnecessarily wordy or fail to be concise and direct.
+        - **Incorrect Pronoun:** Identify any use of third-person pronouns
+          (e.g., "we," "they," "the user") when referring to the reader, instead
+          of the second-person pronoun **"you"**.
+        - **Passive Voice:** Identify sentences written in the passive voice.
+        - **Incorrect Tense:** Identify the use of past or future tense verbs,
+          instead of the **present tense**.
+        - **Poor Vocabulary:** Identify the use of jargon, slang, or overly
+          informal language.
+      - **Language and Grammar Violations:**
+        - **Lack of Conciseness:** Identify unnecessarily long phrases or
+          sentences.
+        - **Punctuation Errors:** Identify incorrect or missing punctuation.
+        - **Ambiguous Dates:** Identify dates that could be misinterpreted
+          (e.g., "next Monday" instead of "April 15, 2026").
+        - **Abbreviation Usage:** Identify the use of abbreviations that should
+          be spelled out (e.g., "e.g." instead of "for example").
+        - **Terminology:** Check for incorrect or inconsistent use of
+          product-specific terms (e.g., "quota" vs. "limit").
+      - **Formatting and Syntax Violations:**
+        - **Missing Overview:** Check for the absence of a brief overview
+          paragraph at the start of the document.
+        - **Line Length:** Identify any lines of text that exceed **80
+          characters** (text wrap violation).
+        - **Casing:** Identify incorrect casing for headings, titles, or named
+          entities (e.g., product names like `Gemini CLI`).
+        - **List Formatting:** Identify incorrectly formatted lists (e.g.,
+          inconsistent indentation or numbering).
+        - **Incorrect Emphasis:** Identify incorrect use of bold text (should
+          only be used for UI elements) or code font (should be used for code,
+          file names, or command-line input).
+        - **Link Quality:** Identify links with non-descriptive anchor text
+          (e.g., "click here").
+        - **Image Alt Text:** Identify images with missing or poor-quality
+          (non-descriptive) alt text.
+      - **Structure Violations:**
+        - **Missing BLUF:** Check for the absence of a "Bottom Line Up Front"
+          summary at the start of complex sections or documents.
+        - **Experimental Feature Notes:** Identify experimental features that
+          are not clearly labeled with a standard note.
+        - **Heading Hierarchy:** Check for skipped heading levels (e.g., going
+          from `##` to `####`).
+        - **Procedure Clarity:** Check for procedural steps that do not start
+          with an imperative verb or where a condition is placed _after_ the
+          instruction.
+        - **Element Misuse:** Identify the incorrect or inappropriate use of
+          special elements (e.g., Notes, Warnings, Cautions).
+        - **Table of Contents:** Identify the presence of a dynamically
+          generated or manually included table of contents.
+        - **Missing Next Steps:** Check for procedural documents that lack a
+          "Next steps" section (if applicable).
+    - **Verify Code Accuracy (if applicable):**
+      - If the document contains code snippets (e.g., shell commands, API calls,
+        file paths, Docker image versions), use `grep_search` and `read_file`
+        within the `packages/` directory (or other relevant parts of the
+        codebase) to ensure the code is still accurate and up-to-date. Pay close
+        attention to version numbers, package names, and command syntax.
+    - **Record Findings:** For each **violation** or inaccuracy found:
+      - Note the file path.
+      - Describe the violation (e.g., "Violation (Language and Grammar): Uses
+        'e.g.'").
+      - Provide a clear and actionable recommendation to correct the issue.
+        (e.g., "Recommendation: Replace 'e.g.' with 'for example'." or
+        "Recommendation: Replace '...' with '...' in active voice.).
+      - Append these findings to `audit-results-[YYYY-MM-DD].md`.
+
+## Phase 2: Software Engineer Audit
+
+**Role:** The software engineer is responsible for finding undocumented features
+by auditing the codebase and recent changelogs, and passing these findings to
+the technical writer.
+
+### Steps
+
+1.  **Proactive Codebase Audit:**
+    - Audit high-signal areas of the codebase to identify undocumented features.
+      You MUST review:
+      - `packages/cli/src/commands/`
+      - `packages/core/src/tools/`
+      - `packages/cli/src/config/settings.ts`
+
+2.  **Review Recent Updates:**
+    - Check recent changelogs in stable and announcements within the
+      documentation to see if newly introduced features are documented properly.
+
+3.  **Evaluate and Record Findings:**
+    - Determine if these features are adequately covered in the docs. They do
+      not need to be documented word for word, but major features that customers
+      should care about probably should have an article.
+    - Append your findings to the `audit-results-[YYYY-MM-DD].md` file,
+      providing a brief description of the feature and where it should be
+      documented.
+
+## Phase 3: Technical Writer Implementation
+
+**Role:** The technical writer handles input from both the editor and the
+software engineer, makes appropriate decisions about what to change, and
+implements the approved changes.
+
+### Steps
+
+1.  **Review Audit Results:**
+    - Read `audit-results-[YYYY-MM-DD].md` to understand all identified issues,
+      undocumented features, and recommendations from both the Editor and
+      Software Engineer phases.
+
+2.  **Make Decisions and Log Reasoning:**
+    - Create or update an implementation log (e.g.,
+      `audit-implementation-log-[YYYY-MM-DD].md`).
+    - Make sure the logs are updated for all steps, documenting your reasoning
+      for each recommendation (why it was accepted, modified, or rejected). This
+      is required for a final check by a human in the PR.
+
+3.  **Implement Changes:**
+    - For each approved recommendation:
+      - Read the target documentation file.
+      - Apply the recommended change using the `replace` tool. Pay close
+        attention to `old_string` for exact matches, including whitespace and
+        newlines. For multiple occurrences of the same simple string (e.g.,
+        "e.g."), use `allow_multiple: true`.
+      - **String replacement safeguards:** When applying these fixes across the
+        docset, you must verify the following:
+        - **Preserve Code Blocks:** Explicitly verify that no code blocks,
+          inline code snippets, terminal commands, or file paths have been
+          erroneously capitalized or modified.
+        - **Preserve Literal Strings:** Never alter the wording of literal error
+          messages, UI quotes, or system logs. For example, if a style rule says
+          to remove the word "please", you must NOT remove it if it appears
+          inside a quoted error message (e.g.,
+          `Error: Please contact your administrator`).
+        - **Verify Sentence Casing:** When removing filler words (like "please")
+          from the beginning of a sentence or list item, always verify that the
+          new first word of the sentence is properly capitalized.
+      - For structural changes (e.g., adding an overview paragraph), use
+        `replace` or `write_file` as appropriate.
+      - For broken links, determine the correct new path or update the link
+        text.
+      - For creating new files (e.g., `docs/get-started.md` to fix a broken
+        link, or a new feature article), use `write_file`.
+
+4.  **Execute Auto-Generation Scripts:**
+    - Some documentation pages are auto-generated from the codebase and should
+      be updated using npm scripts rather than manual edits. After implementing
+      manual changes (especially if you edited settings or configurations based
+      on SWE recommendations), ensure you run:
+      - `npm run docs:settings` to generate/update the configuration reference.
+      - `npm run docs:keybindings` to generate/update the keybindings reference.
+
+5.  **Format Code:**
+    - **Dependencies:** If `npm run format` fails, it may be necessary to run
+      `npm install` first to ensure all formatting dependencies are available.
+    - After all changes have been implemented, run `npm run format` to ensure
+      consistent formatting across the project.

.gemini/skills/review-duplication/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: review-duplication
+description: Use this skill during code reviews to proactively investigate the codebase for duplicated functionality, reinvented wheels, or failure to reuse existing project best practices and shared utilities.
+---
+
+# Review Duplication
+
+## Overview
+
+This skill provides a structured workflow for investigating a codebase during a code review to identify duplicated logic, reinvented utilities, and missed opportunities to reuse established patterns. By executing this workflow, you ensure that new code integrates seamlessly with the existing project architecture.
+
+## Workflow: Investigating for Duplication
+
+When reviewing code, perform the following steps before finalizing your review:
+
+### 1. Extract Core Logic
+Analyze the new code to identify the core algorithms, utility functions, generic data structures, or UI components being introduced. Look beyond the specific business logic to see the underlying mechanics.
+
+### 2. Hypothesize Existing Locations & Trace Dependencies
+Think about where this type of code *would* live if it already existed in the project. Provide absolute paths from the repo root to disambiguate.
+- **Utilities:** `packages/core/src/utils/`, `packages/cli/src/utils/`
+- **UI Components:** `packages/cli/src/ui/components/`, `packages/cli/src/ui/`
+- **Services:** `packages/core/src/services/`, `packages/cli/src/services/`
+- **Configuration:** `packages/core/src/config/`, `packages/cli/src/config/`
+- **Core Logic:** Call out `packages/core/` if functionality does not appear React UI specific.
+
+**Trace Third-Party Dependencies:** If the PR introduces a new import for a utility library (e.g., `lodash.merge`, `date-fns`), trace how and where the project currently uses that library. There is likely an existing wrapper or shared utility.
+
+**Check Package Files:** Before flagging a custom implementation of a complex algorithm, check `package.json` to see if a standard library (like `lodash` or `uuid`) is already installed that provides this functionality.
+
+### 3. Investigate the Codebase (Sub-Agent Delegation)
+Delegate the heavy lifting of codebase investigation to specialized sub-agents. They are optimized to perform deep searches and semantic mapping without bloating your session history.
+
+To ensure a comprehensive review, you MUST formulate highly specific objectives for the sub-agents, providing them with the "scents" you discovered in Step 1.
+
+- **Codebase Investigator:** Use the `codebase_investigator` as your primary researcher. When delegating, formulate an objective that asks specific, investigative questions about the codebase, explicitly including these search vectors:
+  - **Structural Similarity:** Ask if existing code uses the same underlying APIs (e.g., "Does any existing code use `Intl.DateTimeFormat` or `setTimeout` for similar purposes?").
+  - **Naming Conventions:** Ask if there are existing symbols with similar naming patterns (e.g., "Are there existing symbols with naming patterns like `*Format*` or `*Debounce*`?").
+  - **Comments & Documentation:** Ask if keywords from the PR's comments or JSDoc exist in describing similar behavior elsewhere.
+  - **Architectural Fit:** Ask where this type of logic is currently centralized (e.g., "Where is centralized date formatting logic located?").
+  - **Refactoring Guidance:** Crucially, ask the sub-agent to explain *how* the new code could be refactored to use any existing logic it finds.
+- **Generalist Agent:** Use the `generalist` for detailed, turn-intensive comparisons. For example: "Review the implementation of `MyNewComponent` in the PR and compare it semantically against all components in `packages/ui/src`. Are there any existing components that could be extended or used instead?"
+- **Retain Fast Path for Simple Searches:** For extremely simple, unambiguous checks (e.g., "Does `package.json` include `lodash`?"), perform a direct search to save time. Default to delegation for any open-ended "investigations."
+
+### 4. Evaluate Best Practices
+Check if the new code aligns with the project's established conventions.
+- **Error Handling:** Does it use the project's standard error classes or logging mechanisms?
+- **State Management:** Does it bypass established stores or contexts?
+- **Styling:** Does it hardcode colors or spacing instead of using theme variables?
+If the PR introduces a new pattern, compare it against the documented standards and explicitly confirm if an existing project pattern should have been used instead.
+
+### 5. Formulate Constructive Feedback
+If you discover that the PR duplicates existing functionality or ignores a best practice:
+- Provide a clear review comment.
+- **Identify the Source:** Explicitly mention the absolute or project-relative file path and the specific symbol (function, component, class) that should be reused.
+- **Implementation Guidance:** Provide a brief code snippet or a clear explanation showing **how** to integrate the existing code to fulfill the task's requirements.
+- **Explain the Value:** Briefly explain why reusing the existing code is beneficial (e.g., maintainability, consistency, built-in edge case handling).
+
+Example comment:
+> "It looks like this PR introduces a new `formatDate` utility. We already have a robust, tested `formatDate` function in `src/utils/dateHelpers.ts`. 
+>
+> You can replace your implementation by importing it like this:
+> ```typescript
+> import { formatDate } from '../utils/dateHelpers';
+> 
+> // Then use it here:
+> const displayDate = formatDate(userDate, 'MMM Do, YYYY');
+> ```
+> Reusing this ensures that the date formatting remains consistent with the rest of the application and handles timezone conversions correctly."

.gemini/skills/tui-tester/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: tui-tester
+description: Expert guidance for testing Gemini CLI behavior and visual output using terminal automation.
+---
+
+# TUI Tester Skill
+
+This skill provides the operational manual for verifying Gemini CLI behavioral changes and visual output using terminal automation.
+
+## Core Responsibilities
+
+- **Verify Behavior**: Confirm that code changes result in the expected terminal interactions.
+- **Visual Validation**: Ensure the TUI renders correctly across different terminal sizes and states.
+- **Regression Testing**: Use automation to prevent breaking existing interactive workflows.
+
+## Critical Protocol
+
+When performing TUI testing, you must adhere to these strict rules:
+
+### 1. Initialization
+**YOUR ABSOLUTE FIRST ACTION MUST BE:**
+Activate the `agent-tui` skill. This provides the underlying tools needed for terminal automation.
+
+### 2. Environment Setup (macOS / Parallel Safe)
+Ensure the global daemon is running and the live preview is open:
+```bash
+if ! agent-tui sessions >/dev/null 2>&1; then
+  tmux kill-session -t agent-tui 2>/dev/null || true
+  agent-tui daemon stop 2>/dev/null || true
+  rm -f /tmp/agent-tui*
+  tmux new-session -d -s agent-tui 'agent-tui daemon start --foreground > /tmp/agent-tui-daemon.log 2>&1'
+  sleep 1
+fi
+agent-tui live start --open
+```
+
+### 3. Session Management
+- **Session IDs**: Always use the `session_id` returned by `agent-tui run` for subsequent interactions.
+- **Atomic Execution**: Execute exactly one command per turn. Do not pipeline actions.
+- **The Loop**: Action -> Wait -> Screenshot -> Verify -> Next Action.
+
+### 4. Gemini CLI Specifics
+- **Build First**: Always run `npm run build` or `npm run build:all` before testing local changes.
+- **Bypass Trust**: Set `GEMINI_CLI_TRUST_WORKSPACE=true` to avoid focus-stealing modals.
+- **Isolate Config**: Use `GEMINI_CLI_HOME` to prevent interference with your personal settings.
+
+## Workflow Example
+
+```bash
+# Start the CLI
+env GEMINI_CLI_TRUST_WORKSPACE=true agent-tui run node packages/cli/dist/index.js
+
+# Wait for the prompt
+agent-tui wait "│" --assert
+
+# Send a command
+agent-tui type "/help"
+agent-tui press Enter
+
+# Verify output
+agent-tui wait "Available Commands" --assert
+```
+
+## Error Recovery
+If a wait times out, take a fresh screenshot to diagnose the state. If you see `os error 61`, restart the daemon using the tmux method.

.geminiignore

@@ -0,0 +1,2 @@
+packages/core/src/services/scripts/*.exe
+gha-creds-*.json

.github/ISSUE_TEMPLATE/website_issue.yml

@@ -1,7 +1,9 @@
 name: 'Website issue'
 description: 'Report an issue with the Gemini CLI Website and Gemini CLI Extensions Gallery'
+title: 'GeminiCLI.com Feedback: [ISSUE]'
 labels:
   - 'area/extensions'
+  - 'area/documentation'
 body:
   - type: 'markdown'
     attributes:

.github/actions/calculate-vars/action.yml

@@ -14,12 +14,6 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    - name: 'Print inputs'
-      shell: 'bash'
-      env:
-        JSON_INPUTS: '${{ toJSON(inputs) }}'
-      run: 'echo "$JSON_INPUTS"'
-
     - name: 'Set vars for simplified logic'
       id: 'set_vars'
       shell: 'bash'

.github/actions/create-pull-request/action.yml

@@ -30,11 +30,6 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: '📝 Print Inputs'
-      shell: 'bash'
-      env:
-        JSON_INPUTS: '${{ toJSON(inputs) }}'
-      run: 'echo "$JSON_INPUTS"'
     - name: 'Creates a Pull Request'
       if: "inputs.dry-run != 'true'"
       env:

.github/actions/download-mac-binaries/action.yml

@@ -0,0 +1,23 @@
+name: 'Download Mac Binaries'
+description: 'Downloads the unsigned macOS binaries (x64 and arm64)'
+inputs:
+  path:
+    description: 'The base path to download the binaries to'
+    required: true
+    default: 'dist'
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Download macOS arm64 binary'
+      uses: 'actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806' # ratchet:actions/download-artifact@v4
+      continue-on-error: true
+      with:
+        name: 'gemini-darwin-arm64-unsigned'
+        path: '${{ inputs.path }}/darwin-arm64'
+
+    - name: 'Download macOS x64 binary'
+      uses: 'actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806' # ratchet:actions/download-artifact@v4
+      continue-on-error: true
+      with:
+        name: 'gemini-darwin-x64-unsigned'
+        path: '${{ inputs.path }}/darwin-x64'

.github/actions/post-coverage-comment/action.yml

@@ -27,11 +27,6 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: '📝 Print Inputs'
-      shell: 'bash'
-      env:
-        JSON_INPUTS: '${{ toJSON(inputs) }}'
-      run: 'echo "$JSON_INPUTS"'
     - name: 'Prepare Coverage Comment'
       id: 'prep_coverage_comment'
       shell: 'bash'

.github/actions/publish-release/action.yml

@@ -75,12 +75,6 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: '📝 Print Inputs'
-      shell: 'bash'
-      env:
-        JSON_INPUTS: '${{ toJSON(inputs) }}'
-      run: 'echo "$JSON_INPUTS"'
-
     - name: '👤 Configure Git User'
       working-directory: '${{ inputs.working-directory }}'
       shell: 'bash'
@@ -114,13 +108,14 @@ runs:
         BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
         DRY_RUN: '${{ inputs.dry-run }}'
         RELEASE_TAG: '${{ inputs.release-tag }}'
+        GIT_PUSH_TOKEN: '${{ inputs.github-release-token || inputs.github-token }}'
       run: |-
         set -e
         git add package.json package-lock.json packages/*/package.json
         git commit -m "chore(release): ${RELEASE_TAG}"
         if [[ "${DRY_RUN}" == "false" ]]; then
           echo "Pushing release branch to remote..."
-          git push --set-upstream origin "${BRANCH_NAME}" --follow-tags
+          git push "https://x-access-token:${GIT_PUSH_TOKEN}@github.com/${{ github.repository }}.git" "HEAD:${BRANCH_NAME}" --follow-tags
         else
           echo "Dry run enabled. Skipping push."
         fi
@@ -172,10 +167,13 @@ runs:
       shell: 'bash'
       run: |
         npm publish \
+          --ignore-scripts \
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_CORE_PACKAGE_NAME}" \
-          --no-tag
-        npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} false --silent
+          --tag staging-tmp
+        if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+          npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} staging-tmp
+        fi
 
     - name: '🔗 Install latest core package'
       working-directory: '${{ inputs.working-directory }}'
@@ -193,7 +191,7 @@ runs:
         INPUTS_A2A_PACKAGE_NAME: '${{ inputs.a2a-package-name }}'
 
     - name: '📦 Prepare bundled CLI for npm release'
-      if: "inputs.npm-registry-url != 'https://npm.pkg.github.com/' && inputs.npm-tag != 'latest'"
+      if: "inputs.npm-registry-url != 'https://npm.pkg.github.com/'"
       working-directory: '${{ inputs.working-directory }}'
       shell: 'bash'
       run: |
@@ -218,10 +216,13 @@ runs:
       shell: 'bash'
       run: |
         npm publish \
+          --ignore-scripts \
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_CLI_PACKAGE_NAME}" \
-          --no-tag
-        npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} false --silent
+          --tag staging-tmp
+        if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+          npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} staging-tmp
+        fi
 
     - name: 'Get a2a-server Token'
       uses: './.github/actions/npm-auth-token'
@@ -243,10 +244,13 @@ runs:
       # Tag staging for initial release
       run: |
         npm publish \
+          --ignore-scripts \
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_A2A_PACKAGE_NAME}" \
-          --no-tag
-        npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} false --silent
+          --tag staging-tmp
+          if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+            npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} staging-tmp
+          fi
 
     - name: '🔬 Verify NPM release by version'
       uses: './.github/actions/verify-release'
@@ -285,8 +289,38 @@ runs:
         INPUTS_PREVIOUS_TAG: '${{ inputs.previous-tag }}'
       shell: 'bash'
       run: |
+        rm -f gemini-cli-bundle.zip
+        (cd bundle && chmod +x gemini.js && zip -r ../gemini-cli-bundle.zip .)
+
+        echo "Testing the generated bundle archive..."
+        rm -rf test-bundle
+        mkdir -p test-bundle
+        unzip -q gemini-cli-bundle.zip -d test-bundle
+
+        # Verify it runs and outputs a version
+        BUNDLE_VERSION=$(node test-bundle/gemini.js --version | xargs)
+        echo "Bundle version output: ${BUNDLE_VERSION}"
+        if [[ -z "${BUNDLE_VERSION}" ]]; then
+          echo "Error: Bundle failed to execute or return version."
+          exit 1
+        fi
+        rm -rf test-bundle
+
+        RELEASE_ASSETS=("gemini-cli-bundle.zip")
+
+        # Check for and prepare macOS binaries if they exist
+        for arch in arm64 x64; do
+          BINARY_PATH="dist/darwin-${arch}/gemini"
+          if [[ -f "$BINARY_PATH" ]]; then
+            chmod +x "$BINARY_PATH"
+            ZIP_NAME="gemini-darwin-${arch}-unsigned.zip"
+            zip -j "$ZIP_NAME" "$BINARY_PATH"
+            RELEASE_ASSETS+=("$ZIP_NAME")
+          fi
+        done
+
         gh release create "${INPUTS_RELEASE_TAG}" \
-          bundle/gemini.js \
+          "${RELEASE_ASSETS[@]}" \
           --target "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}" \
           --title "Release ${INPUTS_RELEASE_TAG}" \
           --notes-start-tag "${INPUTS_PREVIOUS_TAG}" \
@@ -300,7 +334,8 @@ runs:
       shell: 'bash'
       run: |
         echo "Cleaning up release branch ${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}..."
-        git push origin --delete "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}"
+        git push "https://x-access-token:${GIT_PUSH_TOKEN}@github.com/${{ github.repository }}.git" --delete "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}"
 
       env:
+        GIT_PUSH_TOKEN: '${{ inputs.github-release-token || inputs.github-token }}'
         STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'

.github/actions/push-docker/action.yml

@@ -18,11 +18,6 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: '📝 Print Inputs'
-      shell: 'bash'
-      env:
-        JSON_INPUTS: '${{ toJSON(inputs) }}'
-      run: 'echo "$JSON_INPUTS"'
     - name: 'Checkout'
       uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
       with:

.github/actions/push-sandbox/action.yml

@@ -28,13 +28,8 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: '📝 Print Inputs'
-      shell: 'bash'
-      env:
-        JSON_INPUTS: '${{ toJSON(inputs) }}'
-      run: 'echo "$JSON_INPUTS"'
     - name: 'Checkout'
-      uses: 'actions/checkout@v4'
+      uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
       with:
         ref: '${{ inputs.github-sha }}'
         fetch-depth: 0
@@ -45,11 +40,11 @@ runs:
       shell: 'bash'
       run: 'npm run build'
     - name: 'Set up QEMU'
-      uses: 'docker/setup-qemu-action@v3'
+      uses: 'docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130' # ratchet:docker/setup-qemu-action@v3
     - name: 'Set up Docker Buildx'
-      uses: 'docker/setup-buildx-action@v3'
+      uses: 'docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f' # ratchet:docker/setup-buildx-action@v3
     - name: 'Log in to GitHub Container Registry'
-      uses: 'docker/login-action@v3'
+      uses: 'docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9' # ratchet:docker/login-action@v3
       with:
         registry: 'docker.io'
         username: '${{ inputs.dockerhub-username }}'

.github/actions/run-tests/action.yml

@@ -13,14 +13,17 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: '📝 Print Inputs'
+    - name: 'Install system dependencies'
+      if: "runner.os == 'Linux'"
+      run: |
+        sudo apt-get update -qq && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq bubblewrap
+        # Ubuntu 24.04+ requires this to allow bwrap to function in CI
+        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
       shell: 'bash'
-      env:
-        JSON_INPUTS: '${{ toJSON(inputs) }}'
-      run: 'echo "$JSON_INPUTS"'
     - name: 'Run Tests'
       env:
         GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'
+        GEMINI_CLI_TRUST_WORKSPACE: true
       working-directory: '${{ inputs.working-directory }}'
       run: |-
         echo "::group::Build"

.github/actions/setup-npmrc/action.yml

@@ -19,6 +19,6 @@ runs:
       run: |-
         echo ""@google-gemini:registry=https://npm.pkg.github.com"" > ~/.npmrc
         echo ""//npm.pkg.github.com/:_authToken=${INPUTS_GITHUB_TOKEN}"" >> ~/.npmrc
-        echo ""@google:registry=https://wombat-dressing-room.appspot.com"" >> ~/.npmrc
+        echo ""@google:registry=https://wombat-dressing-room.appspot.com/"" >> ~/.npmrc
       env:
         INPUTS_GITHUB_TOKEN: '${{ inputs.github-token }}'

.github/actions/tag-npm-release/action.yml

@@ -40,12 +40,6 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: '📝 Print Inputs'
-      shell: 'bash'
-      env:
-        JSON_INPUTS: '${{ toJSON(inputs) }}'
-      run: 'echo "$JSON_INPUTS"'
-
     - name: 'Setup Node.js'
       uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
       with:

.github/actions/verify-release/action.yml

@@ -29,14 +29,8 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: '📝 Print Inputs'
-      shell: 'bash'
-      env:
-        JSON_INPUTS: '${{ toJSON(inputs) }}'
-      run: 'echo "$JSON_INPUTS"'
-
     - name: 'setup node'
-      uses: 'actions/setup-node@v4'
+      uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
       with:
         node-version: '20'
 
@@ -98,6 +92,7 @@ runs:
       working-directory: '${{ inputs.working-directory }}'
       env:
         GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'
+        GEMINI_CLI_TRUST_WORKSPACE: true
         INTEGRATION_TEST_USE_INSTALLED_GEMINI: 'true'
         # We must diable CI mode here because it interferes with interactive tests.
         # See https://github.com/google-gemini/gemini-cli/issues/10517

.github/dependabot.yml

@@ -8,6 +8,10 @@ updates:
     open-pull-requests-limit: 10
     reviewers:
       - 'joshualitt'
+    cooldown:
+      semver-major-days: 14
+      semver-minor-days: 14
+      semver-patch-days: 14
     groups:
       npm-dependencies:
         patterns:
@@ -24,6 +28,10 @@ updates:
     open-pull-requests-limit: 10
     reviewers:
       - 'joshualitt'
+    cooldown:
+      semver-major-days: 14
+      semver-minor-days: 14
+      semver-patch-days: 14
     groups:
       actions-dependencies:
         patterns:

.github/scripts/apply-issue-labels.cjs

@@ -0,0 +1,278 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+module.exports = async ({ github, context, core }) => {
+  const extractJson = (raw) => {
+    if (!raw || raw === '[]' || raw === '') return [];
+    try {
+      // First, try to parse the raw output as JSON.
+      return JSON.parse(raw);
+    } catch {
+      // If that fails, check for a markdown code block.
+      core.info(
+        'Direct JSON parsing failed. Trying to extract from a markdown block.',
+      );
+      const jsonMatch = raw.match(/```json\s*([\s\S]*?)\s*```/);
+      if (jsonMatch && jsonMatch[1]) {
+        try {
+          return JSON.parse(jsonMatch[1].trim());
+        } catch (markdownError) {
+          core.warning(
+            `Failed to parse extracted JSON from markdown block: ${markdownError.message}`,
+          );
+        }
+      }
+
+      // Try to find a raw JSON array in the output.
+      const jsonArrayMatch = raw.match(
+        /\[\s*\{\s*"issue_number"[\s\S]*\}\s*\]/,
+      );
+      if (jsonArrayMatch) {
+        try {
+          return JSON.parse(jsonArrayMatch[0]);
+        } catch {
+          const fallbackMatch = raw.match(/(\[\s*\{\s*"issue_number"[\s\S]*)/);
+          if (fallbackMatch) {
+            try {
+              const cleaned = fallbackMatch[0].substring(
+                0,
+                fallbackMatch[0].lastIndexOf(']') + 1,
+              );
+              return JSON.parse(cleaned);
+            } catch (fallbackError) {
+              core.warning(
+                `Failed to parse extracted JSON using fallback regex: ${fallbackError.message}`,
+              );
+            }
+          }
+        }
+      }
+    }
+    core.warning('No valid JSON could be extracted from input.');
+    return [];
+  };
+
+  // Collect all outputs from environment variables
+  // Prioritize EFFORT results over STANDARD results by processing Effort FIRST
+  // so that its labels appear first in the merged arrays (and thus win in mutually exclusive logic)
+  const effortRaw = process.env.LABELS_OUTPUT_EFFORT;
+  const standardRaw = process.env.LABELS_OUTPUT_STANDARD;
+  const genericRaw = process.env.LABELS_OUTPUT;
+
+  const resultsByIssue = new Map();
+
+  const processResults = (results, _sourceName) => {
+    for (const entry of results) {
+      const issueNumber = entry.issue_number;
+      if (!issueNumber) continue;
+
+      if (!resultsByIssue.has(issueNumber)) {
+        resultsByIssue.set(issueNumber, {
+          issue_number: issueNumber,
+          labels_to_add: [...(entry.labels_to_add || [])],
+          labels_to_remove: [...(entry.labels_to_remove || [])],
+          explanation: entry.explanation || '',
+          effort_analysis: entry.effort_analysis || '',
+        });
+      } else {
+        const existing = resultsByIssue.get(issueNumber);
+        // Combine labels
+        existing.labels_to_add = [
+          ...new Set([
+            ...existing.labels_to_add,
+            ...(entry.labels_to_add || []),
+          ]),
+        ];
+        existing.labels_to_remove = [
+          ...new Set([
+            ...existing.labels_to_remove,
+            ...(entry.labels_to_remove || []),
+          ]),
+        ];
+
+        // Combine explanations (if different)
+        if (
+          entry.explanation &&
+          !existing.explanation.includes(entry.explanation)
+        ) {
+          existing.explanation = existing.explanation
+            ? `${existing.explanation}\n\n${entry.explanation}`
+            : entry.explanation;
+        }
+
+        // Take effort analysis if present
+        if (entry.effort_analysis && !existing.effort_analysis) {
+          existing.effort_analysis = entry.effort_analysis;
+        }
+      }
+    }
+  };
+
+  // Order matters: Effort first so its labels win in conflict resolution
+  processResults(extractJson(effortRaw), 'EFFORT');
+  processResults(extractJson(standardRaw), 'STANDARD');
+  processResults(extractJson(genericRaw), 'GENERIC');
+
+  const finalResults = Array.from(resultsByIssue.values());
+  core.info(`Aggregated triage results for ${finalResults.length} issues.`);
+
+  for (const entry of finalResults) {
+    const issueNumber = entry.issue_number;
+    let labelsToAdd = entry.labels_to_add || [];
+    let labelsToRemove = entry.labels_to_remove || [];
+    let existingLabels = [];
+
+    // Fetch existing labels early
+    try {
+      const { data: issueData } = await github.rest.issues.get({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        issue_number: issueNumber,
+      });
+      existingLabels = issueData.labels.map((l) =>
+        typeof l === 'string' ? l : l.name,
+      );
+    } catch (e) {
+      core.warning(
+        `Failed to fetch existing labels for #${issueNumber}: ${e.message}`,
+      );
+    }
+
+    // Programmatic Priority Downgrade Logic
+    if (labelsToAdd.includes('status/need-information')) {
+      const targetPriority = labelsToAdd.find((l) => l.startsWith('priority/'));
+      if (targetPriority) {
+        let downgradedPriority = null;
+        if (targetPriority === 'priority/p0')
+          downgradedPriority = 'priority/p1';
+        if (targetPriority === 'priority/p1')
+          downgradedPriority = 'priority/p2';
+
+        if (downgradedPriority) {
+          core.info(
+            `Programmatically downgrading ${targetPriority} to ${downgradedPriority} due to status/need-information`,
+          );
+          labelsToAdd = labelsToAdd.filter((l) => l !== targetPriority);
+          labelsToAdd.push(downgradedPriority);
+        }
+      }
+    }
+
+    labelsToRemove.push('status/need-triage');
+
+    if (
+      labelsToAdd.includes('status/manual-triage') ||
+      existingLabels.includes('status/manual-triage')
+    ) {
+      labelsToRemove.push('status/bot-triaged');
+      labelsToAdd = labelsToAdd.filter((l) => l !== 'status/bot-triaged');
+    } else {
+      labelsToAdd.push('status/bot-triaged');
+    }
+
+    // Resolve internal conflicts (e.g., adding P1 and P2)
+    // We already resolved these by putting Effort first in the combined list
+
+    // Resolve external conflicts with existing labels
+    if (labelsToAdd.some((l) => l.startsWith('area/'))) {
+      labelsToRemove.push(
+        ...existingLabels.filter((l) => l.startsWith('area/')),
+      );
+    }
+    if (labelsToAdd.some((l) => l.startsWith('priority/'))) {
+      labelsToRemove.push(
+        ...existingLabels.filter((l) => l.startsWith('priority/')),
+      );
+    }
+    if (labelsToAdd.some((l) => l.startsWith('kind/'))) {
+      labelsToRemove.push(
+        ...existingLabels.filter((l) => l.startsWith('kind/')),
+      );
+    }
+
+    // Enforce mutual exclusivity in the TO-ADD list (Architect wins)
+    const exclusivePrefixes = ['area/', 'priority/', 'kind/'];
+    for (const prefix of exclusivePrefixes) {
+      const filtered = labelsToAdd.filter((l) => l.startsWith(prefix));
+      if (filtered.length > 1) {
+        const winner = filtered[0]; // First one wins
+        core.info(
+          `Issue #${issueNumber} has multiple ${prefix} labels suggested. Keeping "${winner}" and discarding others.`,
+        );
+        labelsToAdd = labelsToAdd.filter(
+          (l) => !l.startsWith(prefix) || l === winner,
+        );
+      }
+    }
+
+    // Final deduplication and cleanup
+    labelsToRemove = [...new Set(labelsToRemove)].filter(
+      (l) => !labelsToAdd.includes(l) && existingLabels.includes(l),
+    );
+    labelsToAdd = [...new Set(labelsToAdd)].filter(
+      (l) => !existingLabels.includes(l),
+    );
+
+    // Batch label operations
+    if (labelsToAdd.length > 0) {
+      await github.rest.issues.addLabels({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        issue_number: issueNumber,
+        labels: labelsToAdd,
+      });
+      core.info(
+        `Successfully added labels for #${issueNumber}: ${labelsToAdd.join(', ')}`,
+      );
+    }
+
+    if (labelsToRemove.length > 0) {
+      for (const label of labelsToRemove) {
+        try {
+          await github.rest.issues.removeLabel({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            issue_number: issueNumber,
+            name: label,
+          });
+        } catch (e) {
+          if (e.status !== 404)
+            core.warning(
+              `Failed to remove label ${label} from #${issueNumber}: ${e.message}`,
+            );
+        }
+      }
+      core.info(
+        `Successfully removed labels for #${issueNumber}: ${labelsToRemove.join(', ')}`,
+      );
+    }
+
+    // Post comment if needed
+    const needsInfoAdded =
+      labelsToAdd.includes('status/need-information') &&
+      !existingLabels.includes('status/need-information');
+    const hasEffortAnalysis = !!entry.effort_analysis;
+
+    if (needsInfoAdded || hasEffortAnalysis) {
+      let commentBody = '';
+      if (needsInfoAdded && entry.explanation) commentBody += entry.explanation;
+      if (hasEffortAnalysis) {
+        if (commentBody) commentBody += '\n\n';
+        commentBody += `**Effort Analysis:**\n${entry.effort_analysis}`;
+      }
+
+      if (commentBody) {
+        await github.rest.issues.createComment({
+          owner: context.repo.owner,
+          repo: context.repo.repo,
+          issue_number: issueNumber,
+          body: commentBody,
+        });
+        core.info(`Posted required comment for #${issueNumber}`);
+      }
+    }
+  }
+};

.github/scripts/cleanup-triage-labels.cjs

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const fs = require('node:fs');
+
+module.exports = async ({ github, context, core }) => {
+  let issuesToCleanup = [];
+  try {
+    const fileContent = fs.readFileSync('issues_to_cleanup.json', 'utf8');
+    issuesToCleanup = JSON.parse(fileContent);
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      core.info('No issues found to clean up.');
+      return;
+    }
+    core.setFailed(`Failed to read issues_to_cleanup.json: ${error.message}`);
+    return;
+  }
+
+  for (const issue of issuesToCleanup) {
+    try {
+      const { data: issueData } = await github.rest.issues.get({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        issue_number: issue.number,
+      });
+
+      const labels = issueData.labels.map((l) =>
+        typeof l === 'string' ? l : l.name,
+      );
+
+      if (
+        labels.includes('status/bot-triaged') &&
+        labels.includes('status/need-triage')
+      ) {
+        await github.rest.issues.removeLabel({
+          owner: context.repo.owner,
+          repo: context.repo.repo,
+          issue_number: issue.number,
+          name: 'status/need-triage',
+        });
+        core.info(
+          `Successfully removed status/need-triage from #${issue.number}`,
+        );
+      }
+
+      if (
+        labels.includes('status/bot-triaged') &&
+        labels.includes('status/manual-triage')
+      ) {
+        await github.rest.issues.removeLabel({
+          owner: context.repo.owner,
+          repo: context.repo.repo,
+          issue_number: issue.number,
+          name: 'status/bot-triaged',
+        });
+        core.info(
+          `Successfully removed status/bot-triaged from #${issue.number} because it requires manual triage`,
+        );
+      }
+    } catch (error) {
+      core.warning(
+        `Failed to clean up labels for #${issue.number}: ${error.message}`,
+      );
+    }
+  }
+
+  core.info(
+    `Cleaned up conflicting labels from ${issuesToCleanup.length} issues.`,
+  );
+};

.github/scripts/gemini-lifecycle-manager.cjs

@@ -0,0 +1,380 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Gemini Scheduled Lifecycle Manager Script
+ * @param {object} param0
+ * @param {import('@octokit/rest').Octokit} param0.github
+ * @param {import('@actions/github/lib/context').Context} param0.context
+ * @param {import('@actions/core')} param0.core
+ */
+module.exports = async ({ github, context, core }) => {
+  const dryRun = process.env.DRY_RUN === 'true';
+  const owner = context.repo.owner;
+  const repo = context.repo.repo;
+
+  core.info(`Running in ${dryRun ? 'DRY RUN' : 'PRODUCTION'} mode.`);
+
+  const STALE_LABEL = 'stale';
+  const NEED_INFO_LABEL = 'status/need-information';
+  const EXEMPT_LABELS = [
+    'pinned',
+    'security',
+    '🔒 maintainer only',
+    'help wanted',
+    '🗓️ Public Roadmap',
+  ];
+
+  const STALE_DAYS = 60;
+  const CLOSE_DAYS = 14;
+  const NO_RESPONSE_DAYS = 14;
+
+  const now = new Date();
+  const staleThreshold = new Date(
+    now.getTime() - STALE_DAYS * 24 * 60 * 60 * 1000,
+  );
+  const closeThreshold = new Date(
+    now.getTime() - CLOSE_DAYS * 24 * 60 * 60 * 1000,
+  );
+  const noResponseThreshold = new Date(
+    now.getTime() - NO_RESPONSE_DAYS * 24 * 60 * 60 * 1000,
+  );
+
+  const maintainerCache = new Map();
+  async function isMaintainer(user, association) {
+    if (user?.type === 'Bot') return true;
+    if (['OWNER', 'MEMBER', 'COLLABORATOR'].includes(association)) return true;
+
+    const username = user?.login;
+    if (!username) return false;
+
+    if (maintainerCache.has(username)) {
+      return maintainerCache.get(username);
+    }
+
+    try {
+      const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+        owner,
+        repo,
+        username,
+      });
+      // Permission can be admin, write, read, none.
+      // Roles like 'maintain' or 'triage' often map to 'write' or 'read' in the top-level field.
+      const isM =
+        ['admin', 'write'].includes(data.permission) ||
+        ['admin', 'maintain', 'write'].includes(data.role_name);
+
+      maintainerCache.set(username, isM);
+      return isM;
+    } catch (err) {
+      core.warning(
+        `Could not check permissions for ${username}: ${err.message}`,
+      );
+      maintainerCache.set(username, false);
+      return false;
+    }
+  }
+
+  async function processItems(query, callback) {
+    core.info(`Searching: ${query}`);
+    try {
+      let items = await github.paginate(
+        github.rest.search.issuesAndPullRequests,
+        {
+          q: query,
+          per_page: 100,
+          sort: 'updated',
+          order: 'asc',
+        },
+      );
+      core.info(`Found ${items.length} items.`);
+      for (const item of items) {
+        try {
+          await callback(item);
+        } catch (err) {
+          core.error(`Error processing #${item.number}: ${err.message}`);
+        }
+      }
+    } catch (err) {
+      core.error(`Search failed: ${err.message}`);
+    }
+  }
+
+  // 1. Handle No-Response (status/need-information)
+  // Removal: Check issues updated in the last 48h that have the label
+  const twoDaysAgo = new Date(now.getTime() - 2 * 24 * 60 * 60 * 1000);
+  await processItems(
+    `repo:${owner}/${repo} is:open label:"${NEED_INFO_LABEL}" updated:>${twoDaysAgo.toISOString()}`,
+    async (item) => {
+      const { data: comments } = await github.rest.issues.listComments({
+        owner,
+        repo,
+        issue_number: item.number,
+        sort: 'created',
+        direction: 'desc',
+        per_page: 5,
+      });
+
+      // Check if the last comment is from a non-maintainer and not a bot
+      const lastComment = comments[0];
+      if (
+        lastComment &&
+        lastComment.user?.type !== 'Bot' &&
+        !(await isMaintainer(lastComment.user, lastComment.author_association))
+      ) {
+        if (dryRun) {
+          core.info(
+            `[DRY RUN] Would remove ${NEED_INFO_LABEL} from #${item.number} due to contributor response.`,
+          );
+        } else {
+          core.info(
+            `Removing ${NEED_INFO_LABEL} from #${item.number} due to contributor response.`,
+          );
+          await github.rest.issues
+            .removeLabel({
+              owner,
+              repo,
+              issue_number: item.number,
+              name: NEED_INFO_LABEL,
+            })
+            .catch(() => {});
+        }
+      }
+    },
+  );
+
+  // Closure: Check issues with the label that haven't been updated in 14 days
+  await processItems(
+    `repo:${owner}/${repo} is:open label:"${NEED_INFO_LABEL}" updated:<${noResponseThreshold.toISOString()}`,
+    async (item) => {
+      if (dryRun) {
+        core.info(
+          `[DRY RUN] Would close #${item.number} due to no response for ${NO_RESPONSE_DAYS} days.`,
+        );
+      } else {
+        core.info(
+          `Closing #${item.number} due to no response for ${NO_RESPONSE_DAYS} days.`,
+        );
+        await github.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: item.number,
+          body: `This item was marked as needing more information and has not received a response in ${NO_RESPONSE_DAYS} days. Closing it for now. If you still face this problem, feel free to reopen with more details. Thank you!`,
+        });
+        await github.rest.issues.update({
+          owner,
+          repo,
+          issue_number: item.number,
+          state: 'closed',
+          state_reason: 'not_planned',
+        });
+      }
+    },
+  );
+
+  // 2. Handle Stale Mark (60 days inactivity, no stale label)
+  const exemptQuery = EXEMPT_LABELS.map((l) => `-label:"${l}"`).join(' ');
+
+  await processItems(
+    `repo:${owner}/${repo} is:open -label:"${STALE_LABEL}" ${exemptQuery} updated:<${staleThreshold.toISOString()}`,
+    async (item) => {
+      const isBug = item.labels.some((l) =>
+        (typeof l === 'string' ? l : l.name).toLowerCase().includes('bug'),
+      );
+      const bodyText = isBug
+        ? `This bug report has been automatically marked as stale due to ${STALE_DAYS} days of inactivity. Many issues are resolved in newer releases. Please verify if the issue persists in the latest Gemini CLI version. If it does, please leave a comment to keep this open. It will be closed in ${CLOSE_DAYS} days if no further activity occurs. Thank you!`
+        : `This item has been automatically marked as stale due to ${STALE_DAYS} days of inactivity. It will be closed in ${CLOSE_DAYS} days if no further activity occurs. Thank you!`;
+
+      if (dryRun) {
+        core.info(`[DRY RUN] Would mark #${item.number} as stale.`);
+      } else {
+        core.info(`Marking #${item.number} as stale.`);
+        await github.rest.issues.addLabels({
+          owner,
+          repo,
+          issue_number: item.number,
+          labels: [STALE_LABEL],
+        });
+        await github.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: item.number,
+          body: bodyText,
+        });
+      }
+    },
+  );
+
+  // 3. Handle Stale Removal & Close
+  await processItems(
+    `repo:${owner}/${repo} is:open label:"${STALE_LABEL}" ${exemptQuery}`,
+    async (item) => {
+      // Fetch full timeline to see events and comments
+      const timeline = await github.paginate(
+        github.rest.issues.listEventsForTimeline,
+        {
+          owner,
+          repo,
+          issue_number: item.number,
+          per_page: 100,
+        },
+      );
+
+      // Find exactly when the Stale label was added
+      // We look for the last 'labeled' event for STALE_LABEL
+      const staleEventIndex = timeline.findLastIndex(
+        (e) =>
+          e.event === 'labeled' &&
+          e.label?.name?.toLowerCase() === STALE_LABEL.toLowerCase(),
+      );
+
+      if (staleEventIndex === -1) return; // Fallback if no event found
+
+      const staleEvent = timeline[staleEventIndex];
+      const eventsAfterStale = timeline.slice(staleEventIndex + 1);
+
+      // Check for meaningful activity after the Stale label was applied
+      const meaningfulEvents = eventsAfterStale.filter((e) => {
+        const actor = e.actor?.login || '';
+        const isBot =
+          actor.includes('[bot]') || actor.includes('github-actions');
+
+        if (isBot) return false;
+
+        // Explicit whitelist of meaningful events for humans
+        if (
+          [
+            'commented',
+            'cross-referenced',
+            'connected',
+            'reopened',
+            'assigned',
+          ].includes(e.event)
+        ) {
+          return true;
+        }
+
+        return false;
+      });
+
+      if (meaningfulEvents.length > 0) {
+        // Activity detected, remove Stale label
+        if (dryRun) {
+          core.info(
+            `[DRY RUN] Would remove ${STALE_LABEL} from #${item.number} due to meaningful activity (e.g., comment or PR).`,
+          );
+        } else {
+          core.info(
+            `Removing ${STALE_LABEL} from #${item.number} due to meaningful activity (e.g., comment or PR).`,
+          );
+          await github.rest.issues
+            .removeLabel({
+              owner,
+              repo,
+              issue_number: item.number,
+              name: STALE_LABEL,
+            })
+            .catch(() => {});
+        }
+        return;
+      }
+
+      // No meaningful activity. Check if 14 days have passed.
+      const labeledDate = new Date(staleEvent.created_at);
+      if (labeledDate > closeThreshold) {
+        // Has not been 14 days since it was ACTUALLY marked stale
+        return;
+      }
+
+      if (dryRun) {
+        core.info(`[DRY RUN] Would close stale item #${item.number}.`);
+      } else {
+        core.info(`Closing stale item #${item.number}.`);
+        await github.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: item.number,
+          body: `This item has been closed due to ${CLOSE_DAYS} additional days of inactivity after being marked as stale. If you believe this is still relevant, feel free to comment or reopen. Thank you!`,
+        });
+        await github.rest.issues.update({
+          owner,
+          repo,
+          issue_number: item.number,
+          state: 'closed',
+          state_reason: 'not_planned',
+        });
+      }
+    },
+  );
+
+  // 4. Handle PR Contribution Policy (Nudge at 7d, Close at 14d)
+  const PR_NUDGE_DAYS = 7;
+  const PR_CLOSE_DAYS = 14;
+  const nudgeThreshold = new Date(
+    now.getTime() - PR_NUDGE_DAYS * 24 * 60 * 60 * 1000,
+  );
+  const prCloseThreshold = new Date(
+    now.getTime() - PR_CLOSE_DAYS * 24 * 60 * 60 * 1000,
+  );
+
+  // Nudge
+  await processItems(
+    `repo:${owner}/${repo} is:open is:pr -label:"help wanted" -label:"🔒 maintainer only" -label:"status/pr-nudge-sent" created:${prCloseThreshold.toISOString()}..${nudgeThreshold.toISOString()}`,
+    async (pr) => {
+      if (await isMaintainer(pr.user, pr.author_association)) return;
+
+      if (dryRun) {
+        core.info(
+          `[DRY RUN] Would nudge PR #${pr.number} for contribution policy.`,
+        );
+      } else {
+        core.info(`Nudging PR #${pr.number} for contribution policy.`);
+        await github.rest.issues.addLabels({
+          owner,
+          repo,
+          issue_number: pr.number,
+          labels: ['status/pr-nudge-sent'],
+        });
+        await github.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: pr.number,
+          body: "Hi there! Thank you for your interest in contributing to Gemini CLI. \n\nTo ensure we maintain high code quality and focus on our prioritized roadmap, we only guarantee review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'. \n\nThis PR will be closed in 7 days if it remains without that designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.",
+        });
+      }
+    },
+  );
+
+  // Close
+  await processItems(
+    `repo:${owner}/${repo} is:open is:pr -label:"help wanted" -label:"🔒 maintainer only" created:<${prCloseThreshold.toISOString()}`,
+    async (pr) => {
+      if (await isMaintainer(pr.user, pr.author_association)) return;
+
+      if (dryRun) {
+        core.info(
+          `[DRY RUN] Would close PR #${pr.number} per contribution policy (no 'help wanted').`,
+        );
+      } else {
+        core.info(
+          `Closing PR #${pr.number} per contribution policy (no 'help wanted').`,
+        );
+        await github.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: pr.number,
+          body: "This pull request is being closed as it has been open for 14 days without a 'help wanted' designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.",
+        });
+        await github.rest.pulls.update({
+          owner,
+          repo,
+          pull_number: pr.number,
+          state: 'closed',
+        });
+      }
+    },
+  );
+};

.github/scripts/sync-issue-types.cjs

@@ -0,0 +1,99 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const fs = require('node:fs');
+
+module.exports = async ({ github, context, core }) => {
+  const query = `
+    query($owner: String!, $repo: String!) {
+      repository(owner: $owner, name: $repo) {
+        issues(first: 50, states: OPEN, orderBy: {field: UPDATED_AT, direction: DESC}) {
+          nodes {
+            id
+            number
+            title
+            body
+            issueType {
+              name
+            }
+            labels(first: 20) {
+              nodes {
+                name
+              }
+            }
+          }
+        }
+      }
+    }
+  `;
+
+  try {
+    const result = await github.graphql(query, {
+      owner: context.repo.owner,
+      repo: context.repo.repo,
+    });
+
+    const issues = result.repository.issues.nodes;
+    const issuesNeedingAnalysis = [];
+    let syncedCount = 0;
+
+    for (const issue of issues) {
+      if (issue.issueType === null) {
+        const labelNames = issue.labels.nodes.map((l) => l.name);
+        const hasBug = labelNames.includes('kind/bug');
+        const hasFeature =
+          labelNames.includes('kind/feature') ||
+          labelNames.includes('kind/enhancement');
+
+        let issueTypeId = null;
+        if (hasBug) {
+          issueTypeId = 'IT_kwDOCaSVvs4BR7vP'; // Bug
+        } else if (hasFeature) {
+          issueTypeId = 'IT_kwDOCaSVvs4BR7vQ'; // Feature
+        }
+
+        if (issueTypeId) {
+          await github.graphql(
+            `
+            mutation($issueId: ID!, $issueTypeId: ID!) {
+              updateIssue(input: {id: $issueId, issueTypeId: $issueTypeId}) {
+                issue {
+                  id
+                }
+              }
+            }
+          `,
+            {
+              issueId: issue.id,
+              issueTypeId: issueTypeId,
+            },
+          );
+          core.info(`Successfully synced Issue Type for #${issue.number}`);
+          syncedCount++;
+        } else {
+          // Needs analysis to determine kind/type
+          issuesNeedingAnalysis.push({
+            number: issue.number,
+            title: issue.title,
+            body: issue.body,
+          });
+        }
+      }
+    }
+
+    // Write issues needing analysis to a file so the AI can process them
+    fs.writeFileSync(
+      'no_type_issues.json',
+      JSON.stringify(issuesNeedingAnalysis),
+    );
+    core.info(`Synced ${syncedCount} issues from labels.`);
+    core.info(
+      `Found ${issuesNeedingAnalysis.length} issues missing both type and kind label to be analyzed.`,
+    );
+  } catch (error) {
+    core.setFailed(`Failed to sync issue types: ${error.message}`);
+  }
+};

.github/workflows/agent-session-drift-check.yml

@@ -0,0 +1,132 @@
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+
+name: 'Agent Session Drift Check'
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+      - 'release/**'
+    paths:
+      - 'packages/cli/src/nonInteractiveCli.ts'
+      - 'packages/cli/src/nonInteractiveCliAgentSession.ts'
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  check-drift:
+    name: 'Check Agent Session Drift'
+    runs-on: 'ubuntu-latest'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    permissions:
+      contents: 'read'
+      pull-requests: 'write'
+    steps:
+      - name: 'Detect drift and comment'
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v8
+        with:
+          script: |-
+            // === Pair configuration — append here to cover more pairs ===
+            const PAIRS = [
+              {
+                legacy: 'packages/cli/src/nonInteractiveCli.ts',
+                session: 'packages/cli/src/nonInteractiveCliAgentSession.ts',
+                label: 'non-interactive CLI',
+              },
+              // Future pairs can be added here. Remember to also add both
+              // paths to the `paths:` filter at the top of this workflow.
+              // Example:
+              // {
+              //   legacy: 'packages/core/src/agents/local-invocation.ts',
+              //   session: 'packages/core/src/agents/local-session-invocation.ts',
+              //   label: 'local subagent invocation',
+              // },
+            ];
+            // ============================================================
+
+            const prNumber = context.payload.pull_request.number;
+            const { owner, repo } = context.repo;
+
+            // Use the API to list changed files — no checkout/git diff needed.
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner,
+              repo,
+              pull_number: prNumber,
+              per_page: 100,
+            });
+            const changed = new Set(files.map((f) => f.filename));
+
+            const warnings = [];
+            for (const { legacy, session, label } of PAIRS) {
+              const legacyChanged = changed.has(legacy);
+              const sessionChanged = changed.has(session);
+              if (legacyChanged && !sessionChanged) {
+                warnings.push(
+                  `**${label}**: \`${legacy}\` was modified but \`${session}\` was not.`,
+                );
+              } else if (!legacyChanged && sessionChanged) {
+                warnings.push(
+                  `**${label}**: \`${session}\` was modified but \`${legacy}\` was not.`,
+                );
+              }
+            }
+
+            const MARKER = '<!-- agent-session-drift-check -->';
+
+            // Look up our existing drift comment (for upsert/cleanup).
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner,
+              repo,
+              issue_number: prNumber,
+              per_page: 100,
+            });
+            const existing = comments.find(
+              (c) => c.user?.type === 'Bot' && c.body?.includes(MARKER),
+            );
+
+            if (warnings.length === 0) {
+              core.info('No drift detected.');
+              // If drift was previously flagged and is now resolved, remove the comment.
+              if (existing) {
+                await github.rest.issues.deleteComment({
+                  owner,
+                  repo,
+                  comment_id: existing.id,
+                });
+                core.info(`Deleted stale drift comment ${existing.id}.`);
+              }
+              return;
+            }
+
+            const body = [
+              MARKER,
+              '### ⚠️ Invocation Drift Warning',
+              '',
+              'The following file pairs should generally be kept in sync during the AgentSession migration:',
+              '',
+              ...warnings.map((w) => `- ${w}`),
+              '',
+              'If this is intentional (e.g., a bug fix specific to one implementation), you can ignore this comment.',
+              '',
+              '_This check will be removed once the legacy implementations are deleted._',
+            ].join('\n');
+
+            if (existing) {
+              core.info(`Updating existing drift comment ${existing.id}.`);
+              await github.rest.issues.updateComment({
+                owner,
+                repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              core.info('Creating new drift comment.');
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: prNumber,
+                body,
+              });
+            }

.github/workflows/build-unsigned-mac-binaries.yml

@@ -0,0 +1,65 @@
+name: 'Build Unsigned Mac Binaries'
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      ref:
+        description: 'The branch, tag, or SHA to build from.'
+        required: true
+        type: 'string'
+
+permissions:
+  contents: 'read'
+
+defaults:
+  run:
+    shell: 'bash'
+
+jobs:
+  build-mac:
+    name: 'Build Unsigned (${{ matrix.arch }})'
+    runs-on: 'macos-latest'
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: ['x64', 'arm64']
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        with:
+          ref: '${{ inputs.ref || github.ref }}'
+          persist-credentials: false
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          architecture: '${{ matrix.arch }}'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build Binary'
+        env:
+          SKIP_SIGNING: 'true'
+        run: 'npm run build:binary'
+
+      - name: 'Verify Output Exists'
+        run: |
+          if [ -f "dist/darwin-${{ matrix.arch }}/gemini" ]; then
+            echo "Binary found at dist/darwin-${{ matrix.arch }}/gemini"
+          else
+            echo "Error: Binary not found in dist/darwin-${{ matrix.arch }}/"
+            ls -R dist/
+            exit 1
+          fi
+
+      - name: 'Upload Artifact'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'gemini-darwin-${{ matrix.arch }}-unsigned'
+          path: 'dist/darwin-${{ matrix.arch }}/gemini'
+          retention-days: 14

.github/workflows/chained_e2e.yml

@@ -148,6 +148,7 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -167,6 +168,7 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           VERBOSE: 'true'
           BUILD_SANDBOX_FLAGS: '--cache-from type=gha --cache-to type=gha,mode=max'
@@ -183,7 +185,7 @@ jobs:
     needs:
       - 'merge_queue_skipper'
       - 'parse_run_context'
-    runs-on: 'macos-latest'
+    runs-on: 'macos-latest-large'
     if: |
       github.repository == 'google-gemini/gemini-cli' && always() && (needs.merge_queue_skipper.result !='success' || needs.merge_queue_skipper.outputs.skip != 'true')
     steps:
@@ -192,6 +194,7 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -212,6 +215,7 @@ jobs:
         if: "${{runner.os != 'Windows'}}"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           SANDBOX: 'sandbox:none'
           VERBOSE: 'true'
@@ -231,6 +235,7 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -288,6 +293,7 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           SANDBOX: 'sandbox:none'
           VERBOSE: 'true'
@@ -311,6 +317,7 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
+          persist-credentials: false
           fetch-depth: 0
 
       - name: 'Set up Node.js 20.x'
@@ -334,8 +341,23 @@ jobs:
         if: "${{ steps.check_evals.outputs.should_run == 'true' }}"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
+          GEMINI_MODEL: 'gemini-3-pro-preview'
+          # Only run always passes behavioral tests.
+          EVAL_SUITE_TYPE: 'behavioral'
+          # Disable Vitest internal retries to avoid double-retrying;
+          # custom retry logic is handled in evals/test-helper.ts
+          VITEST_RETRY: 0
         run: 'npm run test:always_passing_evals'
 
+      - name: 'Upload Reliability Logs'
+        if: "always() && steps.check_evals.outputs.should_run == 'true'"
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'eval-logs-${{ github.run_id }}-${{ github.run_attempt }}'
+          path: 'evals/logs/api-reliability.jsonl'
+          retention-days: 7
+
   e2e:
     name: 'E2E'
     if: |

.github/workflows/ci.yml

@@ -57,6 +57,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
           fetch-depth: 0
 
@@ -67,7 +68,7 @@ jobs:
           cache: 'npm'
 
       - name: 'Cache Linters'
-        uses: 'actions/cache@v4'
+        uses: 'actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830' # ratchet:actions/cache@v4
         with:
           path: '${{ env.GEMINI_LINT_TEMP_DIR }}'
           key: "${{ runner.os }}-${{ runner.arch }}-linters-${{ hashFiles('scripts/lint.js') }}"
@@ -76,7 +77,7 @@ jobs:
         run: 'npm ci'
 
       - name: 'Cache ESLint'
-        uses: 'actions/cache@v4'
+        uses: 'actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830' # ratchet:actions/cache@v4
         with:
           path: '.eslintcache'
           key: "${{ runner.os }}-eslint-${{ hashFiles('package-lock.json', 'eslint.config.js') }}"
@@ -102,6 +103,12 @@ jobs:
       - name: 'Run yamllint'
         run: 'node scripts/lint.js --yamllint'
 
+      - name: 'Build project for typecheck'
+        run: 'npm run build'
+
+      - name: 'Run typecheck'
+        run: 'npm run typecheck'
+
       - name: 'Run Prettier'
         run: 'node scripts/lint.js --prettier'
 
@@ -114,6 +121,9 @@ jobs:
       - name: 'Run sensitive keyword linter'
         run: 'node scripts/lint.js --sensitive-keywords'
 
+      - name: 'Run GitHub Actions pinning linter'
+        run: 'node scripts/lint.js --check-github-actions-pinning'
+
   link_checker:
     name: 'Link Checker'
     runs-on: 'ubuntu-latest'
@@ -121,6 +131,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: 'Link Checker'
         uses: 'lycheeverse/lychee-action@885c65f3dc543b57c898c8099f4e08c8afd178a2' # ratchet: lycheeverse/lychee-action@v2.6.1
         with:
@@ -148,6 +160,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
@@ -158,18 +172,25 @@ jobs:
       - name: 'Build project'
         run: 'npm run build'
 
+      - name: 'Install system dependencies'
+        run: |
+          sudo apt-get update -qq && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq bubblewrap
+          # Ubuntu 24.04+ requires this to allow bwrap to function in CI
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+
       - name: 'Install dependencies for testing'
         run: 'npm ci'
 
       - name: 'Run tests and generate reports'
         env:
           NO_COLOR: true
+          GEMINI_CLI_TRUST_WORKSPACE: true
         run: |
           if [[ "${{ matrix.shard }}" == "cli" ]]; then
-            npm run test:ci --workspace @google/gemini-cli
+            npm run test:ci --workspace "@google/gemini-cli"
           else
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
             npm run test:scripts
           fi
 
@@ -215,7 +236,7 @@ jobs:
 
   test_mac:
     name: 'Test (Mac) - ${{ matrix.node-version }}, ${{ matrix.shard }}'
-    runs-on: 'macos-latest'
+    runs-on: 'macos-latest-large'
     needs:
       - 'merge_queue_skipper'
     if: "github.repository == 'google-gemini/gemini-cli' && needs.merge_queue_skipper.outputs.skip == 'false'"
@@ -236,6 +257,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
@@ -252,12 +275,13 @@ jobs:
       - name: 'Run tests and generate reports'
         env:
           NO_COLOR: true
+          GEMINI_CLI_TRUST_WORKSPACE: true
         run: |
           if [[ "${{ matrix.shard }}" == "cli" ]]; then
-            npm run test:ci --workspace @google/gemini-cli -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli" -- --coverage.enabled=false
           else
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
             npm run test:scripts
           fi
 
@@ -322,6 +346,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
 
       - name: 'Initialize CodeQL'
@@ -346,6 +371,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
           fetch-depth: 1
 
@@ -373,6 +399,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
 
       - name: 'Set up Node.js 20.x'
@@ -415,16 +442,20 @@ jobs:
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
           NO_COLOR: true
+          GEMINI_CLI_TRUST_WORKSPACE: true
           NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
           UV_THREADPOOL_SIZE: '32'
           NODE_ENV: 'test'
         run: |
           if ("${{ matrix.shard }}" -eq "cli") {
-            npm run test:ci --workspace @google/gemini-cli -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli" -- --coverage.enabled=false
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           } else {
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
             npm run test:scripts
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
         shell: 'pwsh'
 

.github/workflows/community-report.yml

@@ -173,6 +173,7 @@ jobs:
           GITHUB_TOKEN: '${{ steps.generate_token.outputs.token }}'
           REPOSITORY: '${{ github.repository }}'
         with:
+          upload_artifacts: 'true'
           gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
           gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
@@ -182,12 +183,14 @@ jobs:
           use_gemini_code_assist: '${{ vars.GOOGLE_GENAI_USE_GCA }}'
           settings: |-
             {
-              "coreTools": [
-                "run_shell_command(gh issue list)",
-                "run_shell_command(gh pr list)",
-                "run_shell_command(gh search issues)",
-                "run_shell_command(gh search prs)"
-              ]
+              "tools": {
+                "core": [
+                  "run_shell_command(gh issue list)",
+                  "run_shell_command(gh pr list)",
+                  "run_shell_command(gh search issues)",
+                  "run_shell_command(gh search prs)"
+                ]
+              }
             }
           prompt: |-
             You are a helpful assistant that analyzes community contribution reports.

.github/workflows/deflake.yml

@@ -43,6 +43,7 @@ jobs:
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -62,6 +63,7 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           IS_DOCKER: "${{ matrix.sandbox == 'sandbox:docker' }}"
           KEEP_OUTPUT: 'true'
           RUNS: '${{ github.event.inputs.runs }}'
@@ -77,7 +79,7 @@ jobs:
 
   deflake_e2e_mac:
     name: 'E2E Test (macOS)'
-    runs-on: 'macos-latest'
+    runs-on: 'macos-latest-large'
     if: "github.repository == 'google-gemini/gemini-cli'"
     steps:
       - name: 'Checkout'
@@ -85,6 +87,7 @@ jobs:
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -105,6 +108,7 @@ jobs:
         if: "runner.os != 'Windows'"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           RUNS: '${{ github.event.inputs.runs }}'
           SANDBOX: 'sandbox:none'
@@ -123,6 +127,7 @@ jobs:
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -159,6 +164,7 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           SANDBOX: 'sandbox:none'
           VERBOSE: 'true'

.github/workflows/docs-audit.yml

@@ -0,0 +1,66 @@
+name: 'Automated Documentation Audit'
+
+on:
+  schedule:
+    # Runs every Monday at 00:00 UTC
+    - cron: '0 0 * * MON'
+  workflow_dispatch:
+
+jobs:
+  audit-docs:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+
+    steps:
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
+        with:
+          fetch-depth: 0
+          ref: 'main'
+          persist-credentials: false
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version: '20'
+
+      - name: 'Run Docs Audit with Gemini'
+        id: 'run_gemini'
+        uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31'
+        env:
+          GEMINI_CLI_TRUST_WORKSPACE: true
+        with:
+          upload_artifacts: 'true'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          prompt: |
+            Activate the 'docs-writer' skill.
+
+            **Task:** Execute the docs audit procedure, as defined in your 'docs-auditing.md' reference.
+            Provide a detailed summary of the changes you make.
+
+      - name: 'Get current date'
+        id: 'date'
+        run: |
+          echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
+
+      - name: 'Create Pull Request with Audit Results'
+        uses: 'peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c'
+        with:
+          token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          commit-message: 'docs: weekly audit results for ${{ github.run_id }}'
+          title: 'Docs audit: ${{ steps.date.outputs.date }}'
+          body: |
+            This PR contains the auto-generated documentation audit for the week. It includes a new `audit-results-*.md` file with findings and any direct fixes applied by the agent.
+
+            ### Audit Summary:
+            ${{ steps.run_gemini.outputs.summary || 'No summary provided.' }}
+
+            Please review the suggestions and merge.
+
+            Related to #25152
+          branch: 'docs-audit-${{ github.run_id }}'
+          base: 'main'
+          team-reviewers: 'gemini-cli-docs, gemini-cli-maintainers'
+          delete-branch: true

.github/workflows/docs-page-action.yml

@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Setup Pages'
         uses: 'actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b' # ratchet:actions/configure-pages@v5

.github/workflows/eval-pr.yml

@@ -0,0 +1,211 @@
+name: 'Evals: PR Evaluation & Regression'
+
+on:
+  pull_request_target:
+    types: ['opened', 'synchronize', 'reopened', 'ready_for_review']
+    paths:
+      - 'packages/core/src/prompts/**'
+      - 'packages/core/src/tools/**'
+      - 'packages/core/src/agents/**'
+      - 'evals/**'
+      - '!**/*.test.ts'
+      - '!**/*.test.tsx'
+  workflow_dispatch:
+
+# Prevents multiple runs for the same PR simultaneously (saves tokens)
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: 'write'
+  contents: 'read'
+  actions: 'read'
+
+jobs:
+  detect-changes:
+    name: 'Detect Steering Changes'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    # Security: pull_request_target allows secrets, so we must gate carefully.
+    # Detection should not run code from the fork.
+    if: "github.repository == 'google-gemini/gemini-cli' && github.event.pull_request.draft == false"
+    outputs:
+      SHOULD_RUN: '${{ steps.detect.outputs.SHOULD_RUN }}'
+      STEERING_DETECTED: '${{ steps.detect.outputs.STEERING_DETECTED }}'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          # Check out the trusted code from main for detection
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: 'Detect Steering Changes'
+        id: 'detect'
+        env:
+          # Use the PR's head SHA for comparison without checking it out
+          PR_HEAD_SHA: '${{ github.event.pull_request.head.sha }}'
+        run: |
+          # Fetch the fork's PR branch for analysis
+          git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-head
+
+          # Run the trusted script from main
+          SHOULD_RUN=$(node scripts/changed_prompt.js)
+          STEERING_DETECTED=$(node scripts/changed_prompt.js --steering-only)
+          echo "SHOULD_RUN=$SHOULD_RUN" >> "$GITHUB_OUTPUT"
+          echo "STEERING_DETECTED=$STEERING_DETECTED" >> "$GITHUB_OUTPUT"
+
+      - name: 'Notify Approval Required'
+        if: "steps.detect.outputs.SHOULD_RUN == 'true'"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          COMMENT_BODY="### 🛑 Action Required: Evaluation Approval
+
+          Steering changes have been detected in this PR. To prevent regressions, a maintainer must approve the evaluation run before this PR can be merged.
+
+          **Maintainers:**
+          1. Go to the [**Workflow Run Summary**]($RUN_URL).
+          2. Click the yellow **'Review deployments'** button.
+          3. Select the **'eval-gate'** environment and click **'Approve'**.
+
+          Once approved, the evaluation results will be posted here automatically.
+
+          <!-- eval-approval-notification -->"
+
+          # Check if comment already exists to avoid spamming
+          COMMENT_ID=$(gh pr view ${{ github.event.pull_request.number }} --json comments --jq '.comments[] | select(.body | contains("<!-- eval-approval-notification -->")) | .url' | grep -oE "[0-9]+$" | head -n 1)
+
+          if [ -z "$COMMENT_ID" ]; then
+            gh pr comment ${{ github.event.pull_request.number }} --body "$COMMENT_BODY"
+          else
+            echo "Updating existing notification comment $COMMENT_ID..."
+            gh api -X PATCH "repos/${{ github.repository }}/issues/comments/$COMMENT_ID" -F body="$COMMENT_BODY"
+          fi
+
+  pr-evaluation:
+    name: 'Evaluate Steering & Regressions'
+    needs: 'detect-changes'
+    if: "needs.detect-changes.outputs.SHOULD_RUN == 'true'"
+    # Manual approval gate via environment
+    environment: 'eval-gate'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    env:
+      # CENTRALIZED MODEL LIST
+      MODEL_LIST: 'gemini-3-flash-preview'
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          # Check out the fork's PR code for the actual evaluation
+          # This only runs AFTER manual approval
+          ref: '${{ github.event.pull_request.head.sha }}'
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: 'Remove Approval Notification'
+        # Run even if other steps fail, to ensure we clean up the "Action Required" message
+        if: 'always()'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          PR_NUMBER: '${{ github.event.pull_request.number }}'
+        run: |
+          echo "Debug: PR_NUMBER is '$PR_NUMBER'"
+          # Search for the notification comment by its hidden tag
+          COMMENT_ID=$(gh pr view "$PR_NUMBER" --json comments --jq '.comments[] | select(.body | contains("<!-- eval-approval-notification -->")) | .url' | grep -oE "[0-9]+$" | head -n 1)
+          if [ -n "$COMMENT_ID" ]; then
+            echo "Removing notification comment $COMMENT_ID now that run is approved..."
+            gh api -X DELETE "repos/${{ github.repository }}/issues/comments/$COMMENT_ID"
+          fi
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4.4.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Analyze PR Content (Guidance)'
+        if: "needs.detect-changes.outputs.STEERING_DETECTED == 'true'"
+        id: 'analysis'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          # Check for behavioral eval changes
+          EVAL_CHANGES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep "^evals/" || true)
+          if [ -z "$EVAL_CHANGES" ]; then
+            echo "MISSING_EVALS=true" >> "$GITHUB_OUTPUT"
+          fi
+
+          # Check if user is a maintainer
+          USER_PERMISSION=$(gh api repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission --jq '.permission')
+          if [[ "$USER_PERMISSION" == "admin" || "$USER_PERMISSION" == "write" ]]; then
+            echo "IS_MAINTAINER=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: 'Execute Regression Check'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          MODEL_LIST: '${{ env.MODEL_LIST }}'
+        run: |
+          # Run the regression check loop. The script saves the report to a file.
+          node scripts/run_eval_regression.js
+
+          # Use the generated report file if it exists
+          if [[ -f eval_regression_report.md ]]; then
+            echo "REPORT_FILE=eval_regression_report.md" >> "$GITHUB_ENV"
+          fi
+
+      - name: 'Post or Update PR Comment'
+        if: "always() && (needs.detect-changes.outputs.STEERING_DETECTED == 'true' || env.REPORT_FILE != '')"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          # 1. Build the full comment body
+          {
+            if [[ -f eval_regression_report.md ]]; then
+              cat eval_regression_report.md
+              echo ""
+            fi
+
+            if [[ "${{ needs.detect-changes.outputs.STEERING_DETECTED }}" == "true" ]]; then
+              echo "### 🧠 Model Steering Guidance"
+              echo ""
+              echo "This PR modifies files that affect the model's behavior (prompts, tools, or instructions)."
+              echo ""
+
+              if [[ "${{ steps.analysis.outputs.MISSING_EVALS }}" == "true" ]]; then
+                echo "- ⚠️ **Consider adding Evals:** No behavioral evaluations (\`evals/*.eval.ts\`) were added or updated in this PR. Consider [adding a test case](https://github.com/google-gemini/gemini-cli/blob/main/evals/README.md#creating-an-evaluation) to verify the new behavior and prevent regressions."
+              fi
+
+              if [[ "${{ steps.analysis.outputs.IS_MAINTAINER }}" == "true" ]]; then
+                echo "- 🚀 **Maintainer Reminder:** Please ensure that these changes do not regress results on benchmark evals before merging."
+              fi
+            fi
+
+            echo ""
+            echo "---"
+            echo "*This is an automated guidance message triggered by steering logic signatures.*"
+            echo "<!-- eval-pr-report -->"
+          } > full_comment.md
+
+          # 2. Find if a comment with our unique tag already exists
+          # We extract the numeric ID from the URL to ensure compatibility with the REST API
+          COMMENT_ID=$(gh pr view ${{ github.event.pull_request.number }} --json comments --jq '.comments[] | select(.body | contains("<!-- eval-pr-report -->")) | .url' | grep -oE "[0-9]+$" | head -n 1)
+
+          # 3. Update or Create the comment
+          if [ -n "$COMMENT_ID" ]; then
+            echo "Updating existing comment $COMMENT_ID via API..."
+            gh api -X PATCH "repos/${{ github.repository }}/issues/comments/$COMMENT_ID" -F body=@full_comment.md
+          else
+            echo "Creating new PR comment..."
+            gh pr comment ${{ github.event.pull_request.number }} --body-file full_comment.md
+          fi

.github/workflows/evals-nightly.yml

@@ -5,10 +5,18 @@ on:
     - cron: '0 1 * * *' # Runs at 1 AM every day
   workflow_dispatch:
     inputs:
-      run_all:
-        description: 'Run all evaluations (including usually passing)'
-        type: 'boolean'
-        default: true
+      suite_type:
+        description: 'Suite type to run'
+        type: 'choice'
+        options:
+          - 'behavioral'
+          - 'component-level'
+          - 'hero-scenario'
+        default: 'behavioral'
+      suite_name:
+        description: 'Specific suite name to run'
+        required: false
+        type: 'string'
       test_name_pattern:
         description: 'Test name pattern or file name'
         required: false
@@ -38,6 +46,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Set up Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
@@ -58,9 +68,15 @@ jobs:
         continue-on-error: true
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           GEMINI_MODEL: '${{ matrix.model }}'
-          RUN_EVALS: "${{ github.event.inputs.run_all != 'false' }}"
+          RUN_EVALS: 'true'
+          EVAL_SUITE_TYPE: "${{ github.event.inputs.suite_type || 'behavioral' }}"
+          EVAL_SUITE_NAME: '${{ github.event.inputs.suite_name }}'
           TEST_NAME_PATTERN: '${{ github.event.inputs.test_name_pattern }}'
+          # Disable Vitest internal retries to avoid double-retrying;
+          # custom retry logic is handled in evals/test-helper.ts
+          VITEST_RETRY: 0
         run: |
           CMD="npm run test:all_evals"
           PATTERN="${TEST_NAME_PATTERN}"
@@ -91,6 +107,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Download Logs'
         uses: 'actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806' # ratchet:actions/download-artifact@v4

.github/workflows/gemini-automated-issue-dedup.yml

@@ -48,6 +48,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Log in to GitHub Container Registry'
         uses: 'docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1' # ratchet:docker/login-action@v3
@@ -67,6 +69,7 @@ jobs:
           REPOSITORY: '${{ github.repository }}'
           FIRESTORE_PROJECT: '${{ vars.FIRESTORE_PROJECT }}'
         with:
+          upload_artifacts: 'true'
           gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
           gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
@@ -105,10 +108,12 @@ jobs:
                 }
               },
               "maxSessionTurns": 25,
-              "coreTools": [
-                "run_shell_command(echo)",
-                "run_shell_command(gh issue view)"
-              ],
+              "tools": {
+                "core": [
+                  "run_shell_command(echo)",
+                  "run_shell_command(gh issue view)"
+                ]
+              },
               "telemetry": {
                 "enabled": true,
                 "target": "gcp"

.github/workflows/gemini-automated-issue-triage.yml

@@ -90,6 +90,8 @@ jobs:
 
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Generate GitHub App Token'
         id: 'generate_token'
@@ -134,15 +136,12 @@ jobs:
         id: 'gemini_issue_analysis'
         env:
           GITHUB_TOKEN: '' # Do not pass any auth token here since this runs on untrusted inputs
-          ISSUE_TITLE: >-
-            ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.title || github.event.issue.title }}
-          ISSUE_BODY: >-
-            ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.body || github.event.issue.body }}
           ISSUE_NUMBER: >-
             ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.issue_number || inputs.issue_number) || github.event.issue.number }}
           REPOSITORY: '${{ github.repository }}'
           AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
         with:
+          upload_artifacts: 'true'
           gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
           gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
@@ -157,17 +156,24 @@ jobs:
                 "enabled": true,
                 "target": "gcp"
               },
-              "coreTools": [
-                "run_shell_command(echo)"
-              ]
+              "tools": {
+                "core": []
+              }
             }
           prompt: |-
             ## Role
 
             You are an issue triage assistant. Your role is to analyze a GitHub issue and determine the single most appropriate area/ label based on the definitions provided.
 
+            ## Issue Context
+            Title: ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.title || github.event.issue.title }}
+            Body:
+            --- START OF ISSUE BODY ---
+            ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.body || github.event.issue.body }}
+            --- END OF ISSUE BODY ---
+
             ## Steps
-            1. Review the issue title and body: ${{ env.ISSUE_TITLE }} and ${{ env.ISSUE_BODY }}.
+            1. Analyze the issue context above.
             2. Review the available labels: ${{ env.AVAILABLE_LABELS }}.
             3. Select exactly one area/ label that best matches the issue based on Reference 1: Area Definitions.
             4. Fallback Logic:
@@ -322,14 +328,41 @@ jobs:
               return;
             }
 
+            const newAreaLabel = labelsToAdd[0];
+
+            // Get current labels to resolve conflicts
+            const { data: currentLabels } = await github.rest.issues.listLabelsOnIssue({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issueNumber,
+            });
+            const currentLabelNames = currentLabels.map(l => l.name);
+            const currentAreaLabels = currentLabelNames.filter(name => name.startsWith('area/'));
+
+            const labelsToRemove = currentAreaLabels.filter(name => name !== newAreaLabel);
+
+            for (const label of labelsToRemove) {
+              try {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issueNumber,
+                  name: label
+                });
+                core.info(`Removed conflicting area label: ${label}`);
+              } catch (e) {
+                core.warning(`Failed to remove label ${label}: ${e.message}`);
+              }
+            }
+
             // Set labels based on triage result
             await github.rest.issues.addLabels({
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: issueNumber,
-              labels: labelsToAdd
+              labels: [newAreaLabel]
             });
-            core.info(`Successfully added labels for #${issueNumber}: ${labelsToAdd.join(', ')}`);
+            core.info(`Successfully added labels for #${issueNumber}: ${newAreaLabel}`);
 
       - name: 'Post Issue Analysis Failure Comment'
         if: |-

.github/workflows/gemini-cli-bot-brain.yml

@@ -0,0 +1,348 @@
+name: '🧠 Gemini CLI Bot: Brain'
+
+on:
+  schedule:
+    - cron: '0 0 * * *' # Every 24 hours
+  issue_comment:
+    types: ['created']
+  workflow_dispatch:
+    inputs:
+      run_interactive:
+        description: 'Run interactive flow (requires issue_number)'
+        type: 'boolean'
+        default: false
+      issue_number:
+        description: 'Issue/PR number to simulate context from'
+        type: 'string'
+        required: false
+      comment_id:
+        description: 'Specific comment ID to simulate'
+        type: 'string'
+        required: false
+      clear_memory:
+        description: 'Clear memory (drops learnings from previous runs)'
+        type: 'boolean'
+        default: false
+      enable_prs:
+        description: 'Enable PRs (automatically promote changes to PRs)'
+        type: 'boolean'
+        default: false
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.event.issue.number || github.event.inputs.issue_number || github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  reasoning:
+    name: 'Brain (Reasoning Layer)'
+    runs-on: 'ubuntu-latest'
+    if: |
+      github.repository == 'google-gemini/gemini-cli' && (
+        github.event_name == 'schedule' ||
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.run_interactive != 'true') ||
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.run_interactive == 'true') ||
+        (github.event_name == 'issue_comment' && github.event.comment.user.login != 'gemini-cli[bot]' && contains(github.event.comment.body, '@gemini-cli') && contains(fromJSON('["COLLABORATOR", "MEMBER", "OWNER"]'), github.event.comment.author_association))
+      )
+    # The reasoning phase is strictly readonly.
+    permissions:
+      contents: 'read'
+      issues: 'read'
+      actions: 'read'
+    steps:
+      - name: 'Determine Checkout Ref'
+        id: 'determine_ref'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
+        run: |
+          REF="${{ github.ref }}"
+          if [ -n "$ISSUE_NUMBER" ]; then
+            PR_HEAD=$(gh pr view "$ISSUE_NUMBER" --repo "${{ github.repository }}" --json headRefName --jq .headRefName 2>/dev/null || echo "")
+            if [ -n "$PR_HEAD" ]; then
+              REF="$PR_HEAD"
+            fi
+          fi
+          echo "ref=$REF" >> "$GITHUB_OUTPUT"
+
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ steps.determine_ref.outputs.ref }}'
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build Gemini CLI'
+        run: 'npm run bundle'
+
+      - name: 'Download Previous State'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          if [ "${{ github.event.inputs.clear_memory }}" = "true" ]; then
+            echo "Memory clear requested. Skipping previous state download."
+            exit 0
+          fi
+
+          # Find the last successful run of this workflow
+          LAST_RUN_ID=$(gh run list --workflow "${{ github.workflow }}" --status success --limit 1 --json databaseId --jq '.[0].databaseId')
+
+          if [ -n "$LAST_RUN_ID" ]; then
+            echo "Found previous successful run: $LAST_RUN_ID"
+
+            # Download brain memory to a temp dir so we can selectively restore only persistent state
+            mkdir -p .temp_brain_data
+            gh run download "$LAST_RUN_ID" -n brain-data -D .temp_brain_data || echo "brain-data not found"
+
+            # Restore only persistent memory files
+            cp .temp_brain_data/tools/gemini-cli-bot/lessons-learned.md tools/gemini-cli-bot/lessons-learned.md 2>/dev/null || true
+            mkdir -p tools/gemini-cli-bot/history/
+            cp .temp_brain_data/tools/gemini-cli-bot/history/*.csv tools/gemini-cli-bot/history/ 2>/dev/null || true
+            rm -rf .temp_brain_data
+          else
+            echo "No previous successful run found."
+          fi
+
+      - name: 'Collect Current Metrics'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: 'npx tsx tools/gemini-cli-bot/metrics/index.ts'
+
+      - name: 'Run Brain Phases'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GEMINI_MODEL: 'gemini-3-flash-preview'
+          GEMINI_CLI_HOME: 'tools/gemini-cli-bot'
+          ENABLE_PRS: "${{ github.event.inputs.enable_prs || 'false' }}"
+          TRIGGER_ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
+          TRIGGER_COMMENT_ID: '${{ github.event.comment.id || github.event.inputs.comment_id }}'
+        run: |
+          PROMPT_PATH="tools/gemini-cli-bot/brain/scheduled.md"
+          if [ "${{ github.event_name }}" = "issue_comment" ] || [ "${{ github.event.inputs.run_interactive }}" = "true" ]; then
+            PROMPT_PATH="tools/gemini-cli-bot/brain/interactive.md"
+            export ENABLE_PRS="true"
+          fi
+
+          touch trigger_context.md
+          if [ -n "$TRIGGER_ISSUE_NUMBER" ]; then
+            echo "<untrusted_context>" > trigger_context.md
+            echo "# Interactive Trigger Context" >> trigger_context.md
+            echo "You were invoked by a user in issue/PR #$TRIGGER_ISSUE_NUMBER." >> trigger_context.md
+
+            if [ -n "$TRIGGER_COMMENT_ID" ]; then
+              echo "## User Comment" >> trigger_context.md
+              gh api "repos/${{ github.repository }}/issues/comments/$TRIGGER_COMMENT_ID" -q '.body' >> trigger_context.md 2>/dev/null || gh api "repos/${{ github.repository }}/pulls/comments/$TRIGGER_COMMENT_ID" -q '.body' >> trigger_context.md
+              echo "" >> trigger_context.md
+            fi
+
+            echo "## Issue/PR Context" >> trigger_context.md
+            gh issue view "$TRIGGER_ISSUE_NUMBER" >> trigger_context.md 2>/dev/null || gh pr view "$TRIGGER_ISSUE_NUMBER" >> trigger_context.md
+            echo "</untrusted_context>" >> trigger_context.md
+          fi
+
+          if [ "$ENABLE_PRS" = "true" ]; then
+            echo "**System Directive**: PR creation is ENABLED for this run. You MUST activate the **'prs' skill** to stage your changes and generate a \`pr-description.md\` file if you are proposing fixes." >> trigger_context.md
+            echo "**CRITICAL System Directive**: You MUST ONLY propose and implement a **SINGLE** improvement or fix per run. Bundling unrelated changes (e.g., a documentation update and a script fix, or a metrics update and a logic fix) into a single PR is STRICTLY FORBIDDEN and will result in immediate rejection during the critique phase. If you identify multiple issues, pick the most impactful one and ignore the others for now." >> trigger_context.md
+          else
+            echo "**System Directive**: PR creation is DISABLED for this run. You MUST NOT stage files or attempt to create a PR description." >> trigger_context.md
+          fi
+          echo "" >> trigger_context.md
+
+          cat trigger_context.md "$PROMPT_PATH" > combined_prompt.md
+          node bundle/gemini.js --policy tools/gemini-cli-bot/ci-policy.toml --prompt="$(cat combined_prompt.md)"
+
+          if [ -n "$TRIGGER_ISSUE_NUMBER" ] && [ ! -s "issue-comment.md" ] && [ ! -s "pr-comment.md" ]; then
+            echo "Agent failed to respond. Generating fallback error message."
+            echo "⚠️ **Gemini CLI Bot failed to generate a response.**" > "issue-comment.md"
+            echo "" >> "issue-comment.md"
+            echo "I encountered an error or failed to generate a complete response to your request. You can check the [GitHub Actions Run Log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details on what went wrong." >> "issue-comment.md"
+          fi
+
+      - name: 'Run Critique Phase'
+        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GEMINI_MODEL: 'gemini-3-flash-preview'
+          GEMINI_CLI_HOME: 'tools/gemini-cli-bot'
+        run: |
+          if git diff --staged --quiet; then
+             echo "No changes staged. Skipping critique."
+             echo "[APPROVED]" > critique_result.txt
+          else
+             node bundle/gemini.js --policy tools/gemini-cli-bot/ci-policy.toml --prompt="$(cat tools/gemini-cli-bot/.gemini/skills/critique/SKILL.md)" 2>&1 | tee critique_output.log
+
+             if [ "${PIPESTATUS[0]}" -eq 0 ] && grep -q "\[APPROVED\]" critique_output.log && ! grep -q "\[REJECTED\]" critique_output.log; then
+               echo "[APPROVED]" > critique_result.txt
+             else
+               echo "Critique failed, rejected, or did not explicitly approve changes. Skipping PR creation."
+               echo "[REJECTED]" > critique_result.txt
+             fi
+          fi
+
+      - name: 'Generate Patch'
+        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
+        run: |
+          touch bot-changes.patch
+          touch pr-description.md
+          if [ -f critique_result.txt ] && grep -q "\[APPROVED\]" critique_result.txt && ! grep -q "\[REJECTED\]" critique_result.txt; then
+             git diff --staged > bot-changes.patch
+          else
+             echo "Critique did not approve. Skipping patch generation."
+          fi
+
+      - name: 'Archive Brain Data'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'brain-data'
+          path: |
+            tools/gemini-cli-bot/lessons-learned.md
+            tools/gemini-cli-bot/history/*.csv
+            bot-changes.patch
+            pr-description.md
+            branch-name.txt
+            pr-comment.md
+            pr-number.txt
+            issue-comment.md
+          retention-days: 90
+
+  publish:
+    name: 'Publish Artifacts (Archive Layer)'
+    needs: 'reasoning'
+    runs-on: 'ubuntu-latest'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    # The publish phase is for archiving artifacts and optionally creating PRs.
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+      actions: 'write'
+    steps:
+      - name: 'Generate GitHub App Token 🔑'
+        id: 'generate_token'
+        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
+        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # ratchet:actions/create-github-app-token@v2
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+          owner: '${{ github.repository_owner }}'
+          repositories: '${{ github.event.repository.name }}'
+          permission-contents: 'write'
+          permission-pull-requests: 'write'
+          permission-issues: 'write'
+
+      - name: 'Determine Checkout Ref'
+        id: 'determine_ref'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
+        run: |
+          REF="main"
+          if [ -n "$ISSUE_NUMBER" ]; then
+            PR_HEAD=$(gh pr view "$ISSUE_NUMBER" --repo "${{ github.repository }}" --json headRefName --jq .headRefName 2>/dev/null || echo "")
+            if [ -n "$PR_HEAD" ]; then
+              REF="$PR_HEAD"
+            fi
+          fi
+          echo "ref=$REF" >> "$GITHUB_OUTPUT"
+
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ steps.determine_ref.outputs.ref }}'
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: 'Download Brain Data'
+        uses: 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093' # ratchet:actions/download-artifact@v4
+        with:
+          name: 'brain-data'
+          path: '${{ runner.temp }}/brain-data/'
+
+      - name: 'Create or Update PR'
+        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
+        env:
+          GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
+          FALLBACK_PAT: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+        run: |
+          if [ -s "${{ runner.temp }}/brain-data/bot-changes.patch" ]; then
+            git config user.name "gemini-cli[bot]"
+            git config user.email "gemini-cli[bot]@users.noreply.github.com"
+            git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
+
+            BRANCH_NAME="bot/productivity-updates-$(date +'%Y%m%d%H%M%S')-${{ github.run_id }}"
+            if [ -f "${{ runner.temp }}/brain-data/branch-name.txt" ]; then
+              BRANCH_NAME=$(cat "${{ runner.temp }}/brain-data/branch-name.txt")
+            fi
+
+            if [[ ! "$BRANCH_NAME" =~ ^bot/ ]]; then
+              echo "Error: Branch name '$BRANCH_NAME' does not start with 'bot/'. Safety abort."
+              exit 1
+            fi
+
+            git checkout -B "$BRANCH_NAME"
+            git apply "${{ runner.temp }}/brain-data/bot-changes.patch"
+            git add .
+
+            if [ -s "${{ runner.temp }}/brain-data/pr-description.md" ]; then
+              git commit -F "${{ runner.temp }}/brain-data/pr-description.md"
+            else
+              git commit -m "🤖 Gemini Bot Productivity Optimizations"
+            fi
+
+            PR_TITLE="🤖 Gemini Bot Productivity Optimizations"
+            if [ -s "${{ runner.temp }}/brain-data/pr-description.md" ]; then
+              PR_TITLE=$(head -n 1 "${{ runner.temp }}/brain-data/pr-description.md")
+            fi
+
+            if ! git push origin "$BRANCH_NAME" --force; then
+              echo "Push failed. Retrying with FALLBACK_PAT..."
+              export GH_TOKEN="$FALLBACK_PAT"
+              git remote set-url origin "https://x-access-token:${FALLBACK_PAT}@github.com/${{ github.repository }}.git"
+              git push origin "$BRANCH_NAME" --force
+            fi
+
+            if ! gh pr view "$BRANCH_NAME" > /dev/null 2>&1; then
+              gh pr create --draft --title "$PR_TITLE" --body-file "${{ runner.temp }}/brain-data/pr-description.md" --head "$BRANCH_NAME" --base main || \
+              gh pr create --draft --title "🤖 Gemini Bot Productivity Optimizations" --body "Automated changes generated by Gemini CLI Bot." --head "$BRANCH_NAME" --base main
+            else
+              PR_STATE=$(gh pr view "$BRANCH_NAME" --json state --jq .state)
+              if [ "$PR_STATE" = "CLOSED" ]; then
+                NEW_BRANCH_NAME="${BRANCH_NAME}-retry-${{ github.run_id }}"
+                git checkout -b "$NEW_BRANCH_NAME"
+                git push origin "$NEW_BRANCH_NAME" --force
+                gh pr create --draft --title "$PR_TITLE" --body-file "${{ runner.temp }}/brain-data/pr-description.md" --head "$NEW_BRANCH_NAME" --base main || \
+                gh pr create --draft --title "🤖 Gemini Bot Productivity Optimizations" --body "Automated changes generated by Gemini CLI Bot." --head "$NEW_BRANCH_NAME" --base main
+              fi
+            fi
+          fi
+
+      - name: 'Post PR/Issue Comment'
+        env:
+          GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
+          TRIGGER_ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
+        run: |
+          if [ -s "${{ runner.temp }}/brain-data/issue-comment.md" ] && [ -n "$TRIGGER_ISSUE_NUMBER" ]; then
+            echo "Posting comment to triggering issue #$TRIGGER_ISSUE_NUMBER"
+            # Use REST API (gh api) instead of GraphQL (gh issue comment) to ensure robot identity
+            # while avoiding potential GraphQL-specific authorization hurdles with PATs.
+            gh api "repos/${{ github.repository }}/issues/$TRIGGER_ISSUE_NUMBER/comments" -F body=@"${{ runner.temp }}/brain-data/issue-comment.md"
+          fi
+
+          if [ -s "${{ runner.temp }}/brain-data/pr-comment.md" ] && [ -f "${{ runner.temp }}/brain-data/pr-number.txt" ]; then
+            PR_NUM=$(cat "${{ runner.temp }}/brain-data/pr-number.txt")
+
+            # Using GitHub App, so author check is no longer valid against gemini-cli-robot
+            # Skipping author validation here to let the app post.
+
+            # Use REST API (gh api) for consistency and robot identity
+            gh api "repos/${{ github.repository }}/issues/$PR_NUM/comments" -F body=@"${{ runner.temp }}/brain-data/pr-comment.md"
+          fi

.github/workflows/gemini-cli-bot-pulse.yml

@@ -0,0 +1,49 @@
+name: '🔄 Gemini CLI Bot: Pulse'
+
+on:
+  schedule:
+    - cron: '*/30 * * * *' # Every 30 minutes
+  workflow_dispatch:
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.ref }}'
+  cancel-in-progress: true
+
+permissions:
+  contents: 'write'
+  issues: 'write'
+  pull-requests: 'write'
+
+jobs:
+  pulse:
+    name: 'Pulse (Reflex Layer)'
+    runs-on: 'ubuntu-latest'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Run Reflex Processes'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          if [ -d "tools/gemini-cli-bot/reflexes/scripts" ] && [ "$(ls -A tools/gemini-cli-bot/reflexes/scripts)" ]; then
+            for script in tools/gemini-cli-bot/reflexes/scripts/*.ts; do
+              echo "Running reflex script: $script"
+              npx tsx "$script"
+            done
+          else
+            echo "No reflex scripts found."
+          fi

.github/workflows/gemini-lifecycle-manager.yml

@@ -0,0 +1,47 @@
+name: '🔄 Gemini Scheduled Lifecycle Manager'
+
+on:
+  schedule:
+    - cron: '30 1 * * *' # Once a day
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run in dry-run mode (no changes applied)'
+        required: false
+        default: false
+        type: 'boolean'
+
+concurrency:
+  group: '${{ github.workflow }}'
+  cancel-in-progress: true
+
+permissions:
+  issues: 'write'
+  pull-requests: 'write'
+
+jobs:
+  manage-lifecycle:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: 'Lifecycle Management'
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        env:
+          DRY_RUN: '${{ inputs.dry_run }}'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |
+            const script = require('./.github/scripts/gemini-lifecycle-manager.cjs');
+            await script({github, context, core});

.github/workflows/gemini-scheduled-issue-dedup.yml

@@ -28,6 +28,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Log in to GitHub Container Registry'
         uses: 'docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1' # ratchet:docker/login-action@v3
@@ -47,6 +49,7 @@ jobs:
           REPOSITORY: '${{ github.repository }}'
           FIRESTORE_PROJECT: '${{ vars.FIRESTORE_PROJECT }}'
         with:
+          upload_artifacts: 'true'
           gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
           gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
@@ -85,9 +88,11 @@ jobs:
                 }
               },
               "maxSessionTurns": 25,
-              "coreTools": [
-                "run_shell_command(echo)"
-              ],
+              "tools": {
+                "core": [
+                  "run_shell_command(echo)"
+                ]
+              },
               "telemetry": {
                 "enabled": true,
                 "target": "gcp"

.github/workflows/gemini-scheduled-issue-triage.yml

@@ -1,10 +1,6 @@
 name: '📋 Gemini Scheduled Issue Triage'
 
 on:
-  issues:
-    types:
-      - 'opened'
-      - 'reopened'
   schedule:
     - cron: '0 * * * *' # Runs every hour
   workflow_dispatch:
@@ -23,13 +19,27 @@ permissions:
 
 jobs:
   triage-issues:
-    timeout-minutes: 10
+    timeout-minutes: 60
     if: |-
       ${{ github.repository == 'google-gemini/gemini-cli' }}
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: 'Install Utilities'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ripgrep
+
+      - name: 'Get Current Version'
+        id: 'get_version'
+        run: |
+          VERSION=$(jq -r .version package.json | cut -d'-' -f1)
+          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
+          echo "🚀 Current CLI Version: ${VERSION}"
 
       - name: 'Generate GitHub App Token'
         id: 'generate_token'
@@ -47,10 +57,38 @@ jobs:
           ISSUE_EVENT: '${{ toJSON(github.event.issue) }}'
         run: |
           set -euo pipefail
-          ISSUE_JSON=$(echo "$ISSUE_EVENT" | jq -c '[{number: .number, title: .title, body: .body}]')
-          echo "issues_to_triage=${ISSUE_JSON}" >> "${GITHUB_OUTPUT}"
+          echo "$ISSUE_EVENT" | jq -c '[{number: .number, title: .title, body: .body}]' > issues_to_triage.json
+          echo "has_issues=true" >> "${GITHUB_OUTPUT}"
           echo "✅ Found issue #${{ github.event.issue.number }} from event to triage! 🎯"
 
+      - name: 'Sync Issue Types'
+        if: |-
+          ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |-
+            const syncIssueTypes = require('./.github/scripts/sync-issue-types.cjs');
+            await syncIssueTypes({ github, context, core });
+
+      - name: 'Find Issues with Conflicting Labels'
+        if: |-
+          ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+        env:
+          GITHUB_TOKEN: '${{ steps.generate_token.outputs.token }}'
+          GITHUB_REPOSITORY: '${{ github.repository }}'
+        run: |-
+          set -euo pipefail
+          echo '🔍 Fetching open issues to find conflicts...'
+          # Fetch up to 2000 open issues in one quick GraphQL-backed query
+          gh issue list --repo "${GITHUB_REPOSITORY}" --search "is:issue is:open" --limit 2000 --json number,title,body,labels > all_open_issues.json
+
+          echo '🧹 Filtering issues with multiple area/ or priority/ labels...'
+          jq -c '[ .[] | select( (.labels | map(select(.name | startswith("area/"))) | length) > 1 or (.labels | map(select(.name | startswith("priority/"))) | length) > 1 ) ] | .[0:50]' all_open_issues.json > conflicting_labels_issues.json
+
+          CONFLICT_COUNT=$(jq 'length' conflicting_labels_issues.json)
+          echo "Found ${CONFLICT_COUNT} issues with conflicting labels (capped at 50 for processing)."
+
       - name: 'Find untriaged issues'
         if: |-
           ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
@@ -62,25 +100,56 @@ jobs:
           set -euo pipefail
 
           echo '🔍 Finding issues missing area labels...'
-          NO_AREA_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue -label:area/core -label:area/agent -label:area/enterprise -label:area/non-interactive -label:area/security -label:area/platform -label:area/extensions -label:area/documentation -label:area/unknown' --limit 100 --json number,title,body)"
+          gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:area/core -label:area/agent -label:area/enterprise -label:area/non-interactive -label:area/security -label:area/platform -label:area/extensions -label:area/documentation -label:area/unknown' --limit 50 --json number,title,body,labels > no_area_issues.json
 
           echo '🔍 Finding issues missing kind labels...'
-          NO_KIND_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue -label:kind/bug -label:kind/enhancement -label:kind/customer-issue -label:kind/question' --limit 100 --json number,title,body)"
+          gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:kind/bug -label:kind/enhancement -label:kind/customer-issue -label:kind/question' --limit 50 --json number,title,body,labels > no_kind_issues.json
 
           echo '🏷️ Finding issues missing priority labels...'
-          NO_PRIORITY_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue -label:priority/p0 -label:priority/p1 -label:priority/p2 -label:priority/p3 -label:priority/unknown' --limit 100 --json number,title,body)"
+          gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:priority/p0 -label:priority/p1 -label:priority/p2 -label:priority/p3 -label:priority/unknown' --limit 50 --json number,title,body,labels > no_priority_issues.json
 
-          echo '🔄 Merging and deduplicating issues...'
-          ISSUES="$(echo "${NO_AREA_ISSUES}" "${NO_KIND_ISSUES}" "${NO_PRIORITY_ISSUES}" | jq -c -s 'add | unique_by(.number)')"
+          echo '📏 Finding issues missing effort labels...'
+          gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:effort/small -label:effort/medium -label:effort/large label:area/core,area/extensions,area/site,area/non-interactive' --limit 20 --json number,title,body,labels > no_effort_issues.json
 
-          echo '📝 Setting output for GitHub Actions...'
-          echo "issues_to_triage=${ISSUES}" >> "${GITHUB_OUTPUT}"
+          echo '🔄 Merging and deduplicating standard triage issues...'
+          if [ ! -f conflicting_labels_issues.json ]; then echo "[]" > conflicting_labels_issues.json; fi
+          jq -c -s 'add | unique_by(.number)' no_area_issues.json no_kind_issues.json no_priority_issues.json conflicting_labels_issues.json > standard_issues_to_triage.json
 
-          ISSUE_COUNT="$(echo "${ISSUES}" | jq 'length')"
-          echo "✅ Found ${ISSUE_COUNT} unique issues to triage! 🎯"
+          echo '📏 Deduplicating effort issues...'
+          jq -c -s 'add | unique_by(.number)' no_effort_issues.json > effort_issues_to_triage.json
+
+          STANDARD_COUNT="$(jq 'length' standard_issues_to_triage.json)"
+          EFFORT_COUNT="$(jq 'length' effort_issues_to_triage.json)"
+          if [ "$STANDARD_COUNT" -gt 0 ] || [ "$EFFORT_COUNT" -gt 0 ]; then
+            echo "has_issues=true" >> "${GITHUB_OUTPUT}"
+            echo "has_standard_issues=$([ "$STANDARD_COUNT" -gt 0 ] && echo 'true' || echo 'false')" >> "${GITHUB_OUTPUT}"
+            echo "has_effort_issues=$([ "$EFFORT_COUNT" -gt 0 ] && echo 'true' || echo 'false')" >> "${GITHUB_OUTPUT}"
+          else
+            echo "has_issues=false" >> "${GITHUB_OUTPUT}"
+            echo "has_standard_issues=false" >> "${GITHUB_OUTPUT}"
+            echo "has_effort_issues=false" >> "${GITHUB_OUTPUT}"
+          fi
+          echo "✅ Found ${STANDARD_COUNT} standard issues and ${EFFORT_COUNT} effort issues to triage! 🎯"
+
+      - name: 'Create Gemini CLI Experiments Override'
+        if: |-
+          steps.get_issue_from_event.outputs.has_issues == 'true' || steps.find_issues.outputs.has_issues == 'true'
+        run: |
+          cat << 'EOF' > gemini_exp.json
+          {
+            "flags": [
+              {
+                "flagId": 45750526,
+                "boolValue": false
+              }
+            ],
+            "experimentIds": []
+          }
+          EOF
 
       - name: 'Get Repository Labels'
         id: 'get_labels'
@@ -97,18 +166,21 @@ jobs:
             core.info(`Found ${labelNames.length} labels: ${labelNames.join(', ')}`);
             return labelNames;
 
-      - name: 'Run Gemini Issue Analysis'
+      - name: 'Run Standard Triage Analysis'
         if: |-
-          (steps.get_issue_from_event.outputs.issues_to_triage != '' && steps.get_issue_from_event.outputs.issues_to_triage != '[]') ||
-          (steps.find_issues.outputs.issues_to_triage != '' && steps.find_issues.outputs.issues_to_triage != '[]')
+          steps.get_issue_from_event.outputs.has_issues == 'true' || steps.find_issues.outputs.has_standard_issues == 'true'
         uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
-        id: 'gemini_issue_analysis'
+        id: 'gemini_standard_issue_analysis'
         env:
           GITHUB_TOKEN: '' # Do not pass any auth token here since this runs on untrusted inputs
-          ISSUES_TO_TRIAGE: '${{ steps.get_issue_from_event.outputs.issues_to_triage || steps.find_issues.outputs.issues_to_triage }}'
           REPOSITORY: '${{ github.repository }}'
           AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
+          CLI_VERSION: '${{ steps.get_version.outputs.version }}'
+          GEMINI_EXP: 'gemini_exp.json'
+          GEMINI_STRICT_TELEMETRY_LIMITS: 'true'
+          GEMINI_MODEL: 'gemini-3-flash-preview'
         with:
+          upload_artifacts: 'true'
           gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
           gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
@@ -119,11 +191,14 @@ jobs:
           settings: |-
             {
               "maxSessionTurns": 25,
-              "coreTools": [
-                "run_shell_command(echo)"
-              ],
+              "tools": {
+                "core": [
+                  "run_shell_command(echo)",
+                  "read_file"
+                ]
+              },
               "telemetry": {
-                "enabled": true,
+                "enabled": false,
                 "target": "gcp"
               }
             }
@@ -136,14 +211,16 @@ jobs:
 
             ## Steps
 
-            1. You are only able to use the echo command. Review the available labels in the environment variable: "${AVAILABLE_LABELS}".
-            2. Check environment variable for issues to triage: $ISSUES_TO_TRIAGE (JSON array of issues)
-            3. Review the issue title, body and any comments provided in the environment variables.
-            4. Identify the most relevant labels from the existing labels, specifically focusing on area/*, kind/* and priority/*.
+            1. You are only able to use the echo and read_file commands. Review the available labels in the environment variable: "${AVAILABLE_LABELS}".
+            2. Use the read_file tool to read the file "standard_issues_to_triage.json" which contains the JSON array of issues to triage (including their current labels).
+            3. Review the issue title, body, current labels, and any comments provided in the JSON file.
+            4. Identify the most relevant labels from the existing labels, specifically focusing on area/*, kind/*, and priority/*.
             5. Label Policy:
                - If the issue already has a kind/ label, do not change it.
-               - If the issue already has a priority/ label, do not change it.
-               - If the issue already has an area/ label, do not change it.
+               - If the issue has exactly ONE priority/ label, do not change it (unless you are explicitly re-evaluating an ambiguous priority).
+               - If the issue is missing a priority/ label, OR if the issue currently has MULTIPLE priority/ labels, you must evaluate the issue's impact to determine exactly ONE priority level (priority/p0, priority/p1, priority/p2, priority/p3, or priority/unknown) based the guidelines. If you are fixing an issue with multiple priority/ labels, put the correct one in `labels_to_add` and put all the incorrect ones in `labels_to_remove`.
+               - If the issue has exactly ONE area/ label, do not change it.
+               - If the issue is missing an area/ label, OR if the issue currently has MULTIPLE area/ labels, select exactly ONE area/ label that best fits the issue. Issues MUST NOT have multiple area/ labels. If you are fixing an issue with multiple area/ labels, put the correct one in `labels_to_add` and put all the incorrect ones in `labels_to_remove`.
                - If any of these are missing, select exactly ONE appropriate label for the missing category.
             6. Identify other applicable labels based on the issue content, such as status/*, help wanted, good first issue, etc.
             7. Give me a single short explanation about why you are selecting each label in the process.
@@ -160,11 +237,12 @@ jobs:
                ]
                ```
               If an issue cannot be classified, do not include it in the output array.
-            9. For each issue please check if CLI version is present, this is usually in the output of the /about command and will look like 0.1.5
-              - Anything more than 6 versions older than the most recent should add the status/need-retesting label
-            10. If you see that the issue doesn't look like it has sufficient information recommend the status/need-information label and leave a comment politely requesting the relevant information, eg.. if repro steps are missing request for repro steps. if version information is missing request for version information into the explanation section below.
-            11. If you think an issue might be a Priority/P0 do not apply the priority/p0 label. Instead apply a status/manual-triage label and include a note in your explanation.
-            12. If you are uncertain about a category, use the area/unknown, kind/question, or priority/unknown labels as appropriate. If you are extremely uncertain, apply the status/manual-triage label.
+            9. For each issue, carefully check if the CLI version is present. It is usually found under the "### Client information" header, as a bullet point (e.g., "• CLI Version: 0.33.1", "* **CLI Version:** 0.42.0"), or in the output of the `/about` command.
+              - **Only for issues classified as kind/bug:** If the version is provided but is more than 6 minor versions older than the most recent release (current version is ${{ steps.get_version.outputs.version }}), apply the status/need-information label and leave a comment politely asking the user to verify if the issue persists in the latest version.
+            10. **Only for issues classified as kind/bug:** If the issue does not have sufficient information, recommend the status/need-information label and leave a comment politely requesting the missing details. For example, if repro steps are missing, ask for them; if the CLI version is completely missing, ask for the version information in the explanation section below. Do not ask for version info if it is already in the issue body. (Check both bullet points and bold text). For features and enhancements, the CLI version is NOT required.
+            11. If you think an issue is a Priority/P0, you MUST apply the priority/p1 label AND the status/manual-triage label, and include a note in your explanation that it likely requires P0 escalation.
+            12. If the issue is highly ambiguous, completely lacks a description, or you are torn between two lower priorities (like P2 vs P3), you MUST retain the existing priority label if one is already present. Do not toggle the priority if you do not have enough information to make a definitive change.
+            13. If you are uncertain about a category, use the area/unknown, kind/question, or priority/unknown labels as appropriate. If you are extremely uncertain, apply the status/manual-triage label.
 
             ## Guidelines
 
@@ -174,10 +252,126 @@ jobs:
               - Do not add comments or modify the issue content.
               - Do not remove the following labels maintainer, help wanted or good first issue.
               - Triage only the current issue.
-              - Identify only one area/ label.
+              - Identify exactly ONE area/ label. Do NOT assign multiple area/ labels to a single issue.
               - Identify only one kind/ label (Do not apply kind/duplicate or kind/parent-issue)
-              - Identify only one priority/ label.
-              - Once you categorize the issue if it needs information bump down the priority by 1 eg.. a p0 would become a p1 a p1 would become a p2. P2 and P3 can stay as is in this scenario.
+              - Identify exactly ONE priority/ label. Do NOT assign multiple priority/ labels to a single issue.
+              - **Do not manually downgrade the priority.** Always assign the true priority based on the guidelines. The system will handle downgrades programmatically if information is missing.
+              - **NEVER mention label names, label removals, or label additions in your `explanation`.** The explanation must be purely written for the user (e.g., "Please provide your CLI version.") without exposing internal triage mechanics (e.g., do NOT say "Removing area/unknown to leave only area/core").
+
+            Categorization Guidelines (Priority):
+            P0 - Urgent Blocking Issues:
+              - DO NOT APPLY THE priority/p0 LABEL AUTOMATICALLY. Instead apply priority/p1 and status/manual-triage.
+              - Definition: Critical failures breaking core functionality for a large portion of users. Examples: CLI fails to launch globally, core commands (gemini run) crash on valid input, unhandled promise rejections on boot, critical security vulnerability.
+              - Note: You must apply priority/p1 and status/manual-triage instead of priority/p0.
+            P1 - Critical but Workable:
+              - Definition: Severe issues without a reasonable workaround, significantly degrading the developer experience but not globally blocking. Examples: Specific tools failing consistently (e.g., `web_search` returns 500s), persistent PTY streaming hangs, memory leaks leading to OOM after short use.
+            P2 - Significant Issues:
+              - Definition: Affect some workflows but a clear workaround exists, or non-critical bugs. Examples: Theme flickering, confusing error messages, minor UI misalignment, failing to read deeply nested config files correctly.
+            P3 - Minor/Enhancements:
+              - Definition: Trivial bugs, typos, documentation requests, or feature requests.
+
+            Categorization Guidelines (Kind):
+            kind/bug: The issue is describing an unexpected behavior or failure in the application.
+            kind/enhancement: The issue is describing a feature request or an improvement to an existing feature.
+            kind/question: The issue is asking a question about how to use the CLI or about a specific feature.
+
+            Categorization Guidelines (Area):
+            area/agent: The "brain" of the CLI. Core agent logic, model quality, tool/function calling, memory, web search, generated code quality, sub-agents.
+            area/core: The fundamental CLI app. UI/UX, installation, OS compatibility, performance, command parsing, theming, flickering.
+            area/documentation: Website docs, READMEs, inline help text.
+            area/enterprise: Telemetry, Policy, Quota / Licensing
+            area/extensions: Gemini CLI extensions capability
+            area/non-interactive: GitHub Actions, SDK, 3P Integrations, Shell Scripting, Command line automation
+            area/platform: Platform specific behavior
+            area/security: Authentication, authorization, privacy, data leaks, credential storage.
+
+      - name: 'Stop Telemetry Collector'
+        if: |-
+          steps.find_issues.outputs.has_effort_issues == 'true'
+        run: 'docker rm -f gemini-telemetry-collector || true'
+
+      - name: 'Run Effort Triage Analysis'
+        if: |-
+          steps.find_issues.outputs.has_effort_issues == 'true'
+        uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
+        id: 'gemini_effort_issue_analysis'
+        env:
+          GITHUB_TOKEN: '' # Do not pass any auth token here since this runs on untrusted inputs
+          REPOSITORY: '${{ github.repository }}'
+          AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
+          CLI_VERSION: '${{ steps.get_version.outputs.version }}'
+          GEMINI_EXP: 'gemini_exp.json'
+          GEMINI_STRICT_TELEMETRY_LIMITS: 'true'
+          GEMINI_MODEL: 'gemini-3-flash-preview'
+        with:
+          upload_artifacts: 'true'
+          gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
+          gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
+          gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
+          gcp_service_account: '${{ vars.SERVICE_ACCOUNT_EMAIL }}'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          use_vertex_ai: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
+          use_gemini_code_assist: '${{ vars.GOOGLE_GENAI_USE_GCA }}'
+          settings: |-
+            {
+              "maxSessionTurns": 30,
+              "tools": {
+                "core": [
+                  "run_shell_command(echo)",
+                  "grep_search",
+                  "glob",
+                  "read_file"
+                ]
+              },
+              "telemetry": {
+                "enabled": false,
+                "target": "gcp"
+              }
+            }
+          prompt: |-
+            ## Role
+
+            You are an expert software architect. Analyze the provided GitHub issues and assign the correct `effort/*` label based on the codebase complexity.
+
+            ## Steps
+
+            1. Use the read_file tool to read "effort_issues_to_triage.json".
+            2. For each issue in the array:
+               - You must evaluate the architectural complexity to determine the effort level. You MUST NOT guess the root cause. You MUST actively use your codebase search tools (grep_search and glob) to search for keywords from the issue and explore the codebase. You must identify the specific files and components involved before deciding the effort.
+            3. Output a JSON array of objects, each containing the issue number and the effort label to add, along with an explanation and an effort_analysis field. This effort_analysis must be highly detailed, technical, and empirical. It MUST NOT contain vague guesses (e.g., avoid words like "likely points to" or "possibly"). You must explicitly cite the specific file paths and architectural mechanisms you discovered using your search tools, explain the root cause, and then explicitly state how that complexity maps to the chosen effort level guidelines. For example:
+               ```
+               [
+                 {
+                   "issue_number": 123,
+                   "labels_to_add": ["effort/small"],
+                   "explanation": "This is a simple logic fix.",
+                   "effort_analysis": "The `vscode-ide-companion` extension indiscriminately tracks active text editors via `vscode.window.onDidChangeActiveTextEditor` in `open-files-manager.ts`. When a user opens `.vscode/settings.json`, its content is sent to the CLI's context. The fix is highly localized to the VS Code companion extension's event listener. It involves adding a simple conditional check to exclude specific configuration files from the active editor tracking logic, which is a trivial logic adjustment with a clear root cause."
+                 }
+               ]
+               ```
+
+            ## Guidelines
+
+            - Output only valid JSON format
+            - Do not include any explanation or additional text, just the JSON
+            - Triage only the current issue.
+
+            Categorization Guidelines (Effort):
+            effort/small (1 day or less):
+              - Trivial Logic & Config: Schema updates (Zod), feature flag toggles, adding missing fields to package.json or settings.json.
+              - UI/Aesthetic Adjustments: Fixing minor layout bugs in Ink components (e.g., adding flexShrink, correcting padding in a single Box), text color changes.
+              - Documentation & Strings: Typos, log message updates, CLI argument descriptions.
+              - Localized Bug Fixes: Single-file logic errors, straightforward promise rejections (e.g., wrapping a known failure in a try/catch), simple regex or string parsing fixes.
+            effort/medium (2-3 days):
+              - React/Ink State Management: Debugging useState/useEffect/useReducer bugs, component lifecycle issues (memory leaks in the UI), terminal redraw flickering, or state synchronization between the CLI's internal input buffer and the interactive React components.
+              - Asynchronous Flow & Integration: Resolving complex Promise chains, ERR_STREAM_PREMATURE_CLOSE, debugging IDE companion extensions (VS Code, Android Studio) or resolving hanging HTTP requests/IPC between the CLI and external plugins, timeouts in non-interactive/ACP modes.
+              - Tooling & Output Parsers: Modifying how tools parse streaming stdout/stderr buffers, adding new built-in tools that don't require native bindings.
+              - Cross-Component Refactors: Changes that span across packages/cli and packages/core to pass new data models or telemetry state.
+            effort/large (3+ days):
+              - Platform-Specific Complexities (PTY/Signals): Any issue involving node-pty, child_process.spawn, OS-level shell behavior (Windows vs Linux vs macOS), pseudo-terminal exhaustion (ENXIO), raw mode terminal desyncs, or POSIX signal forwarding (SIGINT/SIGTERM).
+              - Core Architecture & Protocols: Refactoring the Scheduler, Agent-to-Agent (A2A) protocol implementation, low-level MCP (Model Context Protocol) transport mechanisms.
+              - Performance & Memory: Diagnosing massive disk/memory leaks, severe boot time regressions, high-throughput streaming optimizations (e.g., voice streaming pipelines).
+            Note: Any bug that is described as intermittent, flickering, difficult to reproduce, platform-specific, or requiring cross-environment setups (e.g., involving the VS Code IDE companion, GCA plugin, or Android Studio) MUST NOT be rated as effort/small because of the increased overhead of testing and reproducing.
 
             Categorization Guidelines (Priority):
             P0 - Urgent Blocking Issues:
@@ -216,64 +410,52 @@ jobs:
             - This product is designed to use different models eg.. using pro, downgrading to flash etc.
             - When users report that they dont expect the model to change those would be categorized as feature requests.
 
-      - name: 'Apply Labels to Issues'
+      - name: 'Apply Triaged Labels'
         if: |-
-          ${{ steps.gemini_issue_analysis.outcome == 'success' &&
-              steps.gemini_issue_analysis.outputs.summary != '[]' }}
+          always() &&
+          ( (steps.gemini_standard_issue_analysis.outcome == 'success' && steps.gemini_standard_issue_analysis.outputs.summary != '[]' && steps.gemini_standard_issue_analysis.outputs.summary != '') ||
+            (steps.gemini_effort_issue_analysis.outcome == 'success' && steps.gemini_effort_issue_analysis.outputs.summary != '[]' && steps.gemini_effort_issue_analysis.outputs.summary != '') )
         env:
-          REPOSITORY: '${{ github.repository }}'
-          LABELS_OUTPUT: '${{ steps.gemini_issue_analysis.outputs.summary }}'
+          LABELS_OUTPUT_STANDARD: '${{ steps.gemini_standard_issue_analysis.outputs.summary }}'
+          LABELS_OUTPUT_EFFORT: '${{ steps.gemini_effort_issue_analysis.outputs.summary }}'
         uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
         with:
           github-token: '${{ steps.generate_token.outputs.token }}'
           script: |-
-            const rawLabels = process.env.LABELS_OUTPUT;
-            core.info(`Raw labels JSON: ${rawLabels}`);
-            let parsedLabels;
-            try {
-              const jsonMatch = rawLabels.match(/```json\s*([\s\S]*?)\s*```/);
-              if (!jsonMatch || !jsonMatch[1]) {
-                throw new Error("Could not find a ```json ... ``` block in the output.");
-              }
-              const jsonString = jsonMatch[1].trim();
-              parsedLabels = JSON.parse(jsonString);
-              core.info(`Parsed labels JSON: ${JSON.stringify(parsedLabels)}`);
-            } catch (err) {
-              core.setFailed(`Failed to parse labels JSON from Gemini output: ${err.message}\nRaw output: ${rawLabels}`);
-              return;
-            }
+            const applyLabels = require('./.github/scripts/apply-issue-labels.cjs');
+            await applyLabels({ github, context, core });
 
-            for (const entry of parsedLabels) {
-              const issueNumber = entry.issue_number;
-              if (!issueNumber) {
-                core.info(`Skipping entry with no issue number: ${JSON.stringify(entry)}`);
-                continue;
-              }
+      - name: 'Sync Issue Types (Post-Analysis)'
+        if: |-
+          always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |-
+            const syncIssueTypes = require('./.github/scripts/sync-issue-types.cjs');
+            await syncIssueTypes({ github, context, core });
 
-              const labelsToAdd = entry.labels_to_add || [];
-              labelsToAdd.push('status/bot-triaged');
+      - name: 'Find Triaged Issues to Clean Up'
+        if: |-
+          always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        env:
+          GITHUB_TOKEN: '${{ steps.generate_token.outputs.token }}'
+          GITHUB_REPOSITORY: '${{ github.repository }}'
+        run: |-
+          set -euo pipefail
+          echo '🧹 Finding issues that have conflicting status labels...'
+          gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue label:status/bot-triaged label:status/need-triage' --limit 50 --json number > cleanup_1.json
+          gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue label:status/bot-triaged label:status/manual-triage' --limit 50 --json number > cleanup_2.json
+          jq -c -s 'add | unique_by(.number)' cleanup_1.json cleanup_2.json > issues_to_cleanup.json
 
-              if (labelsToAdd.length > 0) {
-                await github.rest.issues.addLabels({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: issueNumber,
-                  labels: labelsToAdd
-                });
-                const explanation = entry.explanation ? ` - ${entry.explanation}` : '';
-                core.info(`Successfully added labels for #${issueNumber}: ${labelsToAdd.join(', ')}${explanation}`);
-              }
-
-              if (entry.explanation) {
-                await github.rest.issues.createComment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: issueNumber,
-                  body: entry.explanation,
-                });
-              }
-
-              if ((!entry.labels_to_add || entry.labels_to_add.length === 0) && (!entry.labels_to_remove || entry.labels_to_remove.length === 0)) {
-                core.info(`No labels to add or remove for #${issueNumber}, leaving as is`);
-              }
-            }
+      - name: 'Clean Up Triage Labels'
+        if: |-
+          always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |-
+            const cleanupLabels = require('./.github/scripts/cleanup-triage-labels.cjs');
+            await cleanupLabels({ github, context, core });

.github/workflows/gemini-scheduled-pr-triage.yml

@@ -21,6 +21,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Generate GitHub App Token'
         id: 'generate_token'

.github/workflows/gemini-scheduled-stale-issue-closer.yml

@@ -1,159 +0,0 @@
-name: '🔒 Gemini Scheduled Stale Issue Closer'
-
-on:
-  schedule:
-    - cron: '0 0 * * 0' # Every Sunday at midnight UTC
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Run in dry-run mode (no changes applied)'
-        required: false
-        default: false
-        type: 'boolean'
-
-concurrency:
-  group: '${{ github.workflow }}'
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: 'bash'
-
-jobs:
-  close-stale-issues:
-    if: "github.repository == 'google-gemini/gemini-cli'"
-    runs-on: 'ubuntu-latest'
-    permissions:
-      issues: 'write'
-    steps:
-      - name: 'Generate GitHub App Token'
-        id: 'generate_token'
-        uses: 'actions/create-github-app-token@v2'
-        with:
-          app-id: '${{ secrets.APP_ID }}'
-          private-key: '${{ secrets.PRIVATE_KEY }}'
-          permission-issues: 'write'
-
-      - name: 'Process Stale Issues'
-        uses: 'actions/github-script@v7'
-        env:
-          DRY_RUN: '${{ inputs.dry_run }}'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token }}'
-          script: |
-            const dryRun = process.env.DRY_RUN === 'true';
-            if (dryRun) {
-              core.info('DRY RUN MODE ENABLED: No changes will be applied.');
-            }
-            const batchLabel = 'Stale';
-
-            const threeMonthsAgo = new Date();
-            threeMonthsAgo.setMonth(threeMonthsAgo.getMonth() - 3);
-
-            const tenDaysAgo = new Date();
-            tenDaysAgo.setDate(tenDaysAgo.getDate() - 10);
-
-            core.info(`Cutoff date for creation: ${threeMonthsAgo.toISOString()}`);
-            core.info(`Cutoff date for updates: ${tenDaysAgo.toISOString()}`);
-
-            const query = `repo:${context.repo.owner}/${context.repo.repo} is:issue is:open created:<${threeMonthsAgo.toISOString()}`;
-            core.info(`Searching with query: ${query}`);
-
-            const itemsToCheck = await github.paginate(github.rest.search.issuesAndPullRequests, {
-              q: query,
-              sort: 'created',
-              order: 'asc',
-              per_page: 100
-            });
-
-            core.info(`Found ${itemsToCheck.length} open issues to check.`);
-
-            let processedCount = 0;
-
-            for (const issue of itemsToCheck) {
-              const createdAt = new Date(issue.created_at);
-              const updatedAt = new Date(issue.updated_at);
-              const reactionCount = issue.reactions.total_count;
-
-              // Basic thresholds
-              if (reactionCount >= 5) {
-                continue;
-              }
-
-              // Skip if it has a maintainer, help wanted, or Public Roadmap label
-              const rawLabels = issue.labels.map((l) => l.name);
-              const lowercaseLabels = rawLabels.map((l) => l.toLowerCase());
-              if (
-                lowercaseLabels.some((l) => l.includes('maintainer')) ||
-                lowercaseLabels.includes('help wanted') ||
-                rawLabels.includes('🗓️ Public Roadmap')
-              ) {
-                continue;
-              }
-
-              let isStale = updatedAt < tenDaysAgo;
-
-              // If apparently active, check if it's only bot activity
-              if (!isStale) {
-                try {
-                  const comments = await github.rest.issues.listComments({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: issue.number,
-                    per_page: 100,
-                    sort: 'created',
-                    direction: 'desc'
-                  });
-
-                  const lastHumanComment = comments.data.find(comment => comment.user.type !== 'Bot');
-                  if (lastHumanComment) {
-                    isStale = new Date(lastHumanComment.created_at) < tenDaysAgo;
-                  } else {
-                    // No human comments. Check if creator is human.
-                    if (issue.user.type !== 'Bot') {
-                       isStale = createdAt < tenDaysAgo;
-                    } else {
-                       isStale = true; // Bot created, only bot comments
-                    }
-                  }
-                } catch (error) {
-                  core.warning(`Failed to fetch comments for issue #${issue.number}: ${error.message}`);
-                  continue;
-                }
-              }
-
-              if (isStale) {
-                processedCount++;
-                const message = `Closing stale issue #${issue.number}: "${issue.title}" (${issue.html_url})`;
-                core.info(message);
-
-                if (!dryRun) {
-                  // Add label
-                  await github.rest.issues.addLabels({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: issue.number,
-                    labels: [batchLabel]
-                  });
-
-                  // Add comment
-                  await github.rest.issues.createComment({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: issue.number,
-                    body: 'Hello! As part of our effort to keep our backlog manageable and focus on the most active issues, we are tidying up older reports.\n\nIt looks like this issue hasn\'t been active for a while, so we are closing it for now. However, if you are still experiencing this bug on the latest stable build, please feel free to comment on this issue or create a new one with updated details.\n\nThank you for your contribution!'
-                  });
-
-                  // Close issue
-                  await github.rest.issues.update({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: issue.number,
-                    state: 'closed',
-                    state_reason: 'not_planned'
-                  });
-                }
-              }
-            }
-
-            core.info(`\nTotal issues processed: ${processedCount}`);

.github/workflows/gemini-scheduled-stale-pr-closer.yml

@@ -1,254 +0,0 @@
-name: 'Gemini Scheduled Stale PR Closer'
-
-on:
-  schedule:
-    - cron: '0 2 * * *' # Every day at 2 AM UTC
-  pull_request:
-    types: ['opened', 'edited']
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Run in dry-run mode'
-        required: false
-        default: false
-        type: 'boolean'
-
-jobs:
-  close-stale-prs:
-    if: "github.repository == 'google-gemini/gemini-cli'"
-    runs-on: 'ubuntu-latest'
-    permissions:
-      pull-requests: 'write'
-      issues: 'write'
-    steps:
-      - name: 'Generate GitHub App Token'
-        id: 'generate_token'
-        env:
-          APP_ID: '${{ secrets.APP_ID }}'
-        if: |-
-          ${{ env.APP_ID != '' }}
-        uses: 'actions/create-github-app-token@v2'
-        with:
-          app-id: '${{ secrets.APP_ID }}'
-          private-key: '${{ secrets.PRIVATE_KEY }}'
-
-      - name: 'Process Stale PRs'
-        uses: 'actions/github-script@v7'
-        env:
-          DRY_RUN: '${{ inputs.dry_run }}'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
-          script: |
-            const dryRun = process.env.DRY_RUN === 'true';
-            const fourteenDaysAgo = new Date();
-            fourteenDaysAgo.setDate(fourteenDaysAgo.getDate() - 14);
-            const thirtyDaysAgo = new Date();
-            thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
-
-            // 1. Fetch maintainers for verification
-            let maintainerLogins = new Set();
-            const teams = ['gemini-cli-maintainers', 'gemini-cli-askmode-approvers', 'gemini-cli-docs'];
-
-            for (const team_slug of teams) {
-              try {
-                const members = await github.paginate(github.rest.teams.listMembersInOrg, {
-                  org: context.repo.owner,
-                  team_slug: team_slug
-                });
-                for (const m of members) maintainerLogins.add(m.login.toLowerCase());
-                core.info(`Successfully fetched ${members.length} team members from ${team_slug}`);
-              } catch (e) {
-                // Silently skip if permissions are insufficient; we will rely on author_association
-                core.debug(`Skipped team fetch for ${team_slug}: ${e.message}`);
-              }
-            }
-
-            const isMaintainer = async (login, assoc) => {
-              // Reliably identify maintainers using authorAssociation (provided by GitHub)
-              // and organization membership (if available).
-              const isTeamMember = maintainerLogins.has(login.toLowerCase());
-              const isRepoMaintainer = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(assoc);
-
-              if (isTeamMember || isRepoMaintainer) return true;
-
-              // Fallback: Check if user belongs to the 'google' or 'googlers' orgs (requires permission)
-              try {
-                const orgs = ['googlers', 'google'];
-                for (const org of orgs) {
-                  try {
-                    await github.rest.orgs.checkMembershipForUser({ org: org, username: login });
-                    return true;
-                  } catch (e) {
-                    if (e.status !== 404) throw e;
-                  }
-                }
-              } catch (e) {
-                // Gracefully ignore failures here
-              }
-
-              return false;
-            };
-
-            // 2. Fetch all open PRs
-            let prs = [];
-            if (context.eventName === 'pull_request') {
-              const { data: pr } = await github.rest.pulls.get({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                pull_number: context.payload.pull_request.number
-              });
-              prs = [pr];
-            } else {
-              prs = await github.paginate(github.rest.pulls.list, {
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                state: 'open',
-                per_page: 100
-              });
-            }
-
-            for (const pr of prs) {
-              const maintainerPr = await isMaintainer(pr.user.login, pr.author_association);
-              const isBot = pr.user.type === 'Bot' || pr.user.login.endsWith('[bot]');
-              if (maintainerPr || isBot) continue;
-
-              // Helper: Fetch labels and linked issues via GraphQL
-              const prDetailsQuery = `query($owner:String!, $repo:String!, $number:Int!) {
-                repository(owner:$owner, name:$repo) {
-                  pullRequest(number:$number) {
-                    closingIssuesReferences(first: 10) {
-                      nodes {
-                        number
-                        labels(first: 20) {
-                          nodes { name }
-                        }
-                      }
-                    }
-                  }
-                }
-              }`;
-
-              let linkedIssues = [];
-              try {
-                const res = await github.graphql(prDetailsQuery, {
-                  owner: context.repo.owner, repo: context.repo.repo, number: pr.number
-                });
-                linkedIssues = res.repository.pullRequest.closingIssuesReferences.nodes;
-              } catch (e) {
-                core.warning(`GraphQL fetch failed for PR #${pr.number}: ${e.message}`);
-              }
-
-              // Check for mentions in body as fallback (regex)
-              const body = pr.body || '';
-              const mentionRegex = /(?:#|https:\/\/github\.com\/[^\/]+\/[^\/]+\/issues\/)(\d+)/i;
-              const matches = body.match(mentionRegex);
-              if (matches && linkedIssues.length === 0) {
-                const issueNumber = parseInt(matches[1]);
-                try {
-                  const { data: issue } = await github.rest.issues.get({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: issueNumber
-                  });
-                  linkedIssues = [{ number: issueNumber, labels: { nodes: issue.labels.map(l => ({ name: l.name })) } }];
-                } catch (e) {}
-              }
-
-              // 3. Enforcement Logic
-              const prLabels = pr.labels.map(l => l.name.toLowerCase());
-              const hasHelpWanted = prLabels.includes('help wanted') ||
-                                    linkedIssues.some(issue => issue.labels.nodes.some(l => l.name.toLowerCase() === 'help wanted'));
-
-              const hasMaintainerOnly = prLabels.includes('🔒 maintainer only') ||
-                                        linkedIssues.some(issue => issue.labels.nodes.some(l => l.name.toLowerCase() === '🔒 maintainer only'));
-
-              const hasLinkedIssue = linkedIssues.length > 0;
-
-              // Closure Policy: No help-wanted label = Close after 14 days
-              if (pr.state === 'open' && !hasHelpWanted && !hasMaintainerOnly) {
-                const prCreatedAt = new Date(pr.created_at);
-
-                // We give a 14-day grace period for non-help-wanted PRs to be manually reviewed/labeled by an EM
-                if (prCreatedAt > fourteenDaysAgo) {
-                  core.info(`PR #${pr.number} is new and lacks 'help wanted'. Giving 14-day grace period for EM review.`);
-                  continue;
-                }
-
-                core.info(`PR #${pr.number} is older than 14 days and lacks 'help wanted' association. Closing.`);
-                if (!dryRun) {
-                  await github.rest.issues.createComment({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: pr.number,
-                    body: "Hi there! Thank you for your interest in contributing to Gemini CLI. \n\nTo ensure we maintain high code quality and focus on our prioritized roadmap, we have updated our contribution policy (see [Discussion #17383](https://github.com/google-gemini/gemini-cli/discussions/17383)). \n\n**We only *guarantee* review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'.** All other community pull requests are subject to closure after 14 days if they do not align with our current focus areas. For this reason, we strongly recommend that contributors only submit pull requests against issues explicitly labeled as **'help-wanted'**. \n\nThis pull request is being closed as it has been open for 14 days without a 'help wanted' designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding and for being part of our community!"
-                  });
-                  await github.rest.pulls.update({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    pull_number: pr.number,
-                    state: 'closed'
-                  });
-                }
-                continue;
-              }
-
-              // Also check for linked issue even if it has help wanted (redundant but safe)
-              if (pr.state === 'open' && !hasLinkedIssue) {
-                 // Already covered by hasHelpWanted check above, but good for future-proofing
-                 continue;
-              }
-
-              // 4. Staleness Check (Scheduled only)
-              if (pr.state === 'open' && context.eventName !== 'pull_request') {
-                // Skip PRs that were created less than 30 days ago - they cannot be stale yet
-                const prCreatedAt = new Date(pr.created_at);
-                if (prCreatedAt > thirtyDaysAgo) continue;
-
-                let lastActivity = new Date(pr.created_at);
-                try {
-                  const reviews = await github.paginate(github.rest.pulls.listReviews, {
-                    owner: context.repo.owner, repo: context.repo.repo, pull_number: pr.number
-                  });
-                  for (const r of reviews) {
-                    if (await isMaintainer(r.user.login, r.author_association)) {
-                      const d = new Date(r.submitted_at || r.updated_at);
-                      if (d > lastActivity) lastActivity = d;
-                    }
-                  }
-                  const comments = await github.paginate(github.rest.issues.listComments, {
-                    owner: context.repo.owner, repo: context.repo.repo, issue_number: pr.number
-                  });
-                  for (const c of comments) {
-                    if (await isMaintainer(c.user.login, c.author_association)) {
-                      const d = new Date(c.updated_at);
-                      if (d > lastActivity) lastActivity = d;
-                    }
-                  }
-                } catch (e) {}
-
-                if (lastActivity < thirtyDaysAgo) {
-                  const labels = pr.labels.map(l => l.name.toLowerCase());
-                  const isProtected = labels.includes('help wanted') || labels.includes('🔒 maintainer only');
-                  if (isProtected) {
-                    core.info(`PR #${pr.number} is stale but has a protected label. Skipping closure.`);
-                    continue;
-                  }
-
-                  core.info(`PR #${pr.number} is stale (no maintainer activity for 30+ days). Closing.`);
-                  if (!dryRun) {
-                    await github.rest.issues.createComment({
-                      owner: context.repo.owner,
-                      repo: context.repo.repo,
-                      issue_number: pr.number,
-                      body: "Hi there! Thank you for your contribution. To keep our backlog manageable, we are closing pull requests that haven't seen maintainer activity for 30 days. If you're still working on this, please let us know!"
-                    });
-                    await github.rest.pulls.update({
-                      owner: context.repo.owner,
-                      repo: context.repo.repo,
-                      pull_number: pr.number,
-                      state: 'closed'
-                    });
-                  }
-                }
-              }
-            }

.github/workflows/label-backlog-child-issues.yml

@@ -18,10 +18,12 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Setup Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version: '20'
           cache: 'npm'
@@ -40,10 +42,12 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Setup Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version: '20'
           cache: 'npm'

.github/workflows/label-workstream-rollup.yml

@@ -15,7 +15,7 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Check for Parent Workstream and Apply Label'
-        uses: 'actions/github-script@v7'
+        uses: 'actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' # ratchet:actions/github-script@v7
         with:
           script: |
             const labelToAdd = 'workstream-rollup';

.github/workflows/links.yml

@@ -17,6 +17,8 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Link Checker'
         id: 'lychee'

.github/workflows/memory-nightly.yml

@@ -0,0 +1,35 @@
+name: 'Memory Tests: Nightly'
+
+on:
+  schedule:
+    - cron: '0 2 * * *' # Runs at 2 AM every day
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: 'read'
+
+jobs:
+  memory-test:
+    name: 'Run Memory Usage Tests'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Run Memory Tests'
+        run: 'npm run test:memory'

.github/workflows/no-response.yml

@@ -1,33 +0,0 @@
-name: 'No Response'
-
-# Run as a daily cron at 1:45 AM
-on:
-  schedule:
-    - cron: '45 1 * * *'
-  workflow_dispatch:
-
-jobs:
-  no-response:
-    runs-on: 'ubuntu-latest'
-    if: |-
-      ${{ github.repository == 'google-gemini/gemini-cli' }}
-    permissions:
-      issues: 'write'
-      pull-requests: 'write'
-    concurrency:
-      group: '${{ github.workflow }}-no-response'
-      cancel-in-progress: true
-    steps:
-      - uses: 'actions/stale@5bef64f19d7facfb25b37b414482c7164d639639' # ratchet:actions/stale@v9
-        with:
-          repo-token: '${{ secrets.GITHUB_TOKEN }}'
-          days-before-stale: -1
-          days-before-close: 14
-          stale-issue-label: 'status/need-information'
-          close-issue-message: >-
-            This issue was marked as needing more information and has not received a response in 14 days.
-            Closing it for now. If you still face this problem, feel free to reopen with more details. Thank you!
-          stale-pr-label: 'status/need-information'
-          close-pr-message: >-
-            This pull request was marked as needing more information and has had no updates in 14 days.
-            Closing it for now. You are welcome to reopen with the required info. Thanks for contributing!

.github/workflows/perf-nightly.yml

@@ -0,0 +1,35 @@
+name: 'Performance Tests: Nightly'
+
+on:
+  schedule:
+    - cron: '0 3 * * *' # Runs at 3 AM every day
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: 'read'
+
+jobs:
+  perf-test:
+    name: 'Run Performance Usage Tests'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Run Performance Tests'
+        run: 'npm run test:perf'

.github/workflows/pr-contribution-guidelines-notifier.yml

@@ -1,133 +0,0 @@
-name: '🏷️ PR Contribution Guidelines Notifier'
-
-on:
-  pull_request:
-    types:
-      - 'opened'
-
-jobs:
-  notify-process-change:
-    runs-on: 'ubuntu-latest'
-    if: |-
-      github.repository == 'google-gemini/gemini-cli' || github.repository == 'google-gemini/maintainers-gemini-cli'
-    permissions:
-      pull-requests: 'write'
-    steps:
-      - name: 'Generate GitHub App Token'
-        id: 'generate_token'
-        env:
-          APP_ID: '${{ secrets.APP_ID }}'
-        if: |-
-          ${{ env.APP_ID != '' }}
-        uses: 'actions/create-github-app-token@v2'
-        with:
-          app-id: '${{ secrets.APP_ID }}'
-          private-key: '${{ secrets.PRIVATE_KEY }}'
-
-      - name: 'Check membership and post comment'
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
-          script: |-
-            const org = context.repo.owner;
-            const repo = context.repo.repo;
-            const username = context.payload.pull_request.user.login;
-            const pr_number = context.payload.pull_request.number;
-
-            // 1. Check if the PR author is a maintainer
-            // Check team membership (most reliable for private org members)
-            let isTeamMember = false;
-            const teams = ['gemini-cli-maintainers', 'gemini-cli-askmode-approvers', 'gemini-cli-docs'];
-            for (const team_slug of teams) {
-              try {
-                const members = await github.paginate(github.rest.teams.listMembersInOrg, {
-                  org: org,
-                  team_slug: team_slug
-                });
-                if (members.some(m => m.login.toLowerCase() === username.toLowerCase())) {
-                  isTeamMember = true;
-                  core.info(`${username} is a member of ${team_slug}. No notification needed.`);
-                  break;
-                }
-              } catch (e) {
-                core.warning(`Failed to fetch team members from ${team_slug}: ${e.message}`);
-              }
-            }
-
-            if (isTeamMember) return;
-
-            // Check author_association from webhook payload
-            const authorAssociation = context.payload.pull_request.author_association;
-            const isRepoMaintainer = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(authorAssociation);
-
-            if (isRepoMaintainer) {
-              core.info(`${username} is a maintainer (author_association: ${authorAssociation}). No notification needed.`);
-              return;
-            }
-
-            // Check if author is a Googler
-            const isGoogler = async (login) => {
-              try {
-                const orgs = ['googlers', 'google'];
-                for (const org of orgs) {
-                  try {
-                    await github.rest.orgs.checkMembershipForUser({
-                      org: org,
-                      username: login
-                    });
-                    return true;
-                  } catch (e) {
-                    if (e.status !== 404) throw e;
-                  }
-                }
-              } catch (e) {
-                core.warning(`Failed to check org membership for ${login}: ${e.message}`);
-              }
-              return false;
-            };
-
-            if (await isGoogler(username)) {
-              core.info(`${username} is a Googler. No notification needed.`);
-              return;
-            }
-
-            // 2. Check if the PR is already associated with an issue
-            const query = `
-              query($owner:String!, $repo:String!, $number:Int!) {
-                repository(owner:$owner, name:$repo) {
-                  pullRequest(number:$number) {
-                    closingIssuesReferences(first: 1) {
-                      totalCount
-                    }
-                  }
-                }
-              }
-            `;
-            const variables = { owner: org, repo: repo, number: pr_number };
-            const result = await github.graphql(query, variables);
-            const issueCount = result.repository.pullRequest.closingIssuesReferences.totalCount;
-
-            if (issueCount > 0) {
-              core.info(`PR #${pr_number} is already associated with an issue. No notification needed.`);
-              return;
-            }
-
-            // 3. Post the notification comment
-            core.info(`${username} is not a maintainer and PR #${pr_number} has no linked issue. Posting notification.`);
-
-            const comment = `
-            Hi @${username}, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this.
-
-            We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: [Improving Our Contribution Process & Introducing New Guidelines](https://github.com/google-gemini/gemini-cli/discussions/16706).
-
-            Key Update: Starting **January 26, 2026**, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed.
-
-            Thank you for your understanding and for being a part of our community!
-            `.trim().replace(/^[ ]+/gm, '');
-
-            await github.rest.issues.createComment({
-              owner: org,
-              repo: repo,
-              issue_number: pr_number,
-              body: comment
-            });

.github/workflows/pr-size-labeler-batch-run.yml

@@ -0,0 +1,107 @@
+name: 'PR Size Labeler (Batch)'
+
+on:
+  workflow_dispatch:
+    inputs:
+      process_all:
+        description: 'Process all PRs (open and closed) or open only'
+        required: true
+        default: 'false'
+        type: 'choice'
+        options:
+          - 'true'
+          - 'false'
+      limit:
+        description: 'Max number of PRs to fetch and check'
+        required: true
+        default: '100'
+        type: 'string'
+
+permissions:
+  pull-requests: 'write'
+
+jobs:
+  batch-label:
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Batch label PRs'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GH_REPO: '${{ github.repository }}'
+        run: |
+          # Determine the state filter
+          STATE="open"
+          if [ "${{ github.event.inputs.process_all }}" = "true" ]; then
+            STATE="all"
+          fi
+
+          LIMIT="${{ github.event.inputs.limit }}"
+          echo "Batch labeling up to $LIMIT $STATE PRs..."
+
+          # 1. Ensure standard premium size labels exist in the repository (self-healing)
+          gh label create "size/XS" --color "7ee081" --description "XS: <10 lines changed" 2>/dev/null || true
+          gh label create "size/S"  --color "a6d49f" --description "S: 10-49 lines changed" 2>/dev/null || true
+          gh label create "size/M"  --color "f7d070" --description "M: 50-249 lines changed" 2>/dev/null || true
+          gh label create "size/L"  --color "f48c06" --description "L: 250-999 lines changed" 2>/dev/null || true
+          gh label create "size/XL" --color "dc2f02" --description "XL: >=1000 lines changed" 2>/dev/null || true
+
+          # 2. Query PR list with all required fields in ONE call to prevent N+1 queries
+          PR_LIST=$(gh pr list --state "$STATE" --limit "$LIMIT" --json number,additions,deletions,labels)
+          if [ -z "$PR_LIST" ] || [ "$PR_LIST" = "[]" ]; then
+            echo "ℹ️ No PRs found matching the criteria."
+            exit 0
+          fi
+
+          # Parse and iterate over PRs
+          UPDATED_COUNT=0
+          SKIPPED_COUNT=0
+
+          echo "$PR_LIST" | jq -c '.[]' | while read -r PR_JSON; do
+            PR_NUMBER=$(echo "$PR_JSON" | jq '.number')
+            ADDITIONS=$(echo "$PR_JSON" | jq '.additions')
+            DELETIONS=$(echo "$PR_JSON" | jq '.deletions')
+            TOTAL=$((ADDITIONS + DELETIONS))
+
+            # Calculate target size
+            if [ $TOTAL -lt 10 ]; then
+              SIZE="size/XS"
+            elif [ $TOTAL -lt 50 ]; then
+              SIZE="size/S"
+            elif [ $TOTAL -lt 250 ]; then
+              SIZE="size/M"
+            elif [ $TOTAL -lt 1000 ]; then
+              SIZE="size/L"
+            else
+              SIZE="size/XL"
+            fi
+
+            # Inspect existing labels to detect discrepancies
+            EXISTING_LABELS=$(echo "$PR_JSON" | jq -r '.labels[].name' 2>/dev/null || echo "")
+
+            LABELS_TO_REMOVE=()
+            for L in size/XS size/S size/M size/L size/XL; do
+              if echo "$EXISTING_LABELS" | grep -Fq "$L" && [ "$L" != "$SIZE" ]; then
+                LABELS_TO_REMOVE+=("--remove-label" "$L")
+              fi
+            done
+
+            LABEL_TO_ADD=()
+            if ! echo "$EXISTING_LABELS" | grep -Fq "$SIZE"; then
+              LABEL_TO_ADD+=("--add-label" "$SIZE")
+            fi
+
+            # Update labels if there's a difference
+            if [ ${#LABELS_TO_REMOVE[@]} -gt 0 ] || [ ${#LABEL_TO_ADD[@]} -gt 0 ]; then
+              echo "🔄 PR #$PR_NUMBER (+$ADDITIONS/-$DELETIONS = $TOTAL lines): updating size to $SIZE"
+              gh pr edit "$PR_NUMBER" "${LABELS_TO_REMOVE[@]}" "${LABEL_TO_ADD[@]}" 2>/dev/null || true
+              UPDATED_COUNT=$((UPDATED_COUNT + 1))
+            else
+              echo "✅ PR #$PR_NUMBER (+$ADDITIONS/-$DELETIONS = $TOTAL lines): already has correct label ($SIZE). Skipping."
+              SKIPPED_COUNT=$((SKIPPED_COUNT + 1))
+            fi
+          done
+
+          echo "============================================"
+          echo "🎉 Batch run completed!"
+          echo "Skipped (already correct): $SKIPPED_COUNT"
+          echo "Updated: $UPDATED_COUNT"

.github/workflows/pr-size-labeler.yml

@@ -0,0 +1,120 @@
+name: 'PR Size Labeler'
+
+on:
+  pull_request_target:
+    types: ['opened', 'synchronize', 'reopened']
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to label manually (for workflow_dispatch)'
+        required: false
+        type: 'string'
+
+permissions:
+  pull-requests: 'write'
+  issues: 'write'
+
+jobs:
+  size-label:
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Run size labeler'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GH_REPO: '${{ github.repository }}'
+        run: |
+          # Determine the target PR number
+          if [ -n "${{ github.event.pull_request.number }}" ]; then
+            PR_NUMBER="${{ github.event.pull_request.number }}"
+          elif [ -n "${{ github.event.inputs.pr_number }}" ]; then
+            PR_NUMBER="${{ github.event.inputs.pr_number }}"
+          else
+            echo "❌ Error: No PR number provided."
+            exit 1
+          fi
+
+          echo "Checking PR #$PR_NUMBER..."
+
+          # 1. Ensure standard premium size labels exist in the repository (self-healing)
+          # size/XS: Light green (#7ee081)
+          # size/S: Yellow-green (#a6d49f)
+          # size/M: Amber/Yellow (#f7d070)
+          # size/L: Orange (#f48c06)
+          # size/XL: Red (#dc2f02)
+          gh label create "size/XS" --color "7ee081" --description "XS: <10 lines changed" 2>/dev/null || true
+          gh label create "size/S"  --color "a6d49f" --description "S: 10-49 lines changed" 2>/dev/null || true
+          gh label create "size/M"  --color "f7d070" --description "M: 50-249 lines changed" 2>/dev/null || true
+          gh label create "size/L"  --color "f48c06" --description "L: 250-999 lines changed" 2>/dev/null || true
+          gh label create "size/XL" --color "dc2f02" --description "XL: >=1000 lines changed" 2>/dev/null || true
+
+          # 2. Fetch PR details in a single efficient API call
+          PR_DATA=$(gh pr view "$PR_NUMBER" --json additions,deletions,changedFiles,labels)
+          if [ -z "$PR_DATA" ]; then
+            echo "❌ Error: Could not fetch PR details."
+            exit 1
+          fi
+
+          ADDITIONS=$(echo "$PR_DATA" | jq '.additions')
+          DELETIONS=$(echo "$PR_DATA" | jq '.deletions')
+          CHANGED_FILES=$(echo "$PR_DATA" | jq '.changedFiles')
+          TOTAL=$((ADDITIONS + DELETIONS))
+
+          echo "PR additions: $ADDITIONS, deletions: $DELETIONS, total changes: $TOTAL, files: $CHANGED_FILES"
+
+          # 3. Calculate new size label
+          if [ $TOTAL -lt 10 ]; then
+            SIZE="size/XS"
+          elif [ $TOTAL -lt 50 ]; then
+            SIZE="size/S"
+          elif [ $TOTAL -lt 250 ]; then
+            SIZE="size/M"
+          elif [ $TOTAL -lt 1000 ]; then
+            SIZE="size/L"
+          else
+            SIZE="size/XL"
+          fi
+
+          # 4. Check existing labels and update only if necessary
+          EXISTING_LABELS=$(echo "$PR_DATA" | jq -r '.labels[].name' 2>/dev/null || echo "")
+
+          LABELS_TO_REMOVE=()
+          for L in size/XS size/S size/M size/L size/XL; do
+            if echo "$EXISTING_LABELS" | grep -Fq "$L" && [ "$L" != "$SIZE" ]; then
+              LABELS_TO_REMOVE+=("--remove-label" "$L")
+            fi
+          done
+
+          LABEL_TO_ADD=()
+          if ! echo "$EXISTING_LABELS" | grep -Fq "$SIZE"; then
+            LABEL_TO_ADD+=("--add-label" "$SIZE")
+          fi
+
+          # Perform a single, highly atomic edit call if changes are needed
+          if [ ${#LABELS_TO_REMOVE[@]} -gt 0 ] || [ ${#LABEL_TO_ADD[@]} -gt 0 ]; then
+            echo "Updating labels: removing ${LABELS_TO_REMOVE[*]}, adding $SIZE"
+            gh pr edit "$PR_NUMBER" "${LABELS_TO_REMOVE[@]}" "${LABEL_TO_ADD[@]}"
+          else
+            echo "✅ PR #$PR_NUMBER already has the correct size label ($SIZE)."
+          fi
+
+          # 5. Premium, anti-spam comment logic (updates previous comment to keep thread clean)
+          COMMENT="📊 PR Size: **$SIZE**
+          - Lines changed: **$TOTAL**
+          - Additions: +$ADDITIONS
+          - Deletions: -$DELETIONS
+          - Files changed: $CHANGED_FILES"
+
+          # Find any existing size labeler comment by the github-actions bot
+          echo "Searching for existing size comment..."
+          COMMENT_ID=$(gh api "repos/${{ github.repository }}/issues/$PR_NUMBER/comments" \
+            --jq '.[] | select(.user.login == "github-actions[bot]" and (.body | startswith("📊 PR Size:"))) | .id' | head -n 1)
+
+          if [ -n "$COMMENT_ID" ]; then
+            echo "Updating existing comment (ID: $COMMENT_ID)..."
+            gh api "repos/${{ github.repository }}/issues/comments/$COMMENT_ID" -X PATCH -f body="$COMMENT" > /dev/null
+          else
+            echo "Creating new comment..."
+            gh pr comment "$PR_NUMBER" --body "$COMMENT" > /dev/null
+          fi
+
+          echo "🎉 PR size labeling completed successfully."

.github/workflows/release-change-tags.yml

@@ -40,10 +40,11 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
         with:
           ref: '${{ github.ref }}'
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 'Setup Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'

.github/workflows/release-manual.yml

@@ -46,8 +46,15 @@ on:
         default: 'prod'
 
 jobs:
+  build-mac:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    uses: './.github/workflows/build-unsigned-mac-binaries.yml'
+    with:
+      ref: '${{ github.event.inputs.ref }}'
+
   release:
     if: "github.repository == 'google-gemini/gemini-cli'"
+    needs: ['build-mac']
     runs-on: 'ubuntu-latest'
     environment: "${{ github.event.inputs.environment || 'prod' }}"
     permissions:
@@ -58,11 +65,13 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: 'Checkout Release Code'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
           path: 'release'
           fetch-depth: 0
@@ -83,6 +92,11 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
+      - name: 'Download macOS Binaries'
+        uses: './.github/actions/download-mac-binaries'
+        with:
+          path: 'release/dist'
+
       - name: 'Prepare Release Info'
         id: 'release_info'
         working-directory: './release'

.github/workflows/release-nightly.yml

@@ -30,9 +30,16 @@ on:
         default: 'prod'
 
 jobs:
+  build-mac:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    uses: './.github/workflows/build-unsigned-mac-binaries.yml'
+    with:
+      ref: '${{ github.event.inputs.ref }}'
+
   release:
     if: "github.repository == 'google-gemini/gemini-cli'"
-    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    needs: ['build-mac']
+    environment: "${{ github.event_name == 'schedule' && 'internal' || github.event.inputs.environment || 'prod' }}"
     runs-on: 'ubuntu-latest'
     permissions:
       contents: 'write'
@@ -43,11 +50,13 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: 'Checkout Release Code'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
           path: 'release'
           fetch-depth: 0
@@ -62,6 +71,11 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
+      - name: 'Download macOS Binaries'
+        uses: './.github/actions/download-mac-binaries'
+        with:
+          path: 'release/dist'
+
       - name: 'Print Inputs'
         shell: 'bash'
         env:
@@ -131,12 +145,12 @@ jobs:
           skip-branch-cleanup: true
           force-skip-tests: "${{ github.event_name != 'schedule' && github.event.inputs.force_skip_tests == 'true' }}"
           gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
-          npm-registry-publish-url: '${{ vars.NPM_REGISTRY_PUBLISH_URL }}'
-          npm-registry-url: '${{ vars.NPM_REGISTRY_URL }}'
-          npm-registry-scope: '${{ vars.NPM_REGISTRY_SCOPE }}'
-          cli-package-name: '${{ vars.CLI_PACKAGE_NAME }}'
-          core-package-name: '${{ vars.CORE_PACKAGE_NAME }}'
-          a2a-package-name: '${{ vars.A2A_PACKAGE_NAME }}'
+          npm-registry-publish-url: "${{ vars.NPM_REGISTRY_PUBLISH_URL || 'https://registry.npmjs.org/' }}"
+          npm-registry-url: "${{ vars.NPM_REGISTRY_URL || 'https://registry.npmjs.org/' }}"
+          npm-registry-scope: "${{ vars.NPM_REGISTRY_SCOPE || '@google' }}"
+          cli-package-name: "${{ vars.CLI_PACKAGE_NAME || '@google/gemini-cli' }}"
+          core-package-name: "${{ vars.CORE_PACKAGE_NAME || '@google/gemini-cli-core' }}"
+          a2a-package-name: "${{ vars.A2A_PACKAGE_NAME || '@google/gemini-cli-a2a-server' }}"
 
       - name: 'Create and Merge Pull Request'
         if: "github.event.inputs.environment != 'dev'"

.github/workflows/release-notes.yml

@@ -29,14 +29,15 @@ jobs:
       pull-requests: 'write'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
         with:
+          persist-credentials: false
           # The user-level skills need to be available to the workflow
           fetch-depth: 0
           ref: 'main'
 
       - name: 'Set up Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version: '20'
 
@@ -70,7 +71,10 @@ jobs:
       - name: 'Generate Changelog with Gemini'
         if: "steps.validate_version.outputs.CONTINUE == 'true'"
         uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
+        env:
+          GEMINI_CLI_TRUST_WORKSPACE: true
         with:
+          upload_artifacts: 'true'
           gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
           prompt: |
             Activate the 'docs-changelog' skill.
@@ -86,7 +90,7 @@ jobs:
 
       - name: 'Create Pull Request'
         if: "steps.validate_version.outputs.CONTINUE == 'true'"
-        uses: 'peter-evans/create-pull-request@v6'
+        uses: 'peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c' # ratchet:peter-evans/create-pull-request@v6
         with:
           token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
           commit-message: 'docs(changelog): update for ${{ steps.release_info.outputs.VERSION }}'

.github/workflows/release-patch-0-from-comment.yml

@@ -17,6 +17,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           fetch-depth: 1
 
       - name: 'Slash Command Dispatch'

.github/workflows/release-patch-1-create-pr.yml

@@ -54,6 +54,7 @@ jobs:
         with:
           ref: '${{ github.event.inputs.ref }}'
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 'Setup Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4

.github/workflows/release-patch-2-trigger.yml

@@ -64,6 +64,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: "${{ github.event.inputs.workflow_ref || 'main' }}"
           fetch-depth: 1
 

.github/workflows/release-patch-3-release.yml

@@ -53,12 +53,14 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
 
       - name: 'Checkout Release Code'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.release_ref }}'
           path: 'release'
           fetch-depth: 0

.github/workflows/release-promote.yml

@@ -55,6 +55,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
 
@@ -171,11 +172,13 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ matrix.sha }}'
           path: 'release'
           fetch-depth: 0
@@ -197,9 +200,15 @@ jobs:
           gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
           working-directory: './release'
 
+  build-mac:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    uses: './.github/workflows/build-unsigned-mac-binaries.yml'
+    with:
+      ref: '${{ github.event.inputs.ref }}'
+
   publish-preview:
     name: 'Publish preview'
-    needs: ['calculate-versions', 'test']
+    needs: ['calculate-versions', 'test', 'build-mac']
     runs-on: 'ubuntu-latest'
     environment: "${{ github.event.inputs.environment || 'prod' }}"
     permissions:
@@ -210,11 +219,13 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ needs.calculate-versions.outputs.PREVIEW_SHA }}'
           path: 'release'
           fetch-depth: 0
@@ -229,6 +240,11 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
+      - name: 'Download macOS Binaries'
+        uses: './.github/actions/download-mac-binaries'
+        with:
+          path: 'release/dist'
+
       - name: 'Publish Release'
         uses: './.github/actions/publish-release'
         with:
@@ -266,7 +282,7 @@ jobs:
 
   publish-stable:
     name: 'Publish stable'
-    needs: ['calculate-versions', 'test', 'publish-preview']
+    needs: ['calculate-versions', 'test', 'publish-preview', 'build-mac']
     runs-on: 'ubuntu-latest'
     environment: "${{ github.event.inputs.environment || 'prod' }}"
     permissions:
@@ -277,11 +293,13 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ needs.calculate-versions.outputs.STABLE_SHA }}'
           path: 'release'
           fetch-depth: 0
@@ -296,6 +314,11 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
+      - name: 'Download macOS Binaries'
+        uses: './.github/actions/download-mac-binaries'
+        with:
+          path: 'release/dist'
+
       - name: 'Publish Release'
         uses: './.github/actions/publish-release'
         with:
@@ -344,6 +367,7 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Setup Node.js'
@@ -379,6 +403,7 @@ jobs:
           BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
           DRY_RUN: '${{ github.event.inputs.dry_run }}'
           NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION: '${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
+          GIT_PUSH_TOKEN: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
         run: |-
           git add package.json packages/*/package.json
           if [ -f package-lock.json ]; then
@@ -387,7 +412,7 @@ jobs:
           git commit -m "chore(release): bump version to ${NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION}"
           if [[ "${DRY_RUN}" == "false" ]]; then
             echo "Pushing release branch to remote..."
-            git push --set-upstream origin "${BRANCH_NAME}"
+            git push "https://x-access-token:${GIT_PUSH_TOKEN}@github.com/${{ github.repository }}.git" "HEAD:${BRANCH_NAME}" --follow-tags
           else
             echo "Dry run enabled. Skipping push."
           fi

.github/workflows/release-rollback.yml

@@ -52,6 +52,7 @@ jobs:
       - name: 'Checkout repository'
         uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
           fetch-depth: 0
 
@@ -192,7 +193,7 @@ jobs:
         run: |
           echo "ROLLBACK_TAG=$ROLLBACK_TAG_NAME" >> "$GITHUB_OUTPUT"
           git tag "$ROLLBACK_TAG_NAME" "${ORIGIN_HASH}"
-          git push origin --tags
+          git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.git" --tags
 
       - name: 'Verify Rollback Tag Added'
         if: "${{ github.event.inputs.dry-run == 'false' }}"

.github/workflows/release-sandbox.yml

@@ -26,6 +26,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref || github.sha }}'
           fetch-depth: 0
       - name: 'Push'

.github/workflows/smoke-test.yml

@@ -32,6 +32,7 @@ jobs:
         with:
           ref: '${{ github.event.inputs.ref || github.sha }}'
           fetch-depth: 0
+          persist-credentials: false
       - name: 'Install Dependencies'
         run: 'npm ci'
       - name: 'Build bundle'

.github/workflows/stale.yml

@@ -1,44 +0,0 @@
-name: 'Mark stale issues and pull requests'
-
-# Run as a daily cron at 1:30 AM
-on:
-  schedule:
-    - cron: '30 1 * * *'
-  workflow_dispatch:
-
-jobs:
-  stale:
-    strategy:
-      fail-fast: false
-      matrix:
-        runner:
-          - 'ubuntu-latest' # GitHub-hosted
-    runs-on: '${{ matrix.runner }}'
-    if: |-
-      ${{ github.repository == 'google-gemini/gemini-cli' }}
-    permissions:
-      issues: 'write'
-      pull-requests: 'write'
-    concurrency:
-      group: '${{ github.workflow }}-stale'
-      cancel-in-progress: true
-    steps:
-      - uses: 'actions/stale@5bef64f19d7facfb25b37b414482c7164d639639' # ratchet:actions/stale@v9
-        with:
-          repo-token: '${{ secrets.GITHUB_TOKEN }}'
-          stale-issue-message: >-
-            This issue has been automatically marked as stale due to 60 days of inactivity.
-            It will be closed in 14 days if no further activity occurs.
-          stale-pr-message: >-
-            This pull request has been automatically marked as stale due to 60 days of inactivity.
-            It will be closed in 14 days if no further activity occurs.
-          close-issue-message: >-
-            This issue has been closed due to 14 additional days of inactivity after being marked as stale.
-            If you believe this is still relevant, feel free to comment or reopen the issue. Thank you!
-          close-pr-message: >-
-            This pull request has been closed due to 14 additional days of inactivity after being marked as stale.
-            If this is still relevant, you are welcome to reopen or leave a comment. Thanks for contributing!
-          days-before-stale: 60
-          days-before-close: 14
-          exempt-issue-labels: 'pinned,security,🔒 maintainer only,help wanted,🗓️ Public Roadmap'
-          exempt-pr-labels: 'pinned,security,🔒 maintainer only,help wanted,🗓️ Public Roadmap'

.github/workflows/test-build-binary.yml

@@ -33,7 +33,9 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Optimize Windows Performance'
         if: "matrix.os == 'windows-latest'"
@@ -46,7 +48,7 @@ jobs:
         shell: 'powershell'
 
       - name: 'Set up Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
           architecture: '${{ matrix.arch }}'
@@ -63,7 +65,7 @@ jobs:
 
       - name: 'Setup Windows SDK (Windows)'
         if: "matrix.os == 'windows-latest'"
-        uses: 'microsoft/setup-msbuild@v2'
+        uses: 'microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce' # ratchet:microsoft/setup-msbuild@v2
 
       - name: 'Add Signtool to Path (Windows)'
         if: "matrix.os == 'windows-latest'"
@@ -141,6 +143,7 @@ jobs:
         if: "github.event_name != 'pull_request'"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
         run: |
           echo "Running integration tests with binary..."
           if [[ "${{ matrix.os }}" == 'windows-latest' ]]; then
@@ -153,7 +156,7 @@ jobs:
           npm run test:integration:sandbox:none -- --testTimeout=600000
 
       - name: 'Upload Artifact'
-        uses: 'actions/upload-artifact@v4'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
         with:
           name: 'gemini-cli-${{ matrix.platform_name }}'
           path: 'dist/${{ matrix.platform_name }}/'

.github/workflows/unassign-inactive-assignees.yml

@@ -40,13 +40,13 @@ jobs:
     steps:
       - name: 'Generate GitHub App Token'
         id: 'generate_token'
-        uses: 'actions/create-github-app-token@v2'
+        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
         with:
           app-id: '${{ secrets.APP_ID }}'
           private-key: '${{ secrets.PRIVATE_KEY }}'
 
       - name: 'Unassign inactive assignees'
-        uses: 'actions/github-script@v7'
+        uses: 'actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' # ratchet:actions/github-script@v7
         env:
           DRY_RUN: '${{ inputs.dry_run }}'
         with:

.github/workflows/verify-release.yml

@@ -44,6 +44,8 @@ jobs:
         shell: 'bash'
         run: 'echo "${{ toJSON(vars) }}"'
       - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          persist-credentials: false
       - name: 'Verify release'
         uses: './.github/actions/verify-release'
         with:

.gitignore

@@ -48,6 +48,7 @@ packages/cli/src/generated/
 packages/core/src/generated/
 packages/devtools/src/_client-assets.ts
 .integration-tests/
+.perf-tests/
 packages/vscode-ide-companion/*.vsix
 packages/cli/download-ripgrep*/
 
@@ -64,3 +65,6 @@ gemini-debug.log
 evals/logs/
 
 temp_agents/
+
+# conductor extension and planning directories
+conductor/

.npmrc

@@ -1 +1 @@
-@google:registry=https://wombat-dressing-room.appspot.com
+@google:registry=https://wombat-dressing-room.appspot.com/

.prettierignore

@@ -22,3 +22,5 @@ Thumbs.db
 .pytest_cache
 **/SKILL.md
 packages/sdk/test-data/*.json
+*.mdx
+packages/vscode-ide-companion/NOTICES.txt

.vscode/launch.json

@@ -43,9 +43,13 @@
     {
       "type": "node",
       "request": "launch",
-      "name": "Launch Program",
+      "name": "CLI: Run Current File",
+      "runtimeExecutable": "node",
+      "runtimeArgs": ["--import", "tsx"],
       "skipFiles": ["<node_internals>/**"],
       "program": "${file}",
+      "cwd": "${workspaceFolder}",
+      "console": "integratedTerminal",
       "outFiles": ["${workspaceFolder}/**/*.js"]
     },
     {

CONTRIBUTING.md

@@ -110,7 +110,9 @@ assign or unassign the issue as requested, provided the conditions are met
 (e.g., an issue must be unassigned to be assigned).
 
 Please note that you can have a maximum of 3 issues assigned to you at any given
-time.
+time and that only
+[issues labeled "help wanted"](https://github.com/google-gemini/gemini-cli/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22help%20wanted%22)
+may be self-assigned.
 
 ### Pull request guidelines
 
@@ -323,8 +325,8 @@ fi
 
 #### Formatting
 
-To separately format the code in this project by running the following command
-from the root directory:
+To separately format the code in this project, run the following command from
+the root directory:
 
 ```bash
 npm run format
@@ -346,9 +348,11 @@ npm run lint
 
 - Please adhere to the coding style, patterns, and conventions used throughout
   the existing codebase.
-- Consult [GEMINI.md](../GEMINI.md) (typically found in the project root) for
-  specific instructions related to AI-assisted development, including
-  conventions for React, comments, and Git usage.
+- Consult
+  [GEMINI.md](https://github.com/google-gemini/gemini-cli/blob/main/GEMINI.md)
+  (typically found in the project root) for specific instructions related to
+  AI-assisted development, including conventions for React, comments, and Git
+  usage.
 - **Imports:** Pay special attention to import paths. The project uses ESLint to
   enforce restrictions on relative imports between packages.
 
@@ -505,8 +509,9 @@ code.
 
 ### Documentation structure
 
-Our documentation is organized using [sidebar.json](/docs/sidebar.json) as the
-table of contents. When adding new documentation:
+Our documentation is organized using
+[sidebar.json](https://github.com/google-gemini/gemini-cli/blob/main/docs/sidebar.json)
+as the table of contents. When adding new documentation:
 
 1. Create your markdown file **in the appropriate directory** under `/docs`.
 2. Add an entry to `sidebar.json` in the relevant section.

Dockerfile

@@ -1,3 +1,44 @@
+# ---- Stage 1: Builder ----
+FROM docker.io/library/node:20-slim AS builder
+
+# Install git (needed by generate-git-commit-info.js script)
+RUN apt-get update && apt-get install -y --no-install-recommends git \
+  && apt-get clean && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+# Copy only package.json files first for better layer caching
+# Dependencies only re-install when package files change, not source files
+COPY package*.json ./
+COPY packages/cli/package*.json ./packages/cli/
+COPY packages/core/package*.json ./packages/core/
+COPY packages/vscode-ide-companion/package*.json ./packages/vscode-ide-companion/
+COPY packages/vscode-ide-companion/scripts/ ./packages/vscode-ide-companion/scripts/
+COPY packages/devtools/package*.json ./packages/devtools/
+COPY packages/sdk/package*.json ./packages/sdk/
+COPY packages/test-utils/package*.json ./packages/test-utils/
+COPY packages/a2a-server/package*.json ./packages/a2a-server/
+
+# Use npm ci for consistent, reliable builds (respects package-lock.json)
+RUN HUSKY=0 npm ci --ignore-scripts
+
+# Now copy the rest of the source (after install for better caching)
+COPY packages/ ./packages/
+COPY tsconfig*.json ./
+COPY eslint.config.js ./
+COPY scripts/ ./scripts/
+COPY esbuild.config.js ./
+
+# Pass git commit hash as build arg instead of copying entire .git directory
+ARG GIT_COMMIT=unknown
+ENV GIT_COMMIT=$GIT_COMMIT
+
+# Build and pack artifacts
+RUN HUSKY=0 npm run build && \
+    npm pack -w packages/core --pack-destination packages/core/dist/ && \
+    npm pack -w packages/cli --pack-destination packages/cli/dist/
+
+# ---- Stage 2: Runtime ----
 FROM docker.io/library/node:20-slim
 
 ARG SANDBOX_NAME="gemini-cli-sandbox"
@@ -40,8 +81,8 @@ ENV PATH=$PATH:/usr/local/share/npm-global/bin
 USER node
 
 # install gemini-cli and clean up
-COPY packages/cli/dist/google-gemini-cli-*.tgz /tmp/gemini-cli.tgz
-COPY packages/core/dist/google-gemini-cli-core-*.tgz /tmp/gemini-core.tgz
+COPY --chown=node:node packages/cli/dist/google-gemini-cli-*.tgz /tmp/gemini-cli.tgz
+COPY --chown=node:node packages/core/dist/google-gemini-cli-core-*.tgz /tmp/gemini-core.tgz
 RUN npm install -g /tmp/gemini-core.tgz \
   && npm install -g /tmp/gemini-cli.tgz \
   && node -e "const fs=require('node:fs'); JSON.parse(fs.readFileSync('/usr/local/share/npm-global/lib/node_modules/@google/gemini-cli/package.json','utf8')); JSON.parse(fs.readFileSync('/usr/local/share/npm-global/lib/node_modules/@google/gemini-cli-core/package.json','utf8'));" \
@@ -50,4 +91,4 @@ RUN npm install -g /tmp/gemini-core.tgz \
   && rm -f /tmp/gemini-{cli,core}.tgz
 
 # default entrypoint when none specified
-CMD ["gemini"]
+ENTRYPOINT ["/usr/local/share/npm-global/bin/gemini"]

GEMINI.md

@@ -44,6 +44,13 @@ powerful tool for developers.
 - **Test Commands:**
   - **Unit (All):** `npm run test`
   - **Integration (E2E):** `npm run test:e2e`
+  - > **NOTE**: Please run the memory and perf tests locally **only if** you are
+    > implementing changes related to those test areas. Otherwise skip these
+    > tests locally and rely on CI to run them on nightly builds.
+  - **Memory (Nightly):** `npm run test:memory` (Runs memory regression tests
+    against baselines. Excluded from `preflight`, run nightly.)
+  - **Performance (Nightly):** `npm run test:perf` (Runs CPU performance
+    regression tests against baselines. Excluded from `preflight`, run nightly.)
   - **Workspace-Specific:** `npm test -w <pkg> -- <path>` (Note: `<path>` must
     be relative to the workspace root, e.g.,
     `-w @google/gemini-cli-core -- src/routing/modelRouterService.test.ts`)

README.md

@@ -30,7 +30,7 @@ Learn all about Gemini CLI in our [documentation](https://geminicli.com/docs/).
 ## 📦 Installation
 
 See
-[Gemini CLI installation, execution, and releases](./docs/get-started/installation.md)
+[Gemini CLI installation, execution, and releases](https://www.geminicli.com/docs/get-started/installation)
 for recommended system specifications and a detailed installation guide.
 
 ### Quick Install
@@ -71,9 +71,9 @@ conda activate gemini_env
 npm install -g @google/gemini-cli
 ```
 
-## Release Cadence and Tags
+## Release Channels
 
-See [Releases](./docs/releases.md) for more details.
+See [Releases](https://www.geminicli.com/docs/changelogs) for more details.
 
 ### Preview
 
@@ -143,6 +143,16 @@ Integrate Gemini CLI directly into your GitHub workflows with
 - **Custom Workflows**: Build automated, scheduled and on-demand workflows
   tailored to your team's needs
 
+<!-- prettier-ignore -->
+> [!WARNING]
+> **Security best practice for public repositories:** Never set
+> `GEMINI_CLI_TRUST_WORKSPACE=true` or use `--skip-trust` in CI/CD workflows
+> that process untrusted public inputs (like issue titles/bodies or PR comments).
+> Doing so can expose dynamically generated runner secrets (such as GCP OIDC
+> service account credentials) to prompt injection attacks. See the
+> [Trusted Folders documentation](https://www.geminicli.com/docs/cli/trusted-folders)
+> for more information.
+
 ## 🔐 Authentication Options
 
 Choose the authentication method that best fits your needs:
@@ -209,7 +219,7 @@ gemini
 ```
 
 For Google Workspace accounts and other authentication methods, see the
-[authentication guide](./docs/get-started/authentication.md).
+[authentication guide](https://www.geminicli.com/docs/get-started/authentication).
 
 ## 🚀 Getting Started
 
@@ -278,59 +288,64 @@ gemini
 
 ### Getting Started
 
-- [**Quickstart Guide**](./docs/get-started/index.md) - Get up and running
-  quickly.
-- [**Authentication Setup**](./docs/get-started/authentication.md) - Detailed
-  auth configuration.
-- [**Configuration Guide**](./docs/reference/configuration.md) - Settings and
-  customization.
-- [**Keyboard Shortcuts**](./docs/reference/keyboard-shortcuts.md) -
+- [**Quickstart Guide**](https://www.geminicli.com/docs/get-started) - Get up
+  and running quickly.
+- [**Authentication Setup**](https://www.geminicli.com/docs/get-started/authentication) -
+  Detailed auth configuration.
+- [**Configuration Guide**](https://www.geminicli.com/docs/reference/configuration) -
+  Settings and customization.
+- [**Keyboard Shortcuts**](https://www.geminicli.com/docs/reference/keyboard-shortcuts) -
   Productivity tips.
 
 ### Core Features
 
-- [**Commands Reference**](./docs/reference/commands.md) - All slash commands
-  (`/help`, `/chat`, etc).
-- [**Custom Commands**](./docs/cli/custom-commands.md) - Create your own
-  reusable commands.
-- [**Context Files (GEMINI.md)**](./docs/cli/gemini-md.md) - Provide persistent
-  context to Gemini CLI.
-- [**Checkpointing**](./docs/cli/checkpointing.md) - Save and resume
-  conversations.
-- [**Token Caching**](./docs/cli/token-caching.md) - Optimize token usage.
+- [**Commands Reference**](https://www.geminicli.com/docs/reference/commands) -
+  All slash commands (`/help`, `/chat`, etc).
+- [**Custom Commands**](https://www.geminicli.com/docs/cli/custom-commands) -
+  Create your own reusable commands.
+- [**Context Files (GEMINI.md)**](https://www.geminicli.com/docs/cli/gemini-md) -
+  Provide persistent context to Gemini CLI.
+- [**Checkpointing**](https://www.geminicli.com/docs/cli/checkpointing) - Save
+  and resume conversations.
+- [**Token Caching**](https://www.geminicli.com/docs/cli/token-caching) -
+  Optimize token usage.
 
 ### Tools & Extensions
 
-- [**Built-in Tools Overview**](./docs/reference/tools.md)
-  - [File System Operations](./docs/tools/file-system.md)
-  - [Shell Commands](./docs/tools/shell.md)
-  - [Web Fetch & Search](./docs/tools/web-fetch.md)
-- [**MCP Server Integration**](./docs/tools/mcp-server.md) - Extend with custom
-  tools.
-- [**Custom Extensions**](./docs/extensions/index.md) - Build and share your own
-  commands.
+- [**Built-in Tools Overview**](https://www.geminicli.com/docs/reference/tools)
+  - [File System Operations](https://www.geminicli.com/docs/tools/file-system)
+  - [Shell Commands](https://www.geminicli.com/docs/tools/shell)
+  - [Web Fetch & Search](https://www.geminicli.com/docs/tools/web-fetch)
+- [**MCP Server Integration**](https://www.geminicli.com/docs/tools/mcp-server) -
+  Extend with custom tools.
+- [**Custom Extensions**](https://geminicli.com/docs/extensions/writing-extensions) -
+  Build and share your own commands.
 
 ### Advanced Topics
 
-- [**Headless Mode (Scripting)**](./docs/cli/headless.md) - Use Gemini CLI in
-  automated workflows.
-- [**IDE Integration**](./docs/ide-integration/index.md) - VS Code companion.
-- [**Sandboxing & Security**](./docs/cli/sandbox.md) - Safe execution
-  environments.
-- [**Trusted Folders**](./docs/cli/trusted-folders.md) - Control execution
-  policies by folder.
-- [**Enterprise Guide**](./docs/cli/enterprise.md) - Deploy and manage in a
-  corporate environment.
-- [**Telemetry & Monitoring**](./docs/cli/telemetry.md) - Usage tracking.
-- [**Tools reference**](./docs/reference/tools.md) - Built-in tools overview.
-- [**Local development**](./docs/local-development.md) - Local development
-  tooling.
+- [**Headless Mode (Scripting)**](https://www.geminicli.com/docs/cli/headless) -
+  Use Gemini CLI in automated workflows.
+- [**IDE Integration**](https://www.geminicli.com/docs/ide-integration) - VS
+  Code companion.
+- [**Sandboxing & Security**](https://www.geminicli.com/docs/cli/sandbox) - Safe
+  execution environments.
+- [**Trusted Folders**](https://www.geminicli.com/docs/cli/trusted-folders) -
+  Control execution policies by folder.
+- [**Enterprise Guide**](https://www.geminicli.com/docs/cli/enterprise) - Deploy
+  and manage in a corporate environment.
+- [**Telemetry & Monitoring**](https://www.geminicli.com/docs/cli/telemetry) -
+  Usage tracking.
+- [**Tools reference**](https://www.geminicli.com/docs/reference/tools) -
+  Built-in tools overview.
+- [**Local development**](https://www.geminicli.com/docs/local-development) -
+  Local development tooling.
 
 ### Troubleshooting & Support
 
-- [**Troubleshooting Guide**](./docs/resources/troubleshooting.md) - Common
-  issues and solutions.
-- [**FAQ**](./docs/resources/faq.md) - Frequently asked questions.
+- [**Troubleshooting Guide**](https://www.geminicli.com/docs/resources/troubleshooting) -
+  Common issues and solutions.
+- [**FAQ**](https://www.geminicli.com/docs/resources/faq) - Frequently asked
+  questions.
 - Use `/bug` command to report issues directly from the CLI.
 
 ### Using MCP Servers
@@ -344,8 +359,9 @@ custom tools:
 > @database Run a query to find inactive users
 ```
 
-See the [MCP Server Integration guide](./docs/tools/mcp-server.md) for setup
-instructions.
+See the
+[MCP Server Integration guide](https://www.geminicli.com/docs/tools/mcp-server)
+for setup instructions.
 
 ## 🤝 Contributing
 
@@ -365,8 +381,11 @@ for planned features and priorities.
 
 ## 📖 Resources
 
+- **[Free Course](https://learn.deeplearning.ai/courses/gemini-cli-code-and-create-with-an-open-source-agent/information)** -
+  Learn the basics.
 - **[Official Roadmap](./ROADMAP.md)** - See what's coming next.
-- **[Changelog](./docs/changelogs/index.md)** - See recent notable updates.
+- **[Changelog](https://www.geminicli.com/docs/changelogs)** - See recent
+  notable updates.
 - **[NPM Package](https://www.npmjs.com/package/@google/gemini-cli)** - Package
   registry.
 - **[GitHub Issues](https://github.com/google-gemini/gemini-cli/issues)** -
@@ -376,15 +395,26 @@ for planned features and priorities.
 
 ### Uninstall
 
-See the [Uninstall Guide](./docs/resources/uninstall.md) for removal
-instructions.
+See the [Uninstall Guide](https://www.geminicli.com/docs/resources/uninstall)
+for removal instructions.
 
 ## 📄 Legal
 
 - **License**: [Apache License 2.0](LICENSE)
-- **Terms of Service**: [Terms & Privacy](./docs/resources/tos-privacy.md)
+- **Terms of Service**:
+  [Terms & Privacy](https://www.geminicli.com/docs/resources/tos-privacy)
 - **Security**: [Security Policy](SECURITY.md)
 
+<p align="left">
+ <a href="https://www.star-history.com/google-gemini/gemini-cli">
+  <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/badge?repo=google-gemini/gemini-cli&theme=dark" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/badge?repo=google-gemini/gemini-cli" />
+   <img alt="Star History Rank" src="https://api.star-history.com/badge?repo=google-gemini/gemini-cli" />
+  </picture>
+ </a>
+</p>
+
 ---
 
 <p align="center">

docs/admin/enterprise-controls.md

@@ -72,7 +72,7 @@ organization.
 **Supported Fields:**
 
 - `url`: (Required) The full URL of the MCP server endpoint.
-- `type`: (Required) The connection type (e.g., `sse` or `http`).
+- `type`: (Required) The connection type (for example, `sse` or `http`).
 - `trust`: (Optional) If set to `true`, the server is trusted and tool execution
   will not require user approval.
 - `includeTools`: (Optional) An explicit list of tool names to allow. If
@@ -106,6 +106,67 @@ organization.
   ensures users maintain final control over which permitted servers are actually
   active in their environment.
 
+#### Required MCP Servers (preview)
+
+**Default**: empty
+
+Allows administrators to define MCP servers that are **always injected** into
+the user's environment. Unlike the allowlist (which filters user-configured
+servers), required servers are automatically added regardless of the user's
+local configuration.
+
+**Required Servers Format:**
+
+```json
+{
+  "requiredMcpServers": {
+    "corp-compliance-tool": {
+      "url": "https://mcp.corp/compliance",
+      "type": "http",
+      "trust": true,
+      "description": "Corporate compliance tool"
+    },
+    "internal-registry": {
+      "url": "https://registry.corp/mcp",
+      "type": "sse",
+      "authProviderType": "google_credentials",
+      "oauth": {
+        "scopes": ["https://www.googleapis.com/auth/scope"]
+      }
+    }
+  }
+}
+```
+
+**Supported Fields:**
+
+- `url`: (Required) The full URL of the MCP server endpoint.
+- `type`: (Required) The connection type (`sse` or `http`).
+- `trust`: (Optional) If set to `true`, tool execution will not require user
+  approval. Defaults to `true` for required servers.
+- `description`: (Optional) Human-readable description of the server.
+- `authProviderType`: (Optional) Authentication provider (`dynamic_discovery`,
+  `google_credentials`, or `service_account_impersonation`).
+- `oauth`: (Optional) OAuth configuration including `scopes`, `clientId`, and
+  `clientSecret`.
+- `targetAudience`: (Optional) OAuth target audience for service-to-service
+  auth.
+- `targetServiceAccount`: (Optional) Service account email to impersonate.
+- `headers`: (Optional) Additional HTTP headers to send with requests.
+- `includeTools` / `excludeTools`: (Optional) Tool filtering lists.
+- `timeout`: (Optional) Timeout in milliseconds for MCP requests.
+
+**Client Enforcement Logic:**
+
+- Required servers are injected **after** allowlist filtering, so they are
+  always available even if the allowlist is active.
+- If a required server has the **same name** as a locally configured server, the
+  admin configuration **completely overrides** the local one.
+- Required servers only support remote transports (`sse`, `http`). Local
+  execution fields (`command`, `args`, `env`, `cwd`) are not supported.
+- Required servers can coexist with allowlisted servers — both features work
+  independently.
+
 ### Unmanaged Capabilities
 
 **Enabled/Disabled** | Default: disabled

docs/changelogs/index.md

@@ -18,6 +18,210 @@ on GitHub.
 | [Preview](preview.md) | Experimental features ready for early feedback. |
 | [Stable](latest.md)   | Stable, recommended for general use.            |
 
+## Announcements: v0.45.0 - 2026-06-03
+
+- **Context Simplification:** Completed major architectural work to simplify the
+  `ContextManager`, improving system robustness and performance
+  ([#27345](https://github.com/google-gemini/gemini-cli/pull/27345) by
+  @joshualitt).
+- **A2A Usage Metadata:** Exposed critical usage metadata in the Agent-to-Agent
+  (A2A) protocol for better resource tracking
+  ([#27288](https://github.com/google-gemini/gemini-cli/pull/27288) by
+  @jvargassanchez-dot).
+- **Reliability Fixes:** Addressed Termux relaunch loops, PTY resize errors, and
+  forced sequential execution for topic updates
+  ([#27110](https://github.com/google-gemini/gemini-cli/pull/27110) by @saymanq,
+  [#27357](https://github.com/google-gemini/gemini-cli/pull/27357) by
+  @jvargassanchez-dot,
+  [#27461](https://github.com/google-gemini/gemini-cli/pull/27461) by
+  @scidomino).
+
+## Announcements: v0.44.0 - 2026-05-27
+
+- **Unified Auto Mode:** Streamlined the automation experience by merging
+  specialized Auto modes into a single, unified mode
+  ([#26714](https://github.com/google-gemini/gemini-cli/pull/26714) by
+  @DavidAPierce).
+- **New Editor Integrations:** Added native support for Sublime Text and Emacs
+  Client ([#21090](https://github.com/google-gemini/gemini-cli/pull/21090) by
+  @alberti42).
+- **Enhanced TUI Testing:** Introduced `agent-tui` and `tui-tester` skills for
+  programmatic testing and automation of terminal UI applications
+  ([#27121](https://github.com/google-gemini/gemini-cli/pull/27121) by
+  @adamfweidman).
+
+## Announcements: v0.43.0 - 2026-05-22
+
+- **Surgical Code Edits:** Steered Gemini models to prefer the `edit` tool for
+  surgical modifications, improving speed and precision
+  ([#26480](https://github.com/google-gemini/gemini-cli/pull/26480) by
+  @aishaneeshah).
+- **Session Export and Import:** Added the ability to export sessions to files
+  and import them via a new flag, facilitating session portability
+  ([#26514](https://github.com/google-gemini/gemini-cli/pull/26514) by
+  @cocosheng-g).
+- **Adaptive Token Estimation:** Introduced an adaptive token calculator for
+  more accurate content size estimation, enhancing context management efficiency
+  ([#26888](https://github.com/google-gemini/gemini-cli/pull/26888) by
+  @joshualitt).
+
+## Announcements: v0.42.0 - 2026-05-12
+
+- **Auto Memory Inbox:** Introduced a new inbox flow for Auto Memory with a
+  canonical-patch contract for seamless skill management
+  ([#26338](https://github.com/google-gemini/gemini-cli/pull/26338) by
+  @SandyTao520).
+- **Gemma 4 by Default:** Enabled Gemma 4 models by default via the Gemini API
+  for all users
+  ([#26307](https://github.com/google-gemini/gemini-cli/pull/26307) by
+  @Abhijit-2592).
+- **Voice Mode Enhancements:** Added wave animations and privacy/compliance UX
+  warnings for the Gemini Live backend
+  ([#26284](https://github.com/google-gemini/gemini-cli/pull/26284) by
+  @devr0306, [#26454](https://github.com/google-gemini/gemini-cli/pull/26454) by
+  @cocosheng-g).
+
+## Announcements: v0.41.0 - 2026-05-05
+
+- **Real-time Voice Mode:** Implemented real-time voice mode with cloud and
+  local backends
+  ([#24174](https://github.com/google-gemini/gemini-cli/pull/24174) by
+  @Abhijit-2592).
+- **Secure Environment Loading:** Enforced workspace trust and secured .env
+  loading in headless mode
+  ([#25814](https://github.com/google-gemini/gemini-cli/pull/25814) by
+  @ehedlund).
+- **Advanced Shell Validation:** Enhanced shell command validation and added
+  core tools allowlist for improved security
+  ([#25720](https://github.com/google-gemini/gemini-cli/pull/25720) by @galz10).
+
+## Announcements: v0.40.0 - 2026-04-28
+
+- **Offline Search and Themes:** Bundled ripgrep for offline search support and
+  added GitHub-style colorblind themes
+  ([#25342](https://github.com/google-gemini/gemini-cli/pull/25342) by
+  @scidomino, [#15504](https://github.com/google-gemini/gemini-cli/pull/15504)
+  by @Z1xus).
+- **Advanced Resource and Memory Management:** Introduced MCP resource tools and
+  transitioned to a prompt-driven, four-tier memory management system
+  ([#25395](https://github.com/google-gemini/gemini-cli/pull/25395) by
+  @ruomengz, [#25716](https://github.com/google-gemini/gemini-cli/pull/25716) by
+  @SandyTao520).
+- **UX and Local Models:** Enabled topic update narrations by default and
+  streamlined Gemma local model setup with `gemini gemma`
+  ([#25586](https://github.com/google-gemini/gemini-cli/pull/25586) by
+  @gundermanc, [#25498](https://github.com/google-gemini/gemini-cli/pull/25498)
+  by @Samee24).
+
+## Announcements: v0.39.0 - 2026-04-23
+
+- **Skill Management:** Added a new `/memory` inbox command for reviewing and
+  patching skills extracted during sessions
+  ([#24544](https://github.com/google-gemini/gemini-cli/pull/24544) by
+  @SandyTao520, [#25148](https://github.com/google-gemini/gemini-cli/pull/25148)
+  by @SandyTao520).
+- **Improved Transparency:** Plan Mode now requires confirmation for skill
+  activation and allows plan inspection
+  ([#24946](https://github.com/google-gemini/gemini-cli/pull/24946),
+  [#25058](https://github.com/google-gemini/gemini-cli/pull/25058) by
+  @ruomengz).
+- **Architecture & Reliability:** Introduced a decoupled `ContextManager`
+  architecture and resolved several critical memory leaks and PTY exhaustion
+  issues ([#24752](https://github.com/google-gemini/gemini-cli/pull/24752) by
+  @joshualitt, [#25079](https://github.com/google-gemini/gemini-cli/pull/25079)
+  by @spencer426).
+
+## Announcements: v0.38.0 - 2026-04-14
+
+- **Chapters Narrative Flow:** Group agent interactions into "Chapters" based on
+  intent and tool usage for better session structure
+  ([#23150](https://github.com/google-gemini/gemini-cli/pull/23150) by
+  @Abhijit-2592,
+  [#24079](https://github.com/google-gemini/gemini-cli/pull/24079) by
+  @gundermanc).
+- **Context Compression Service:** Advanced context management to efficiently
+  distill conversation history
+  ([#24483](https://github.com/google-gemini/gemini-cli/pull/24483) by
+  @joshualitt).
+- **UI Flicker & UX Enhancements:** Solved rendering flicker with "Terminal
+  Buffer" mode and introduced selective topic expansion
+  ([#24512](https://github.com/google-gemini/gemini-cli/pull/24512) by
+  @jacob314, [#24793](https://github.com/google-gemini/gemini-cli/pull/24793) by
+  @Abhijit-2592).
+- **Persistent Policy Approvals:** Implemented context-aware persistent
+  approvals for tool execution
+  ([#23257](https://github.com/google-gemini/gemini-cli/pull/23257) by @jerop).
+
+## Announcements: v0.37.0 - 2026-04-08
+
+- **Dynamic Sandbox Expansion:** Implemented dynamic sandbox expansion and
+  worktree support for Linux and Windows, improving developer workflows in
+  isolated environments
+  ([#23692](https://github.com/google-gemini/gemini-cli/pull/23692) by @galz10,
+  [#23691](https://github.com/google-gemini/gemini-cli/pull/23691) by
+  @scidomino).
+- **Chapters Narrative Flow:** Introduced tool-based topic grouping ("Chapters")
+  to provide better session structure and narrative continuity
+  ([#23150](https://github.com/google-gemini/gemini-cli/pull/23150) by
+  @Abhijit-2592,
+  [#24079](https://github.com/google-gemini/gemini-cli/pull/24079) by
+  @gundermanc).
+- **Advanced Browser Capabilities:** Enhanced the browser agent with persistent
+  sessions and dynamic tool discovery
+  ([#21306](https://github.com/google-gemini/gemini-cli/pull/21306) by
+  @kunal-10-cloud,
+  [#23805](https://github.com/google-gemini/gemini-cli/pull/23805) by
+  @cynthialong0-0).
+
+## Announcements: v0.36.0 - 2026-04-01
+
+- **Multi-Registry Architecture and Sandboxing:** Introduced a multi-registry
+  architecture and implemented native macOS Seatbelt and Windows sandboxing for
+  enhanced subagent security
+  ([#22712](https://github.com/google-gemini/gemini-cli/pull/22712),
+  [#22718](https://github.com/google-gemini/gemini-cli/pull/22718) by @akh64bit,
+  [#22832](https://github.com/google-gemini/gemini-cli/pull/22832) by @ehedlund,
+  [#21807](https://github.com/google-gemini/gemini-cli/pull/21807) by
+  @mattKorwel).
+- **Refreshed Composer UX:** Implemented a refreshed user experience for the
+  Composer layout and improved terminal interaction robustness
+  ([#21212](https://github.com/google-gemini/gemini-cli/pull/21212),
+  [#23286](https://github.com/google-gemini/gemini-cli/pull/23286) by
+  @jwhelangoog).
+- **Git Worktree Support:** Added native support for Git worktrees, allowing for
+  isolated parallel sessions
+  ([#22973](https://github.com/google-gemini/gemini-cli/pull/22973),
+  [#23265](https://github.com/google-gemini/gemini-cli/pull/23265) by @jerop).
+- **Subagent Context and Feedback:** Enhanced subagents with JIT context
+  injection and resilient tool rejection with contextual feedback
+  ([#23032](https://github.com/google-gemini/gemini-cli/pull/23032),
+  [#22951](https://github.com/google-gemini/gemini-cli/pull/22951) by
+  @abhipatel12).
+
+## Announcements: v0.35.0 - 2026-03-24
+
+- **Customizable Keyboard Shortcuts:** Users can now customize their keyboard
+  shortcuts, including support for literal character keybindings and the
+  extended Kitty protocol
+  ([#21945](https://github.com/google-gemini/gemini-cli/pull/21945),
+  [#21972](https://github.com/google-gemini/gemini-cli/pull/21972) by
+  @scidomino).
+- **Vim Mode Improvements:** Added missing motions (X, ~, r, f/F/t/T) and
+  yank/paste support with the unnamed register
+  ([#21932](https://github.com/google-gemini/gemini-cli/pull/21932),
+  [#22026](https://github.com/google-gemini/gemini-cli/pull/22026) by @aanari).
+- **Tool Isolation and Sandboxing:** Introduced `SandboxManager` to isolate
+  process-spawning tools and added Linux bubblewrap/seccomp sandboxing support
+  ([#21774](https://github.com/google-gemini/gemini-cli/pull/21774),
+  [#22231](https://github.com/google-gemini/gemini-cli/pull/22231) by @galz10,
+  [#22680](https://github.com/google-gemini/gemini-cli/pull/22680) by
+  @DavidAPierce).
+- **JIT Context Discovery:** Implemented Just-In-Time context discovery for file
+  system tools to improve model performance and accuracy
+  ([#22082](https://github.com/google-gemini/gemini-cli/pull/22082),
+  [#22736](https://github.com/google-gemini/gemini-cli/pull/22736) by
+  @SandyTao520).
+
 ## Announcements: v0.34.0 - 2026-03-17
 
 - **Plan Mode Enabled by Default:** Plan Mode is now enabled by default to help

docs/changelogs/latest.md

@@ -1,6 +1,6 @@
-# Latest stable release: v0.34.0
+# Latest stable release: v0.45.0
 
-Released: March 17, 2026
+Released: June 03, 2026
 
 For most users, our latest stable release is the recommended release. Install
 the latest stable version with:
@@ -11,474 +11,55 @@ npm install -g @google/gemini-cli
 
 ## Highlights
 
-- **Plan Mode Enabled by Default**: The comprehensive planning capability is now
-  enabled by default, allowing for better structured task management and
-  execution.
-- **Enhanced Sandboxing Capabilities**: Added support for native gVisor (runsc)
-  sandboxing as well as experimental LXC container sandboxing to provide more
-  robust and isolated execution environments.
-- **Improved Loop Detection & Recovery**: Implemented iterative loop detection
-  and model feedback mechanisms to prevent the CLI from getting stuck in
-  repetitive actions.
-- **Customizable UI Elements**: You can now configure a custom footer using the
-  new `/footer` command, and enjoy standardized semantic focus colors for better
-  history visibility.
-- **Extensive Subagent Updates**: Refinements across the tracker visualization
-  tools, background process logging, and broader fallback support for models in
-  tool execution scenarios.
+- **Context Manager Simplification:** Completed a significant refactoring of the
+  context management system to improve reliability and architectural clarity.
+- **A2A Usage Metadata:** Enhanced the Agent-to-Agent protocol to expose usage
+  metadata, enabling more transparent resource monitoring.
+- **Terminal & PTY Robustness:** Resolved several critical issues related to
+  terminal interactions, including Termux relaunch loops and PTY resize errors.
+- **Routing Optimizations:** Updated default auto-routing and bypassed
+  classifiers for specific tool responses to prevent orphaned function errors.
+- **Tool Execution Control:** Forced the `update_topic` tool to execute
+  sequentially, ensuring consistent narrative flow in agent interactions.
 
 ## What's Changed
 
-- feat(cli): add chat resume footer on session quit by @lordshashank in
-  [#20667](https://github.com/google-gemini/gemini-cli/pull/20667)
-- Support bold and other styles in svg snapshots by @jacob314 in
-  [#20937](https://github.com/google-gemini/gemini-cli/pull/20937)
-- fix(core): increase A2A agent timeout to 30 minutes by @adamfweidman in
-  [#21028](https://github.com/google-gemini/gemini-cli/pull/21028)
-- Cleanup old branches. by @jacob314 in
-  [#19354](https://github.com/google-gemini/gemini-cli/pull/19354)
-- chore(release): bump version to 0.34.0-nightly.20260303.34f0c1538 by
+- chore(release): bump version to 0.45.0-nightly.20260521.g854f811be by
   @gemini-cli-robot in
-  [#21034](https://github.com/google-gemini/gemini-cli/pull/21034)
-- feat(ui): standardize semantic focus colors and enhance history visibility by
-  @keithguerin in
-  [#20745](https://github.com/google-gemini/gemini-cli/pull/20745)
-- fix: merge duplicate imports in packages/core (3/4) by @Nixxx19 in
-  [#20928](https://github.com/google-gemini/gemini-cli/pull/20928)
-- Add extra safety checks for proto pollution by @jacob314 in
-  [#20396](https://github.com/google-gemini/gemini-cli/pull/20396)
-- feat(core): Add tracker CRUD tools & visualization by @anj-s in
-  [#19489](https://github.com/google-gemini/gemini-cli/pull/19489)
-- Revert "fix(ui): persist expansion in AskUser dialog when navigating options"
-  by @jacob314 in
-  [#21042](https://github.com/google-gemini/gemini-cli/pull/21042)
-- Changelog for v0.33.0-preview.0 by @gemini-cli-robot in
-  [#21030](https://github.com/google-gemini/gemini-cli/pull/21030)
-- fix: model persistence for all scenarios by @sripasg in
-  [#21051](https://github.com/google-gemini/gemini-cli/pull/21051)
-- chore/release: bump version to 0.34.0-nightly.20260304.28af4e127 by
+  [#27362](https://github.com/google-gemini/gemini-cli/pull/27362)
+- fix(cli): prevent Termux relaunch and resize remount loops by @saymanq in
+  [#27110](https://github.com/google-gemini/gemini-cli/pull/27110)
+- Feat/a2a expose usage metadata by @jvargassanchez-dot in
+  [#27288](https://github.com/google-gemini/gemini-cli/pull/27288)
+- feat(context): Complete simplification work. by @joshualitt in
+  [#27345](https://github.com/google-gemini/gemini-cli/pull/27345)
+- fix(core): force update_topic tool to execute sequentially by
+  @jvargassanchez-dot in
+  [#27357](https://github.com/google-gemini/gemini-cli/pull/27357)
+- Changelog for v0.44.0-preview.0 by @gemini-cli-robot in
+  [#27360](https://github.com/google-gemini/gemini-cli/pull/27360)
+- Changelog for v0.43.0 by @gemini-cli-robot in
+  [#27361](https://github.com/google-gemini/gemini-cli/pull/27361)
+- Revert "fix(core): prevent SIGHUP kills in PTY environments" by @bbiggs in
+  [#27401](https://github.com/google-gemini/gemini-cli/pull/27401)
+- fix(cli): filter internal session context from history during resumption by
+  @rmedranollamas in
+  [#27391](https://github.com/google-gemini/gemini-cli/pull/27391)
+- Update default auto routing by @DavidAPierce in
+  [#27071](https://github.com/google-gemini/gemini-cli/pull/27071)
+- fix(core): bypass routing classifiers to prevent orphaned function response
+  errors by @danielweis in
+  [#27389](https://github.com/google-gemini/gemini-cli/pull/27389)
+- fix(core): suppress PTY resize EBADF errors by @scidomino in
+  [#27461](https://github.com/google-gemini/gemini-cli/pull/27461)
+- fix(core): prevent blacklist bypass in mcp list by @ompatel-aiml in
+  [#27377](https://github.com/google-gemini/gemini-cli/pull/27377)
+- fix(cli): ignore unmapped vim normal keys by @MukundaKatta in
+  [#27102](https://github.com/google-gemini/gemini-cli/pull/27102)
+- fix(patch): cherry-pick bd53951 to release/v0.45.0-preview.0-pr-27496 to patch
+  version v0.45.0-preview.0 and create version 0.45.0-preview.1 by
   @gemini-cli-robot in
-  [#21054](https://github.com/google-gemini/gemini-cli/pull/21054)
-- Consistently guard restarts against concurrent auto updates by @scidomino in
-  [#21016](https://github.com/google-gemini/gemini-cli/pull/21016)
-- Defensive coding to reduce the risk of Maximum update depth errors by
-  @jacob314 in [#20940](https://github.com/google-gemini/gemini-cli/pull/20940)
-- fix(cli): Polish shell autocomplete rendering to be a little more shell native
-  feeling. by @jacob314 in
-  [#20931](https://github.com/google-gemini/gemini-cli/pull/20931)
-- Docs: Update plan mode docs by @jkcinouye in
-  [#19682](https://github.com/google-gemini/gemini-cli/pull/19682)
-- fix(mcp): Notifications/tools/list_changed support not working by @jacob314 in
-  [#21050](https://github.com/google-gemini/gemini-cli/pull/21050)
-- fix(cli): register extension lifecycle events in DebugProfiler by
-  @fayerman-source in
-  [#20101](https://github.com/google-gemini/gemini-cli/pull/20101)
-- chore(dev): update vscode settings for typescriptreact by @rohit-4321 in
-  [#19907](https://github.com/google-gemini/gemini-cli/pull/19907)
-- fix(cli): enable multi-arch docker builds for sandbox by @ru-aish in
-  [#19821](https://github.com/google-gemini/gemini-cli/pull/19821)
-- Changelog for v0.32.0 by @gemini-cli-robot in
-  [#21033](https://github.com/google-gemini/gemini-cli/pull/21033)
-- Changelog for v0.33.0-preview.1 by @gemini-cli-robot in
-  [#21058](https://github.com/google-gemini/gemini-cli/pull/21058)
-- feat(core): improve @scripts/copy_files.js autocomplete to prioritize
-  filenames by @sehoon38 in
-  [#21064](https://github.com/google-gemini/gemini-cli/pull/21064)
-- feat(sandbox): add experimental LXC container sandbox support by @h30s in
-  [#20735](https://github.com/google-gemini/gemini-cli/pull/20735)
-- feat(evals): add overall pass rate row to eval nightly summary table by
-  @gundermanc in
-  [#20905](https://github.com/google-gemini/gemini-cli/pull/20905)
-- feat(telemetry): include language in telemetry and fix accepted lines
-  computation by @gundermanc in
-  [#21126](https://github.com/google-gemini/gemini-cli/pull/21126)
-- Changelog for v0.32.1 by @gemini-cli-robot in
-  [#21055](https://github.com/google-gemini/gemini-cli/pull/21055)
-- feat(core): add robustness tests, logging, and metrics for CodeAssistServer
-  SSE parsing by @yunaseoul in
-  [#21013](https://github.com/google-gemini/gemini-cli/pull/21013)
-- feat: add issue assignee workflow by @kartikangiras in
-  [#21003](https://github.com/google-gemini/gemini-cli/pull/21003)
-- fix: improve error message when OAuth succeeds but project ID is required by
-  @Nixxx19 in [#21070](https://github.com/google-gemini/gemini-cli/pull/21070)
-- feat(loop-reduction): implement iterative loop detection and model feedback by
-  @aishaneeshah in
-  [#20763](https://github.com/google-gemini/gemini-cli/pull/20763)
-- chore(github): require prompt approvers for agent prompt files by @gundermanc
-  in [#20896](https://github.com/google-gemini/gemini-cli/pull/20896)
-- Docs: Create tools reference by @jkcinouye in
-  [#19470](https://github.com/google-gemini/gemini-cli/pull/19470)
-- fix(core, a2a-server): prevent hang during OAuth in non-interactive sessions
-  by @spencer426 in
-  [#21045](https://github.com/google-gemini/gemini-cli/pull/21045)
-- chore(cli): enable deprecated settings removal by default by @yashodipmore in
-  [#20682](https://github.com/google-gemini/gemini-cli/pull/20682)
-- feat(core): Disable fast ack helper for hints. by @joshualitt in
-  [#21011](https://github.com/google-gemini/gemini-cli/pull/21011)
-- fix(ui): suppress redundant failure note when tool error note is shown by
-  @NTaylorMullen in
-  [#21078](https://github.com/google-gemini/gemini-cli/pull/21078)
-- docs: document planning workflows with Conductor example by @jerop in
-  [#21166](https://github.com/google-gemini/gemini-cli/pull/21166)
-- feat(release): ship esbuild bundle in npm package by @genneth in
-  [#19171](https://github.com/google-gemini/gemini-cli/pull/19171)
-- fix(extensions): preserve symlinks in extension source path while enforcing
-  folder trust by @galz10 in
-  [#20867](https://github.com/google-gemini/gemini-cli/pull/20867)
-- fix(cli): defer tool exclusions to policy engine in non-interactive mode by
-  @EricRahm in [#20639](https://github.com/google-gemini/gemini-cli/pull/20639)
-- fix(ui): removed double padding on rendered content by @devr0306 in
-  [#21029](https://github.com/google-gemini/gemini-cli/pull/21029)
-- fix(core): truncate excessively long lines in grep search output by
-  @gundermanc in
-  [#21147](https://github.com/google-gemini/gemini-cli/pull/21147)
-- feat: add custom footer configuration via `/footer` by @jackwotherspoon in
-  [#19001](https://github.com/google-gemini/gemini-cli/pull/19001)
-- perf(core): fix OOM crash in long-running sessions by @WizardsForgeGames in
-  [#19608](https://github.com/google-gemini/gemini-cli/pull/19608)
-- refactor(cli): categorize built-in themes into dark/ and light/ directories by
-  @JayadityaGit in
-  [#18634](https://github.com/google-gemini/gemini-cli/pull/18634)
-- fix(core): explicitly allow codebase_investigator and cli_help in read-only
-  mode by @Adib234 in
-  [#21157](https://github.com/google-gemini/gemini-cli/pull/21157)
-- test: add browser agent integration tests by @kunal-10-cloud in
-  [#21151](https://github.com/google-gemini/gemini-cli/pull/21151)
-- fix(cli): fix enabling kitty codes on Windows Terminal by @scidomino in
-  [#21136](https://github.com/google-gemini/gemini-cli/pull/21136)
-- refactor(core): extract shared OAuth flow primitives from MCPOAuthProvider by
-  @SandyTao520 in
-  [#20895](https://github.com/google-gemini/gemini-cli/pull/20895)
-- fix(ui): add partial output to cancelled shell UI by @devr0306 in
-  [#21178](https://github.com/google-gemini/gemini-cli/pull/21178)
-- fix(cli): replace hardcoded keybinding strings with dynamic formatters by
-  @scidomino in [#21159](https://github.com/google-gemini/gemini-cli/pull/21159)
-- DOCS: Update quota and pricing page by @g-samroberts in
-  [#21194](https://github.com/google-gemini/gemini-cli/pull/21194)
-- feat(telemetry): implement Clearcut logging for startup statistics by
-  @yunaseoul in [#21172](https://github.com/google-gemini/gemini-cli/pull/21172)
-- feat(triage): add area/documentation to issue triage by @g-samroberts in
-  [#21222](https://github.com/google-gemini/gemini-cli/pull/21222)
-- Fix so shell calls are formatted by @jacob314 in
-  [#21237](https://github.com/google-gemini/gemini-cli/pull/21237)
-- feat(cli): add native gVisor (runsc) sandboxing support by @Zheyuan-Lin in
-  [#21062](https://github.com/google-gemini/gemini-cli/pull/21062)
-- docs: use absolute paths for internal links in plan-mode.md by @jerop in
-  [#21299](https://github.com/google-gemini/gemini-cli/pull/21299)
-- fix(core): prevent unhandled AbortError crash during stream loop detection by
-  @7hokerz in [#21123](https://github.com/google-gemini/gemini-cli/pull/21123)
-- fix:reorder env var redaction checks to scan values first by @kartikangiras in
-  [#21059](https://github.com/google-gemini/gemini-cli/pull/21059)
-- fix(acp): rename --experimental-acp to --acp & remove Zed-specific refrences
-  by @skeshive in
-  [#21171](https://github.com/google-gemini/gemini-cli/pull/21171)
-- feat(core): fallback to 2.5 models with no access for toolcalls by @sehoon38
-  in [#21283](https://github.com/google-gemini/gemini-cli/pull/21283)
-- test(core): improve testing for API request/response parsing by @sehoon38 in
-  [#21227](https://github.com/google-gemini/gemini-cli/pull/21227)
-- docs(links): update docs-writer skill and fix broken link by @g-samroberts in
-  [#21314](https://github.com/google-gemini/gemini-cli/pull/21314)
-- Fix code colorizer ansi escape bug. by @jacob314 in
-  [#21321](https://github.com/google-gemini/gemini-cli/pull/21321)
-- remove wildcard behavior on keybindings by @scidomino in
-  [#21315](https://github.com/google-gemini/gemini-cli/pull/21315)
-- feat(acp): Add support for AI Gateway auth by @skeshive in
-  [#21305](https://github.com/google-gemini/gemini-cli/pull/21305)
-- fix(theme): improve theme color contrast for macOS Terminal.app by @clocky in
-  [#21175](https://github.com/google-gemini/gemini-cli/pull/21175)
-- feat (core): Implement tracker related SI changes by @anj-s in
-  [#19964](https://github.com/google-gemini/gemini-cli/pull/19964)
-- Changelog for v0.33.0-preview.2 by @gemini-cli-robot in
-  [#21333](https://github.com/google-gemini/gemini-cli/pull/21333)
-- Changelog for v0.33.0-preview.3 by @gemini-cli-robot in
-  [#21347](https://github.com/google-gemini/gemini-cli/pull/21347)
-- docs: format release times as HH:MM UTC by @pavan-sh in
-  [#20726](https://github.com/google-gemini/gemini-cli/pull/20726)
-- fix(cli): implement --all flag for extensions uninstall by @sehoon38 in
-  [#21319](https://github.com/google-gemini/gemini-cli/pull/21319)
-- docs: fix incorrect relative links to command reference by @kanywst in
-  [#20964](https://github.com/google-gemini/gemini-cli/pull/20964)
-- documentiong ensures ripgrep by @Jatin24062005 in
-  [#21298](https://github.com/google-gemini/gemini-cli/pull/21298)
-- fix(core): handle AbortError thrown during processTurn by @MumuTW in
-  [#21296](https://github.com/google-gemini/gemini-cli/pull/21296)
-- docs(cli): clarify ! command output visibility in shell commands tutorial by
-  @MohammedADev in
-  [#21041](https://github.com/google-gemini/gemini-cli/pull/21041)
-- fix: logic for task tracker strategy and remove tracker tools by @anj-s in
-  [#21355](https://github.com/google-gemini/gemini-cli/pull/21355)
-- fix(partUtils): display media type and size for inline data parts by @Aboudjem
-  in [#21358](https://github.com/google-gemini/gemini-cli/pull/21358)
-- Fix(accessibility): add screen reader support to RewindViewer by @Famous077 in
-  [#20750](https://github.com/google-gemini/gemini-cli/pull/20750)
-- fix(hooks): propagate stopHookActive in AfterAgent retry path (#20426) by
-  @Aarchi-07 in [#20439](https://github.com/google-gemini/gemini-cli/pull/20439)
-- fix(core): deduplicate GEMINI.md files by device/inode on case-insensitive
-  filesystems (#19904) by @Nixxx19 in
-  [#19915](https://github.com/google-gemini/gemini-cli/pull/19915)
-- feat(core): add concurrency safety guidance for subagent delegation (#17753)
-  by @abhipatel12 in
-  [#21278](https://github.com/google-gemini/gemini-cli/pull/21278)
-- feat(ui): dynamically generate all keybinding hints by @scidomino in
-  [#21346](https://github.com/google-gemini/gemini-cli/pull/21346)
-- feat(core): implement unified KeychainService and migrate token storage by
-  @ehedlund in [#21344](https://github.com/google-gemini/gemini-cli/pull/21344)
-- fix(cli): gracefully handle --resume when no sessions exist by @SandyTao520 in
-  [#21429](https://github.com/google-gemini/gemini-cli/pull/21429)
-- fix(plan): keep approved plan during chat compression by @ruomengz in
-  [#21284](https://github.com/google-gemini/gemini-cli/pull/21284)
-- feat(core): implement generic CacheService and optimize setupUser by @sehoon38
-  in [#21374](https://github.com/google-gemini/gemini-cli/pull/21374)
-- Update quota and pricing documentation with subscription tiers by @srithreepo
-  in [#21351](https://github.com/google-gemini/gemini-cli/pull/21351)
-- fix(core): append correct OTLP paths for HTTP exporters by
-  @sebastien-prudhomme in
-  [#16836](https://github.com/google-gemini/gemini-cli/pull/16836)
-- Changelog for v0.33.0-preview.4 by @gemini-cli-robot in
-  [#21354](https://github.com/google-gemini/gemini-cli/pull/21354)
-- feat(cli): implement dot-prefixing for slash command conflicts by @ehedlund in
-  [#20979](https://github.com/google-gemini/gemini-cli/pull/20979)
-- refactor(core): standardize MCP tool naming to mcp\_ FQN format by
-  @abhipatel12 in
-  [#21425](https://github.com/google-gemini/gemini-cli/pull/21425)
-- feat(cli): hide gemma settings from display and mark as experimental by
-  @abhipatel12 in
-  [#21471](https://github.com/google-gemini/gemini-cli/pull/21471)
-- feat(skills): refine string-reviewer guidelines and description by @clocky in
-  [#20368](https://github.com/google-gemini/gemini-cli/pull/20368)
-- fix(core): whitelist TERM and COLORTERM in environment sanitization by
-  @deadsmash07 in
-  [#20514](https://github.com/google-gemini/gemini-cli/pull/20514)
-- fix(billing): fix overage strategy lifecycle and settings integration by
-  @gsquared94 in
-  [#21236](https://github.com/google-gemini/gemini-cli/pull/21236)
-- fix: expand paste placeholders in TextInput on submit by @Jefftree in
-  [#19946](https://github.com/google-gemini/gemini-cli/pull/19946)
-- fix(core): add in-memory cache to ChatRecordingService to prevent OOM by
-  @SandyTao520 in
-  [#21502](https://github.com/google-gemini/gemini-cli/pull/21502)
-- feat(cli): overhaul thinking UI by @keithguerin in
-  [#18725](https://github.com/google-gemini/gemini-cli/pull/18725)
-- fix(ui): unify Ctrl+O expansion hint experience across buffer modes by
-  @jwhelangoog in
-  [#21474](https://github.com/google-gemini/gemini-cli/pull/21474)
-- fix(cli): correct shell height reporting by @jacob314 in
-  [#21492](https://github.com/google-gemini/gemini-cli/pull/21492)
-- Make test suite pass when the GEMINI_SYSTEM_MD env variable or
-  GEMINI_WRITE_SYSTEM_MD variable happens to be set locally/ by @jacob314 in
-  [#21480](https://github.com/google-gemini/gemini-cli/pull/21480)
-- Disallow underspecified types by @gundermanc in
-  [#21485](https://github.com/google-gemini/gemini-cli/pull/21485)
-- refactor(cli): standardize on 'reload' verb for all components by @keithguerin
-  in [#20654](https://github.com/google-gemini/gemini-cli/pull/20654)
-- feat(cli): Invert quota language to 'percent used' by @keithguerin in
-  [#20100](https://github.com/google-gemini/gemini-cli/pull/20100)
-- Docs: Add documentation for notifications (experimental)(macOS) by @jkcinouye
-  in [#21163](https://github.com/google-gemini/gemini-cli/pull/21163)
-- Code review comments as a pr by @jacob314 in
-  [#21209](https://github.com/google-gemini/gemini-cli/pull/21209)
-- feat(cli): unify /chat and /resume command UX by @LyalinDotCom in
-  [#20256](https://github.com/google-gemini/gemini-cli/pull/20256)
-- docs: fix typo 'allowslisted' -> 'allowlisted' in mcp-server.md by
-  @Gyanranjan-Priyam in
-  [#21665](https://github.com/google-gemini/gemini-cli/pull/21665)
-- fix(core): display actual graph output in tracker_visualize tool by @anj-s in
-  [#21455](https://github.com/google-gemini/gemini-cli/pull/21455)
-- fix(core): sanitize SSE-corrupted JSON and domain strings in error
-  classification by @gsquared94 in
-  [#21702](https://github.com/google-gemini/gemini-cli/pull/21702)
-- Docs: Make documentation links relative by @diodesign in
-  [#21490](https://github.com/google-gemini/gemini-cli/pull/21490)
-- feat(cli): expose /tools desc as explicit subcommand for discoverability by
-  @aworki in [#21241](https://github.com/google-gemini/gemini-cli/pull/21241)
-- feat(cli): add /compact alias for /compress command by @jackwotherspoon in
-  [#21711](https://github.com/google-gemini/gemini-cli/pull/21711)
-- feat(plan): enable Plan Mode by default by @jerop in
-  [#21713](https://github.com/google-gemini/gemini-cli/pull/21713)
-- feat(core): Introduce `AgentLoopContext`. by @joshualitt in
-  [#21198](https://github.com/google-gemini/gemini-cli/pull/21198)
-- fix(core): resolve symlinks for non-existent paths during validation by
-  @Adib234 in [#21487](https://github.com/google-gemini/gemini-cli/pull/21487)
-- docs: document tool exclusion from memory via deny policy by @Abhijit-2592 in
-  [#21428](https://github.com/google-gemini/gemini-cli/pull/21428)
-- perf(core): cache loadApiKey to reduce redundant keychain access by @sehoon38
-  in [#21520](https://github.com/google-gemini/gemini-cli/pull/21520)
-- feat(cli): implement /upgrade command by @sehoon38 in
-  [#21511](https://github.com/google-gemini/gemini-cli/pull/21511)
-- Feat/browser agent progress emission by @kunal-10-cloud in
-  [#21218](https://github.com/google-gemini/gemini-cli/pull/21218)
-- fix(settings): display objects as JSON instead of [object Object] by
-  @Zheyuan-Lin in
-  [#21458](https://github.com/google-gemini/gemini-cli/pull/21458)
-- Unmarshall update by @DavidAPierce in
-  [#21721](https://github.com/google-gemini/gemini-cli/pull/21721)
-- Update mcp's list function to check for disablement. by @DavidAPierce in
-  [#21148](https://github.com/google-gemini/gemini-cli/pull/21148)
-- robustness(core): static checks to validate history is immutable by @jacob314
-  in [#21228](https://github.com/google-gemini/gemini-cli/pull/21228)
-- refactor(cli): better react patterns for BaseSettingsDialog by @psinha40898 in
-  [#21206](https://github.com/google-gemini/gemini-cli/pull/21206)
-- feat(security): implement robust IP validation and safeFetch foundation by
-  @alisa-alisa in
-  [#21401](https://github.com/google-gemini/gemini-cli/pull/21401)
-- feat(core): improve subagent result display by @joshualitt in
-  [#20378](https://github.com/google-gemini/gemini-cli/pull/20378)
-- docs: fix broken markdown syntax and anchor links in /tools by @campox747 in
-  [#20902](https://github.com/google-gemini/gemini-cli/pull/20902)
-- feat(policy): support subagent-specific policies in TOML by @akh64bit in
-  [#21431](https://github.com/google-gemini/gemini-cli/pull/21431)
-- Add script to speed up reviewing PRs adding a worktree. by @jacob314 in
-  [#21748](https://github.com/google-gemini/gemini-cli/pull/21748)
-- fix(core): prevent infinite recursion in symlink resolution by @Adib234 in
-  [#21750](https://github.com/google-gemini/gemini-cli/pull/21750)
-- fix(docs): fix headless mode docs by @ame2en in
-  [#21287](https://github.com/google-gemini/gemini-cli/pull/21287)
-- feat/redesign header compact by @jacob314 in
-  [#20922](https://github.com/google-gemini/gemini-cli/pull/20922)
-- refactor: migrate to useKeyMatchers hook by @scidomino in
-  [#21753](https://github.com/google-gemini/gemini-cli/pull/21753)
-- perf(cli): cache loadSettings to reduce redundant disk I/O at startup by
-  @sehoon38 in [#21521](https://github.com/google-gemini/gemini-cli/pull/21521)
-- fix(core): resolve Windows line ending and path separation bugs across CLI by
-  @muhammadusman586 in
-  [#21068](https://github.com/google-gemini/gemini-cli/pull/21068)
-- docs: fix heading formatting in commands.md and phrasing in tools-api.md by
-  @campox747 in [#20679](https://github.com/google-gemini/gemini-cli/pull/20679)
-- refactor(ui): unify keybinding infrastructure and support string
-  initialization by @scidomino in
-  [#21776](https://github.com/google-gemini/gemini-cli/pull/21776)
-- Add support for updating extension sources and names by @chrstnb in
-  [#21715](https://github.com/google-gemini/gemini-cli/pull/21715)
-- fix(core): handle GUI editor non-zero exit codes gracefully by @reyyanxahmed
-  in [#20376](https://github.com/google-gemini/gemini-cli/pull/20376)
-- fix(core): destroy PTY on kill() and exception to prevent fd leak by @nbardy
-  in [#21693](https://github.com/google-gemini/gemini-cli/pull/21693)
-- fix(docs): update theme screenshots and add missing themes by @ashmod in
-  [#20689](https://github.com/google-gemini/gemini-cli/pull/20689)
-- refactor(cli): rename 'return' key to 'enter' internally by @scidomino in
-  [#21796](https://github.com/google-gemini/gemini-cli/pull/21796)
-- build(release): restrict npm bundling to non-stable tags by @sehoon38 in
-  [#21821](https://github.com/google-gemini/gemini-cli/pull/21821)
-- fix(core): override toolRegistry property for sub-agent schedulers by
-  @gsquared94 in
-  [#21766](https://github.com/google-gemini/gemini-cli/pull/21766)
-- fix(cli): make footer items equally spaced by @jacob314 in
-  [#21843](https://github.com/google-gemini/gemini-cli/pull/21843)
-- docs: clarify global policy rules application in plan mode by @jerop in
-  [#21864](https://github.com/google-gemini/gemini-cli/pull/21864)
-- fix(core): ensure correct flash model steering in plan mode implementation
-  phase by @jerop in
-  [#21871](https://github.com/google-gemini/gemini-cli/pull/21871)
-- fix(core): update @a2a-js/sdk to 0.3.11 by @adamfweidman in
-  [#21875](https://github.com/google-gemini/gemini-cli/pull/21875)
-- refactor(core): improve API response error logging when retry by @yunaseoul in
-  [#21784](https://github.com/google-gemini/gemini-cli/pull/21784)
-- fix(ui): handle headless execution in credits and upgrade dialogs by
-  @gsquared94 in
-  [#21850](https://github.com/google-gemini/gemini-cli/pull/21850)
-- fix(core): treat retryable errors with >5 min delay as terminal quota errors
-  by @gsquared94 in
-  [#21881](https://github.com/google-gemini/gemini-cli/pull/21881)
-- feat(telemetry): add specific PR, issue, and custom tracking IDs for GitHub
-  Actions by @cocosheng-g in
-  [#21129](https://github.com/google-gemini/gemini-cli/pull/21129)
-- feat(core): add OAuth2 Authorization Code auth provider for A2A agents by
-  @SandyTao520 in
-  [#21496](https://github.com/google-gemini/gemini-cli/pull/21496)
-- feat(cli): give visibility to /tools list command in the TUI and follow the
-  subcommand pattern of other commands by @JayadityaGit in
-  [#21213](https://github.com/google-gemini/gemini-cli/pull/21213)
-- Handle dirty worktrees better and warn about running scripts/review.sh on
-  untrusted code. by @jacob314 in
-  [#21791](https://github.com/google-gemini/gemini-cli/pull/21791)
-- feat(policy): support auto-add to policy by default and scoped persistence by
-  @spencer426 in
-  [#20361](https://github.com/google-gemini/gemini-cli/pull/20361)
-- fix(core): handle AbortError when ESC cancels tool execution by @PrasannaPal21
-  in [#20863](https://github.com/google-gemini/gemini-cli/pull/20863)
-- fix(release): Improve Patch Release Workflow Comments: Clearer Approval
-  Guidance by @jerop in
-  [#21894](https://github.com/google-gemini/gemini-cli/pull/21894)
-- docs: clarify telemetry setup and comprehensive data map by @jerop in
-  [#21879](https://github.com/google-gemini/gemini-cli/pull/21879)
-- feat(core): add per-model token usage to stream-json output by @yongruilin in
-  [#21839](https://github.com/google-gemini/gemini-cli/pull/21839)
-- docs: remove experimental badge from plan mode in sidebar by @jerop in
-  [#21906](https://github.com/google-gemini/gemini-cli/pull/21906)
-- fix(cli): prevent race condition in loop detection retry by @skyvanguard in
-  [#17916](https://github.com/google-gemini/gemini-cli/pull/17916)
-- Add behavioral evals for tracker by @anj-s in
-  [#20069](https://github.com/google-gemini/gemini-cli/pull/20069)
-- fix(auth): update terminology to 'sign in' and 'sign out' by @clocky in
-  [#20892](https://github.com/google-gemini/gemini-cli/pull/20892)
-- docs(mcp): standardize mcp tool fqn documentation by @abhipatel12 in
-  [#21664](https://github.com/google-gemini/gemini-cli/pull/21664)
-- fix(ui): prevent empty tool-group border stubs after filtering by @Aaxhirrr in
-  [#21852](https://github.com/google-gemini/gemini-cli/pull/21852)
-- make command names consistent by @scidomino in
-  [#21907](https://github.com/google-gemini/gemini-cli/pull/21907)
-- refactor: remove agent_card_requires_auth config flag by @adamfweidman in
-  [#21914](https://github.com/google-gemini/gemini-cli/pull/21914)
-- feat(a2a): implement standardized normalization and streaming reassembly by
-  @alisa-alisa in
-  [#21402](https://github.com/google-gemini/gemini-cli/pull/21402)
-- feat(cli): enable skill activation via slash commands by @NTaylorMullen in
-  [#21758](https://github.com/google-gemini/gemini-cli/pull/21758)
-- docs(cli): mention per-model token usage in stream-json result event by
-  @yongruilin in
-  [#21908](https://github.com/google-gemini/gemini-cli/pull/21908)
-- fix(plan): prevent plan truncation in approval dialog by supporting
-  unconstrained heights by @Adib234 in
-  [#21037](https://github.com/google-gemini/gemini-cli/pull/21037)
-- feat(a2a): switch from callback-based to event-driven tool scheduler by
-  @cocosheng-g in
-  [#21467](https://github.com/google-gemini/gemini-cli/pull/21467)
-- feat(voice): implement speech-friendly response formatter by @ayush31010 in
-  [#20989](https://github.com/google-gemini/gemini-cli/pull/20989)
-- feat: add pulsating blue border automation overlay to browser agent by
-  @kunal-10-cloud in
-  [#21173](https://github.com/google-gemini/gemini-cli/pull/21173)
-- Add extensionRegistryURI setting to change where the registry is read from by
-  @kevinjwang1 in
-  [#20463](https://github.com/google-gemini/gemini-cli/pull/20463)
-- fix: patch gaxios v7 Array.toString() stream corruption by @gsquared94 in
-  [#21884](https://github.com/google-gemini/gemini-cli/pull/21884)
-- fix: prevent hangs in non-interactive mode and improve agent guidance by
-  @cocosheng-g in
-  [#20893](https://github.com/google-gemini/gemini-cli/pull/20893)
-- Add ExtensionDetails dialog and support install by @chrstnb in
-  [#20845](https://github.com/google-gemini/gemini-cli/pull/20845)
-- chore/release: bump version to 0.34.0-nightly.20260310.4653b126f by
-  @gemini-cli-robot in
-  [#21816](https://github.com/google-gemini/gemini-cli/pull/21816)
-- Changelog for v0.33.0-preview.13 by @gemini-cli-robot in
-  [#21927](https://github.com/google-gemini/gemini-cli/pull/21927)
-- fix(cli): stabilize prompt layout to prevent jumping when typing by
-  @NTaylorMullen in
-  [#21081](https://github.com/google-gemini/gemini-cli/pull/21081)
-- fix: preserve prompt text when cancelling streaming by @Nixxx19 in
-  [#21103](https://github.com/google-gemini/gemini-cli/pull/21103)
-- fix: robust UX for remote agent errors by @Shyam-Raghuwanshi in
-  [#20307](https://github.com/google-gemini/gemini-cli/pull/20307)
-- feat: implement background process logging and cleanup by @galz10 in
-  [#21189](https://github.com/google-gemini/gemini-cli/pull/21189)
-- Changelog for v0.33.0-preview.14 by @gemini-cli-robot in
-  [#21938](https://github.com/google-gemini/gemini-cli/pull/21938)
-- fix(patch): cherry-pick 45faf4d to release/v0.34.0-preview.0-pr-22148
-  [CONFLICTS] by @gemini-cli-robot in
-  [#22174](https://github.com/google-gemini/gemini-cli/pull/22174)
-- fix(patch): cherry-pick 8432bce to release/v0.34.0-preview.1-pr-22069 to patch
-  version v0.34.0-preview.1 and create version 0.34.0-preview.2 by
-  @gemini-cli-robot in
-  [#22205](https://github.com/google-gemini/gemini-cli/pull/22205)
-- fix(patch): cherry-pick 24adacd to release/v0.34.0-preview.2-pr-22332 to patch
-  version v0.34.0-preview.2 and create version 0.34.0-preview.3 by
-  @gemini-cli-robot in
-  [#22391](https://github.com/google-gemini/gemini-cli/pull/22391)
-- fix(patch): cherry-pick 48130eb to release/v0.34.0-preview.3-pr-22665 to patch
-  version v0.34.0-preview.3 and create version 0.34.0-preview.4 by
-  @gemini-cli-robot in
-  [#22719](https://github.com/google-gemini/gemini-cli/pull/22719)
+  [#27535](https://github.com/google-gemini/gemini-cli/pull/27535)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.33.2...v0.34.0
+https://github.com/google-gemini/gemini-cli/compare/v0.44.1...v0.45.0