chore(release): v0.29.2

Co-authored-by: Shreya Keshive <shreyakeshive@google.com>

.gemini/commands/fix-behavioral-eval.toml

@@ -25,7 +25,7 @@ You are an expert at fixing behavioral evaluations.
        the same scenario. We don't want to lose test fidelity by making the prompts too
        direct (i.e.: easy).
      - Your primary mechanism for improving the agent's behavior is to make changes to
-       tool instructions, prompt.ts, and/or modules that contribute to the prompt.
+       tool instructions, system prompt (snippets.ts), and/or modules that contribute to the prompt.
      - If prompt and description changes are unsuccessful, use logs and debugging to
        confirm that everything is working as expected.
     - If unable to fix the test, you can make recommendations for architecture changes

.gemini/settings.json

@@ -2,6 +2,10 @@
   "experimental": {
     "toolOutputMasking": {
       "enabled": true
-    }
+    },
+    "plan": true
+  },
+  "general": {
+    "devtools": true
   }
 }

.gemini/skills/docs-changelog/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: docs-changelog
+description: Provides a step-by-step procedure for generating Gemini CLI changelog files based on github release information.
+---
+
+# Procedure: Updating Changelog for New Releases
+
+The following instructions are run by Gemini CLI when processing new releases.
+
+## Objective
+
+To standardize the process of updating the Gemini CLI changelog files for a new
+release, ensuring accuracy, consistency, and adherence to project style
+guidelines.
+
+## Release Types
+
+This skill covers two types of releases:
+
+*   **Standard Releases:** Regular, versioned releases that are announced to all
+    users. These updates modify `docs/changelogs/latest.md` and
+    `docs/changelogs/index.md`.
+*   **Preview Releases:** Pre-release versions for testing and feedback. These
+    updates only modify `docs/changelogs/preview.md`.
+
+Ignore all other releases, such as nightly releases.
+
+### Expected Inputs
+
+Regardless of the type of release, the following information is expected:
+
+*   **New version number:** The version number for the new release
+    (e.g., `v0.27.0`).
+*   **Release date:** The date of the new release (e.g., `2026-02-03`).
+*   **Raw changelog data:** A list of all pull requests and changes
+    included in the release, in the format `description by @author in
+    #pr_number`.
+*   **Previous version number:** The version number of the last release can be
+    calculated by decreasing the minor version number by one and setting the
+    patch or bug fix version number.
+
+## Procedure
+
+### Initial Setup
+
+1.  Identify the files to be modified: 
+
+    For standard releases, update `docs/changelogs/latest.md` and
+    `docs/changelogs/index.md`. For preview releases, update
+    `docs/changelogs/preview.md`.
+
+2.  Activate the `docs-writer` skill.
+
+### Analyze Raw Changelog Data
+
+1.  Review the complete list of changes. If it is a patch or a bug fix with few
+    changes, skip to the "Update `docs/changelogs/latest.md` or
+    `docs/changelogs/preview.md`" section.
+
+2.  Group related changes into high-level categories such as
+    important features, "UI/UX Improvements", and "Bug Fixes". Use the existing
+    announcements in `docs/changelogs/index.md` as an example.
+
+### Create Highlight Summaries
+
+Create two distinct versions of the release highlights.
+
+**Important:** Carefully inspect highlights for "experimental" or
+"preview" features before public announcement, and do not include them.
+
+#### Version 1: Comprehensive Highlights (for `latest.md` or `preview.md`)
+
+Write a detailed summary for each category focusing on user-facing
+impact.
+
+#### Version 2: Concise Highlights (for `index.md`)
+
+Skip this step for preview releases.
+
+Write concise summaries including the primary PR and author
+(e.g., `([#12345](link) by @author)`).
+
+### Update `docs/changelogs/latest.md` or `docs/changelogs/preview.md`
+
+1. Read current content and use `write_file` to replace it with the new
+  version number, and date.
+  
+  If it is a patch or bug fix with few changes, simply add these
+  changes to the "What's Changed" list. Otherwise, replace comprehensive
+  highlights, and the full "What's Changed" list. 
+
+2. For each item in the "What's Changed" list, keep usernames in plaintext, and
+  add github links for each issue number. Example:
+
+  "- feat: implement /rewind command by @username in
+  [#12345](https://github.com/google-gemini/gemini-cli/pull/12345)"
+
+3. Skip entries by @gemini-cli-robot.
+
+4. Do not add the "New Contributors" section.
+
+5. Update the "Full changelog:" link by doing one of following:
+
+   If it is a patch or bug fix with few changes, retain the original link
+   but replace the latter version with the new version. For example, if the
+   patch is version is "v0.28.1", replace the latter version:
+   "https://github.com/google-gemini/gemini-cli/compare/v0.27.0...v0.28.0" with
+   "https://github.com/google-gemini/gemini-cli/compare/v0.27.0...v0.28.1".
+   
+   Otherwise, for minor and major version changes, replace the link with the
+   one included at the end of the changelog data.
+
+6. Ensure lines are wrapped to 80 characters.
+
+### Update `docs/changelogs/index.md`
+
+Skip this step for patches, bug fixes, or preview releases.
+
+Insert a new "Announcements" section for the new version directly
+above the previous version's section. Ensure lines are wrapped to
+80 characters.
+
+### Finalize
+
+Run `npm run format` to ensure consistency.

.gemini/skills/pr-creator/SKILL.md

@@ -14,25 +14,34 @@ repository's standards.
 
 Follow these steps to create a Pull Request:
 
-1.  **Branch Management**: Check the current branch to avoid working directly
-    on `main`.
+1.  **Branch Management**: **CRITICAL:** Ensure you are NOT working on the
+    `main` branch.
     - Run `git branch --show-current`.
-    - If the current branch is `main`, create and switch to a new descriptive
-      branch:
+    - If the current branch is `main`, you MUST create and switch to a new
+      descriptive branch:
       ```bash
       git checkout -b <new-branch-name>
       ```
 
-2.  **Locate Template**: Search for a pull request template in the repository.
+2.  **Commit Changes**: Verify that all intended changes are committed.
+    - Run `git status` to check for unstaged or uncommitted changes.
+    - If there are uncommitted changes, stage and commit them with a descriptive
+      message before proceeding. NEVER commit directly to `main`.
+      ```bash
+      git add .
+      git commit -m "type(scope): description"
+      ```
+
+3.  **Locate Template**: Search for a pull request template in the repository.
     - Check `.github/pull_request_template.md`
     - Check `.github/PULL_REQUEST_TEMPLATE.md`
     - If multiple templates exist (e.g., in `.github/PULL_REQUEST_TEMPLATE/`),
       ask the user which one to use or select the most appropriate one based on
       the context (e.g., `bug_fix.md` vs `feature.md`).
 
-3.  **Read Template**: Read the content of the identified template file.
+4.  **Read Template**: Read the content of the identified template file.
 
-4.  **Draft Description**: Create a PR description that strictly follows the
+5.  **Draft Description**: Create a PR description that strictly follows the
     template's structure.
     - **Headings**: Keep all headings from the template.
     - **Checklists**: Review each item. Mark with `[x]` if completed. If an item
@@ -44,14 +53,24 @@ Follow these steps to create a Pull Request:
     - **Related Issues**: Link any issues fixed or related to this PR (e.g.,
       "Fixes #123").
 
-5.  **Preflight Check**: Before creating the PR, run the workspace preflight
+6.  **Preflight Check**: Before creating the PR, run the workspace preflight
     script to ensure all build, lint, and test checks pass.
     ```bash
     npm run preflight
     ```
     If any checks fail, address the issues before proceeding to create the PR.
 
-6.  **Create PR**: Use the `gh` CLI to create the PR. To avoid shell escaping
+7.  **Push Branch**: Push the current branch to the remote repository.
+    **CRITICAL SAFETY RAIL:** Double-check your branch name before pushing.
+    NEVER push if the current branch is `main`.
+    ```bash
+    # Verify current branch is NOT main
+    git branch --show-current
+    # Push non-interactively
+    git push -u origin HEAD
+    ```
+
+8.  **Create PR**: Use the `gh` CLI to create the PR. To avoid shell escaping
     issues with multi-line Markdown, write the description to a temporary file
     first.
     ```bash
@@ -68,6 +87,7 @@ Follow these steps to create a Pull Request:
 
 ## Principles
 
+- **Safety First**: NEVER push to `main`. This is your highest priority.
 - **Compliance**: Never ignore the PR template. It exists for a reason.
 - **Completeness**: Fill out all relevant sections.
 - **Accuracy**: Don't check boxes for tasks you haven't done.

.github/scripts/sync-maintainer-labels.cjs

@@ -1,5 +1,9 @@
-/* eslint-disable @typescript-eslint/no-require-imports */
-/* global process, console, require */
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 const { Octokit } = require('@octokit/rest');
 
 /**

.github/workflows/ci.yml

@@ -356,11 +356,17 @@ jobs:
           clean-script: 'clean'
 
   test_windows:
-    name: 'Slow Test - Win'
+    name: 'Slow Test - Win - ${{ matrix.shard }}'
     runs-on: 'gemini-cli-windows-16-core'
     needs: 'merge_queue_skipper'
     if: "${{needs.merge_queue_skipper.outputs.skip == 'false'}}"
     continue-on-error: true
+    timeout-minutes: 60
+    strategy:
+      matrix:
+        shard:
+          - 'cli'
+          - 'others'
 
     steps:
       - name: 'Checkout'
@@ -411,7 +417,14 @@ jobs:
           NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
           UV_THREADPOOL_SIZE: '32'
           NODE_ENV: 'test'
-        run: 'npm run test:ci -- --coverage.enabled=false'
+        run: |
+          if ("${{ matrix.shard }}" -eq "cli") {
+            npm run test:ci --workspace @google/gemini-cli -- --coverage.enabled=false
+          } else {
+            # Explicitly list non-cli packages to ensure they are sharded correctly
+            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:scripts
+          }
         shell: 'pwsh'
 
       - name: 'Bundle'

.github/workflows/release-notes.yml

@@ -0,0 +1,84 @@
+# This workflow is triggered on every new release.
+# It uses Gemini to generate release notes and creates a PR with the changes.
+name: 'Generate Release Notes'
+
+on:
+  release:
+    types: ['published']
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'New version (e.g., v1.2.3)'
+        required: true
+        type: 'string'
+      body:
+        description: 'Release notes body'
+        required: true
+        type: 'string'
+      time:
+        description: 'Release time'
+        required: true
+        type: 'string'
+
+jobs:
+  generate-release-notes:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+    steps:
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@v4'
+        with:
+          # The user-level skills need to be available to the workflow
+          fetch-depth: 0
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@v4'
+        with:
+          node-version: '20'
+
+      - name: 'Get release information'
+        id: 'release_info'
+        run: |
+          VERSION="${{ github.event.inputs.version || github.event.release.tag_name }}"
+          BODY="${{ github.event.inputs.body || github.event.release.body }}"
+          TIME="${{ github.event.inputs.time || github.event.release.created_at }}"
+
+          echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "TIME=${TIME}" >> "$GITHUB_OUTPUT"
+
+          # Use a heredoc to preserve multiline release body
+          echo 'RAW_CHANGELOG<<EOF' >> "$GITHUB_OUTPUT"
+          echo "${BODY}" >> "$GITHUB_OUTPUT"
+          echo 'EOF' >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+
+      - name: 'Generate Changelog with Gemini'
+        uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
+        with:
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          prompt: |
+            Activate the 'docs-changelog' skill.
+
+            **Release Information:**
+            - New Version: ${{ steps.release_info.outputs.VERSION }}
+            - Release Date: ${{ steps.release_info.outputs.TIME }}
+            - Raw Changelog Data: ${{ steps.release_info.outputs.RAW_CHANGELOG }}
+
+            Execute the release notes generation process using the information provided.
+
+      - name: 'Create Pull Request'
+        uses: 'peter-evans/create-pull-request@v6'
+        with:
+          token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          commit-message: 'docs(changelog): update for ${{ steps.release_info.outputs.VERSION }}'
+          title: 'Changelog for ${{ steps.release_info.outputs.VERSION }}'
+          body: |
+            This PR contains the auto-generated changelog for the ${{ steps.release_info.outputs.VERSION }} release.
+
+            Please review and merge.
+          branch: 'changelog-${{ steps.release_info.outputs.VERSION }}'
+          team-reviewers: 'gemini-cli-docs, gemini-cli-maintainers'
+          delete-branch: true

GEMINI.md

@@ -52,15 +52,24 @@ powerful tool for developers.
 
 ## Development Conventions
 
+- **Legacy Snippets:** `packages/core/src/prompts/snippets.legacy.ts` is a
+  snapshot of an older system prompt. Avoid changing the prompting verbiage to
+  preserve its historical behavior; however, structural changes to ensure
+  compilation or simplify the code are permitted.
 - **Contributions:** Follow the process outlined in `CONTRIBUTING.md`. Requires
   signing the Google CLA.
 - **Pull Requests:** Keep PRs small, focused, and linked to an existing issue.
+  Always activate the `pr-creator` skill for PR generation, even when using the
+  `gh` CLI.
 - **Commit Messages:** Follow the
   [Conventional Commits](https://www.conventionalcommits.org/) standard.
 - **Coding Style:** Adhere to existing patterns in `packages/cli` (React/Ink)
   and `packages/core` (Backend logic).
 - **Imports:** Use specific imports and avoid restricted relative imports
   between packages (enforced by ESLint).
+- **License Headers:** For all new source code files (`.ts`, `.tsx`, `.js`),
+  include the Apache-2.0 license header with the current year. (e.g.,
+  `Copyright 2026 Google LLC`). This is enforced by ESLint.
 
 ## Testing Conventions
 

docs/cli/commands.md

@@ -113,10 +113,14 @@ Slash commands provide meta-level control over the CLI itself.
   - **Description:** Lists all active extensions in the current Gemini CLI
     session. See [Gemini CLI Extensions](../extensions/index.md).
 
-- **`/help`** (or **`/?`**)
+- **`/help`**
   - **Description:** Display help information about Gemini CLI, including
     available commands and their usage.
 
+- **`/shortcuts`**
+  - **Description:** Toggle the shortcuts panel above the input.
+  - **Shortcut:** Press `?` when the prompt is empty.
+
 - **`/hooks`**
   - **Description:** Manage hooks, which allow you to intercept and customize
     Gemini CLI behavior at specific lifecycle events.

docs/cli/index.md

@@ -23,6 +23,8 @@ overview of Gemini CLI, see the [main documentation page](../index.md).
 
 ## Advanced features
 
+- **[Plan mode (experimental)](./plan-mode.md):** Use a safe, read-only mode for
+  planning complex changes.
 - **[Checkpointing](./checkpointing.md):** Automatically save and restore
   snapshots of your session and files.
 - **[Enterprise configuration](./enterprise.md):** Deploy and manage Gemini CLI

docs/cli/keyboard-shortcuts.md

@@ -106,16 +106,18 @@ available combinations.
 | Toggle YOLO (auto-approval) mode for tool calls.                                                      | `Ctrl + Y`                 |
 | Cycle through approval modes: default (prompt), auto_edit (auto-approve edits), and plan (read-only). | `Shift + Tab`              |
 | Expand a height-constrained response to show additional lines when not in alternate buffer mode.      | `Ctrl + O`<br />`Ctrl + S` |
-| Ctrl+B                                                                                                | `Ctrl + B`                 |
-| Ctrl+L                                                                                                | `Ctrl + L`                 |
-| Ctrl+K                                                                                                | `Ctrl + K`                 |
-| Enter                                                                                                 | `Enter`                    |
-| Esc                                                                                                   | `Esc`                      |
-| Shift+Tab                                                                                             | `Shift + Tab`              |
-| Tab                                                                                                   | `Tab (no Shift)`           |
-| Tab                                                                                                   | `Tab (no Shift)`           |
-| Focus the shell input from the gemini input.                                                          | `Tab (no Shift)`           |
-| Focus the Gemini input from the shell input.                                                          | `Tab`                      |
+| Expand or collapse a paste placeholder when cursor is over placeholder.                               | `Ctrl + O`                 |
+| Toggle current background shell visibility.                                                           | `Ctrl + B`                 |
+| Toggle background shell list.                                                                         | `Ctrl + L`                 |
+| Kill the active background shell.                                                                     | `Ctrl + K`                 |
+| Confirm selection in background shell list.                                                           | `Enter`                    |
+| Dismiss background shell list.                                                                        | `Esc`                      |
+| Move focus from background shell to Gemini.                                                           | `Shift + Tab`              |
+| Move focus from background shell list to Gemini.                                                      | `Tab (no Shift)`           |
+| Show warning when trying to unfocus background shell via Tab.                                         | `Tab (no Shift)`           |
+| Show warning when trying to unfocus shell input via Tab.                                              | `Tab (no Shift)`           |
+| Move focus from Gemini to the active shell.                                                           | `Tab (no Shift)`           |
+| Move focus from the shell back to Gemini.                                                             | `Shift + Tab`              |
 | Clear the terminal screen and redraw the UI.                                                          | `Ctrl + L`                 |
 | Restart the application.                                                                              | `R`                        |
 | Suspend the application (not yet implemented).                                                        | `Ctrl + Z`                 |
@@ -127,6 +129,9 @@ available combinations.
 - `Option+B/F/M` (macOS only): Are interpreted as `Cmd+B/F/M` even if your
   terminal isn't configured to send Meta with Option.
 - `!` on an empty prompt: Enter or exit shell mode.
+- `?` on an empty prompt: Toggle the shortcuts panel above the input. Press
+  `Esc`, `Backspace`, or any printable key to close it. Press `?` again to close
+  the panel and insert a `?` into the prompt.
 - `\` (at end of a line) + `Enter`: Insert a newline without leaving single-line
   mode.
 - `Esc` pressed twice quickly: Clear the input prompt if it is not empty,
@@ -135,6 +140,7 @@ available combinations.
   single-line input, navigate backward or forward through prompt history.
 - `Number keys (1-9, multi-digit)` inside selection dialogs: Jump directly to
   the numbered radio option and confirm when the full number is entered.
-- `Double-click` on a paste placeholder (`[Pasted Text: X lines]`) in alternate
-  buffer mode: Expand to view full content inline. Double-click again to
-  collapse.
+- `Ctrl + O`: Expand or collapse paste placeholders (`[Pasted Text: X lines]`)
+  inline when the cursor is over the placeholder.
+- `Double-click` on a paste placeholder (alternate buffer mode only): Expand to
+  view full content inline. Double-click again to collapse.

docs/cli/plan-mode.md

@@ -0,0 +1,106 @@
+# Plan Mode (experimental)
+
+Plan Mode is a safe, read-only mode for researching and designing complex
+changes. It prevents modifications while you research, design and plan an
+implementation strategy.
+
+> **Note: Plan Mode is currently an experimental feature.**
+>
+> Experimental features are subject to change. To use Plan Mode, enable it via
+> `/settings` (search for `Plan`) or add the following to your `settings.json`:
+>
+> ```json
+> {
+>   "experimental": {
+>     "plan": true
+>   }
+> }
+> ```
+>
+> Your feedback is invaluable as we refine this feature. If you have ideas,
+> suggestions, or encounter issues:
+>
+> - Use the `/bug` command within the CLI to file an issue.
+> - [Open an issue](https://github.com/google-gemini/gemini-cli/issues) on
+>   GitHub.
+
+- [Starting in Plan Mode](#starting-in-plan-mode)
+- [How to use Plan Mode](#how-to-use-plan-mode)
+  - [Entering Plan Mode](#entering-plan-mode)
+  - [The Planning Workflow](#the-planning-workflow)
+  - [Exiting Plan Mode](#exiting-plan-mode)
+- [Tool Restrictions](#tool-restrictions)
+
+## Starting in Plan Mode
+
+You can configure Gemini CLI to start directly in Plan Mode by default:
+
+1.  Type `/settings` in the CLI.
+2.  Search for `Default Approval Mode`.
+3.  Set the value to `Plan`.
+
+Other ways to start in Plan Mode:
+
+- **CLI Flag:** `gemini --approval-mode=plan`
+- **Manual Settings:** Manually update your `settings.json`:
+
+  ```json
+  {
+    "general": {
+      "defaultApprovalMode": "plan"
+    }
+  }
+  ```
+
+## How to use Plan Mode
+
+### Entering Plan Mode
+
+You can enter Plan Mode in three ways:
+
+1.  **Keyboard Shortcut:** Press `Shift+Tab` to cycle through approval modes
+    (`Default` -> `Auto-Edit` -> `Plan`).
+2.  **Command:** Type `/plan` in the input box.
+3.  **Natural Language:** Ask the agent to "start a plan for...".
+
+### The Planning Workflow
+
+1.  **Requirements:** The agent clarifies goals using `ask_user`.
+2.  **Exploration:** The agent uses read-only tools (like [`read_file`]) to map
+    the codebase and validate assumptions.
+3.  **Planning:** A detailed plan is written to a temporary Markdown file.
+4.  **Review:** You review the plan.
+    - **Approve:** Exit Plan Mode and start implementation (switching to
+      Auto-Edit or Default approval mode).
+    - **Iterate:** Provide feedback to refine the plan.
+
+### Exiting Plan Mode
+
+To exit Plan Mode:
+
+1. **Keyboard Shortcut:** Press `Shift+Tab` to cycle to the desired mode.
+1. **Tool:** The agent calls the `exit_plan_mode` tool to present the finalized
+   plan for your approval.
+
+## Tool Restrictions
+
+Plan Mode enforces strict safety policies to prevent accidental changes.
+
+These are the only allowed tools:
+
+- **FileSystem (Read):** [`read_file`], [`list_directory`], [`glob`]
+- **Search:** [`grep_search`], [`google_web_search`]
+- **Interaction:** `ask_user`
+- **MCP Tools (Read):** Read-only [MCP tools] (e.g., `github_read_issue`,
+  `postgres_read_schema`) are allowed.
+- **Planning (Write):** [`write_file`] and [`replace`] ONLY allowed for `.md`
+  files in the `~/.gemini/tmp/<project>/plans/` directory.
+
+[`list_directory`]: /docs/tools/file-system.md#1-list_directory-readfolder
+[`read_file`]: /docs/tools/file-system.md#2-read_file-readfile
+[`grep_search`]: /docs/tools/file-system.md#5-grep_search-searchtext
+[`write_file`]: /docs/tools/file-system.md#3-write_file-writefile
+[`glob`]: /docs/tools/file-system.md#4-glob-findfiles
+[`google_web_search`]: /docs/tools/web-search.md
+[`replace`]: /docs/tools/file-system.md#6-replace-edit
+[MCP tools]: /docs/tools/mcp-server.md

docs/cli/settings.md

@@ -22,14 +22,14 @@ they appear in the UI.
 
 ### General
 
-| UI Label                        | Setting                            | Description                                                   | Default |
-| ------------------------------- | ---------------------------------- | ------------------------------------------------------------- | ------- |
-| Preview Features (e.g., models) | `general.previewFeatures`          | Enable preview features (e.g., preview models).               | `false` |
-| Vim Mode                        | `general.vimMode`                  | Enable Vim keybindings                                        | `false` |
-| Enable Auto Update              | `general.enableAutoUpdate`         | Enable automatic updates.                                     | `true`  |
-| Enable Prompt Completion        | `general.enablePromptCompletion`   | Enable AI-powered prompt completion suggestions while typing. | `false` |
-| Debug Keystroke Logging         | `general.debugKeystrokeLogging`    | Enable debug logging of keystrokes to the console.            | `false` |
-| Enable Session Cleanup          | `general.sessionRetention.enabled` | Enable automatic session cleanup                              | `false` |
+| UI Label                 | Setting                            | Description                                                                                                                                                                    | Default     |
+| ------------------------ | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------- |
+| Vim Mode                 | `general.vimMode`                  | Enable Vim keybindings                                                                                                                                                         | `false`     |
+| Default Approval Mode    | `general.defaultApprovalMode`      | The default approval mode for tool execution. 'default' prompts for approval, 'auto_edit' auto-approves edit tools, and 'plan' is read-only mode. 'yolo' is not supported yet. | `"default"` |
+| Enable Auto Update       | `general.enableAutoUpdate`         | Enable automatic updates.                                                                                                                                                      | `true`      |
+| Enable Prompt Completion | `general.enablePromptCompletion`   | Enable AI-powered prompt completion suggestions while typing.                                                                                                                  | `false`     |
+| Debug Keystroke Logging  | `general.debugKeystrokeLogging`    | Enable debug logging of keystrokes to the console.                                                                                                                             | `false`     |
+| Enable Session Cleanup   | `general.sessionRetention.enabled` | Enable automatic session cleanup                                                                                                                                               | `false`     |
 
 ### Output
 
@@ -44,6 +44,7 @@ they appear in the UI.
 | Auto Theme Switching                 | `ui.autoThemeSwitching`                 | Automatically switch between default light and dark themes based on terminal background color.                                                                    | `true`  |
 | Terminal Background Polling Interval | `ui.terminalBackgroundPollingInterval`  | Interval in seconds to poll the terminal background color.                                                                                                        | `60`    |
 | Hide Window Title                    | `ui.hideWindowTitle`                    | Hide the window title bar                                                                                                                                         | `false` |
+| Inline Thinking                      | `ui.inlineThinkingMode`                 | Display model thinking inline: off or full.                                                                                                                       | `"off"` |
 | Show Thoughts in Title               | `ui.showStatusInTitle`                  | Show Gemini CLI model thoughts in the terminal window title during the working phase                                                                              | `false` |
 | Dynamic Window Title                 | `ui.dynamicWindowTitle`                 | Update the terminal window title with current status icons (Ready: ◇, Action Required: ✋, Working: ✦)                                                            | `true`  |
 | Show Home Directory Warning          | `ui.showHomeDirectoryWarning`           | Show a warning when running Gemini CLI in the home directory.                                                                                                     | `true`  |
@@ -96,16 +97,13 @@ they appear in the UI.
 
 ### Tools
 
-| UI Label                         | Setting                              | Description                                                                                                                                                                    | Default     |
-| -------------------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------- |
-| Enable Interactive Shell         | `tools.shell.enableInteractiveShell` | Use node-pty for an interactive shell experience. Fallback to child_process still applies.                                                                                     | `true`      |
-| Show Color                       | `tools.shell.showColor`              | Show color in shell output.                                                                                                                                                    | `false`     |
-| Approval Mode                    | `tools.approvalMode`                 | The default approval mode for tool execution. 'default' prompts for approval, 'auto_edit' auto-approves edit tools, and 'plan' is read-only mode. 'yolo' is not supported yet. | `"default"` |
-| Use Ripgrep                      | `tools.useRipgrep`                   | Use ripgrep for file content search instead of the fallback implementation. Provides faster search performance.                                                                | `true`      |
-| Enable Tool Output Truncation    | `tools.enableToolOutputTruncation`   | Enable truncation of large tool outputs.                                                                                                                                       | `true`      |
-| Tool Output Truncation Threshold | `tools.truncateToolOutputThreshold`  | Truncate tool output if it is larger than this many characters. Set to -1 to disable.                                                                                          | `4000000`   |
-| Tool Output Truncation Lines     | `tools.truncateToolOutputLines`      | The number of lines to keep when truncating tool output.                                                                                                                       | `1000`      |
-| Disable LLM Correction           | `tools.disableLLMCorrection`         | Disable LLM-based error correction for edit tools. When enabled, tools will fail immediately if exact string matches are not found, instead of attempting to self-correct.     | `true`      |
+| UI Label                         | Setting                              | Description                                                                                                                                                                | Default |
+| -------------------------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| Enable Interactive Shell         | `tools.shell.enableInteractiveShell` | Use node-pty for an interactive shell experience. Fallback to child_process still applies.                                                                                 | `true`  |
+| Show Color                       | `tools.shell.showColor`              | Show color in shell output.                                                                                                                                                | `false` |
+| Use Ripgrep                      | `tools.useRipgrep`                   | Use ripgrep for file content search instead of the fallback implementation. Provides faster search performance.                                                            | `true`  |
+| Tool Output Truncation Threshold | `tools.truncateToolOutputThreshold`  | Maximum characters to show when truncating large tool outputs. Set to 0 or negative to disable truncation.                                                                 | `40000` |
+| Disable LLM Correction           | `tools.disableLLMCorrection`         | Disable LLM-based error correction for edit tools. When enabled, tools will fail immediately if exact string matches are not found, instead of attempting to self-correct. | `true`  |
 
 ### Security
 

docs/get-started/configuration.md

@@ -98,10 +98,6 @@ their corresponding top-level category object in your `settings.json` file.
 
 #### `general`
 
-- **`general.previewFeatures`** (boolean):
-  - **Description:** Enable preview features (e.g., preview models).
-  - **Default:** `false`
-
 - **`general.preferredEditor`** (string):
   - **Description:** The preferred editor to open files in.
   - **Default:** `undefined`
@@ -110,6 +106,17 @@ their corresponding top-level category object in your `settings.json` file.
   - **Description:** Enable Vim keybindings
   - **Default:** `false`
 
+- **`general.defaultApprovalMode`** (enum):
+  - **Description:** The default approval mode for tool execution. 'default'
+    prompts for approval, 'auto_edit' auto-approves edit tools, and 'plan' is
+    read-only mode. 'yolo' is not supported yet.
+  - **Default:** `"default"`
+  - **Values:** `"default"`, `"auto_edit"`, `"plan"`
+
+- **`general.devtools`** (boolean):
+  - **Description:** Enable DevTools inspector on launch.
+  - **Default:** `false`
+
 - **`general.enableAutoUpdate`** (boolean):
   - **Description:** Enable automatic updates.
   - **Default:** `true`
@@ -188,6 +195,11 @@ their corresponding top-level category object in your `settings.json` file.
   - **Default:** `false`
   - **Requires restart:** Yes
 
+- **`ui.inlineThinkingMode`** (enum):
+  - **Description:** Display model thinking inline: off or full.
+  - **Default:** `"off"`
+  - **Values:** `"off"`, `"full"`
+
 - **`ui.showStatusInTitle`** (boolean):
   - **Description:** Show Gemini CLI model thoughts in the terminal window title
     during the working phase
@@ -676,13 +688,6 @@ their corresponding top-level category object in your `settings.json` file.
     performance.
   - **Default:** `true`
 
-- **`tools.approvalMode`** (enum):
-  - **Description:** The default approval mode for tool execution. 'default'
-    prompts for approval, 'auto_edit' auto-approves edit tools, and 'plan' is
-    read-only mode. 'yolo' is not supported yet.
-  - **Default:** `"default"`
-  - **Values:** `"default"`, `"auto_edit"`, `"plan"`
-
 - **`tools.core`** (array):
   - **Description:** Restrict the set of built-in tools with an allowlist. Match
     semantics mirror tools.allowed; see the built-in tools documentation for
@@ -720,20 +725,10 @@ their corresponding top-level category object in your `settings.json` file.
     implementation. Provides faster search performance.
   - **Default:** `true`
 
-- **`tools.enableToolOutputTruncation`** (boolean):
-  - **Description:** Enable truncation of large tool outputs.
-  - **Default:** `true`
-  - **Requires restart:** Yes
-
 - **`tools.truncateToolOutputThreshold`** (number):
-  - **Description:** Truncate tool output if it is larger than this many
-    characters. Set to -1 to disable.
-  - **Default:** `4000000`
-  - **Requires restart:** Yes
-
-- **`tools.truncateToolOutputLines`** (number):
-  - **Description:** The number of lines to keep when truncating tool output.
-  - **Default:** `1000`
+  - **Description:** Maximum characters to show when truncating large tool
+    outputs. Set to 0 or negative to disable truncation.
+  - **Default:** `40000`
   - **Requires restart:** Yes
 
 - **`tools.disableLLMCorrection`** (boolean):
@@ -866,12 +861,12 @@ their corresponding top-level category object in your `settings.json` file.
 
 - **`experimental.extensionConfig`** (boolean):
   - **Description:** Enable requesting and fetching of extension settings.
-  - **Default:** `false`
+  - **Default:** `true`
   - **Requires restart:** Yes
 
-- **`experimental.enableEventDrivenScheduler`** (boolean):
-  - **Description:** Enables event-driven scheduler within the CLI session.
-  - **Default:** `true`
+- **`experimental.extensionRegistry`** (boolean):
+  - **Description:** Enable extension registry explore UI.
+  - **Default:** `false`
   - **Requires restart:** Yes
 
 - **`experimental.extensionReloading`** (boolean):

docs/sidebar.json

@@ -20,6 +20,7 @@
       { "label": "Project context (GEMINI.md)", "slug": "docs/cli/gemini-md" },
       { "label": "Shell commands", "slug": "docs/tools/shell" },
       { "label": "Session management", "slug": "docs/cli/session-management" },
+      { "label": "Plan mode (experimental)", "slug": "docs/cli/plan-mode" },
       { "label": "Todos", "slug": "docs/tools/todos" },
       { "label": "Web search and fetch", "slug": "docs/tools/web-search" }
     ]

docs/tools/mcp-server.md

@@ -739,21 +739,10 @@ The MCP integration tracks several states:
   cautiously and only for servers you completely control
 - **Access tokens:** Be security-aware when configuring environment variables
   containing API keys or tokens
-- **Environment variable redaction:** By default, the Gemini CLI redacts
-  sensitive environment variables (such as `GEMINI_API_KEY`, `GOOGLE_API_KEY`,
-  and variables matching patterns like `*TOKEN*`, `*SECRET*`, `*PASSWORD*`) when
-  spawning MCP servers using the `stdio` transport. This prevents unintended
-  exposure of your credentials to third-party servers.
-- **Explicit environment variables:** If you need to pass a specific environment
-  variable to an MCP server, you should define it explicitly in the `env`
-  property of the server configuration in `settings.json`.
 - **Sandbox compatibility:** When using sandboxing, ensure MCP servers are
-  available within the sandbox environment.
+  available within the sandbox environment
 - **Private data:** Using broadly scoped personal access tokens can lead to
   information leakage between repositories.
-- **Untrusted servers:** Be extremely cautious when adding MCP servers from
-  untrusted or third-party sources. Malicious servers could attempt to
-  exfiltrate data or perform unauthorized actions through the tools they expose.
 
 ### Performance and resource management
 

esbuild.config.js

@@ -63,6 +63,7 @@ const external = [
   '@lydell/node-pty-win32-arm64',
   '@lydell/node-pty-win32-x64',
   'keytar',
+  'gemini-cli-devtools',
 ];
 
 const baseConfig = {

eslint.config.js

@@ -23,6 +23,7 @@ const __dirname = path.dirname(__filename);
 
 // Determine the monorepo root (assuming eslint.config.js is at the root)
 const projectRoot = __dirname;
+const currentYear = new Date().getFullYear();
 
 export default tseslint.config(
   {
@@ -37,7 +38,6 @@ export default tseslint.config(
       'dist/**',
       'evals/**',
       'packages/test-utils/**',
-      'packages/core/src/skills/builtin/skill-creator/scripts/*.cjs',
     ],
   },
   eslint.configs.recommended,
@@ -193,6 +193,14 @@ export default tseslint.config(
       ],
     },
   },
+  {
+    // Rules that only apply to product code
+    files: ['packages/*/src/**/*.{ts,tsx}'],
+    ignores: ['**/*.test.ts', '**/*.test.tsx'],
+    rules: {
+      '@typescript-eslint/no-unsafe-type-assertion': 'error',
+    },
+  },
   {
     // Allow os.homedir() in tests and paths.ts where it is used to implement the helper
     files: [
@@ -243,7 +251,7 @@ export default tseslint.config(
     },
   },
   {
-    files: ['./**/*.{tsx,ts,js}'],
+    files: ['./**/*.{tsx,ts,js,cjs}'],
     plugins: {
       headers,
       import: importPlugin,
@@ -260,8 +268,8 @@ export default tseslint.config(
           ].join('\n'),
           patterns: {
             year: {
-              pattern: '202[5-6]',
-              defaultValue: '2026',
+              pattern: `202[5-${currentYear.toString().slice(-1)}]`,
+              defaultValue: currentYear.toString(),
             },
           },
         },
@@ -269,7 +277,6 @@ export default tseslint.config(
       'import/enforce-node-protocol-usage': ['error', 'always'],
     },
   },
-  // extra settings for scripts that we run directly with node
   {
     files: ['./scripts/**/*.js', 'esbuild.config.js'],
     languageOptions: {
@@ -290,6 +297,30 @@ export default tseslint.config(
       ],
     },
   },
+  {
+    files: ['**/*.cjs'],
+    languageOptions: {
+      sourceType: 'commonjs',
+      globals: {
+        ...globals.node,
+      },
+    },
+    rules: {
+      'no-restricted-syntax': 'off',
+      'no-console': 'off',
+      'no-empty': 'off',
+      'no-redeclare': 'off',
+      '@typescript-eslint/no-require-imports': 'off',
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        {
+          argsIgnorePattern: '^_',
+          varsIgnorePattern: '^_',
+          caughtErrorsIgnorePattern: '^_',
+        },
+      ],
+    },
+  },
   {
     files: ['packages/vscode-ide-companion/esbuild.js'],
     languageOptions: {

evals/edit-locations-eval.eval.ts

@@ -0,0 +1,110 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect } from 'vitest';
+import { evalTest } from './test-helper.js';
+
+describe('Edits location eval', () => {
+  /**
+   * Ensure that Gemini CLI always updates existing test files, if present,
+   * instead of creating a new one.
+   */
+  evalTest('USUALLY_PASSES', {
+    name: 'should update existing test file instead of creating a new one',
+    files: {
+      'package.json': JSON.stringify(
+        {
+          name: 'test-location-repro',
+          version: '1.0.0',
+          scripts: {
+            test: 'vitest run',
+          },
+          devDependencies: {
+            vitest: '^1.0.0',
+            typescript: '^5.0.0',
+          },
+        },
+        null,
+        2,
+      ),
+      'src/math.ts': `
+export function add(a: number, b: number): number {
+  return a + b;
+}
+
+export function subtract(a: number, b: number): number {
+  return a - b;
+}
+
+export function multiply(a: number, b: number): number {
+  return a + b;
+}
+`,
+      'src/math.test.ts': `
+import { expect, test } from 'vitest';
+import { add, subtract } from './math';
+
+test('add adds two numbers', () => {
+  expect(add(2, 3)).toBe(5);
+});
+
+test('subtract subtracts two numbers', () => {
+  expect(subtract(5, 3)).toBe(2);
+});
+`,
+      'src/utils.ts': `
+export function capitalize(s: string): string {
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}
+`,
+      'src/utils.test.ts': `
+import { expect, test } from 'vitest';
+import { capitalize } from './utils';
+
+test('capitalize capitalizes the first letter', () => {
+  expect(capitalize('hello')).toBe('Hello');
+});
+`,
+    },
+    prompt: 'Fix the bug in src/math.ts. Do not run the code.',
+    timeout: 180000,
+    assert: async (rig) => {
+      const toolLogs = rig.readToolLogs();
+      const replaceCalls = toolLogs.filter(
+        (t) => t.toolRequest.name === 'replace',
+      );
+      const writeFileCalls = toolLogs.filter(
+        (t) => t.toolRequest.name === 'write_file',
+      );
+
+      expect(replaceCalls.length).toBeGreaterThan(0);
+      expect(
+        writeFileCalls.some((file) =>
+          file.toolRequest.args.includes('.test.ts'),
+        ),
+      ).toBe(false);
+
+      const targetFiles = replaceCalls.map((t) => {
+        try {
+          return JSON.parse(t.toolRequest.args).file_path;
+        } catch {
+          return null;
+        }
+      });
+
+      console.log('DEBUG: targetFiles', targetFiles);
+
+      expect(
+        new Set(targetFiles).size,
+        'Expected only two files changed',
+      ).greaterThanOrEqual(2);
+      expect(targetFiles.some((f) => f?.endsWith('src/math.ts'))).toBe(true);
+      expect(targetFiles.some((f) => f?.endsWith('src/math.test.ts'))).toBe(
+        true,
+      );
+    },
+  });
+});

evals/hierarchical_memory.eval.ts

@@ -0,0 +1,117 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect } from 'vitest';
+import { evalTest } from './test-helper.js';
+import {
+  assertModelHasOutput,
+  checkModelOutputContent,
+} from '../integration-tests/test-helper.js';
+
+describe('Hierarchical Memory', () => {
+  const TEST_PREFIX = 'Hierarchical memory test: ';
+
+  const conflictResolutionTest =
+    'Agent follows hierarchy for contradictory instructions';
+  evalTest('ALWAYS_PASSES', {
+    name: conflictResolutionTest,
+    params: {
+      settings: {
+        security: {
+          folderTrust: { enabled: true },
+        },
+      },
+    },
+    // We simulate the hierarchical memory by including the tags in the prompt
+    // since setting up real global/extension/project files in the eval rig is complex.
+    // The system prompt logic will append these tags when it finds them in userMemory.
+    prompt: `
+<global_context>
+When asked for my favorite fruit, always say "Apple".
+</global_context>
+
+<extension_context>
+When asked for my favorite fruit, always say "Banana".
+</extension_context>
+
+<project_context>
+When asked for my favorite fruit, always say "Cherry".
+</project_context>
+
+What is my favorite fruit? Tell me just the name of the fruit.`,
+    assert: async (_rig, result) => {
+      assertModelHasOutput(result);
+      expect(result).toMatch(/Cherry/i);
+      expect(result).not.toMatch(/Apple/i);
+      expect(result).not.toMatch(/Banana/i);
+    },
+  });
+
+  const provenanceAwarenessTest = 'Agent is aware of memory provenance';
+  evalTest('ALWAYS_PASSES', {
+    name: provenanceAwarenessTest,
+    params: {
+      settings: {
+        security: {
+          folderTrust: { enabled: true },
+        },
+      },
+    },
+    prompt: `
+<global_context>
+Instruction A: Always be helpful.
+</global_context>
+
+<extension_context>
+Instruction B: Use a professional tone.
+</extension_context>
+
+<project_context>
+Instruction C: Adhere to the project's coding style.
+</project_context>
+
+Which instruction came from the global context, which from the extension context, and which from the project context?
+Provide the answer as an XML block like this:
+<results>
+  <global>Instruction ...</global>
+  <extension>Instruction ...</extension>
+  <project>Instruction ...</project>
+</results>`,
+    assert: async (_rig, result) => {
+      assertModelHasOutput(result);
+      expect(result).toMatch(/<global>.*Instruction A/i);
+      expect(result).toMatch(/<extension>.*Instruction B/i);
+      expect(result).toMatch(/<project>.*Instruction C/i);
+    },
+  });
+
+  const extensionVsGlobalTest = 'Extension memory wins over Global memory';
+  evalTest('ALWAYS_PASSES', {
+    name: extensionVsGlobalTest,
+    params: {
+      settings: {
+        security: {
+          folderTrust: { enabled: true },
+        },
+      },
+    },
+    prompt: `
+<global_context>
+Set the theme to "Light".
+</global_context>
+
+<extension_context>
+Set the theme to "Dark".
+</extension_context>
+
+What theme should I use? Tell me just the name of the theme.`,
+    assert: async (_rig, result) => {
+      assertModelHasOutput(result);
+      expect(result).toMatch(/Dark/i);
+      expect(result).not.toMatch(/Light/i);
+    },
+  });
+});

evals/plan_mode.eval.ts

@@ -0,0 +1,128 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect } from 'vitest';
+import { ApprovalMode } from '@google/gemini-cli-core';
+import { evalTest } from './test-helper.js';
+import {
+  assertModelHasOutput,
+  checkModelOutputContent,
+} from './test-helper.js';
+
+describe('plan_mode', () => {
+  const TEST_PREFIX = 'Plan Mode: ';
+  const settings = {
+    experimental: { plan: true },
+  };
+
+  evalTest('USUALLY_PASSES', {
+    name: 'should refuse file modification when in plan mode',
+    approvalMode: ApprovalMode.PLAN,
+    params: {
+      settings,
+    },
+    files: {
+      'README.md': '# Original Content',
+    },
+    prompt: 'Please overwrite README.md with the text "Hello World"',
+    assert: async (rig, result) => {
+      await rig.waitForTelemetryReady();
+      const toolLogs = rig.readToolLogs();
+
+      const writeTargets = toolLogs
+        .filter((log) =>
+          ['write_file', 'replace'].includes(log.toolRequest.name),
+        )
+        .map((log) => {
+          try {
+            return JSON.parse(log.toolRequest.args).file_path;
+          } catch {
+            return null;
+          }
+        });
+
+      expect(
+        writeTargets,
+        'Should not attempt to modify README.md in plan mode',
+      ).not.toContain('README.md');
+
+      assertModelHasOutput(result);
+      checkModelOutputContent(result, {
+        expectedContent: [/plan mode|read-only|cannot modify|refuse|exiting/i],
+        testName: `${TEST_PREFIX}should refuse file modification`,
+      });
+    },
+  });
+
+  evalTest('USUALLY_PASSES', {
+    name: 'should enter plan mode when asked to create a plan',
+    approvalMode: ApprovalMode.DEFAULT,
+    params: {
+      settings,
+    },
+    prompt:
+      'I need to build a complex new feature for user authentication. Please create a detailed implementation plan.',
+    assert: async (rig, result) => {
+      const wasToolCalled = await rig.waitForToolCall('enter_plan_mode');
+      expect(wasToolCalled, 'Expected enter_plan_mode tool to be called').toBe(
+        true,
+      );
+      assertModelHasOutput(result);
+    },
+  });
+
+  evalTest('USUALLY_PASSES', {
+    name: 'should exit plan mode when plan is complete and implementation is requested',
+    approvalMode: ApprovalMode.PLAN,
+    params: {
+      settings,
+    },
+    files: {
+      'plans/my-plan.md':
+        '# My Implementation Plan\n\n1. Step one\n2. Step two',
+    },
+    prompt:
+      'The plan in plans/my-plan.md is solid. Please proceed with the implementation.',
+    assert: async (rig, result) => {
+      const wasToolCalled = await rig.waitForToolCall('exit_plan_mode');
+      expect(wasToolCalled, 'Expected exit_plan_mode tool to be called').toBe(
+        true,
+      );
+      assertModelHasOutput(result);
+    },
+  });
+
+  evalTest('USUALLY_PASSES', {
+    name: 'should allow file modification in plans directory when in plan mode',
+    approvalMode: ApprovalMode.PLAN,
+    params: {
+      settings,
+    },
+    prompt: 'Create a plan for a new login feature.',
+    assert: async (rig, result) => {
+      await rig.waitForTelemetryReady();
+      const toolLogs = rig.readToolLogs();
+
+      const writeCall = toolLogs.find(
+        (log) => log.toolRequest.name === 'write_file',
+      );
+
+      expect(
+        writeCall,
+        'Should attempt to modify a file in the plans directory when in plan mode',
+      ).toBeDefined();
+
+      if (writeCall) {
+        const args = JSON.parse(writeCall.toolRequest.args);
+        expect(args.file_path).toContain('.gemini/tmp');
+        expect(args.file_path).toContain('/plans/');
+        expect(args.file_path).toMatch(/\.md$/);
+      }
+
+      assertModelHasOutput(result);
+    },
+  });
+});

evals/save_memory.eval.ts

@@ -109,7 +109,7 @@ describe('save_memory', () => {
     params: {
       settings: { tools: { core: ['save_memory'] } },
     },
-    prompt: `My dog's name is Buddy. What is my dog's name?`,
+    prompt: `Please remember that my dog's name is Buddy.`,
     assert: async (rig, result) => {
       const wasToolCalled = await rig.waitForToolCall('save_memory');
       expect(wasToolCalled, 'Expected save_memory tool to be called').toBe(
@@ -145,25 +145,34 @@ describe('save_memory', () => {
     },
   });
 
-  const rememberingDbSchemaLocation =
-    "Agent remembers project's database schema location";
+  const ignoringDbSchemaLocation =
+    "Agent ignores workspace's database schema location";
   evalTest('ALWAYS_PASSES', {
-    name: rememberingDbSchemaLocation,
+    name: ignoringDbSchemaLocation,
     params: {
-      settings: { tools: { core: ['save_memory'] } },
+      settings: {
+        tools: {
+          core: [
+            'save_memory',
+            'list_directory',
+            'read_file',
+            'run_shell_command',
+          ],
+        },
+      },
     },
-    prompt: `The database schema for this project is located in \`db/schema.sql\`.`,
+    prompt: `The database schema for this workspace is located in \`db/schema.sql\`.`,
     assert: async (rig, result) => {
-      const wasToolCalled = await rig.waitForToolCall('save_memory');
-      expect(wasToolCalled, 'Expected save_memory tool to be called').toBe(
-        true,
-      );
+      await rig.waitForTelemetryReady();
+      const wasToolCalled = rig
+        .readToolLogs()
+        .some((log) => log.toolRequest.name === 'save_memory');
+      expect(
+        wasToolCalled,
+        'save_memory should not be called for workspace-specific information',
+      ).toBe(false);
 
       assertModelHasOutput(result);
-      checkModelOutputContent(result, {
-        expectedContent: [/database schema|ok|remember|will do/i],
-        testName: `${TEST_PREFIX}${rememberingDbSchemaLocation}`,
-      });
     },
   });
 
@@ -189,38 +198,74 @@ describe('save_memory', () => {
     },
   });
 
-  const rememberingTestCommand =
-    'Agent remembers specific project test command';
+  const ignoringBuildArtifactLocation =
+    'Agent ignores workspace build artifact location';
   evalTest('ALWAYS_PASSES', {
-    name: rememberingTestCommand,
+    name: ignoringBuildArtifactLocation,
     params: {
-      settings: { tools: { core: ['save_memory'] } },
+      settings: {
+        tools: {
+          core: [
+            'save_memory',
+            'list_directory',
+            'read_file',
+            'run_shell_command',
+          ],
+        },
+      },
     },
-    prompt: `The command to run all backend tests is \`npm run test:backend\`.`,
+    prompt: `In this workspace, build artifacts are stored in the \`dist/artifacts\` directory.`,
     assert: async (rig, result) => {
-      const wasToolCalled = await rig.waitForToolCall('save_memory');
-      expect(wasToolCalled, 'Expected save_memory tool to be called').toBe(
-        true,
-      );
+      await rig.waitForTelemetryReady();
+      const wasToolCalled = rig
+        .readToolLogs()
+        .some((log) => log.toolRequest.name === 'save_memory');
+      expect(
+        wasToolCalled,
+        'save_memory should not be called for workspace-specific information',
+      ).toBe(false);
 
       assertModelHasOutput(result);
-      checkModelOutputContent(result, {
-        expectedContent: [
-          /command to run all backend tests|ok|remember|will do/i,
-        ],
-        testName: `${TEST_PREFIX}${rememberingTestCommand}`,
-      });
     },
   });
 
-  const rememberingMainEntryPoint =
-    "Agent remembers project's main entry point";
+  const ignoringMainEntryPoint = "Agent ignores workspace's main entry point";
   evalTest('ALWAYS_PASSES', {
-    name: rememberingMainEntryPoint,
+    name: ignoringMainEntryPoint,
+    params: {
+      settings: {
+        tools: {
+          core: [
+            'save_memory',
+            'list_directory',
+            'read_file',
+            'run_shell_command',
+          ],
+        },
+      },
+    },
+    prompt: `The main entry point for this workspace is \`src/index.js\`.`,
+    assert: async (rig, result) => {
+      await rig.waitForTelemetryReady();
+      const wasToolCalled = rig
+        .readToolLogs()
+        .some((log) => log.toolRequest.name === 'save_memory');
+      expect(
+        wasToolCalled,
+        'save_memory should not be called for workspace-specific information',
+      ).toBe(false);
+
+      assertModelHasOutput(result);
+    },
+  });
+
+  const rememberingBirthday = "Agent remembers user's birthday";
+  evalTest('ALWAYS_PASSES', {
+    name: rememberingBirthday,
     params: {
       settings: { tools: { core: ['save_memory'] } },
     },
-    prompt: `The main entry point for this project is \`src/index.js\`.`,
+    prompt: `My birthday is on June 15th.`,
     assert: async (rig, result) => {
       const wasToolCalled = await rig.waitForToolCall('save_memory');
       expect(wasToolCalled, 'Expected save_memory tool to be called').toBe(
@@ -229,10 +274,8 @@ describe('save_memory', () => {
 
       assertModelHasOutput(result);
       checkModelOutputContent(result, {
-        expectedContent: [
-          /main entry point for this project|ok|remember|will do/i,
-        ],
-        testName: `${TEST_PREFIX}${rememberingMainEntryPoint}`,
+        expectedContent: [/June 15th|ok|remember|will do/i],
+        testName: `${TEST_PREFIX}${rememberingBirthday}`,
       });
     },
   });

evals/shell-efficiency.eval.ts

@@ -0,0 +1,110 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect } from 'vitest';
+import { evalTest } from './test-helper.js';
+
+describe('Shell Efficiency', () => {
+  const getCommand = (call: any): string | undefined => {
+    let args = call.toolRequest.args;
+    if (typeof args === 'string') {
+      try {
+        args = JSON.parse(args);
+      } catch (e) {
+        // Ignore parse errors
+      }
+    }
+    return typeof args === 'string' ? args : (args as any)['command'];
+  };
+
+  evalTest('USUALLY_PASSES', {
+    name: 'should use --silent/--quiet flags when installing packages',
+    prompt: 'Install the "lodash" package using npm.',
+    assert: async (rig) => {
+      const toolCalls = rig.readToolLogs();
+      const shellCalls = toolCalls.filter(
+        (call) => call.toolRequest.name === 'run_shell_command',
+      );
+
+      const hasEfficiencyFlag = shellCalls.some((call) => {
+        const cmd = getCommand(call);
+        return (
+          cmd &&
+          cmd.includes('npm install') &&
+          (cmd.includes('--silent') ||
+            cmd.includes('--quiet') ||
+            cmd.includes('-q'))
+        );
+      });
+
+      expect(
+        hasEfficiencyFlag,
+        `Expected agent to use efficiency flags for npm install. Commands used: ${shellCalls
+          .map(getCommand)
+          .join(', ')}`,
+      ).toBe(true);
+    },
+  });
+
+  evalTest('USUALLY_PASSES', {
+    name: 'should use --no-pager with git commands',
+    prompt: 'Show the git log.',
+    assert: async (rig) => {
+      const toolCalls = rig.readToolLogs();
+      const shellCalls = toolCalls.filter(
+        (call) => call.toolRequest.name === 'run_shell_command',
+      );
+
+      const hasNoPager = shellCalls.some((call) => {
+        const cmd = getCommand(call);
+        return cmd && cmd.includes('git') && cmd.includes('--no-pager');
+      });
+
+      expect(
+        hasNoPager,
+        `Expected agent to use --no-pager with git. Commands used: ${shellCalls
+          .map(getCommand)
+          .join(', ')}`,
+      ).toBe(true);
+    },
+  });
+
+  evalTest('USUALLY_PASSES', {
+    name: 'should NOT use efficiency flags when enableShellOutputEfficiency is disabled',
+    params: {
+      settings: {
+        tools: {
+          shell: {
+            enableShellOutputEfficiency: false,
+          },
+        },
+      },
+    },
+    prompt: 'Install the "lodash" package using npm.',
+    assert: async (rig) => {
+      const toolCalls = rig.readToolLogs();
+      const shellCalls = toolCalls.filter(
+        (call) => call.toolRequest.name === 'run_shell_command',
+      );
+
+      const hasEfficiencyFlag = shellCalls.some((call) => {
+        const cmd = getCommand(call);
+        return (
+          cmd &&
+          cmd.includes('npm install') &&
+          (cmd.includes('--silent') ||
+            cmd.includes('--quiet') ||
+            cmd.includes('-q'))
+        );
+      });
+
+      expect(
+        hasEfficiencyFlag,
+        'Agent used efficiency flags even though enableShellOutputEfficiency was disabled',
+      ).toBe(false);
+    },
+  });
+});

evals/test-helper.ts

@@ -49,7 +49,7 @@ export function evalTest(policy: EvalPolicy, evalCase: EvalCase) {
       // bootstrap test projects.
       const rootNodeModules = path.join(process.cwd(), 'node_modules');
       const testNodeModules = path.join(rig.testDir || '', 'node_modules');
-      if (fs.existsSync(rootNodeModules)) {
+      if (fs.existsSync(rootNodeModules) && !fs.existsSync(testNodeModules)) {
         fs.symlinkSync(rootNodeModules, testNodeModules, 'dir');
       }
 
@@ -125,7 +125,7 @@ export function evalTest(policy: EvalPolicy, evalCase: EvalCase) {
         approvalMode: evalCase.approvalMode ?? 'yolo',
         timeout: evalCase.timeout,
         env: {
-          GEMINI_CLI_ACTIVITY_LOG_FILE: activityLogFile,
+          GEMINI_CLI_ACTIVITY_LOG_TARGET: activityLogFile,
         },
       });
 
@@ -162,7 +162,7 @@ export function evalTest(policy: EvalPolicy, evalCase: EvalCase) {
   if (policy === 'USUALLY_PASSES' && !process.env['RUN_EVALS']) {
     it.skip(evalCase.name, fn);
   } else {
-    it(evalCase.name, fn);
+    it(evalCase.name, fn, evalCase.timeout);
   }
 }
 

evals/validation_fidelity.eval.ts

@@ -0,0 +1,85 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect } from 'vitest';
+import { evalTest } from './test-helper.js';
+
+describe('validation_fidelity', () => {
+  evalTest('ALWAYS_PASSES', {
+    name: 'should perform exhaustive validation autonomously when guided by system instructions',
+    files: {
+      'src/types.ts': `
+export interface LogEntry {
+  level: 'info' | 'warn' | 'error';
+  message: string;
+}
+`,
+      'src/logger.ts': `
+import { LogEntry } from './types.js';
+
+export function formatLog(entry: LogEntry): string {
+  return \`[\${entry.level.toUpperCase()}] \${entry.message}\`;
+}
+`,
+      'src/logger.test.ts': `
+import { expect, test } from 'vitest';
+import { formatLog } from './logger.js';
+import { LogEntry } from './types.js';
+
+test('formats log correctly', () => {
+  const entry: LogEntry = { level: 'info', message: 'test message' };
+  expect(formatLog(entry)).toBe('[INFO] test message');
+});
+`,
+      'package.json': JSON.stringify({
+        name: 'test-project',
+        type: 'module',
+        scripts: {
+          test: 'vitest run',
+          build: 'tsc --noEmit',
+        },
+      }),
+      'tsconfig.json': JSON.stringify({
+        compilerOptions: {
+          target: 'ESNext',
+          module: 'ESNext',
+          moduleResolution: 'node',
+          strict: true,
+          esModuleInterop: true,
+          skipLibCheck: true,
+          forceConsistentCasingInFileNames: true,
+        },
+      }),
+    },
+    prompt:
+      "Refactor the 'LogEntry' interface in 'src/types.ts' to rename the 'message' field to 'payload'.",
+    timeout: 600000,
+    assert: async (rig) => {
+      // The goal of this eval is to see if the agent realizes it needs to update usages
+      // AND run 'npm run build' or 'tsc' autonomously to ensure project-wide structural integrity.
+
+      const toolLogs = rig.readToolLogs();
+      const shellCalls = toolLogs.filter(
+        (log) => log.toolRequest.name === 'run_shell_command',
+      );
+
+      const hasBuildOrTsc = shellCalls.some((log) => {
+        const cmd = JSON.parse(log.toolRequest.args).command.toLowerCase();
+        return (
+          cmd.includes('npm run build') ||
+          cmd.includes('tsc') ||
+          cmd.includes('typecheck') ||
+          cmd.includes('npm run verify')
+        );
+      });
+
+      expect(
+        hasBuildOrTsc,
+        'Expected the agent to autonomously run a build or type-check command to verify the refactoring',
+      ).toBe(true);
+    },
+  });
+});

evals/validation_fidelity_pre_existing_errors.eval.ts

@@ -0,0 +1,79 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect } from 'vitest';
+import { evalTest } from './test-helper.js';
+
+describe('validation_fidelity_pre_existing_errors', () => {
+  evalTest('USUALLY_PASSES', {
+    name: 'should handle pre-existing project errors gracefully during validation',
+    files: {
+      'src/math.ts': `
+export function add(a: number, b: number): number {
+  return a + b;
+}
+`,
+      'src/index.ts': `
+import { add } from './math.js';
+console.log(add(1, 2));
+`,
+      'src/utils.ts': `
+export function multiply(a: number, b: number): number {
+  return a * c; // 'c' is not defined - PRE-EXISTING ERROR
+}
+`,
+      'package.json': JSON.stringify({
+        name: 'test-project',
+        type: 'module',
+        scripts: {
+          test: 'vitest run',
+          build: 'tsc --noEmit',
+        },
+      }),
+      'tsconfig.json': JSON.stringify({
+        compilerOptions: {
+          target: 'ESNext',
+          module: 'ESNext',
+          moduleResolution: 'node',
+          strict: true,
+          esModuleInterop: true,
+          skipLibCheck: true,
+          forceConsistentCasingInFileNames: true,
+        },
+      }),
+    },
+    prompt: "In src/math.ts, rename the 'add' function to 'sum'.",
+    timeout: 600000,
+    assert: async (rig) => {
+      const toolLogs = rig.readToolLogs();
+      const replaceCalls = toolLogs.filter(
+        (log) => log.toolRequest.name === 'replace',
+      );
+
+      // Verify it did the work in math.ts
+      const mathRefactor = replaceCalls.some((log) => {
+        const args = JSON.parse(log.toolRequest.args);
+        return (
+          args.file_path.endsWith('src/math.ts') &&
+          args.new_string.includes('sum')
+        );
+      });
+      expect(mathRefactor, 'Agent should have refactored math.ts').toBe(true);
+
+      const shellCalls = toolLogs.filter(
+        (log) => log.toolRequest.name === 'run_shell_command',
+      );
+      const ranValidation = shellCalls.some((log) => {
+        const cmd = JSON.parse(log.toolRequest.args).command.toLowerCase();
+        return cmd.includes('build') || cmd.includes('tsc');
+      });
+
+      expect(ranValidation, 'Agent should have attempted validation').toBe(
+        true,
+      );
+    },
+  });
+});

integration-tests/resume_repro.responses

@@ -0,0 +1 @@
+{"method":"generateContentStream","response":[{"candidates":[{"content":{"parts":[{"text":"Session started."}],"role":"model"},"finishReason":"STOP","index":0}]}]}

integration-tests/resume_repro.test.ts

@@ -0,0 +1,42 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { TestRig } from './test-helper.js';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+describe('resume-repro', () => {
+  let rig: TestRig;
+
+  beforeEach(() => {
+    rig = new TestRig();
+  });
+
+  afterEach(async () => await rig.cleanup());
+
+  it('should be able to resume a session without "Storage must be initialized before use"', async () => {
+    const responsesPath = path.join(__dirname, 'resume_repro.responses');
+    await rig.setup('should be able to resume a session', {
+      fakeResponsesPath: responsesPath,
+    });
+
+    // 1. First run to create a session
+    await rig.run({
+      args: 'hello',
+    });
+
+    // 2. Second run with --resume latest
+    // This should NOT fail with "Storage must be initialized before use"
+    const result = await rig.run({
+      args: ['--resume', 'latest', 'continue'],
+    });
+
+    expect(result).toContain('Session started');
+  });
+});

integration-tests/ripgrep-real.test.ts

@@ -11,6 +11,7 @@ import * as os from 'node:os';
 import { RipGrepTool } from '../packages/core/src/tools/ripGrep.js';
 import { Config } from '../packages/core/src/config/config.js';
 import { WorkspaceContext } from '../packages/core/src/utils/workspaceContext.js';
+import { createMockMessageBus } from '../packages/core/src/test-utils/mock-message-bus.js';
 
 // Mock Config to provide necessary context
 class MockConfig {
@@ -66,7 +67,7 @@ describe('ripgrep-real-direct', () => {
     await fs.writeFile(path.join(tempDir, 'file3.txt'), 'goodbye moon\n');
 
     const config = new MockConfig(tempDir) as unknown as Config;
-    tool = new RipGrepTool(config);
+    tool = new RipGrepTool(config, createMockMessageBus());
   });
 
   afterAll(async () => {
@@ -108,4 +109,24 @@ describe('ripgrep-real-direct', () => {
     expect(result.llmContent).toContain('script.js');
     expect(result.llmContent).not.toContain('file1.txt');
   });
+
+  it('should support context parameters', async () => {
+    // Create a file with multiple lines
+    await fs.writeFile(
+      path.join(tempDir, 'context.txt'),
+      'line1\nline2\nline3 match\nline4\nline5\n',
+    );
+
+    const invocation = tool.build({
+      pattern: 'match',
+      context: 1,
+    });
+    const result = await invocation.execute(new AbortController().signal);
+
+    expect(result.llmContent).toContain('Found 1 match');
+    expect(result.llmContent).toContain('context.txt');
+    expect(result.llmContent).toContain('L2- line2');
+    expect(result.llmContent).toContain('L3: line3 match');
+    expect(result.llmContent).toContain('L4- line4');
+  });
 });

integration-tests/vitest.config.ts

@@ -20,5 +20,8 @@ export default defineConfig({
         maxThreads: 16,
       },
     },
+    env: {
+      GEMINI_TEST_TYPE: 'integration',
+    },
   },
 });

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.29.0-nightly.20260203.71f46f116",
+  "version": "0.29.2",
   "engines": {
     "node": ">=20.0.0"
   },
@@ -14,7 +14,7 @@
     "url": "git+https://github.com/google-gemini/gemini-cli.git"
   },
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.29.0-nightly.20260203.71f46f116"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.29.2"
   },
   "scripts": {
     "start": "cross-env NODE_ENV=development node scripts/start.js",
@@ -32,7 +32,7 @@
     "docs:settings": "tsx ./scripts/generate-settings-doc.ts",
     "docs:keybindings": "tsx ./scripts/generate-keybindings-doc.ts",
     "build": "node scripts/build.js",
-    "build-and-start": "npm run build && npm run start",
+    "build-and-start": "npm run build && npm run start --",
     "build:vscode": "node scripts/build_vscode_companion.js",
     "build:all": "npm run build && npm run build:sandbox && npm run build:vscode",
     "build:packages": "npm run build --workspaces",
@@ -86,9 +86,11 @@
     "@types/minimatch": "^5.1.2",
     "@types/mock-fs": "^4.13.4",
     "@types/prompts": "^2.4.9",
+    "@types/proper-lockfile": "^4.1.4",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
     "@types/shell-quote": "^1.7.5",
+    "@types/ws": "^8.18.1",
     "@vitest/coverage-v8": "^3.1.1",
     "@vitest/eslint-plugin": "^1.3.4",
     "cross-env": "^7.0.3",
@@ -126,6 +128,7 @@
   "dependencies": {
     "ink": "npm:@jrichman/ink@6.4.8",
     "latest-version": "^9.0.0",
+    "proper-lockfile": "^4.1.2",
     "simple-git": "^3.28.0"
   },
   "optionalDependencies": {
@@ -135,6 +138,7 @@
     "@lydell/node-pty-linux-x64": "1.1.0",
     "@lydell/node-pty-win32-arm64": "1.1.0",
     "@lydell/node-pty-win32-x64": "1.1.0",
+    "gemini-cli-devtools": "^0.2.1",
     "keytar": "^7.9.0",
     "node-pty": "^1.0.0"
   },

packages/a2a-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-a2a-server",
-  "version": "0.29.0-nightly.20260203.71f46f116",
+  "version": "0.29.2",
   "description": "Gemini CLI A2A Server",
   "repository": {
     "type": "git",

packages/a2a-server/src/agent/executor.ts

@@ -117,6 +117,7 @@ export class CoderAgentExecutor implements AgentExecutor {
     const agentSettings = persistedState._agentSettings;
     const config = await this.getConfig(agentSettings, sdkTask.id);
     const contextId: string =
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       (metadata['_contextId'] as string) || sdkTask.contextId;
     const runtimeTask = await Task.create(
       sdkTask.id,
@@ -140,6 +141,7 @@ export class CoderAgentExecutor implements AgentExecutor {
     agentSettingsInput?: AgentSettings,
     eventBus?: ExecutionEventBus,
   ): Promise<TaskWrapper> {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     const agentSettings = agentSettingsInput || ({} as AgentSettings);
     const config = await this.getConfig(agentSettings, taskId);
     const runtimeTask = await Task.create(
@@ -290,6 +292,7 @@ export class CoderAgentExecutor implements AgentExecutor {
     const contextId: string =
       userMessage.contextId ||
       sdkTask?.contextId ||
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       (sdkTask?.metadata?.['_contextId'] as string) ||
       uuidv4();
 
@@ -385,6 +388,7 @@ export class CoderAgentExecutor implements AgentExecutor {
       }
     } else {
       logger.info(`[CoderAgentExecutor] Creating new task ${taskId}.`);
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       const agentSettings = userMessage.metadata?.[
         'coderAgent'
       ] as AgentSettings;

packages/a2a-server/src/agent/task.ts

@@ -378,6 +378,7 @@ export class Task {
       if (tc.status === 'awaiting_approval' && tc.confirmationDetails) {
         this.pendingToolConfirmationDetails.set(
           tc.request.callId,
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
           tc.confirmationDetails as ToolCallConfirmationDetails,
         );
       }
@@ -411,7 +412,7 @@ export class Task {
       );
       toolCalls.forEach((tc: ToolCall) => {
         if (tc.status === 'awaiting_approval' && tc.confirmationDetails) {
-          // eslint-disable-next-line @typescript-eslint/no-floating-promises
+          // eslint-disable-next-line @typescript-eslint/no-floating-promises, @typescript-eslint/no-unsafe-type-assertion
           (tc.confirmationDetails as ToolCallConfirmationDetails).onConfirm(
             ToolConfirmationOutcome.ProceedOnce,
           );
@@ -465,12 +466,14 @@ export class Task {
     T extends ToolCall | AnyDeclarativeTool,
     K extends UnionKeys<T>,
   >(from: T, ...fields: K[]): Partial<T> {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     const ret = {} as Pick<T, K>;
     for (const field of fields) {
       if (field in from) {
         ret[field] = from[field];
       }
     }
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return ret as Partial<T>;
   }
 
@@ -493,6 +496,7 @@ export class Task {
     );
 
     if (tc.tool) {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       serializableToolCall.tool = this._pickFields(
         tc.tool,
         'name',
@@ -622,8 +626,11 @@ export class Task {
           request.args['new_string']
         ) {
           const newContent = await this.getProposedContent(
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
             request.args['file_path'] as string,
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
             request.args['old_string'] as string,
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
             request.args['new_string'] as string,
           );
           return { ...request, args: { ...request.args, newContent } };
@@ -719,6 +726,7 @@ export class Task {
       case GeminiEventType.Error:
       default: {
         // Block scope for lexical declaration
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         const errorEvent = event as ServerGeminiErrorEvent; // Type assertion
         const errorMessage =
           errorEvent.value?.error.message ?? 'Unknown error from LLM stream';
@@ -807,6 +815,7 @@ export class Task {
         if (confirmationDetails.type === 'edit') {
           const payload = part.data['newContent']
             ? ({
+                // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
                 newContent: part.data['newContent'] as string,
               } as ToolConfirmationPayload)
             : undefined;

packages/a2a-server/src/commands/init.ts

@@ -85,6 +85,7 @@ export class InitCommand implements Command {
     if (!context.agentExecutor) {
       throw new Error('Agent executor not found in context.');
     }
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     const agentExecutor = context.agentExecutor as CoderAgentExecutor;
 
     const agentSettings: AgentSettings = {

packages/a2a-server/src/config/config.test.ts

@@ -41,9 +41,11 @@ vi.mock('@google/gemini-cli-core', async (importOriginal) => {
       };
       return mockConfig;
     }),
-    loadServerHierarchicalMemory: vi
-      .fn()
-      .mockResolvedValue({ memoryContent: '', fileCount: 0, filePaths: [] }),
+    loadServerHierarchicalMemory: vi.fn().mockResolvedValue({
+      memoryContent: { global: '', extension: '', project: '' },
+      fileCount: 0,
+      filePaths: [],
+    }),
     startupProfiler: {
       flush: vi.fn(),
     },

packages/a2a-server/src/config/config.ts

@@ -18,7 +18,6 @@ import {
   loadServerHierarchicalMemory,
   GEMINI_DIR,
   DEFAULT_GEMINI_EMBEDDING_MODEL,
-  DEFAULT_GEMINI_MODEL,
   type ExtensionLoader,
   startupProfiler,
   PREVIEW_GEMINI_MODEL,
@@ -60,9 +59,7 @@ export async function loadConfig(
 
   const configParams: ConfigParameters = {
     sessionId: taskId,
-    model: settings.general?.previewFeatures
-      ? PREVIEW_GEMINI_MODEL
-      : DEFAULT_GEMINI_MODEL,
+    model: PREVIEW_GEMINI_MODEL,
     embeddingModel: DEFAULT_GEMINI_EMBEDDING_MODEL,
     sandbox: undefined, // Sandbox might not be relevant for a server-side agent
     targetDir: workspaceDir, // Or a specific directory the agent operates on
@@ -80,6 +77,7 @@ export async function loadConfig(
     cwd: workspaceDir,
     telemetry: {
       enabled: settings.telemetry?.enabled,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       target: settings.telemetry?.target as TelemetryTarget,
       otlpEndpoint:
         process.env['OTEL_EXPORTER_OTLP_ENDPOINT'] ??
@@ -104,7 +102,6 @@ export async function loadConfig(
     trustedFolder: true,
     extensionLoader,
     checkpointing,
-    previewFeatures: settings.general?.previewFeatures,
     interactive: true,
     enableInteractiveShell: true,
     ptyInfo: 'auto',

packages/a2a-server/src/config/extension.ts

@@ -93,6 +93,7 @@ function loadExtension(extensionDir: string): GeminiCLIExtension | null {
 
   try {
     const configContent = fs.readFileSync(configFilePath, 'utf-8');
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     const config = JSON.parse(configContent) as ExtensionConfig;
     if (!config.name || !config.version) {
       logger.error(
@@ -107,6 +108,7 @@ function loadExtension(extensionDir: string): GeminiCLIExtension | null {
       .map((contextFileName) => path.join(extensionDir, contextFileName))
       .filter((contextFilePath) => fs.existsSync(contextFilePath));
 
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return {
       name: config.name,
       version: config.version,
@@ -140,6 +142,7 @@ export function loadInstallMetadata(
   const metadataFilePath = path.join(extensionDir, INSTALL_METADATA_FILENAME);
   try {
     const configContent = fs.readFileSync(metadataFilePath, 'utf-8');
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     const metadata = JSON.parse(configContent) as ExtensionInstallMetadata;
     return metadata;
   } catch (e) {

packages/a2a-server/src/config/settings.test.ts

@@ -89,67 +89,6 @@ describe('loadSettings', () => {
     vi.restoreAllMocks();
   });
 
-  it('should load nested previewFeatures from user settings', () => {
-    const settings = {
-      general: {
-        previewFeatures: true,
-      },
-    };
-    fs.writeFileSync(USER_SETTINGS_PATH, JSON.stringify(settings));
-
-    const result = loadSettings(mockWorkspaceDir);
-    expect(result.general?.previewFeatures).toBe(true);
-  });
-
-  it('should load nested previewFeatures from workspace settings', () => {
-    const settings = {
-      general: {
-        previewFeatures: true,
-      },
-    };
-    const workspaceSettingsPath = path.join(
-      mockGeminiWorkspaceDir,
-      'settings.json',
-    );
-    fs.writeFileSync(workspaceSettingsPath, JSON.stringify(settings));
-
-    const result = loadSettings(mockWorkspaceDir);
-    expect(result.general?.previewFeatures).toBe(true);
-  });
-
-  it('should prioritize workspace settings over user settings', () => {
-    const userSettings = {
-      general: {
-        previewFeatures: false,
-      },
-    };
-    fs.writeFileSync(USER_SETTINGS_PATH, JSON.stringify(userSettings));
-
-    const workspaceSettings = {
-      general: {
-        previewFeatures: true,
-      },
-    };
-    const workspaceSettingsPath = path.join(
-      mockGeminiWorkspaceDir,
-      'settings.json',
-    );
-    fs.writeFileSync(workspaceSettingsPath, JSON.stringify(workspaceSettings));
-
-    const result = loadSettings(mockWorkspaceDir);
-    expect(result.general?.previewFeatures).toBe(true);
-  });
-
-  it('should handle missing previewFeatures', () => {
-    const settings = {
-      general: {},
-    };
-    fs.writeFileSync(USER_SETTINGS_PATH, JSON.stringify(settings));
-
-    const result = loadSettings(mockWorkspaceDir);
-    expect(result.general?.previewFeatures).toBeUndefined();
-  });
-
   it('should load other top-level settings correctly', () => {
     const settings = {
       showMemoryUsage: true,

packages/a2a-server/src/config/settings.ts

@@ -31,9 +31,6 @@ export interface Settings {
   showMemoryUsage?: boolean;
   checkpointing?: CheckpointingSettings;
   folderTrust?: boolean;
-  general?: {
-    previewFeatures?: boolean;
-  };
 
   // Git-aware file filtering settings
   fileFiltering?: {
@@ -70,6 +67,7 @@ export function loadSettings(workspaceDir: string): Settings {
   try {
     if (fs.existsSync(USER_SETTINGS_PATH)) {
       const userContent = fs.readFileSync(USER_SETTINGS_PATH, 'utf-8');
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       const parsedUserSettings = JSON.parse(
         stripJsonComments(userContent),
       ) as Settings;
@@ -92,6 +90,7 @@ export function loadSettings(workspaceDir: string): Settings {
   try {
     if (fs.existsSync(workspaceSettingsPath)) {
       const projectContent = fs.readFileSync(workspaceSettingsPath, 'utf-8');
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       const parsedWorkspaceSettings = JSON.parse(
         stripJsonComments(projectContent),
       ) as Settings;
@@ -142,10 +141,12 @@ function resolveEnvVarsInObject<T>(obj: T): T {
   }
 
   if (typeof obj === 'string') {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return resolveEnvVarsInString(obj) as unknown as T;
   }
 
   if (Array.isArray(obj)) {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return obj.map((item) => resolveEnvVarsInObject(item)) as unknown as T;
   }
 

packages/a2a-server/src/http/app.ts

@@ -118,6 +118,7 @@ async function handleExecuteCommand(
       const eventHandler = (event: AgentExecutionEvent) => {
         const jsonRpcResponse = {
           jsonrpc: '2.0',
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
           id: 'taskId' in event ? event.taskId : (event as Message).messageId,
           result: event,
         };
@@ -206,6 +207,7 @@ export async function createApp() {
     expressApp.post('/tasks', async (req, res) => {
       try {
         const taskId = uuidv4();
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         const agentSettings = req.body.agentSettings as
           | AgentSettings
           | undefined;

packages/a2a-server/src/persistence/gcs.ts

@@ -95,6 +95,7 @@ export class GCSTaskStore implements TaskStore {
     await this.ensureBucketInitialized();
     const taskId = task.id;
     const persistedState = getPersistedState(
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       task.metadata as PersistedTaskMetadata,
     );
 

packages/a2a-server/src/types.ts

@@ -125,6 +125,7 @@ export const METADATA_KEY = '__persistedState';
 export function getPersistedState(
   metadata: PersistedTaskMetadata,
 ): PersistedStateMetadata | undefined {
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   return metadata?.[METADATA_KEY] as PersistedStateMetadata | undefined;
 }
 

packages/a2a-server/src/utils/testing_utils.ts

@@ -4,6 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import * as path from 'node:path';
 import type {
   Task as SDKTask,
   TaskStatusUpdateEvent,
@@ -12,11 +13,11 @@ import type {
 import {
   ApprovalMode,
   DEFAULT_GEMINI_MODEL,
-  DEFAULT_TRUNCATE_TOOL_OUTPUT_LINES,
   DEFAULT_TRUNCATE_TOOL_OUTPUT_THRESHOLD,
   GeminiClient,
   HookSystem,
   PolicyDecision,
+  tmpdir,
 } from '@google/gemini-cli-core';
 import { createMockMessageBus } from '@google/gemini-cli-core/src/test-utils/mock-message-bus.js';
 import type { Config, Storage } from '@google/gemini-cli-core';
@@ -25,6 +26,8 @@ import { expect, vi } from 'vitest';
 export function createMockConfig(
   overrides: Partial<Config> = {},
 ): Partial<Config> {
+  const tmpDir = tmpdir();
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   const mockConfig = {
     getToolRegistry: vi.fn().mockReturnValue({
       getTool: vi.fn(),
@@ -39,15 +42,15 @@ export function createMockConfig(
     getWorkspaceContext: vi.fn().mockReturnValue({
       isPathWithinWorkspace: () => true,
     }),
-    getTargetDir: () => '/test',
+    getTargetDir: () => tmpDir,
     getCheckpointingEnabled: vi.fn().mockReturnValue(false),
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     storage: {
-      getProjectTempDir: () => '/tmp',
-      getProjectTempCheckpointsDir: () => '/tmp/checkpoints',
+      getProjectTempDir: () => tmpDir,
+      getProjectTempCheckpointsDir: () => path.join(tmpDir, 'checkpoints'),
     } as Storage,
     getTruncateToolOutputThreshold: () =>
       DEFAULT_TRUNCATE_TOOL_OUTPUT_THRESHOLD,
-    getTruncateToolOutputLines: () => DEFAULT_TRUNCATE_TOOL_OUTPUT_LINES,
     getActiveModel: vi.fn().mockReturnValue(DEFAULT_GEMINI_MODEL),
     getDebugMode: vi.fn().mockReturnValue(false),
     getContentGeneratorConfig: vi.fn().mockReturnValue({ model: 'gemini-pro' }),
@@ -147,6 +150,7 @@ export function assertUniqueFinalEventIsLast(
   events: SendStreamingMessageSuccessResponse[],
 ) {
   // Final event is input-required & final
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   const finalEvent = events[events.length - 1].result as TaskStatusUpdateEvent;
   expect(finalEvent.metadata?.['coderAgent']).toMatchObject({
     kind: 'state-change',
@@ -156,9 +160,11 @@ export function assertUniqueFinalEventIsLast(
 
   // There is only one event with final and its the last
   expect(
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     events.filter((e) => (e.result as TaskStatusUpdateEvent).final).length,
   ).toBe(1);
   expect(
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     events.findIndex((e) => (e.result as TaskStatusUpdateEvent).final),
   ).toBe(events.length - 1);
 }
@@ -167,11 +173,13 @@ export function assertTaskCreationAndWorkingStatus(
   events: SendStreamingMessageSuccessResponse[],
 ) {
   // Initial task creation event
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   const taskEvent = events[0].result as SDKTask;
   expect(taskEvent.kind).toBe('task');
   expect(taskEvent.status.state).toBe('submitted');
 
   // Status update: working
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   const workingEvent = events[1].result as TaskStatusUpdateEvent;
   expect(workingEvent.kind).toBe('status-update');
   expect(workingEvent.status.state).toBe('working');

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.29.0-nightly.20260203.71f46f116",
+  "version": "0.29.2",
   "description": "Gemini CLI",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "dist"
   ],
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.29.0-nightly.20260203.71f46f116"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.29.2"
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "^0.12.0",
@@ -34,8 +34,10 @@
     "@google/genai": "1.30.0",
     "@iarna/toml": "^2.2.5",
     "@modelcontextprotocol/sdk": "^1.23.0",
-    "@types/update-notifier": "^6.0.8",
+    "ansi-escapes": "^7.3.0",
     "ansi-regex": "^6.2.2",
+    "chalk": "^4.1.2",
+    "cli-spinners": "^2.9.2",
     "clipboardy": "^5.0.0",
     "color-convert": "^2.0.1",
     "command-exists": "^1.2.9",
@@ -54,8 +56,8 @@
     "mnemonist": "^0.40.3",
     "open": "^10.1.2",
     "prompts": "^2.4.2",
+    "proper-lockfile": "^4.1.2",
     "react": "^19.2.0",
-    "read-package-up": "^11.0.0",
     "shell-quote": "^1.8.3",
     "simple-git": "^3.28.0",
     "string-width": "^8.1.0",
@@ -64,27 +66,21 @@
     "tar": "^7.5.2",
     "tinygradient": "^1.1.5",
     "undici": "^7.10.0",
-    "wrap-ansi": "9.0.2",
+    "ws": "^8.16.0",
     "yargs": "^17.7.2",
     "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@babel/runtime": "^7.27.6",
     "@google/gemini-cli-test-utils": "file:../test-utils",
-    "@types/archiver": "^6.0.3",
     "@types/command-exists": "^1.2.3",
-    "@types/dotenv": "^6.1.1",
+    "@types/hast": "^3.0.4",
     "@types/node": "^20.11.24",
     "@types/react": "^19.2.0",
-    "@types/react-dom": "^19.2.0",
     "@types/semver": "^7.7.0",
     "@types/shell-quote": "^1.7.5",
-    "@types/tar": "^6.1.13",
+    "@types/ws": "^8.5.10",
     "@types/yargs": "^17.0.32",
-    "archiver": "^7.0.1",
     "ink-testing-library": "^4.0.0",
-    "pretty-format": "^30.0.2",
-    "react-dom": "^19.2.0",
     "typescript": "^5.3.3",
     "vitest": "^3.1.1"
   },

packages/cli/src/commands/extensions/configure.ts

@@ -71,6 +71,7 @@ export const configureCommand: CommandModule<object, ConfigureArgs> = {
         extensionManager,
         name,
         setting,
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         scope as ExtensionSettingScope,
       );
     }
@@ -79,6 +80,7 @@ export const configureCommand: CommandModule<object, ConfigureArgs> = {
       await configureExtension(
         extensionManager,
         name,
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         scope as ExtensionSettingScope,
       );
     }
@@ -86,6 +88,7 @@ export const configureCommand: CommandModule<object, ConfigureArgs> = {
     else {
       await configureAllExtensions(
         extensionManager,
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         scope as ExtensionSettingScope,
       );
     }

packages/cli/src/commands/extensions/disable.ts

@@ -79,7 +79,9 @@ export const disableCommand: CommandModule = {
       }),
   handler: async (argv) => {
     await handleDisable({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       name: argv['name'] as string,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       scope: argv['scope'] as string,
     });
     await exitCli();

packages/cli/src/commands/extensions/enable.ts

@@ -105,7 +105,9 @@ export const enableCommand: CommandModule = {
       }),
   handler: async (argv) => {
     await handleEnable({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       name: argv['name'] as string,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       scope: argv['scope'] as string,
     });
     await exitCli();

packages/cli/src/commands/extensions/install.ts

@@ -99,10 +99,15 @@ export const installCommand: CommandModule = {
       }),
   handler: async (argv) => {
     await handleInstall({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       source: argv['source'] as string,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       ref: argv['ref'] as string | undefined,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       autoUpdate: argv['auto-update'] as boolean | undefined,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       allowPreRelease: argv['pre-release'] as boolean | undefined,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       consent: argv['consent'] as boolean | undefined,
     });
     await exitCli();

packages/cli/src/commands/extensions/link.ts

@@ -79,7 +79,9 @@ export const linkCommand: CommandModule = {
       .check((_) => true),
   handler: async (argv) => {
     await handleLink({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       path: argv['path'] as string,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       consent: argv['consent'] as boolean | undefined,
     });
     await exitCli();

packages/cli/src/commands/extensions/list.ts

@@ -62,6 +62,7 @@ export const listCommand: CommandModule = {
     }),
   handler: async (argv) => {
     await handleList({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       outputFormat: argv['output-format'] as 'text' | 'json',
     });
     await exitCli();

packages/cli/src/commands/extensions/new.ts

@@ -98,7 +98,9 @@ export const newCommand: CommandModule = {
   },
   handler: async (args) => {
     await handleNew({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       path: args['path'] as string,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       template: args['template'] as string | undefined,
     });
     await exitCli();

packages/cli/src/commands/extensions/uninstall.ts

@@ -71,6 +71,7 @@ export const uninstallCommand: CommandModule = {
       }),
   handler: async (argv) => {
     await handleUninstall({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       names: argv['names'] as string[],
     });
     await exitCli();

packages/cli/src/commands/extensions/update.ts

@@ -155,7 +155,9 @@ export const updateCommand: CommandModule = {
       }),
   handler: async (argv) => {
     await handleUpdate({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       name: argv['name'] as string | undefined,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       all: argv['all'] as boolean | undefined,
     });
     await exitCli();

packages/cli/src/commands/extensions/validate.ts

@@ -100,6 +100,7 @@ export const validateCommand: CommandModule = {
     }),
   handler: async (args) => {
     await handleValidate({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       path: args['path'] as string,
     });
     await exitCli();

packages/cli/src/commands/hooks/migrate.ts

@@ -70,6 +70,7 @@ function migrateClaudeHook(claudeHook: unknown): unknown {
     return claudeHook;
   }
 
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   const hook = claudeHook as Record<string, unknown>;
   const migrated: Record<string, unknown> = {};
 
@@ -107,10 +108,12 @@ function migrateClaudeHooks(claudeConfig: unknown): Record<string, unknown> {
     return {};
   }
 
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   const config = claudeConfig as Record<string, unknown>;
   const geminiHooks: Record<string, unknown> = {};
 
   // Check if there's a hooks section
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   const hooksSection = config['hooks'] as Record<string, unknown> | undefined;
   if (!hooksSection || typeof hooksSection !== 'object') {
     return {};
@@ -130,6 +133,7 @@ function migrateClaudeHooks(claudeConfig: unknown): Record<string, unknown> {
         return def;
       }
 
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       const definition = def as Record<string, unknown>;
       const migratedDef: Record<string, unknown> = {};
 
@@ -179,6 +183,7 @@ export async function handleMigrateFromClaude() {
     sourceFile = claudeLocalSettingsPath;
     try {
       const content = fs.readFileSync(claudeLocalSettingsPath, 'utf-8');
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       claudeSettings = JSON.parse(stripJsonComments(content)) as Record<
         string,
         unknown
@@ -192,6 +197,7 @@ export async function handleMigrateFromClaude() {
     sourceFile = claudeSettingsPath;
     try {
       const content = fs.readFileSync(claudeSettingsPath, 'utf-8');
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       claudeSettings = JSON.parse(stripJsonComments(content)) as Record<
         string,
         unknown
@@ -259,6 +265,7 @@ export const migrateCommand: CommandModule = {
       default: false,
     }),
   handler: async (argv) => {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     const args = argv as unknown as MigrateArgs;
     if (args.fromClaude) {
       await handleMigrateFromClaude();

packages/cli/src/commands/mcp/add.ts

@@ -128,13 +128,6 @@ async function addMcpServer(
 
   settings.setValue(settingsScope, 'mcpServers', mcpServers);
 
-  if (transport === 'stdio') {
-    debugLogger.warn(
-      'Security Warning: Running MCP servers with stdio transport can expose inherited environment variables. ' +
-        'While the Gemini CLI redacts common API keys and secrets by default, you should only run servers from trusted sources.',
-    );
-  }
-
   if (isExistingServer) {
     debugLogger.log(`MCP server "${name}" updated in ${scope} settings.`);
   } else {
@@ -219,24 +212,38 @@ export const addCommand: CommandModule = {
       .middleware((argv) => {
         // Handle -- separator args as server args if present
         if (argv['--']) {
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
           const existingArgs = (argv['args'] as Array<string | number>) || [];
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
           argv['args'] = [...existingArgs, ...(argv['--'] as string[])];
         }
       }),
   handler: async (argv) => {
     await addMcpServer(
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       argv['name'] as string,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       argv['commandOrUrl'] as string,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       argv['args'] as Array<string | number>,
       {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         scope: argv['scope'] as string,
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         transport: argv['transport'] as string,
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         env: argv['env'] as string[],
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         header: argv['header'] as string[],
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         timeout: argv['timeout'] as number | undefined,
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         trust: argv['trust'] as boolean | undefined,
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         description: argv['description'] as string | undefined,
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         includeTools: argv['includeTools'] as string[] | undefined,
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         excludeTools: argv['excludeTools'] as string[] | undefined,
       },
     );

packages/cli/src/commands/mcp/list.test.ts

@@ -32,6 +32,7 @@ vi.mock('@google/gemini-cli-core', async (importOriginal) => {
   return {
     ...original,
     createTransport: vi.fn(),
+
     MCPServerStatus: {
       CONNECTED: 'CONNECTED',
       CONNECTING: 'CONNECTING',
@@ -223,4 +224,46 @@ describe('mcp list command', () => {
       ),
     );
   });
+
+  it('should filter servers based on admin allowlist passed in settings', async () => {
+    const settingsWithAllowlist = mergeSettings({}, {}, {}, {}, true);
+    settingsWithAllowlist.admin = {
+      secureModeEnabled: false,
+      extensions: { enabled: true },
+      skills: { enabled: true },
+      mcp: {
+        enabled: true,
+        config: {
+          'allowed-server': { url: 'http://allowed' },
+        },
+      },
+    };
+
+    settingsWithAllowlist.mcpServers = {
+      'allowed-server': { command: 'cmd1' },
+      'forbidden-server': { command: 'cmd2' },
+    };
+
+    mockedLoadSettings.mockReturnValue({
+      merged: settingsWithAllowlist,
+    });
+
+    mockClient.connect.mockResolvedValue(undefined);
+    mockClient.ping.mockResolvedValue(undefined);
+
+    await listMcpServers(settingsWithAllowlist);
+
+    expect(debugLogger.log).toHaveBeenCalledWith(
+      expect.stringContaining('allowed-server'),
+    );
+    expect(debugLogger.log).not.toHaveBeenCalledWith(
+      expect.stringContaining('forbidden-server'),
+    );
+    expect(mockedCreateTransport).toHaveBeenCalledWith(
+      'allowed-server',
+      expect.objectContaining({ url: 'http://allowed' }), // Should use admin config
+      false,
+      expect.anything(),
+    );
+  });
 });

packages/cli/src/commands/mcp/list.ts

@@ -6,12 +6,14 @@
 
 // File for 'gemini mcp list' command
 import type { CommandModule } from 'yargs';
-import { loadSettings } from '../../config/settings.js';
+import { type MergedSettings, loadSettings } from '../../config/settings.js';
 import type { MCPServerConfig } from '@google/gemini-cli-core';
 import {
   MCPServerStatus,
   createTransport,
   debugLogger,
+  applyAdminAllowlist,
+  getAdminBlockedMcpServersMessage,
 } from '@google/gemini-cli-core';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { ExtensionManager } from '../../config/extension-manager.js';
@@ -24,18 +26,24 @@ const COLOR_YELLOW = '\u001b[33m';
 const COLOR_RED = '\u001b[31m';
 const RESET_COLOR = '\u001b[0m';
 
-export async function getMcpServersFromConfig(): Promise<
-  Record<string, MCPServerConfig>
-> {
-  const settings = loadSettings();
+export async function getMcpServersFromConfig(
+  settings?: MergedSettings,
+): Promise<{
+  mcpServers: Record<string, MCPServerConfig>;
+  blockedServerNames: string[];
+}> {
+  if (!settings) {
+    settings = loadSettings().merged;
+  }
+
   const extensionManager = new ExtensionManager({
-    settings: settings.merged,
+    settings,
     workspaceDir: process.cwd(),
     requestConsent: requestConsentNonInteractive,
     requestSetting: promptForSetting,
   });
   const extensions = await extensionManager.loadExtensions();
-  const mcpServers = { ...settings.merged.mcpServers };
+  const mcpServers = { ...settings.mcpServers };
   for (const extension of extensions) {
     Object.entries(extension.mcpServers || {}).forEach(([key, server]) => {
       if (mcpServers[key]) {
@@ -47,7 +55,11 @@ export async function getMcpServersFromConfig(): Promise<
       };
     });
   }
-  return mcpServers;
+
+  const adminAllowlist = settings.admin?.mcp?.config;
+  const filteredResult = applyAdminAllowlist(mcpServers, adminAllowlist);
+
+  return filteredResult;
 }
 
 async function testMCPConnection(
@@ -103,12 +115,23 @@ async function getServerStatus(
   return testMCPConnection(serverName, server);
 }
 
-export async function listMcpServers(): Promise<void> {
-  const mcpServers = await getMcpServersFromConfig();
+export async function listMcpServers(settings?: MergedSettings): Promise<void> {
+  const { mcpServers, blockedServerNames } =
+    await getMcpServersFromConfig(settings);
   const serverNames = Object.keys(mcpServers);
 
+  if (blockedServerNames.length > 0) {
+    const message = getAdminBlockedMcpServersMessage(
+      blockedServerNames,
+      undefined,
+    );
+    debugLogger.log(COLOR_YELLOW + message + RESET_COLOR + '\n');
+  }
+
   if (serverNames.length === 0) {
-    debugLogger.log('No MCP servers configured.');
+    if (blockedServerNames.length === 0) {
+      debugLogger.log('No MCP servers configured.');
+    }
     return;
   }
 
@@ -154,11 +177,15 @@ export async function listMcpServers(): Promise<void> {
   }
 }
 
-export const listCommand: CommandModule = {
+interface ListArgs {
+  settings?: MergedSettings;
+}
+
+export const listCommand: CommandModule<object, ListArgs> = {
   command: 'list',
   describe: 'List all configured MCP servers',
-  handler: async () => {
-    await listMcpServers();
+  handler: async (argv) => {
+    await listMcpServers(argv.settings);
     await exitCli();
   },
 };

packages/cli/src/commands/mcp/remove.ts

@@ -55,7 +55,9 @@ export const removeCommand: CommandModule = {
         choices: ['user', 'project'],
       }),
   handler: async (argv) => {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     await removeMcpServer(argv['name'] as string, {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       scope: argv['scope'] as string,
     });
     await exitCli();

packages/cli/src/commands/skills/disable.ts

@@ -53,6 +53,7 @@ export const disableCommand: CommandModule = {
         ? SettingScope.Workspace
         : SettingScope.User;
     await handleDisable({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       name: argv['name'] as string,
       scope,
     });

packages/cli/src/commands/skills/enable.ts

@@ -40,6 +40,7 @@ export const enableCommand: CommandModule = {
     }),
   handler: async (argv) => {
     await handleEnable({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       name: argv['name'] as string,
     });
     await exitCli();

packages/cli/src/commands/skills/install.ts

@@ -102,9 +102,13 @@ export const installCommand: CommandModule = {
       }),
   handler: async (argv) => {
     await handleInstall({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       source: argv['source'] as string,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       scope: argv['scope'] as 'user' | 'workspace',
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       path: argv['path'] as string | undefined,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       consent: argv['consent'] as boolean | undefined,
     });
     await exitCli();

packages/cli/src/commands/skills/link.ts

@@ -84,8 +84,11 @@ export const linkCommand: CommandModule = {
       }),
   handler: async (argv) => {
     await handleLink({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       path: argv['path'] as string,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       scope: argv['scope'] as 'user' | 'workspace',
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       consent: argv['consent'] as boolean | undefined,
     });
     await exitCli();

packages/cli/src/commands/skills/list.ts

@@ -18,6 +18,7 @@ export async function handleList(args: { all?: boolean }) {
   const config = await loadCliConfig(
     settings.merged,
     'skills-list-session',
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     {
       debug: false,
     } as Partial<CliArgs> as CliArgs,
@@ -72,6 +73,7 @@ export const listCommand: CommandModule = {
       default: false,
     }),
   handler: async (argv) => {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     await handleList({ all: argv['all'] as boolean });
     await exitCli();
   },

packages/cli/src/commands/skills/uninstall.ts

@@ -64,7 +64,9 @@ export const uninstallCommand: CommandModule = {
       }),
   handler: async (argv) => {
     await handleUninstall({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       name: argv['name'] as string,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       scope: argv['scope'] as 'user' | 'workspace',
     });
     await exitCli();

packages/cli/src/config/config.test.ts

@@ -141,6 +141,22 @@ vi.mock('@google/gemini-cli-core', async () => {
       defaultDecision: ServerConfig.PolicyDecision.ASK_USER,
       approvalMode: ServerConfig.ApprovalMode.DEFAULT,
     })),
+    isHeadlessMode: vi.fn((opts) => {
+      if (process.env['VITEST'] === 'true') {
+        return (
+          !!opts?.prompt ||
+          (!!process.stdin && !process.stdin.isTTY) ||
+          (!!process.stdout && !process.stdout.isTTY)
+        );
+      }
+      return (
+        !!opts?.prompt ||
+        process.env['CI'] === 'true' ||
+        process.env['GITHUB_ACTIONS'] === 'true' ||
+        (!!process.stdin && !process.stdin.isTTY) ||
+        (!!process.stdout && !process.stdout.isTTY)
+      );
+    }),
   };
 });
 
@@ -154,6 +170,8 @@ vi.mock('./extension-manager.js', () => {
 // Global setup to ensure clean environment for all tests in this file
 const originalArgv = process.argv;
 const originalGeminiModel = process.env['GEMINI_MODEL'];
+const originalStdoutIsTTY = process.stdout.isTTY;
+const originalStdinIsTTY = process.stdin.isTTY;
 
 beforeEach(() => {
   delete process.env['GEMINI_MODEL'];
@@ -162,6 +180,18 @@ beforeEach(() => {
   ExtensionManager.prototype.loadExtensions = vi
     .fn()
     .mockResolvedValue(undefined);
+
+  // Default to interactive mode for tests unless otherwise specified
+  Object.defineProperty(process.stdout, 'isTTY', {
+    value: true,
+    configurable: true,
+    writable: true,
+  });
+  Object.defineProperty(process.stdin, 'isTTY', {
+    value: true,
+    configurable: true,
+    writable: true,
+  });
 });
 
 afterEach(() => {
@@ -171,6 +201,16 @@ afterEach(() => {
   } else {
     delete process.env['GEMINI_MODEL'];
   }
+  Object.defineProperty(process.stdout, 'isTTY', {
+    value: originalStdoutIsTTY,
+    configurable: true,
+    writable: true,
+  });
+  Object.defineProperty(process.stdin, 'isTTY', {
+    value: originalStdinIsTTY,
+    configurable: true,
+    writable: true,
+  });
 });
 
 describe('parseArguments', () => {
@@ -249,6 +289,16 @@ describe('parseArguments', () => {
   });
 
   describe('positional arguments and @commands', () => {
+    beforeEach(() => {
+      // Default to headless mode for these tests as they mostly expect one-shot behavior
+      process.stdin.isTTY = false;
+      Object.defineProperty(process.stdout, 'isTTY', {
+        value: false,
+        configurable: true,
+        writable: true,
+      });
+    });
+
     it.each([
       {
         description:
@@ -379,8 +429,12 @@ describe('parseArguments', () => {
     );
 
     it('should include a startup message when converting positional query to interactive prompt', async () => {
-      const originalIsTTY = process.stdin.isTTY;
       process.stdin.isTTY = true;
+      Object.defineProperty(process.stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+        writable: true,
+      });
       process.argv = ['node', 'script.js', 'hello'];
 
       try {
@@ -389,7 +443,7 @@ describe('parseArguments', () => {
           'Positional arguments now default to interactive mode. To run in non-interactive mode, use the --prompt (-p) flag.',
         );
       } finally {
-        process.stdin.isTTY = originalIsTTY;
+        // beforeEach handles resetting
       }
     });
   });
@@ -1511,7 +1565,7 @@ describe('loadCliConfig with admin.mcp.config', () => {
     });
     const config = await loadCliConfig(settings, 'test-session', argv);
 
-    const mergedServers = config.getMcpServers();
+    const mergedServers = config.getMcpServers() ?? {};
     expect(mergedServers).toHaveProperty('serverA');
     expect(mergedServers).not.toHaveProperty('serverB');
   });
@@ -1569,9 +1623,9 @@ describe('loadCliConfig with admin.mcp.config', () => {
     });
     const config = await loadCliConfig(settings, 'test-session', argv);
 
-    const mergedServers = config.getMcpServers();
+    const mergedServers = config.getMcpServers() ?? {};
     expect(mergedServers).not.toHaveProperty('serverC');
-    expect(Object.keys(mergedServers || {})).toHaveLength(0);
+    expect(Object.keys(mergedServers)).toHaveLength(0);
   });
 
   it('should merge local fields and prefer admin tool filters', async () => {
@@ -1601,7 +1655,7 @@ describe('loadCliConfig with admin.mcp.config', () => {
     });
     const config = await loadCliConfig(settings, 'test-session', argv);
 
-    const serverA = config.getMcpServers()?.['serverA'];
+    const serverA = (config.getMcpServers() ?? {})['serverA'];
     expect(serverA).toMatchObject({
       timeout: 1234,
       includeTools: ['admin_tool'],
@@ -1683,7 +1737,7 @@ describe('loadCliConfig model selection', () => {
       argv,
     );
 
-    expect(config.getModel()).toBe('auto-gemini-2.5');
+    expect(config.getModel()).toBe('auto-gemini-3');
   });
 
   it('always prefers model from argv', async () => {
@@ -1727,19 +1781,34 @@ describe('loadCliConfig model selection', () => {
       argv,
     );
 
-    expect(config.getModel()).toBe('auto-gemini-2.5');
+    expect(config.getModel()).toBe('auto-gemini-3');
   });
 });
 
 describe('loadCliConfig folderTrust', () => {
+  let originalVitest: string | undefined;
+  let originalIntegrationTest: string | undefined;
+
   beforeEach(() => {
     vi.resetAllMocks();
     vi.mocked(os.homedir).mockReturnValue('/mock/home/user');
     vi.stubEnv('GEMINI_API_KEY', 'test-api-key');
     vi.spyOn(ExtensionManager.prototype, 'getExtensions').mockReturnValue([]);
+
+    originalVitest = process.env['VITEST'];
+    originalIntegrationTest = process.env['GEMINI_CLI_INTEGRATION_TEST'];
+    delete process.env['VITEST'];
+    delete process.env['GEMINI_CLI_INTEGRATION_TEST'];
   });
 
   afterEach(() => {
+    if (originalVitest !== undefined) {
+      process.env['VITEST'] = originalVitest;
+    }
+    if (originalIntegrationTest !== undefined) {
+      process.env['GEMINI_CLI_INTEGRATION_TEST'] = originalIntegrationTest;
+    }
+
     vi.unstubAllEnvs();
     vi.restoreAllMocks();
   });
@@ -1798,10 +1867,11 @@ describe('loadCliConfig with includeDirectories', () => {
     vi.restoreAllMocks();
   });
 
-  it('should combine and resolve paths from settings and CLI arguments', async () => {
+  it.skip('should combine and resolve paths from settings and CLI arguments', async () => {
     const mockCwd = path.resolve(path.sep, 'home', 'user', 'project');
     process.argv = [
       'node',
+
       'script.js',
       '--include-directories',
       `${path.resolve(path.sep, 'cli', 'path1')},${path.join(mockCwd, 'cli', 'path2')}`,
@@ -2555,7 +2625,7 @@ describe('loadCliConfig approval mode', () => {
     it('should use approvalMode from settings when no CLI flags are set', async () => {
       process.argv = ['node', 'script.js'];
       const settings = createTestMergedSettings({
-        tools: { approvalMode: 'auto_edit' },
+        general: { defaultApprovalMode: 'auto_edit' },
       });
       const argv = await parseArguments(settings);
       const config = await loadCliConfig(settings, 'test-session', argv);
@@ -2567,7 +2637,7 @@ describe('loadCliConfig approval mode', () => {
     it('should prioritize --approval-mode flag over settings', async () => {
       process.argv = ['node', 'script.js', '--approval-mode', 'auto_edit'];
       const settings = createTestMergedSettings({
-        tools: { approvalMode: 'default' },
+        general: { defaultApprovalMode: 'default' },
       });
       const argv = await parseArguments(settings);
       const config = await loadCliConfig(settings, 'test-session', argv);
@@ -2579,7 +2649,7 @@ describe('loadCliConfig approval mode', () => {
     it('should prioritize --yolo flag over settings', async () => {
       process.argv = ['node', 'script.js', '--yolo'];
       const settings = createTestMergedSettings({
-        tools: { approvalMode: 'auto_edit' },
+        general: { defaultApprovalMode: 'auto_edit' },
       });
       const argv = await parseArguments(settings);
       const config = await loadCliConfig(settings, 'test-session', argv);
@@ -2589,7 +2659,7 @@ describe('loadCliConfig approval mode', () => {
     it('should respect plan mode from settings when experimental.plan is enabled', async () => {
       process.argv = ['node', 'script.js'];
       const settings = createTestMergedSettings({
-        tools: { approvalMode: 'plan' },
+        general: { defaultApprovalMode: 'plan' },
         experimental: { plan: true },
       });
       const argv = await parseArguments(settings);
@@ -2600,7 +2670,7 @@ describe('loadCliConfig approval mode', () => {
     it('should throw error if plan mode is in settings but experimental.plan is disabled', async () => {
       process.argv = ['node', 'script.js'];
       const settings = createTestMergedSettings({
-        tools: { approvalMode: 'plan' },
+        general: { defaultApprovalMode: 'plan' },
         experimental: { plan: false },
       });
       const argv = await parseArguments(settings);
@@ -2779,6 +2849,16 @@ describe('Output format', () => {
 describe('parseArguments with positional prompt', () => {
   const originalArgv = process.argv;
 
+  beforeEach(() => {
+    // Default to headless mode for these tests as they mostly expect one-shot behavior
+    process.stdin.isTTY = false;
+    Object.defineProperty(process.stdout, 'isTTY', {
+      value: false,
+      configurable: true,
+      writable: true,
+    });
+  });
+
   afterEach(() => {
     process.argv = originalArgv;
   });

packages/cli/src/config/config.ts

@@ -15,7 +15,6 @@ import {
   setGeminiMdFilename as setServerGeminiMdFilename,
   getCurrentGeminiMdFilename,
   ApprovalMode,
-  DEFAULT_GEMINI_MODEL_AUTO,
   DEFAULT_GEMINI_EMBEDDING_MODEL,
   DEFAULT_FILE_FILTERING_OPTIONS,
   DEFAULT_MEMORY_FILE_FILTERING_OPTIONS,
@@ -33,16 +32,17 @@ import {
   ASK_USER_TOOL_NAME,
   getVersion,
   PREVIEW_GEMINI_MODEL_AUTO,
+  type HierarchicalMemory,
   coreEvents,
   GEMINI_MODEL_ALIAS_AUTO,
   getAdminErrorMessage,
+  isHeadlessMode,
   Config,
-} from '@google/gemini-cli-core';
-import type {
-  MCPServerConfig,
-  HookDefinition,
-  HookEventName,
-  OutputFormat,
+  applyAdminAllowlist,
+  getAdminBlockedMcpServersMessage,
+  type HookDefinition,
+  type HookEventName,
+  type OutputFormat,
 } from '@google/gemini-cli-core';
 import {
   type Settings,
@@ -280,6 +280,7 @@ export async function parseArguments(
     .check((argv) => {
       // The 'query' positional can be a string (for one arg) or string[] (for multiple).
       // This guard safely checks if any positional argument was provided.
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       const query = argv['query'] as string | string[] | undefined;
       const hasPositionalQuery = Array.isArray(query)
         ? query.length > 0
@@ -297,6 +298,7 @@ export async function parseArguments(
       if (
         argv['outputFormat'] &&
         !['text', 'json', 'stream-json'].includes(
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
           argv['outputFormat'] as string,
         )
       ) {
@@ -345,6 +347,7 @@ export async function parseArguments(
   }
 
   // Normalize query args: handle both quoted "@path file" and unquoted @path file
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   const queryArg = (result as { query?: string | string[] | undefined }).query;
   const q: string | undefined = Array.isArray(queryArg)
     ? queryArg.join(' ')
@@ -352,7 +355,7 @@ export async function parseArguments(
 
   // -p/--prompt forces non-interactive mode; positional args default to interactive in TTY
   if (q && !result['prompt']) {
-    if (process.stdin.isTTY) {
+    if (!isHeadlessMode()) {
       startupMessages.push(
         'Positional arguments now default to interactive mode. To run in non-interactive mode, use the --prompt (-p) flag.',
       );
@@ -368,6 +371,7 @@ export async function parseArguments(
 
   // The import format is now only controlled by settings.memoryImportFormat
   // We no longer accept it as a CLI argument
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   return result as unknown as CliArgs;
 }
 
@@ -436,8 +440,16 @@ export async function loadCliConfig(
 
   const ideMode = settings.ide?.enabled ?? false;
 
-  const folderTrust = settings.security?.folderTrust?.enabled ?? false;
-  const trustedFolder = isWorkspaceTrusted(settings, cwd)?.isTrusted ?? false;
+  const folderTrust =
+    process.env['GEMINI_CLI_INTEGRATION_TEST'] === 'true' ||
+    process.env['VITEST'] === 'true'
+      ? false
+      : (settings.security?.folderTrust?.enabled ?? false);
+  const trustedFolder =
+    isWorkspaceTrusted(settings, cwd, undefined, {
+      prompt: argv.prompt,
+      query: argv.query,
+    })?.isTrusted ?? false;
 
   // Set the context filename in the server's memoryTool module BEFORE loading memory
   // TODO(b/343434939): This is a bit of a hack. The contextFileName should ideally be passed
@@ -472,6 +484,7 @@ export async function loadCliConfig(
     requestSetting: promptForSetting,
     workspaceDir: cwd,
     enabledExtensionOverrides: argv.extensions,
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     eventEmitter: coreEvents as EventEmitter<ExtensionEvents>,
     clientVersion: await getVersion(),
   });
@@ -479,7 +492,7 @@ export async function loadCliConfig(
 
   const experimentalJitContext = settings.experimental?.jitContext ?? false;
 
-  let memoryContent = '';
+  let memoryContent: string | HierarchicalMemory = '';
   let fileCount = 0;
   let filePaths: string[] = [];
 
@@ -510,8 +523,8 @@ export async function loadCliConfig(
   const rawApprovalMode =
     argv.approvalMode ||
     (argv.yolo ? 'yolo' : undefined) ||
-    ((settings.tools?.approvalMode as string) !== 'yolo'
-      ? settings.tools.approvalMode
+    ((settings.general?.defaultApprovalMode as string) !== 'yolo'
+      ? settings.general?.defaultApprovalMode
       : undefined);
 
   if (rawApprovalMode) {
@@ -575,6 +588,7 @@ export async function loadCliConfig(
   let telemetrySettings;
   try {
     telemetrySettings = await resolveTelemetrySettings({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       env: process.env as unknown as Record<string, string | undefined>,
       settings: settings.telemetry,
     });
@@ -592,7 +606,8 @@ export async function loadCliConfig(
   const interactive =
     !!argv.promptInteractive ||
     !!argv.experimentalAcp ||
-    (process.stdin.isTTY && !argv.query && !argv.prompt && !argv.isCommand);
+    (!isHeadlessMode({ prompt: argv.prompt, query: argv.query }) &&
+      !argv.isCommand);
 
   const allowedTools = argv.allowedTools || settings.tools?.allowed || [];
   const allowedToolsSet = new Set(allowedTools);
@@ -662,9 +677,7 @@ export async function loadCliConfig(
   );
   policyEngineConfig.nonInteractive = !interactive;
 
-  const defaultModel = settings.general?.previewFeatures
-    ? PREVIEW_GEMINI_MODEL_AUTO
-    : DEFAULT_GEMINI_MODEL_AUTO;
+  const defaultModel = PREVIEW_GEMINI_MODEL_AUTO;
   const specifiedModel =
     argv.model || process.env['GEMINI_MODEL'] || settings.model?.name;
 
@@ -695,38 +708,17 @@ export async function loadCliConfig(
   let mcpServers = mcpEnabled ? settings.mcpServers : {};
 
   if (mcpEnabled && adminAllowlist && Object.keys(adminAllowlist).length > 0) {
-    const filteredMcpServers: Record<string, MCPServerConfig> = {};
-    for (const [serverId, localConfig] of Object.entries(mcpServers)) {
-      const adminConfig = adminAllowlist[serverId];
-      if (adminConfig) {
-        const mergedConfig = {
-          ...localConfig,
-          url: adminConfig.url,
-          type: adminConfig.type,
-          trust: adminConfig.trust,
-        };
-
-        // Remove local connection details
-        delete mergedConfig.command;
-        delete mergedConfig.args;
-        delete mergedConfig.env;
-        delete mergedConfig.cwd;
-        delete mergedConfig.httpUrl;
-        delete mergedConfig.tcp;
-
-        if (
-          (adminConfig.includeTools && adminConfig.includeTools.length > 0) ||
-          (adminConfig.excludeTools && adminConfig.excludeTools.length > 0)
-        ) {
-          mergedConfig.includeTools = adminConfig.includeTools;
-          mergedConfig.excludeTools = adminConfig.excludeTools;
-        }
-
-        filteredMcpServers[serverId] = mergedConfig;
-      }
-    }
-    mcpServers = filteredMcpServers;
+    const result = applyAdminAllowlist(mcpServers, adminAllowlist);
+    mcpServers = result.mcpServers;
     mcpServerCommand = undefined;
+
+    if (result.blockedServerNames && result.blockedServerNames.length > 0) {
+      const message = getAdminBlockedMcpServersMessage(
+        result.blockedServerNames,
+        undefined,
+      );
+      coreEvents.emitConsoleLog('warn', message);
+    }
   }
 
   return new Config({
@@ -740,7 +732,6 @@ export async function loadCliConfig(
       settings.context?.loadMemoryFromIncludeDirectories || false,
     debugMode,
     question,
-    previewFeatures: settings.general?.previewFeatures,
 
     coreTools: settings.tools?.core || undefined,
     allowedTools: allowedTools.length > 0 ? allowedTools : undefined,
@@ -801,8 +792,7 @@ export async function loadCliConfig(
     enableExtensionReloading: settings.experimental?.extensionReloading,
     enableAgents: settings.experimental?.enableAgents,
     plan: settings.experimental?.plan,
-    enableEventDrivenScheduler:
-      settings.experimental?.enableEventDrivenScheduler,
+    enableEventDrivenScheduler: true,
     skillsSupport: settings.skills?.enabled ?? true,
     disabledSkills: settings.skills?.disabled,
     experimentalJitContext: settings.experimental?.jitContext,
@@ -824,11 +814,10 @@ export async function loadCliConfig(
     skipNextSpeakerCheck: settings.model?.skipNextSpeakerCheck,
     enablePromptCompletion: settings.general?.enablePromptCompletion,
     truncateToolOutputThreshold: settings.tools?.truncateToolOutputThreshold,
-    truncateToolOutputLines: settings.tools?.truncateToolOutputLines,
-    enableToolOutputTruncation: settings.tools?.enableToolOutputTruncation,
     eventEmitter: coreEvents,
     useWriteTodos: argv.useWriteTodos ?? settings.useWriteTodos,
     output: {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       format: (argv.outputFormat ?? settings.output?.format) as OutputFormat,
     },
     fakeResponses: argv.fakeResponses,

packages/cli/src/config/extension-manager-themes.spec.ts

@@ -16,10 +16,11 @@ import {
   vi,
   afterEach,
 } from 'vitest';
+
 import { createExtension } from '../test-utils/createExtension.js';
 import { ExtensionManager } from './extension-manager.js';
 import { themeManager, DEFAULT_THEME } from '../ui/themes/theme-manager.js';
-import { GEMINI_DIR, type Config } from '@google/gemini-cli-core';
+import { GEMINI_DIR, type Config, tmpdir } from '@google/gemini-cli-core';
 import { createTestMergedSettings, SettingScope } from './settings.js';
 
 describe('ExtensionManager theme loading', () => {
@@ -29,7 +30,7 @@ describe('ExtensionManager theme loading', () => {
 
   beforeAll(async () => {
     tempHomeDir = await fs.promises.mkdtemp(
-      path.join(fs.realpathSync('/tmp'), 'gemini-cli-test-'),
+      path.join(tmpdir(), 'gemini-cli-test-'),
     );
   });
 
@@ -85,6 +86,7 @@ describe('ExtensionManager theme loading', () => {
 
     await extensionManager.loadExtensions();
 
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     const mockConfig = {
       getEnableExtensionReloading: () => false,
       getMcpClientManager: () => ({
@@ -170,6 +172,7 @@ describe('ExtensionManager theme loading', () => {
 
     await extensionManager.loadExtensions();
 
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     const mockConfig = {
       getWorkingDir: () => tempHomeDir,
       shouldLoadMemoryFromIncludeDirectories: () => false,

packages/cli/src/config/extension-manager.ts

@@ -48,6 +48,8 @@ import {
   type HookEventName,
   type ResolvedExtensionSetting,
   coreEvents,
+  applyAdminAllowlist,
+  getAdminBlockedMcpServersMessage,
 } from '@google/gemini-cli-core';
 import { maybeRequestConsentOrFail } from './extensions/consent.js';
 import { resolveEnvVarsInObject } from '../utils/envVarResolver.js';
@@ -186,7 +188,10 @@ export class ExtensionManager extends ExtensionLoader {
           )
         ) {
           const trustedFolders = loadTrustedFolders();
-          trustedFolders.setValue(this.workspaceDir, TrustLevel.TRUST_FOLDER);
+          await trustedFolders.setValue(
+            this.workspaceDir,
+            TrustLevel.TRUST_FOLDER,
+          );
         } else {
           throw new Error(
             `Could not install extension because the current workspace at ${this.workspaceDir} is not trusted.`,
@@ -661,12 +666,33 @@ Would you like to attempt to install via "git clone" instead?`,
         if (this.settings.admin.mcp.enabled === false) {
           config.mcpServers = undefined;
         } else {
-          config.mcpServers = Object.fromEntries(
-            Object.entries(config.mcpServers).map(([key, value]) => [
-              key,
-              filterMcpConfig(value),
-            ]),
-          );
+          // Apply admin allowlist if configured
+          const adminAllowlist = this.settings.admin.mcp.config;
+          if (adminAllowlist && Object.keys(adminAllowlist).length > 0) {
+            const result = applyAdminAllowlist(
+              config.mcpServers,
+              adminAllowlist,
+            );
+            config.mcpServers = result.mcpServers;
+
+            if (result.blockedServerNames.length > 0) {
+              const message = getAdminBlockedMcpServersMessage(
+                result.blockedServerNames,
+                undefined,
+              );
+              coreEvents.emitConsoleLog('warn', message);
+            }
+          }
+
+          // Then apply local filtering/sanitization
+          if (config.mcpServers) {
+            config.mcpServers = Object.fromEntries(
+              Object.entries(config.mcpServers).map(([key, value]) => [
+                key,
+                filterMcpConfig(value),
+              ]),
+            );
+          }
         }
       }
 
@@ -704,6 +730,7 @@ Would you like to attempt to install via "git clone" instead?`,
 
         if (Object.keys(hookEnv).length > 0) {
           for (const eventName of Object.keys(hooks)) {
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
             const eventHooks = hooks[eventName as HookEventName];
             if (eventHooks) {
               for (const definition of eventHooks) {
@@ -800,13 +827,16 @@ Would you like to attempt to install via "git clone" instead?`,
     }
     try {
       const configContent = await fs.promises.readFile(configFilePath, 'utf-8');
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       const rawConfig = JSON.parse(configContent) as ExtensionConfig;
       if (!rawConfig.name || !rawConfig.version) {
         throw new Error(
           `Invalid configuration in ${configFilePath}: missing ${!rawConfig.name ? '"name"' : '"version"'}`,
         );
       }
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       const config = recursivelyHydrateStrings(
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         rawConfig as unknown as JsonObject,
         {
           extensionPath: extensionDir,
@@ -852,6 +882,7 @@ Would you like to attempt to install via "git clone" instead?`,
 
       // Hydrate variables in the hooks configuration
       const hydratedHooks = recursivelyHydrateStrings(
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         rawHooks.hooks as unknown as JsonObject,
         {
           ...context,
@@ -862,6 +893,7 @@ Would you like to attempt to install via "git clone" instead?`,
 
       return hydratedHooks;
     } catch (e) {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       if ((e as NodeJS.ErrnoException).code === 'ENOENT') {
         return undefined; // File not found is not an error here.
       }

packages/cli/src/config/extension.ts

@@ -47,6 +47,7 @@ export function loadInstallMetadata(
   const metadataFilePath = path.join(extensionDir, INSTALL_METADATA_FILENAME);
   try {
     const configContent = fs.readFileSync(metadataFilePath, 'utf-8');
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     const metadata = JSON.parse(configContent) as ExtensionInstallMetadata;
     return metadata;
   } catch (_e) {

packages/cli/src/config/extensionRegistryClient.test.ts

@@ -0,0 +1,227 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import {
+  describe,
+  it,
+  expect,
+  vi,
+  beforeEach,
+  afterEach,
+  type Mock,
+} from 'vitest';
+import {
+  ExtensionRegistryClient,
+  type RegistryExtension,
+} from './extensionRegistryClient.js';
+import { fetchWithTimeout } from '@google/gemini-cli-core';
+
+vi.mock('@google/gemini-cli-core', () => ({
+  fetchWithTimeout: vi.fn(),
+}));
+
+const mockExtensions: RegistryExtension[] = [
+  {
+    id: 'ext1',
+    rank: 1,
+    url: 'https://github.com/test/ext1',
+    fullName: 'test/ext1',
+    repoDescription: 'Test extension 1',
+    stars: 100,
+    lastUpdated: '2025-01-01T00:00:00Z',
+    extensionName: 'extension-one',
+    extensionVersion: '1.0.0',
+    extensionDescription: 'First test extension',
+    avatarUrl: 'https://example.com/avatar1.png',
+    hasMCP: true,
+    hasContext: false,
+    isGoogleOwned: false,
+    licenseKey: 'mit',
+    hasHooks: false,
+    hasCustomCommands: false,
+    hasSkills: false,
+  },
+  {
+    id: 'ext2',
+    rank: 2,
+    url: 'https://github.com/test/ext2',
+    fullName: 'test/ext2',
+    repoDescription: 'Test extension 2',
+    stars: 50,
+    lastUpdated: '2025-01-02T00:00:00Z',
+    extensionName: 'extension-two',
+    extensionVersion: '0.5.0',
+    extensionDescription: 'Second test extension',
+    avatarUrl: 'https://example.com/avatar2.png',
+    hasMCP: false,
+    hasContext: true,
+    isGoogleOwned: true,
+    licenseKey: 'apache-2.0',
+    hasHooks: false,
+    hasCustomCommands: false,
+    hasSkills: false,
+  },
+  {
+    id: 'ext3',
+    rank: 3,
+    url: 'https://github.com/test/ext3',
+    fullName: 'test/ext3',
+    repoDescription: 'Test extension 3',
+    stars: 10,
+    lastUpdated: '2025-01-03T00:00:00Z',
+    extensionName: 'extension-three',
+    extensionVersion: '0.1.0',
+    extensionDescription: 'Third test extension',
+    avatarUrl: 'https://example.com/avatar3.png',
+    hasMCP: true,
+    hasContext: true,
+    isGoogleOwned: false,
+    licenseKey: 'gpl-3.0',
+    hasHooks: false,
+    hasCustomCommands: false,
+    hasSkills: false,
+  },
+];
+
+describe('ExtensionRegistryClient', () => {
+  let client: ExtensionRegistryClient;
+  let fetchMock: Mock;
+
+  beforeEach(() => {
+    ExtensionRegistryClient.resetCache();
+    client = new ExtensionRegistryClient();
+    fetchMock = fetchWithTimeout as Mock;
+    fetchMock.mockReset();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('should fetch and return extensions with pagination (default ranking)', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      json: async () => mockExtensions,
+    });
+
+    const result = await client.getExtensions(1, 2);
+    expect(result.extensions).toHaveLength(2);
+    expect(result.extensions[0].id).toBe('ext1'); // rank 1
+    expect(result.extensions[1].id).toBe('ext2'); // rank 2
+    expect(result.total).toBe(3);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://geminicli.com/extensions.json',
+      10000,
+    );
+  });
+
+  it('should return extensions sorted alphabetically', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      json: async () => mockExtensions,
+    });
+
+    const result = await client.getExtensions(1, 3, 'alphabetical');
+    expect(result.extensions).toHaveLength(3);
+    expect(result.extensions[0].id).toBe('ext1');
+    expect(result.extensions[1].id).toBe('ext3');
+    expect(result.extensions[2].id).toBe('ext2');
+  });
+
+  it('should return the second page of extensions', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      json: async () => mockExtensions,
+    });
+
+    const result = await client.getExtensions(2, 2);
+    expect(result.extensions).toHaveLength(1);
+    expect(result.extensions[0].id).toBe('ext3');
+    expect(result.total).toBe(3);
+  });
+
+  it('should search extensions by name', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      json: async () => mockExtensions,
+    });
+
+    const results = await client.searchExtensions('one');
+    expect(results.length).toBeGreaterThanOrEqual(1);
+    expect(results[0].id).toBe('ext1');
+  });
+
+  it('should search extensions by description', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      json: async () => mockExtensions,
+    });
+
+    const results = await client.searchExtensions('Second');
+    expect(results.length).toBeGreaterThanOrEqual(1);
+    expect(results[0].id).toBe('ext2');
+  });
+
+  it('should get an extension by ID', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      json: async () => mockExtensions,
+    });
+
+    const result = await client.getExtension('ext2');
+    expect(result).toBeDefined();
+    expect(result?.id).toBe('ext2');
+  });
+
+  it('should return undefined if extension not found', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      json: async () => mockExtensions,
+    });
+
+    const result = await client.getExtension('non-existent');
+    expect(result).toBeUndefined();
+  });
+
+  it('should cache the fetch result', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      json: async () => mockExtensions,
+    });
+
+    await client.getExtensions();
+    await client.getExtensions();
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('should share the fetch result across instances', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      json: async () => mockExtensions,
+    });
+
+    const client1 = new ExtensionRegistryClient();
+    const client2 = new ExtensionRegistryClient();
+
+    await client1.getExtensions();
+    await client2.getExtensions();
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('should throw an error if fetch fails', async () => {
+    fetchMock.mockResolvedValue({
+      ok: false,
+      statusText: 'Not Found',
+    });
+
+    await expect(client.getExtensions()).rejects.toThrow(
+      'Failed to fetch extensions: Not Found',
+    );
+  });
+});

packages/cli/src/config/extensionRegistryClient.ts

@@ -0,0 +1,119 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { fetchWithTimeout } from '@google/gemini-cli-core';
+import { AsyncFzf } from 'fzf';
+
+export interface RegistryExtension {
+  id: string;
+  rank: number;
+  url: string;
+  fullName: string;
+  repoDescription: string;
+  stars: number;
+  lastUpdated: string;
+  extensionName: string;
+  extensionVersion: string;
+  extensionDescription: string;
+  avatarUrl: string;
+  hasMCP: boolean;
+  hasContext: boolean;
+  hasHooks: boolean;
+  hasSkills: boolean;
+  hasCustomCommands: boolean;
+  isGoogleOwned: boolean;
+  licenseKey: string;
+}
+
+export class ExtensionRegistryClient {
+  private static readonly REGISTRY_URL =
+    'https://geminicli.com/extensions.json';
+  private static readonly FETCH_TIMEOUT_MS = 10000; // 10 seconds
+
+  private static fetchPromise: Promise<RegistryExtension[]> | null = null;
+
+  /** @internal */
+  static resetCache() {
+    ExtensionRegistryClient.fetchPromise = null;
+  }
+
+  async getExtensions(
+    page: number = 1,
+    limit: number = 10,
+    orderBy: 'ranking' | 'alphabetical' = 'ranking',
+  ): Promise<{ extensions: RegistryExtension[]; total: number }> {
+    const allExtensions = [...(await this.fetchAllExtensions())];
+
+    switch (orderBy) {
+      case 'ranking':
+        allExtensions.sort((a, b) => a.rank - b.rank);
+        break;
+      case 'alphabetical':
+        allExtensions.sort((a, b) =>
+          a.extensionName.localeCompare(b.extensionName),
+        );
+        break;
+      default: {
+        const _exhaustiveCheck: never = orderBy;
+        throw new Error(`Unhandled orderBy: ${_exhaustiveCheck}`);
+      }
+    }
+
+    const startIndex = (page - 1) * limit;
+    const endIndex = startIndex + limit;
+    return {
+      extensions: allExtensions.slice(startIndex, endIndex),
+      total: allExtensions.length,
+    };
+  }
+
+  async searchExtensions(query: string): Promise<RegistryExtension[]> {
+    const allExtensions = await this.fetchAllExtensions();
+    if (!query.trim()) {
+      return allExtensions;
+    }
+
+    const fzf = new AsyncFzf(allExtensions, {
+      selector: (ext: RegistryExtension) =>
+        `${ext.extensionName} ${ext.extensionDescription} ${ext.fullName}`,
+      fuzzy: 'v2',
+    });
+    const results = await fzf.find(query);
+    return results.map((r: { item: RegistryExtension }) => r.item);
+  }
+
+  async getExtension(id: string): Promise<RegistryExtension | undefined> {
+    const allExtensions = await this.fetchAllExtensions();
+    return allExtensions.find((ext) => ext.id === id);
+  }
+
+  private async fetchAllExtensions(): Promise<RegistryExtension[]> {
+    if (ExtensionRegistryClient.fetchPromise) {
+      return ExtensionRegistryClient.fetchPromise;
+    }
+
+    ExtensionRegistryClient.fetchPromise = (async () => {
+      try {
+        const response = await fetchWithTimeout(
+          ExtensionRegistryClient.REGISTRY_URL,
+          ExtensionRegistryClient.FETCH_TIMEOUT_MS,
+        );
+        if (!response.ok) {
+          throw new Error(`Failed to fetch extensions: ${response.statusText}`);
+        }
+
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+        return (await response.json()) as RegistryExtension[];
+      } catch (error) {
+        // Clear the promise on failure so that subsequent calls can try again
+        ExtensionRegistryClient.fetchPromise = null;
+        throw error;
+      }
+    })();
+
+    return ExtensionRegistryClient.fetchPromise;
+  }
+}

packages/cli/src/config/extensions/extensionUpdates.test.ts

@@ -5,23 +5,20 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import * as path from 'node:path';
-import * as os from 'node:os';
 import * as fs from 'node:fs';
 import { getMissingSettings } from './extensionSettings.js';
 import type { ExtensionConfig } from '../extension.js';
-import { ExtensionStorage } from './storage.js';
 import {
-  KeychainTokenStorage,
   debugLogger,
   type ExtensionInstallMetadata,
   type GeminiCLIExtension,
   coreEvents,
 } from '@google/gemini-cli-core';
-import { EXTENSION_SETTINGS_FILENAME } from './variables.js';
 import { ExtensionManager } from '../extension-manager.js';
 import { createTestMergedSettings } from '../settings.js';
 
+// --- Mocks ---
+
 vi.mock('node:fs', async (importOriginal) => {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const actual = await importOriginal<any>();
@@ -29,11 +26,23 @@ vi.mock('node:fs', async (importOriginal) => {
     ...actual,
     default: {
       ...actual.default,
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      existsSync: vi.fn((...args: any[]) => actual.existsSync(...args)),
+      existsSync: vi.fn(),
+      statSync: vi.fn(),
+      lstatSync: vi.fn(),
+      realpathSync: vi.fn((p) => p),
+    },
+    existsSync: vi.fn(),
+    statSync: vi.fn(),
+    lstatSync: vi.fn(),
+    realpathSync: vi.fn((p) => p),
+    promises: {
+      ...actual.promises,
+      mkdir: vi.fn(),
+      writeFile: vi.fn(),
+      rm: vi.fn(),
+      cp: vi.fn(),
+      readFile: vi.fn(),
     },
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    existsSync: vi.fn((...args: any[]) => actual.existsSync(...args)),
   };
 });
 
@@ -49,183 +58,101 @@ vi.mock('@google/gemini-cli-core', async (importOriginal) => {
       log: vi.fn(),
     },
     coreEvents: {
-      emitFeedback: vi.fn(), // Mock emitFeedback
+      emitFeedback: vi.fn(),
       on: vi.fn(),
       off: vi.fn(),
+      emitConsoleLog: vi.fn(),
     },
+    loadSkillsFromDir: vi.fn().mockResolvedValue([]),
+    loadAgentsFromDirectory: vi
+      .fn()
+      .mockResolvedValue({ agents: [], errors: [] }),
+    logExtensionInstallEvent: vi.fn().mockResolvedValue(undefined),
+    logExtensionUpdateEvent: vi.fn().mockResolvedValue(undefined),
+    logExtensionUninstall: vi.fn().mockResolvedValue(undefined),
+    logExtensionEnable: vi.fn().mockResolvedValue(undefined),
+    logExtensionDisable: vi.fn().mockResolvedValue(undefined),
+    Config: vi.fn().mockImplementation(() => ({
+      getEnableExtensionReloading: vi.fn().mockReturnValue(true),
+    })),
   };
 });
 
-// Mock os.homedir because ExtensionStorage uses it
+vi.mock('./consent.js', () => ({
+  maybeRequestConsentOrFail: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock('./extensionSettings.js', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('./extensionSettings.js')>();
+  return {
+    ...actual,
+    getEnvContents: vi.fn().mockResolvedValue({}),
+    getMissingSettings: vi.fn(), // We will mock this implementation per test
+  };
+});
+
+vi.mock('../trustedFolders.js', () => ({
+  isWorkspaceTrusted: vi.fn().mockReturnValue({ isTrusted: true }), // Default to trusted to simplify flow
+  loadTrustedFolders: vi.fn().mockReturnValue({
+    setValue: vi.fn().mockResolvedValue(undefined),
+  }),
+  TrustLevel: { TRUST_FOLDER: 'TRUST_FOLDER' },
+}));
+
+// Mock ExtensionStorage to avoid real FS paths
+vi.mock('./storage.js', () => ({
+  ExtensionStorage: class {
+    constructor(public name: string) {}
+    getExtensionDir() {
+      return `/mock/extensions/${this.name}`;
+    }
+    static getUserExtensionsDir() {
+      return '/mock/extensions';
+    }
+    static createTmpDir() {
+      return Promise.resolve('/mock/tmp');
+    }
+  },
+}));
+
 vi.mock('os', async (importOriginal) => {
-  const mockedOs = await importOriginal<typeof os>();
+  const mockedOs = await importOriginal<typeof import('node:os')>();
   return {
     ...mockedOs,
-    homedir: vi.fn(),
+    homedir: vi.fn().mockReturnValue('/mock/home'),
   };
 });
 
 describe('extensionUpdates', () => {
-  let tempHomeDir: string;
   let tempWorkspaceDir: string;
-  let extensionDir: string;
-  let mockKeychainData: Record<string, Record<string, string>>;
 
   beforeEach(() => {
     vi.clearAllMocks();
-    mockKeychainData = {};
+    // Default fs mocks
+    vi.mocked(fs.promises.mkdir).mockResolvedValue(undefined);
+    vi.mocked(fs.promises.writeFile).mockResolvedValue(undefined);
+    vi.mocked(fs.promises.rm).mockResolvedValue(undefined);
+    vi.mocked(fs.promises.cp).mockResolvedValue(undefined);
 
-    // Mock Keychain
-    vi.mocked(KeychainTokenStorage).mockImplementation(
-      (serviceName: string) => {
-        if (!mockKeychainData[serviceName]) {
-          mockKeychainData[serviceName] = {};
-        }
-        const keychainData = mockKeychainData[serviceName];
-        return {
-          getSecret: vi
-            .fn()
-            .mockImplementation(
-              async (key: string) => keychainData[key] || null,
-            ),
-          setSecret: vi
-            .fn()
-            .mockImplementation(async (key: string, value: string) => {
-              keychainData[key] = value;
-            }),
-          deleteSecret: vi.fn().mockImplementation(async (key: string) => {
-            delete keychainData[key];
-          }),
-          listSecrets: vi
-            .fn()
-            .mockImplementation(async () => Object.keys(keychainData)),
-          isAvailable: vi.fn().mockResolvedValue(true),
-        } as unknown as KeychainTokenStorage;
-      },
-    );
+    // Allow directories to exist by default to satisfy Config/WorkspaceContext checks
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    vi.mocked(fs.statSync).mockReturnValue({ isDirectory: () => true } as any);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    vi.mocked(fs.lstatSync).mockReturnValue({ isDirectory: () => true } as any);
+    vi.mocked(fs.realpathSync).mockImplementation((p) => p as string);
 
-    // Setup Temp Dirs
-    tempHomeDir = fs.mkdtempSync(
-      path.join(os.tmpdir(), 'gemini-cli-test-home-'),
-    );
-    tempWorkspaceDir = fs.mkdtempSync(
-      path.join(os.tmpdir(), 'gemini-cli-test-workspace-'),
-    );
-    extensionDir = path.join(tempHomeDir, '.gemini', 'extensions', 'test-ext');
-
-    // Mock ExtensionStorage to rely on our temp extension dir
-    vi.spyOn(ExtensionStorage.prototype, 'getExtensionDir').mockReturnValue(
-      extensionDir,
-    );
-    // Mock getEnvFilePath is checking extensionDir/variables.env? No, it used ExtensionStorage logic.
-    // getEnvFilePath in extensionSettings.ts:
-    // if workspace, process.cwd()/.env (we need to mock process.cwd or move tempWorkspaceDir there)
-    // if user, ExtensionStorage(name).getEnvFilePath() -> joins extensionDir + '.env'
-
-    fs.mkdirSync(extensionDir, { recursive: true });
-    vi.mocked(os.homedir).mockReturnValue(tempHomeDir);
-    vi.spyOn(process, 'cwd').mockReturnValue(tempWorkspaceDir);
+    tempWorkspaceDir = '/mock/workspace';
   });
 
   afterEach(() => {
-    fs.rmSync(tempHomeDir, { recursive: true, force: true });
-    fs.rmSync(tempWorkspaceDir, { recursive: true, force: true });
     vi.restoreAllMocks();
   });
 
-  describe('getMissingSettings', () => {
-    it('should return empty list if all settings are present', async () => {
-      const config: ExtensionConfig = {
-        name: 'test-ext',
-        version: '1.0.0',
-        settings: [
-          { name: 's1', description: 'd1', envVar: 'VAR1' },
-          { name: 's2', description: 'd2', envVar: 'VAR2', sensitive: true },
-        ],
-      };
-      const extensionId = '12345';
-
-      // Setup User Env
-      const userEnvPath = path.join(extensionDir, EXTENSION_SETTINGS_FILENAME);
-      fs.writeFileSync(userEnvPath, 'VAR1=val1');
-
-      // Setup Keychain
-      const userKeychain = new KeychainTokenStorage(
-        `Gemini CLI Extensions test-ext ${extensionId}`,
-      );
-      await userKeychain.setSecret('VAR2', 'val2');
-
-      const missing = await getMissingSettings(
-        config,
-        extensionId,
-        tempWorkspaceDir,
-      );
-      expect(missing).toEqual([]);
-    });
-
-    it('should identify missing non-sensitive settings', async () => {
-      const config: ExtensionConfig = {
-        name: 'test-ext',
-        version: '1.0.0',
-        settings: [{ name: 's1', description: 'd1', envVar: 'VAR1' }],
-      };
-      const extensionId = '12345';
-
-      const missing = await getMissingSettings(
-        config,
-        extensionId,
-        tempWorkspaceDir,
-      );
-      expect(missing).toHaveLength(1);
-      expect(missing[0].name).toBe('s1');
-    });
-
-    it('should identify missing sensitive settings', async () => {
-      const config: ExtensionConfig = {
-        name: 'test-ext',
-        version: '1.0.0',
-        settings: [
-          { name: 's2', description: 'd2', envVar: 'VAR2', sensitive: true },
-        ],
-      };
-      const extensionId = '12345';
-
-      const missing = await getMissingSettings(
-        config,
-        extensionId,
-        tempWorkspaceDir,
-      );
-      expect(missing).toHaveLength(1);
-      expect(missing[0].name).toBe('s2');
-    });
-
-    it('should respect settings present in workspace', async () => {
-      const config: ExtensionConfig = {
-        name: 'test-ext',
-        version: '1.0.0',
-        settings: [{ name: 's1', description: 'd1', envVar: 'VAR1' }],
-      };
-      const extensionId = '12345';
-
-      // Setup Workspace Env
-      const workspaceEnvPath = path.join(
-        tempWorkspaceDir,
-        EXTENSION_SETTINGS_FILENAME,
-      );
-      fs.writeFileSync(workspaceEnvPath, 'VAR1=val1');
-
-      const missing = await getMissingSettings(
-        config,
-        extensionId,
-        tempWorkspaceDir,
-      );
-      expect(missing).toEqual([]);
-    });
-  });
-
   describe('ExtensionManager integration', () => {
     it('should warn about missing settings after update', async () => {
-      // Mock ExtensionManager methods to avoid FS/Network usage
+      // 1. Setup Data
       const newConfig: ExtensionConfig = {
         name: 'test-ext',
         version: '1.1.0',
@@ -239,31 +166,30 @@ describe('extensionUpdates', () => {
       };
 
       const installMetadata: ExtensionInstallMetadata = {
-        source: extensionDir,
+        source: '/mock/source',
         type: 'local',
         autoUpdate: true,
       };
 
+      // 2. Setup Manager
       const manager = new ExtensionManager({
         workspaceDir: tempWorkspaceDir,
-
         settings: createTestMergedSettings({
           telemetry: { enabled: false },
           experimental: { extensionConfig: true },
         }),
         requestConsent: vi.fn().mockResolvedValue(true),
-        requestSetting: null, // Simulate non-interactive
+        requestSetting: null,
       });
 
-      // Mock methods called by installOrUpdateExtension
+      // 3. Mock Internal Manager Methods
       vi.spyOn(manager, 'loadExtensionConfig').mockResolvedValue(newConfig);
       vi.spyOn(manager, 'getExtensions').mockReturnValue([
         {
           name: 'test-ext',
           version: '1.0.0',
           installMetadata,
-          path: extensionDir,
-          // Mocks for other required props
+          path: '/mock/extensions/test-ext',
           contextFiles: [],
           mcpServers: {},
           hooks: undefined,
@@ -275,23 +201,28 @@ describe('extensionUpdates', () => {
         } as unknown as GeminiCLIExtension,
       ]);
       vi.spyOn(manager, 'uninstallExtension').mockResolvedValue(undefined);
+      // Mock loadExtension to return something so the method doesn't crash at the end
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      vi.spyOn(manager as any, 'loadExtension').mockResolvedValue(
-        {} as unknown as GeminiCLIExtension,
-      );
-      vi.spyOn(manager, 'enableExtension').mockResolvedValue(undefined);
+      vi.spyOn(manager as any, 'loadExtension').mockResolvedValue({
+        name: 'test-ext',
+        version: '1.1.0',
+      } as GeminiCLIExtension);
 
-      // Mock fs.promises for the operations inside installOrUpdateExtension
-      vi.spyOn(fs.promises, 'mkdir').mockResolvedValue(undefined);
-      vi.spyOn(fs.promises, 'writeFile').mockResolvedValue(undefined);
-      vi.spyOn(fs.promises, 'rm').mockResolvedValue(undefined);
-      vi.mocked(fs.existsSync).mockReturnValue(false); // No hooks
-      try {
-        await manager.installOrUpdateExtension(installMetadata, previousConfig);
-      } catch (_) {
-        // Ignore errors from copyExtension or others, we just want to verify the warning
-      }
+      // 4. Mock External Helpers
+      // This is the key fix: we explicitly mock `getMissingSettings` to return
+      // the result we expect, avoiding any real FS or logic execution during the update.
+      vi.mocked(getMissingSettings).mockResolvedValue([
+        {
+          name: 's1',
+          description: 'd1',
+          envVar: 'VAR1',
+        },
+      ]);
 
+      // 5. Execute
+      await manager.installOrUpdateExtension(installMetadata, previousConfig);
+
+      // 6. Assert
       expect(debugLogger.warn).toHaveBeenCalledWith(
         expect.stringContaining(
           'Extension "test-ext" has missing settings: s1',

packages/cli/src/config/extensions/github_fetch.ts

@@ -45,6 +45,7 @@ export async function fetchJson<T>(
         res.on('data', (chunk) => chunks.push(chunk));
         res.on('end', () => {
           const data = Buffer.concat(chunks).toString();
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
           resolve(JSON.parse(data) as T);
         });
       })

packages/cli/src/config/extensions/variables.ts

@@ -52,9 +52,11 @@ export function recursivelyHydrateStrings<T>(
   values: VariableContext,
 ): T {
   if (typeof obj === 'string') {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return hydrateString(obj, values) as unknown as T;
   }
   if (Array.isArray(obj)) {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return obj.map((item) =>
       recursivelyHydrateStrings(item, values),
     ) as unknown as T;
@@ -64,11 +66,13 @@ export function recursivelyHydrateStrings<T>(
     for (const key in obj) {
       if (Object.prototype.hasOwnProperty.call(obj, key)) {
         newObj[key] = recursivelyHydrateStrings(
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
           (obj as Record<string, unknown>)[key],
           values,
         );
       }
     }
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return newObj as T;
   }
   return obj;

packages/cli/src/config/keyBindings.ts

@@ -80,6 +80,7 @@ export enum Command {
   UNFOCUS_BACKGROUND_SHELL = 'backgroundShell.unfocus',
   UNFOCUS_BACKGROUND_SHELL_LIST = 'backgroundShell.listUnfocus',
   SHOW_BACKGROUND_SHELL_UNFOCUS_WARNING = 'backgroundShell.unfocusWarning',
+  SHOW_SHELL_INPUT_UNFOCUS_WARNING = 'shellInput.unfocusWarning',
 
   // App Controls
   SHOW_ERROR_DETAILS = 'app.showErrorDetails',
@@ -90,6 +91,7 @@ export enum Command {
   TOGGLE_YOLO = 'app.toggleYolo',
   CYCLE_APPROVAL_MODE = 'app.cycleApprovalMode',
   SHOW_MORE_LINES = 'app.showMoreLines',
+  EXPAND_PASTE = 'app.expandPaste',
   FOCUS_SHELL_INPUT = 'app.focusShellInput',
   UNFOCUS_SHELL_INPUT = 'app.unfocusShellInput',
   CLEAR_SCREEN = 'app.clearScreen',
@@ -281,14 +283,16 @@ export const defaultKeyBindings: KeyBindingConfig = {
   [Command.SHOW_BACKGROUND_SHELL_UNFOCUS_WARNING]: [
     { key: 'tab', shift: false },
   ],
+  [Command.SHOW_SHELL_INPUT_UNFOCUS_WARNING]: [{ key: 'tab', shift: false }],
   [Command.BACKGROUND_SHELL_SELECT]: [{ key: 'return' }],
   [Command.BACKGROUND_SHELL_ESCAPE]: [{ key: 'escape' }],
   [Command.SHOW_MORE_LINES]: [
     { key: 'o', ctrl: true },
     { key: 's', ctrl: true },
   ],
+  [Command.EXPAND_PASTE]: [{ key: 'o', ctrl: true }],
   [Command.FOCUS_SHELL_INPUT]: [{ key: 'tab', shift: false }],
-  [Command.UNFOCUS_SHELL_INPUT]: [{ key: 'tab' }],
+  [Command.UNFOCUS_SHELL_INPUT]: [{ key: 'tab', shift: true }],
   [Command.CLEAR_SCREEN]: [{ key: 'l', ctrl: true }],
   [Command.RESTART_APP]: [{ key: 'r' }],
   [Command.SUSPEND_APP]: [{ key: 'z', ctrl: true }],
@@ -397,6 +401,7 @@ export const commandCategories: readonly CommandCategory[] = [
       Command.TOGGLE_YOLO,
       Command.CYCLE_APPROVAL_MODE,
       Command.SHOW_MORE_LINES,
+      Command.EXPAND_PASTE,
       Command.TOGGLE_BACKGROUND_SHELL,
       Command.TOGGLE_BACKGROUND_SHELL_LIST,
       Command.KILL_BACKGROUND_SHELL,
@@ -405,6 +410,7 @@ export const commandCategories: readonly CommandCategory[] = [
       Command.UNFOCUS_BACKGROUND_SHELL,
       Command.UNFOCUS_BACKGROUND_SHELL_LIST,
       Command.SHOW_BACKGROUND_SHELL_UNFOCUS_WARNING,
+      Command.SHOW_SHELL_INPUT_UNFOCUS_WARNING,
       Command.FOCUS_SHELL_INPUT,
       Command.UNFOCUS_SHELL_INPUT,
       Command.CLEAR_SCREEN,
@@ -496,16 +502,25 @@ export const commandDescriptions: Readonly<Record<Command, string>> = {
     'Cycle through approval modes: default (prompt), auto_edit (auto-approve edits), and plan (read-only).',
   [Command.SHOW_MORE_LINES]:
     'Expand a height-constrained response to show additional lines when not in alternate buffer mode.',
-  [Command.BACKGROUND_SHELL_SELECT]: 'Enter',
-  [Command.BACKGROUND_SHELL_ESCAPE]: 'Esc',
-  [Command.TOGGLE_BACKGROUND_SHELL]: 'Ctrl+B',
-  [Command.TOGGLE_BACKGROUND_SHELL_LIST]: 'Ctrl+L',
-  [Command.KILL_BACKGROUND_SHELL]: 'Ctrl+K',
-  [Command.UNFOCUS_BACKGROUND_SHELL]: 'Shift+Tab',
-  [Command.UNFOCUS_BACKGROUND_SHELL_LIST]: 'Tab',
-  [Command.SHOW_BACKGROUND_SHELL_UNFOCUS_WARNING]: 'Tab',
-  [Command.FOCUS_SHELL_INPUT]: 'Focus the shell input from the gemini input.',
-  [Command.UNFOCUS_SHELL_INPUT]: 'Focus the Gemini input from the shell input.',
+  [Command.EXPAND_PASTE]:
+    'Expand or collapse a paste placeholder when cursor is over placeholder.',
+  [Command.BACKGROUND_SHELL_SELECT]:
+    'Confirm selection in background shell list.',
+  [Command.BACKGROUND_SHELL_ESCAPE]: 'Dismiss background shell list.',
+  [Command.TOGGLE_BACKGROUND_SHELL]:
+    'Toggle current background shell visibility.',
+  [Command.TOGGLE_BACKGROUND_SHELL_LIST]: 'Toggle background shell list.',
+  [Command.KILL_BACKGROUND_SHELL]: 'Kill the active background shell.',
+  [Command.UNFOCUS_BACKGROUND_SHELL]:
+    'Move focus from background shell to Gemini.',
+  [Command.UNFOCUS_BACKGROUND_SHELL_LIST]:
+    'Move focus from background shell list to Gemini.',
+  [Command.SHOW_BACKGROUND_SHELL_UNFOCUS_WARNING]:
+    'Show warning when trying to unfocus background shell via Tab.',
+  [Command.SHOW_SHELL_INPUT_UNFOCUS_WARNING]:
+    'Show warning when trying to unfocus shell input via Tab.',
+  [Command.FOCUS_SHELL_INPUT]: 'Move focus from Gemini to the active shell.',
+  [Command.UNFOCUS_SHELL_INPUT]: 'Move focus from the shell back to Gemini.',
   [Command.CLEAR_SCREEN]: 'Clear the terminal screen and redraw the UI.',
   [Command.RESTART_APP]: 'Restart the application.',
   [Command.SUSPEND_APP]: 'Suspend the application (not yet implemented).',

packages/cli/src/config/mcp/mcpServerEnablement.ts

@@ -358,6 +358,7 @@ export class McpServerEnablementManager {
   private async readConfig(): Promise<McpServerEnablementConfig> {
     try {
       const content = await fs.readFile(this.configFilePath, 'utf-8');
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       return JSON.parse(content) as McpServerEnablementConfig;
     } catch (error) {
       if (

packages/cli/src/config/policy-engine.integration.test.ts

@@ -338,6 +338,7 @@ describe('Policy Engine Integration Tests', () => {
           const validPaths = [
             '/home/user/.gemini/tmp/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2/plans/my-plan.md',
             '/home/user/.gemini/tmp/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2/plans/feature_auth.md',
+            '/home/user/.gemini/tmp/new-temp_dir_123/plans/plan.md', // new style of temp directory
           ];
 
           for (const file_path of validPaths) {
@@ -364,8 +365,8 @@ describe('Policy Engine Integration Tests', () => {
             '/project/src/file.ts', // Workspace
             '/home/user/.gemini/tmp/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2/plans/script.js', // Wrong extension
             '/home/user/.gemini/tmp/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2/plans/../../../etc/passwd.md', // Path traversal
-            '/home/user/.gemini/tmp/abc123/plans/plan.md', // Invalid hash length
             '/home/user/.gemini/tmp/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2/plans/subdir/plan.md', // Subdirectory
+            '/home/user/.gemini/non-tmp/new-temp_dir_123/plans/plan.md', // outside of temp dir
           ];
 
           for (const file_path of invalidPaths) {
@@ -433,8 +434,8 @@ describe('Policy Engine Integration Tests', () => {
       expect(mcpServerRule?.priority).toBe(2.1); // MCP allowed server
 
       const readOnlyToolRule = rules.find((r) => r.toolName === 'glob');
-      // Priority 50 in default tier → 1.05
-      expect(readOnlyToolRule?.priority).toBeCloseTo(1.05, 5);
+      // Priority 70 in default tier → 1.07 (Overriding Plan Mode Deny)
+      expect(readOnlyToolRule?.priority).toBeCloseTo(1.07, 5);
 
       // Verify the engine applies these priorities correctly
       expect(
@@ -589,8 +590,8 @@ describe('Policy Engine Integration Tests', () => {
       expect(server1Rule?.priority).toBe(2.1); // Allowed servers (user tier)
 
       const globRule = rules.find((r) => r.toolName === 'glob');
-      // Priority 50 in default tier → 1.05
-      expect(globRule?.priority).toBeCloseTo(1.05, 5); // Auto-accept read-only
+      // Priority 70 in default tier → 1.07
+      expect(globRule?.priority).toBeCloseTo(1.07, 5); // Auto-accept read-only
 
       // The PolicyEngine will sort these by priority when it's created
       const engine = new PolicyEngine(config);

packages/cli/src/config/settings-validation.ts

@@ -23,6 +23,7 @@ function buildZodSchemaFromJsonSchema(def: any): z.ZodTypeAny {
   }
 
   if (def.type === 'string') {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     if (def.enum) return z.enum(def.enum as [string, ...string[]]);
     return z.string();
   }
@@ -40,7 +41,7 @@ function buildZodSchemaFromJsonSchema(def: any): z.ZodTypeAny {
     let schema;
     if (def.properties) {
       const shape: Record<string, z.ZodTypeAny> = {};
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
       for (const [key, propDef] of Object.entries(def.properties) as any) {
         let propSchema = buildZodSchemaFromJsonSchema(propDef);
         if (
@@ -86,9 +87,11 @@ function buildEnumSchema(
   }
   const values = options.map((opt) => opt.value);
   if (values.every((v) => typeof v === 'string')) {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return z.enum(values as [string, ...string[]]);
   } else if (values.every((v) => typeof v === 'number')) {
     return z.union(
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       values.map((v) => z.literal(v)) as [
         z.ZodLiteral<number>,
         z.ZodLiteral<number>,
@@ -97,6 +100,7 @@ function buildEnumSchema(
     );
   } else {
     return z.union(
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       values.map((v) => z.literal(v)) as [
         z.ZodLiteral<unknown>,
         z.ZodLiteral<unknown>,

packages/cli/src/config/settings.test.ts

@@ -1936,6 +1936,40 @@ describe('Settings Loading and Merging', () => {
       );
     });
 
+    it('should migrate tools.approvalMode to general.defaultApprovalMode', () => {
+      const userSettingsContent = {
+        tools: {
+          approvalMode: 'plan',
+        },
+      };
+
+      (fs.readFileSync as Mock).mockImplementation(
+        (p: fs.PathOrFileDescriptor) => {
+          if (p === USER_SETTINGS_PATH)
+            return JSON.stringify(userSettingsContent);
+          return '{}';
+        },
+      );
+
+      const setValueSpy = vi.spyOn(LoadedSettings.prototype, 'setValue');
+      const loadedSettings = loadSettings(MOCK_WORKSPACE_DIR);
+
+      migrateDeprecatedSettings(loadedSettings, true);
+
+      expect(setValueSpy).toHaveBeenCalledWith(
+        SettingScope.User,
+        'general',
+        expect.objectContaining({ defaultApprovalMode: 'plan' }),
+      );
+
+      // Verify removal
+      expect(setValueSpy).toHaveBeenCalledWith(
+        SettingScope.User,
+        'tools',
+        expect.not.objectContaining({ approvalMode: 'plan' }),
+      );
+    });
+
     it('should migrate all 4 inverted boolean settings', () => {
       const userSettingsContent = {
         general: {
@@ -2078,7 +2112,7 @@ describe('Settings Loading and Merging', () => {
       );
     });
 
-    it('should migrate disableUpdateNag to enableAutoUpdateNotification in system and system defaults settings', () => {
+    it('should migrate disableUpdateNag to enableAutoUpdateNotification in memory but not save for system and system defaults settings', () => {
       const systemSettingsContent = {
         general: {
           disableUpdateNag: true,
@@ -2103,9 +2137,10 @@ describe('Settings Loading and Merging', () => {
         },
       );
 
+      const feedbackSpy = mockCoreEvents.emitFeedback;
       const settings = loadSettings(MOCK_WORKSPACE_DIR);
 
-      // Verify system settings were migrated
+      // Verify system settings were migrated in memory
       expect(settings.system.settings.general).toHaveProperty(
         'enableAutoUpdateNotification',
       );
@@ -2115,7 +2150,7 @@ describe('Settings Loading and Merging', () => {
         ],
       ).toBe(false);
 
-      // Verify system defaults settings were migrated
+      // Verify system defaults settings were migrated in memory
       expect(settings.systemDefaults.settings.general).toHaveProperty(
         'enableAutoUpdateNotification',
       );
@@ -2127,6 +2162,74 @@ describe('Settings Loading and Merging', () => {
 
       // Merged should also reflect it (system overrides defaults, but both are migrated)
       expect(settings.merged.general?.enableAutoUpdateNotification).toBe(false);
+
+      // Verify it was NOT saved back to disk
+      expect(updateSettingsFilePreservingFormat).not.toHaveBeenCalledWith(
+        getSystemSettingsPath(),
+        expect.anything(),
+      );
+      expect(updateSettingsFilePreservingFormat).not.toHaveBeenCalledWith(
+        getSystemDefaultsPath(),
+        expect.anything(),
+      );
+
+      // Verify warnings were shown
+      expect(feedbackSpy).toHaveBeenCalledWith(
+        'warning',
+        expect.stringContaining(
+          'The system configuration contains deprecated settings',
+        ),
+      );
+      expect(feedbackSpy).toHaveBeenCalledWith(
+        'warning',
+        expect.stringContaining(
+          'The system default configuration contains deprecated settings',
+        ),
+      );
+    });
+
+    it('should migrate experimental agent settings in system scope in memory but not save', () => {
+      const systemSettingsContent = {
+        experimental: {
+          codebaseInvestigatorSettings: {
+            enabled: true,
+          },
+        },
+      };
+
+      vi.mocked(fs.existsSync).mockReturnValue(true);
+      (fs.readFileSync as Mock).mockImplementation(
+        (p: fs.PathOrFileDescriptor) => {
+          if (p === getSystemSettingsPath()) {
+            return JSON.stringify(systemSettingsContent);
+          }
+          return '{}';
+        },
+      );
+
+      const feedbackSpy = mockCoreEvents.emitFeedback;
+      const settings = loadSettings(MOCK_WORKSPACE_DIR);
+
+      // Verify it was migrated in memory
+      expect(settings.system.settings.agents?.overrides).toMatchObject({
+        codebase_investigator: {
+          enabled: true,
+        },
+      });
+
+      // Verify it was NOT saved back to disk
+      expect(updateSettingsFilePreservingFormat).not.toHaveBeenCalledWith(
+        getSystemSettingsPath(),
+        expect.anything(),
+      );
+
+      // Verify warnings were shown
+      expect(feedbackSpy).toHaveBeenCalledWith(
+        'warning',
+        expect.stringContaining(
+          'The system configuration contains deprecated settings: [experimental.codebaseInvestigatorSettings]',
+        ),
+      );
     });
 
     it('should migrate experimental agent settings to agents overrides', () => {

packages/cli/src/config/settings.ts

@@ -194,6 +194,7 @@ export interface SettingsFile {
   originalSettings: Settings;
   path: string;
   rawJson?: string;
+  readOnly?: boolean;
 }
 
 function setNestedProperty(
@@ -212,6 +213,7 @@ function setNestedProperty(
     }
     const next = current[key];
     if (typeof next === 'object' && next !== null) {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       current = next as Record<string, unknown>;
     } else {
       // This path is invalid, so we stop.
@@ -253,6 +255,7 @@ export function mergeSettings(
   // 3. User Settings
   // 4. Workspace Settings
   // 5. System Settings (as overrides)
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   return customDeepMerge(
     getMergeStrategyForPath,
     schemaDefaults,
@@ -273,6 +276,7 @@ export function mergeSettings(
 export function createTestMergedSettings(
   overrides: Partial<Settings> = {},
 ): MergedSettings {
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
   return customDeepMerge(
     getMergeStrategyForPath,
     getDefaultsFromSchema(),
@@ -354,6 +358,7 @@ export class LoadedSettings {
 
       // The final admin settings are the defaults overridden by remote settings.
       // Any admin settings from files are ignored.
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       merged.admin = customDeepMerge(
         (path: string[]) => getMergeStrategyForPath(['admin', ...path]),
         adminDefaults,
@@ -378,25 +383,32 @@ export class LoadedSettings {
     }
   }
 
+  private isPersistable(settingsFile: SettingsFile): boolean {
+    return !settingsFile.readOnly;
+  }
+
   setValue(scope: LoadableSettingScope, key: string, value: unknown): void {
     const settingsFile = this.forScope(scope);
 
-    // Clone value to prevent reference sharing between settings and originalSettings
+    // Clone value to prevent reference sharing
     const valueToSet =
       typeof value === 'object' && value !== null
         ? structuredClone(value)
         : value;
 
     setNestedProperty(settingsFile.settings, key, valueToSet);
-    // Use a fresh clone for originalSettings to ensure total independence
-    setNestedProperty(
-      settingsFile.originalSettings,
-      key,
-      structuredClone(valueToSet),
-    );
+
+    if (this.isPersistable(settingsFile)) {
+      // Use a fresh clone for originalSettings to ensure total independence
+      setNestedProperty(
+        settingsFile.originalSettings,
+        key,
+        structuredClone(valueToSet),
+      );
+      saveSettings(settingsFile);
+    }
 
     this._merged = this.computeMergedSettings();
-    saveSettings(settingsFile);
     coreEvents.emitSettingsChanged();
   }
 
@@ -609,6 +621,7 @@ export function loadSettings(
           return { settings: {} };
         }
 
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         const settingsObject = rawSettings as Record<string, unknown>;
 
         // Validate settings structure with Zod
@@ -716,24 +729,28 @@ export function loadSettings(
       settings: systemSettings,
       originalSettings: systemOriginalSettings,
       rawJson: systemResult.rawJson,
+      readOnly: true,
     },
     {
       path: systemDefaultsPath,
       settings: systemDefaultSettings,
       originalSettings: systemDefaultsOriginalSettings,
       rawJson: systemDefaultsResult.rawJson,
+      readOnly: true,
     },
     {
       path: USER_SETTINGS_PATH,
       settings: userSettings,
       originalSettings: userOriginalSettings,
       rawJson: userResult.rawJson,
+      readOnly: false,
     },
     {
       path: workspaceSettingsPath,
       settings: workspaceSettings,
       originalSettings: workspaceOriginalSettings,
       rawJson: workspaceResult.rawJson,
+      readOnly: false,
     },
     isTrusted,
     settingsErrors,
@@ -758,17 +775,26 @@ export function migrateDeprecatedSettings(
   removeDeprecated = false,
 ): boolean {
   let anyModified = false;
+  const systemWarnings: Map<LoadableSettingScope, string[]> = new Map();
 
+  /**
+   * Helper to migrate a boolean setting and track it if it's deprecated.
+   */
   const migrateBoolean = (
     settings: Record<string, unknown>,
     oldKey: string,
     newKey: string,
+    prefix: string,
+    foundDeprecated?: string[],
   ): boolean => {
     let modified = false;
     const oldValue = settings[oldKey];
     const newValue = settings[newKey];
 
     if (typeof oldValue === 'boolean') {
+      if (foundDeprecated) {
+        foundDeprecated.push(prefix ? `${prefix}.${oldKey}` : oldKey);
+      }
       if (typeof newValue === 'boolean') {
         // Both exist, trust the new one
         if (removeDeprecated) {
@@ -788,7 +814,9 @@ export function migrateDeprecatedSettings(
   };
 
   const processScope = (scope: LoadableSettingScope) => {
-    const settings = loadedSettings.forScope(scope).settings;
+    const settingsFile = loadedSettings.forScope(scope);
+    const settings = settingsFile.settings;
+    const foundDeprecated: string[] = [];
 
     // Migrate general settings
     const generalSettings = settings.general as
@@ -799,18 +827,27 @@ export function migrateDeprecatedSettings(
       let modified = false;
 
       modified =
-        migrateBoolean(newGeneral, 'disableAutoUpdate', 'enableAutoUpdate') ||
-        modified;
+        migrateBoolean(
+          newGeneral,
+          'disableAutoUpdate',
+          'enableAutoUpdate',
+          'general',
+          foundDeprecated,
+        ) || modified;
       modified =
         migrateBoolean(
           newGeneral,
           'disableUpdateNag',
           'enableAutoUpdateNotification',
+          'general',
+          foundDeprecated,
         ) || modified;
 
       if (modified) {
         loadedSettings.setValue(scope, 'general', newGeneral);
-        anyModified = true;
+        if (!settingsFile.readOnly) {
+          anyModified = true;
+        }
       }
     }
 
@@ -818,6 +855,7 @@ export function migrateDeprecatedSettings(
     const uiSettings = settings.ui as Record<string, unknown> | undefined;
     if (uiSettings) {
       const newUi = { ...uiSettings };
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       const accessibilitySettings = newUi['accessibility'] as
         | Record<string, unknown>
         | undefined;
@@ -829,11 +867,15 @@ export function migrateDeprecatedSettings(
             newAccessibility,
             'disableLoadingPhrases',
             'enableLoadingPhrases',
+            'ui.accessibility',
+            foundDeprecated,
           )
         ) {
           newUi['accessibility'] = newAccessibility;
           loadedSettings.setValue(scope, 'ui', newUi);
-          anyModified = true;
+          if (!settingsFile.readOnly) {
+            anyModified = true;
+          }
         }
       }
     }
@@ -844,6 +886,7 @@ export function migrateDeprecatedSettings(
       | undefined;
     if (contextSettings) {
       const newContext = { ...contextSettings };
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       const fileFilteringSettings = newContext['fileFiltering'] as
         | Record<string, unknown>
         | undefined;
@@ -855,23 +898,67 @@ export function migrateDeprecatedSettings(
             newFileFiltering,
             'disableFuzzySearch',
             'enableFuzzySearch',
+            'context.fileFiltering',
+            foundDeprecated,
           )
         ) {
           newContext['fileFiltering'] = newFileFiltering;
           loadedSettings.setValue(scope, 'context', newContext);
-          anyModified = true;
+          if (!settingsFile.readOnly) {
+            anyModified = true;
+          }
+        }
+      }
+    }
+
+    // Migrate tools settings
+    const toolsSettings = settings.tools as Record<string, unknown> | undefined;
+    if (toolsSettings) {
+      if (toolsSettings['approvalMode'] !== undefined) {
+        foundDeprecated.push('tools.approvalMode');
+
+        const generalSettings =
+          (settings.general as Record<string, unknown> | undefined) || {};
+        const newGeneral = { ...generalSettings };
+
+        // Only set defaultApprovalMode if it's not already set
+        if (newGeneral['defaultApprovalMode'] === undefined) {
+          newGeneral['defaultApprovalMode'] = toolsSettings['approvalMode'];
+          loadedSettings.setValue(scope, 'general', newGeneral);
+          if (!settingsFile.readOnly) {
+            anyModified = true;
+          }
+        }
+
+        if (removeDeprecated) {
+          const newTools = { ...toolsSettings };
+          delete newTools['approvalMode'];
+          loadedSettings.setValue(scope, 'tools', newTools);
+          if (!settingsFile.readOnly) {
+            anyModified = true;
+          }
         }
       }
     }
 
     // Migrate experimental agent settings
-    anyModified =
-      migrateExperimentalSettings(
-        settings,
-        loadedSettings,
-        scope,
-        removeDeprecated,
-      ) || anyModified;
+    const experimentalModified = migrateExperimentalSettings(
+      settings,
+      loadedSettings,
+      scope,
+      removeDeprecated,
+      foundDeprecated,
+    );
+
+    if (experimentalModified) {
+      if (!settingsFile.readOnly) {
+        anyModified = true;
+      }
+    }
+
+    if (settingsFile.readOnly && foundDeprecated.length > 0) {
+      systemWarnings.set(scope, foundDeprecated);
+    }
   };
 
   processScope(SettingScope.User);
@@ -879,6 +966,19 @@ export function migrateDeprecatedSettings(
   processScope(SettingScope.System);
   processScope(SettingScope.SystemDefaults);
 
+  if (systemWarnings.size > 0) {
+    for (const [scope, flags] of systemWarnings) {
+      const scopeName =
+        scope === SettingScope.SystemDefaults
+          ? 'system default'
+          : scope.toLowerCase();
+      coreEvents.emitFeedback(
+        'warning',
+        `The ${scopeName} configuration contains deprecated settings: [${flags.join(', ')}]. These could not be migrated automatically as system settings are read-only. Please update the system configuration manually.`,
+      );
+    }
+  }
+
   return anyModified;
 }
 
@@ -926,25 +1026,39 @@ function migrateExperimentalSettings(
   loadedSettings: LoadedSettings,
   scope: LoadableSettingScope,
   removeDeprecated: boolean,
+  foundDeprecated?: string[],
 ): boolean {
   const experimentalSettings = settings.experimental as
     | Record<string, unknown>
     | undefined;
+
   if (experimentalSettings) {
     const agentsSettings = {
       ...(settings.agents as Record<string, unknown> | undefined),
     };
     const agentsOverrides = {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       ...((agentsSettings['overrides'] as Record<string, unknown>) || {}),
     };
     let modified = false;
 
+    const migrateExperimental = (
+      oldKey: string,
+      migrateFn: (oldValue: Record<string, unknown>) => void,
+    ) => {
+      const old = experimentalSettings[oldKey];
+      if (old) {
+        foundDeprecated?.push(`experimental.${oldKey}`);
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+        migrateFn(old as Record<string, unknown>);
+        modified = true;
+      }
+    };
+
     // Migrate codebaseInvestigatorSettings -> agents.overrides.codebase_investigator
-    if (experimentalSettings['codebaseInvestigatorSettings']) {
-      const old = experimentalSettings[
-        'codebaseInvestigatorSettings'
-      ] as Record<string, unknown>;
+    migrateExperimental('codebaseInvestigatorSettings', (old) => {
       const override = {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         ...(agentsOverrides['codebase_investigator'] as
           | Record<string, unknown>
           | undefined),
@@ -953,6 +1067,7 @@ function migrateExperimentalSettings(
       if (old['enabled'] !== undefined) override['enabled'] = old['enabled'];
 
       const runConfig = {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         ...(override['runConfig'] as Record<string, unknown> | undefined),
       };
       if (old['maxNumTurns'] !== undefined)
@@ -963,16 +1078,19 @@ function migrateExperimentalSettings(
 
       if (old['model'] !== undefined || old['thinkingBudget'] !== undefined) {
         const modelConfig = {
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
           ...(override['modelConfig'] as Record<string, unknown> | undefined),
         };
         if (old['model'] !== undefined) modelConfig['model'] = old['model'];
         if (old['thinkingBudget'] !== undefined) {
           const generateContentConfig = {
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
             ...(modelConfig['generateContentConfig'] as
               | Record<string, unknown>
               | undefined),
           };
           const thinkingConfig = {
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
             ...(generateContentConfig['thinkingConfig'] as
               | Record<string, unknown>
               | undefined),
@@ -985,22 +1103,17 @@ function migrateExperimentalSettings(
       }
 
       agentsOverrides['codebase_investigator'] = override;
-      modified = true;
-    }
+    });
 
     // Migrate cliHelpAgentSettings -> agents.overrides.cli_help
-    if (experimentalSettings['cliHelpAgentSettings']) {
-      const old = experimentalSettings['cliHelpAgentSettings'] as Record<
-        string,
-        unknown
-      >;
+    migrateExperimental('cliHelpAgentSettings', (old) => {
       const override = {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         ...(agentsOverrides['cli_help'] as Record<string, unknown> | undefined),
       };
       if (old['enabled'] !== undefined) override['enabled'] = old['enabled'];
       agentsOverrides['cli_help'] = override;
-      modified = true;
-    }
+    });
 
     if (modified) {
       agentsSettings['overrides'] = agentsOverrides;

packages/cli/src/config/settingsSchema.test.ts

@@ -328,30 +328,6 @@ describe('SettingsSchema', () => {
       ).toBe('Enable debug logging of keystrokes to the console.');
     });
 
-    it('should have previewFeatures setting in schema', () => {
-      expect(
-        getSettingsSchema().general.properties.previewFeatures,
-      ).toBeDefined();
-      expect(getSettingsSchema().general.properties.previewFeatures.type).toBe(
-        'boolean',
-      );
-      expect(
-        getSettingsSchema().general.properties.previewFeatures.category,
-      ).toBe('General');
-      expect(
-        getSettingsSchema().general.properties.previewFeatures.default,
-      ).toBe(false);
-      expect(
-        getSettingsSchema().general.properties.previewFeatures.requiresRestart,
-      ).toBe(false);
-      expect(
-        getSettingsSchema().general.properties.previewFeatures.showInDialog,
-      ).toBe(true);
-      expect(
-        getSettingsSchema().general.properties.previewFeatures.description,
-      ).toBe('Enable preview features (e.g., preview models).');
-    });
-
     it('should have enableAgents setting in schema', () => {
       const setting = getSettingsSchema().experimental.properties.enableAgents;
       expect(setting).toBeDefined();
@@ -389,20 +365,6 @@ describe('SettingsSchema', () => {
       );
     });
 
-    it('should have enableEventDrivenScheduler setting in schema', () => {
-      const setting =
-        getSettingsSchema().experimental.properties.enableEventDrivenScheduler;
-      expect(setting).toBeDefined();
-      expect(setting.type).toBe('boolean');
-      expect(setting.category).toBe('Experimental');
-      expect(setting.default).toBe(true);
-      expect(setting.requiresRestart).toBe(true);
-      expect(setting.showInDialog).toBe(false);
-      expect(setting.description).toBe(
-        'Enables event-driven scheduler within the CLI session.',
-      );
-    });
-
     it('should have hooksConfig.notifications setting in schema', () => {
       const setting = getSettingsSchema().hooksConfig?.properties.notifications;
       expect(setting).toBeDefined();

packages/cli/src/config/settingsSchema.ts

@@ -10,7 +10,6 @@
 // --------------------------------------------------------------------------
 
 import {
-  DEFAULT_TRUNCATE_TOOL_OUTPUT_LINES,
   DEFAULT_TRUNCATE_TOOL_OUTPUT_THRESHOLD,
   DEFAULT_MODEL_CONFIGS,
   type MCPServerConfig,
@@ -162,15 +161,6 @@ const SETTINGS_SCHEMA = {
     description: 'General application settings.',
     showInDialog: false,
     properties: {
-      previewFeatures: {
-        type: 'boolean',
-        label: 'Preview Features (e.g., models)',
-        category: 'General',
-        requiresRestart: false,
-        default: false,
-        description: 'Enable preview features (e.g., preview models).',
-        showInDialog: true,
-      },
       preferredEditor: {
         type: 'string',
         label: 'Preferred Editor',
@@ -189,6 +179,33 @@ const SETTINGS_SCHEMA = {
         description: 'Enable Vim keybindings',
         showInDialog: true,
       },
+      defaultApprovalMode: {
+        type: 'enum',
+        label: 'Default Approval Mode',
+        category: 'General',
+        requiresRestart: false,
+        default: 'default',
+        description: oneLine`
+          The default approval mode for tool execution.
+          'default' prompts for approval, 'auto_edit' auto-approves edit tools,
+          and 'plan' is read-only mode. 'yolo' is not supported yet.
+        `,
+        showInDialog: true,
+        options: [
+          { value: 'default', label: 'Default' },
+          { value: 'auto_edit', label: 'Auto Edit' },
+          { value: 'plan', label: 'Plan' },
+        ],
+      },
+      devtools: {
+        type: 'boolean',
+        label: 'DevTools',
+        category: 'General',
+        requiresRestart: false,
+        default: false,
+        description: 'Enable DevTools inspector on launch.',
+        showInDialog: false,
+      },
       enableAutoUpdate: {
         type: 'boolean',
         label: 'Enable Auto Update',
@@ -393,6 +410,19 @@ const SETTINGS_SCHEMA = {
         description: 'Hide the window title bar',
         showInDialog: true,
       },
+      inlineThinkingMode: {
+        type: 'enum',
+        label: 'Inline Thinking',
+        category: 'UI',
+        requiresRestart: false,
+        default: 'off',
+        description: 'Display model thinking inline: off or full.',
+        showInDialog: true,
+        options: [
+          { value: 'off', label: 'Off' },
+          { value: 'full', label: 'Full' },
+        ],
+      },
       showStatusInTitle: {
         type: 'boolean',
         label: 'Show Thoughts in Title',
@@ -1071,24 +1101,7 @@ const SETTINGS_SCHEMA = {
           },
         },
       },
-      approvalMode: {
-        type: 'enum',
-        label: 'Approval Mode',
-        category: 'Tools',
-        requiresRestart: false,
-        default: 'default',
-        description: oneLine`
-          The default approval mode for tool execution.
-          'default' prompts for approval, 'auto_edit' auto-approves edit tools,
-          and 'plan' is read-only mode. 'yolo' is not supported yet.
-        `,
-        showInDialog: true,
-        options: [
-          { value: 'default', label: 'Default' },
-          { value: 'auto_edit', label: 'Auto Edit' },
-          { value: 'plan', label: 'Plan' },
-        ],
-      },
+
       core: {
         type: 'array',
         label: 'Core Tools',
@@ -1158,15 +1171,6 @@ const SETTINGS_SCHEMA = {
           'Use ripgrep for file content search instead of the fallback implementation. Provides faster search performance.',
         showInDialog: true,
       },
-      enableToolOutputTruncation: {
-        type: 'boolean',
-        label: 'Enable Tool Output Truncation',
-        category: 'General',
-        requiresRestart: true,
-        default: true,
-        description: 'Enable truncation of large tool outputs.',
-        showInDialog: true,
-      },
       truncateToolOutputThreshold: {
         type: 'number',
         label: 'Tool Output Truncation Threshold',
@@ -1174,16 +1178,7 @@ const SETTINGS_SCHEMA = {
         requiresRestart: true,
         default: DEFAULT_TRUNCATE_TOOL_OUTPUT_THRESHOLD,
         description:
-          'Truncate tool output if it is larger than this many characters. Set to -1 to disable.',
-        showInDialog: true,
-      },
-      truncateToolOutputLines: {
-        type: 'number',
-        label: 'Tool Output Truncation Lines',
-        category: 'General',
-        requiresRestart: true,
-        default: DEFAULT_TRUNCATE_TOOL_OUTPUT_LINES,
-        description: 'The number of lines to keep when truncating tool output.',
+          'Maximum characters to show when truncating large tool outputs. Set to 0 or negative to disable truncation.',
         showInDialog: true,
       },
       disableLLMCorrection: {
@@ -1538,17 +1533,17 @@ const SETTINGS_SCHEMA = {
         label: 'Extension Configuration',
         category: 'Experimental',
         requiresRestart: true,
-        default: false,
+        default: true,
         description: 'Enable requesting and fetching of extension settings.',
         showInDialog: false,
       },
-      enableEventDrivenScheduler: {
+      extensionRegistry: {
         type: 'boolean',
-        label: 'Event Driven Scheduler',
+        label: 'Extension Registry Explore UI',
         category: 'Experimental',
         requiresRestart: true,
-        default: true,
-        description: 'Enables event-driven scheduler within the CLI session.',
+        default: false,
+        description: 'Enable extension registry explore UI.',
         showInDialog: false,
       },
       extensionReloading: {

packages/cli/src/config/settings_repro.test.ts

@@ -134,7 +134,6 @@ describe('Settings Repro', () => {
         enablePromptCompletion: false,
         preferredEditor: 'vim',
         vimMode: false,
-        previewFeatures: false,
       },
       security: {
         auth: {
@@ -150,7 +149,6 @@ describe('Settings Repro', () => {
           showColor: true,
           enableInteractiveShell: true,
         },
-        truncateToolOutputLines: 100,
       },
       experimental: {
         useModelRouter: false,

packages/cli/src/config/trustedFolders.ts

@@ -6,6 +6,8 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+import { lock } from 'proper-lockfile';
 import {
   FatalConfigError,
   getErrorMessage,
@@ -13,10 +15,15 @@ import {
   ideContextStore,
   GEMINI_DIR,
   homedir,
+  isHeadlessMode,
+  coreEvents,
+  type HeadlessModeOptions,
 } from '@google/gemini-cli-core';
 import type { Settings } from './settings.js';
 import stripJsonComments from 'strip-json-comments';
 
+const { promises: fsPromises } = fs;
+
 export const TRUSTED_FOLDERS_FILENAME = 'trustedFolders.json';
 
 export function getUserSettingsDir(): string {
@@ -41,6 +48,7 @@ export function isTrustLevel(
 ): value is TrustLevel {
   return (
     typeof value === 'string' &&
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     Object.values(TrustLevel).includes(value as TrustLevel)
   );
 }
@@ -67,6 +75,13 @@ export interface TrustResult {
 
 const realPathCache = new Map<string, string>();
 
+/**
+ * Parses the trusted folders JSON content, stripping comments.
+ */
+function parseTrustedFoldersJson(content: string): unknown {
+  return JSON.parse(stripJsonComments(content));
+}
+
 /**
  * FOR TESTING PURPOSES ONLY.
  * Clears the real path cache.
@@ -114,7 +129,11 @@ export class LoadedTrustedFolders {
   isPathTrusted(
     location: string,
     config?: Record<string, TrustLevel>,
+    headlessOptions?: HeadlessModeOptions,
   ): boolean | undefined {
+    if (isHeadlessMode(headlessOptions)) {
+      return true;
+    }
     const configToUse = config ?? this.user.config;
 
     // Resolve location to its realpath for canonical comparison
@@ -150,19 +169,68 @@ export class LoadedTrustedFolders {
     return undefined;
   }
 
-  setValue(path: string, trustLevel: TrustLevel): void {
-    const originalTrustLevel = this.user.config[path];
-    this.user.config[path] = trustLevel;
+  async setValue(folderPath: string, trustLevel: TrustLevel): Promise<void> {
+    if (this.errors.length > 0) {
+      const errorMessages = this.errors.map(
+        (error) => `Error in ${error.path}: ${error.message}`,
+      );
+      throw new FatalConfigError(
+        `Cannot update trusted folders because the configuration file is invalid:\n${errorMessages.join('\n')}\nPlease fix the file manually before trying to update it.`,
+      );
+    }
+
+    const dirPath = path.dirname(this.user.path);
+    if (!fs.existsSync(dirPath)) {
+      await fsPromises.mkdir(dirPath, { recursive: true });
+    }
+
+    // lockfile requires the file to exist
+    if (!fs.existsSync(this.user.path)) {
+      await fsPromises.writeFile(this.user.path, JSON.stringify({}, null, 2), {
+        mode: 0o600,
+      });
+    }
+
+    const release = await lock(this.user.path, {
+      retries: {
+        retries: 10,
+        minTimeout: 100,
+      },
+    });
+
     try {
-      saveTrustedFolders(this.user);
-    } catch (e) {
-      // Revert the in-memory change if the save failed.
-      if (originalTrustLevel === undefined) {
-        delete this.user.config[path];
-      } else {
-        this.user.config[path] = originalTrustLevel;
+      // Re-read the file to handle concurrent updates
+      const content = await fsPromises.readFile(this.user.path, 'utf-8');
+      let config: Record<string, TrustLevel>;
+      try {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+        config = parseTrustedFoldersJson(content) as Record<string, TrustLevel>;
+      } catch (error) {
+        coreEvents.emitFeedback(
+          'error',
+          `Failed to parse trusted folders file at ${this.user.path}. The file may be corrupted.`,
+          error,
+        );
+        config = {};
       }
-      throw e;
+
+      const originalTrustLevel = config[folderPath];
+      config[folderPath] = trustLevel;
+      this.user.config[folderPath] = trustLevel;
+
+      try {
+        saveTrustedFolders({ ...this.user, config });
+      } catch (e) {
+        // Revert the in-memory change if the save failed.
+        if (originalTrustLevel === undefined) {
+          delete this.user.config[folderPath];
+        } else {
+          this.user.config[folderPath] = originalTrustLevel;
+        }
+        throw e;
+      }
+    } finally {
+      await release();
     }
   }
 }
@@ -190,10 +258,8 @@ export function loadTrustedFolders(): LoadedTrustedFolders {
   try {
     if (fs.existsSync(userPath)) {
       const content = fs.readFileSync(userPath, 'utf-8');
-      const parsed = JSON.parse(stripJsonComments(content)) as Record<
-        string,
-        string
-      >;
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+      const parsed = parseTrustedFoldersJson(content) as Record<string, string>;
 
       if (
         typeof parsed !== 'object' ||
@@ -241,11 +307,26 @@ export function saveTrustedFolders(
     fs.mkdirSync(dirPath, { recursive: true });
   }
 
-  fs.writeFileSync(
-    trustedFoldersFile.path,
-    JSON.stringify(trustedFoldersFile.config, null, 2),
-    { encoding: 'utf-8', mode: 0o600 },
-  );
+  const content = JSON.stringify(trustedFoldersFile.config, null, 2);
+  const tempPath = `${trustedFoldersFile.path}.tmp.${crypto.randomUUID()}`;
+
+  try {
+    fs.writeFileSync(tempPath, content, {
+      encoding: 'utf-8',
+      mode: 0o600,
+    });
+    fs.renameSync(tempPath, trustedFoldersFile.path);
+  } catch (error) {
+    // Clean up temp file if it was created but rename failed
+    if (fs.existsSync(tempPath)) {
+      try {
+        fs.unlinkSync(tempPath);
+      } catch {
+        // Ignore cleanup errors
+      }
+    }
+    throw error;
+  }
 }
 
 /** Is folder trust feature enabled per the current applied settings */
@@ -257,6 +338,7 @@ export function isFolderTrustEnabled(settings: Settings): boolean {
 function getWorkspaceTrustFromLocalConfig(
   workspaceDir: string,
   trustConfig?: Record<string, TrustLevel>,
+  headlessOptions?: HeadlessModeOptions,
 ): TrustResult {
   const folders = loadTrustedFolders();
   const configToUse = trustConfig ?? folders.user.config;
@@ -270,7 +352,11 @@ function getWorkspaceTrustFromLocalConfig(
     );
   }
 
-  const isTrusted = folders.isPathTrusted(workspaceDir, configToUse);
+  const isTrusted = folders.isPathTrusted(
+    workspaceDir,
+    configToUse,
+    headlessOptions,
+  );
   return {
     isTrusted,
     source: isTrusted !== undefined ? 'file' : undefined,
@@ -281,7 +367,12 @@ export function isWorkspaceTrusted(
   settings: Settings,
   workspaceDir: string = process.cwd(),
   trustConfig?: Record<string, TrustLevel>,
+  headlessOptions?: HeadlessModeOptions,
 ): TrustResult {
+  if (isHeadlessMode(headlessOptions)) {
+    return { isTrusted: true, source: undefined };
+  }
+
   if (!isFolderTrustEnabled(settings)) {
     return { isTrusted: true, source: undefined };
   }
@@ -292,5 +383,9 @@ export function isWorkspaceTrusted(
   }
 
   // Fall back to the local user configuration
-  return getWorkspaceTrustFromLocalConfig(workspaceDir, trustConfig);
+  return getWorkspaceTrustFromLocalConfig(
+    workspaceDir,
+    trustConfig,
+    headlessOptions,
+  );
 }

packages/cli/src/deferred.test.ts

@@ -167,7 +167,15 @@ describe('deferred', () => {
 
       // Now manually run it to verify it captured correctly
       await runDeferredCommand(createMockSettings().merged);
-      expect(originalHandler).toHaveBeenCalledWith(argv);
+      expect(originalHandler).toHaveBeenCalledWith(
+        expect.objectContaining({
+          settings: expect.objectContaining({
+            admin: expect.objectContaining({
+              extensions: expect.objectContaining({ enabled: true }),
+            }),
+          }),
+        }),
+      );
       expect(mockExit).toHaveBeenCalledWith(ExitCodes.SUCCESS);
     });
 

packages/cli/src/deferred.ts

@@ -63,7 +63,13 @@ export async function runDeferredCommand(settings: MergedSettings) {
     process.exit(ExitCodes.FATAL_CONFIG_ERROR);
   }
 
-  await deferredCommand.handler(deferredCommand.argv);
+  // Inject settings into argv
+  const argvWithSettings = {
+    ...deferredCommand.argv,
+    settings,
+  };
+
+  await deferredCommand.handler(argvWithSettings);
   await runExitCleanup();
   process.exit(ExitCodes.SUCCESS);
 }
@@ -80,9 +86,11 @@ export function defer<T = object, U = object>(
     ...commandModule,
     handler: (argv: ArgumentsCamelCase<U>) => {
       setDeferredCommand({
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         handler: commandModule.handler as (
           argv: ArgumentsCamelCase,
         ) => void | Promise<void>,
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         argv: argv as unknown as ArgumentsCamelCase,
         commandName: parentCommandName || 'unknown',
       });

packages/cli/src/gemini.tsx

@@ -510,13 +510,19 @@ export async function main() {
       projectHooks: settings.workspace.settings.hooks,
     });
     loadConfigHandle?.end();
+
+    // Initialize storage immediately after loading config to ensure that
+    // storage-related operations (like listing or resuming sessions) have
+    // access to the project identifier.
+    await config.storage.initialize();
+
     adminControlsListner.setConfig(config);
 
-    if (config.isInteractive() && config.storage && config.getDebugMode()) {
-      const { registerActivityLogger } = await import(
-        './utils/activityLogger.js'
+    if (config.isInteractive() && settings.merged.general.devtools) {
+      const { setupInitialActivityLogger } = await import(
+        './utils/devtoolsService.js'
       );
-      registerActivityLogger(config);
+      await setupInitialActivityLogger(config);
     }
 
     // Register config for telemetry shutdown
@@ -597,12 +603,13 @@ export async function main() {
       }
 
       // This cleanup isn't strictly needed but may help in certain situations.
-      process.on('SIGTERM', () => {
+      const restoreRawMode = () => {
         process.stdin.setRawMode(wasRaw);
-      });
-      process.on('SIGINT', () => {
-        process.stdin.setRawMode(wasRaw);
-      });
+      };
+      process.off('SIGTERM', restoreRawMode);
+      process.on('SIGTERM', restoreRawMode);
+      process.off('SIGINT', restoreRawMode);
+      process.on('SIGINT', restoreRawMode);
     }
 
     await setupTerminalAndTheme(config, settings);
@@ -813,6 +820,7 @@ function setupAdminControlsListener() {
   let config: Config | undefined;
 
   const messageHandler = (msg: unknown) => {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     const message = msg as {
       type?: string;
       settings?: AdminControlsSettings;

packages/cli/src/gemini_cleanup.test.tsx

@@ -38,6 +38,10 @@ vi.mock('@google/gemini-cli-core', async (importOriginal) => {
     disableMouseEvents: vi.fn(),
     enterAlternateScreen: vi.fn(),
     disableLineWrapping: vi.fn(),
+    ProjectRegistry: vi.fn().mockImplementation(() => ({
+      initialize: vi.fn(),
+      getShortId: vi.fn().mockReturnValue('project-slug'),
+    })),
   };
 });
 
@@ -73,6 +77,7 @@ vi.mock('./config/config.js', () => ({
     getSandbox: vi.fn(() => false),
     getQuestion: vi.fn(() => ''),
     isInteractive: () => false,
+    storage: { initialize: vi.fn().mockResolvedValue(undefined) },
   } as unknown as Config),
   parseArguments: vi.fn().mockResolvedValue({}),
   isDebugMode: vi.fn(() => false),
@@ -191,6 +196,7 @@ describe('gemini.tsx main function cleanup', () => {
       getEnableHooks: vi.fn(() => false),
       getHookSystem: () => undefined,
       initialize: vi.fn(),
+      storage: { initialize: vi.fn().mockResolvedValue(undefined) },
       getContentGeneratorConfig: vi.fn(),
       getMcpServers: () => ({}),
       getMcpClientManager: vi.fn(),

packages/cli/src/nonInteractiveCli.test.ts

@@ -38,9 +38,9 @@ import type { LoadedSettings } from './config/settings.js';
 // Mock core modules
 vi.mock('./ui/hooks/atCommandProcessor.js');
 
-const mockRegisterActivityLogger = vi.hoisted(() => vi.fn());
-vi.mock('./utils/activityLogger.js', () => ({
-  registerActivityLogger: mockRegisterActivityLogger,
+const mockSetupInitialActivityLogger = vi.hoisted(() => vi.fn());
+vi.mock('./utils/devtoolsService.js', () => ({
+  setupInitialActivityLogger: mockSetupInitialActivityLogger,
 }));
 
 const mockCoreEvents = vi.hoisted(() => ({
@@ -267,8 +267,8 @@ describe('runNonInteractive', () => {
     // so we no longer expect shutdownTelemetry to be called directly here
   });
 
-  it('should register activity logger when GEMINI_CLI_ACTIVITY_LOG_FILE is set', async () => {
-    vi.stubEnv('GEMINI_CLI_ACTIVITY_LOG_FILE', '/tmp/test.jsonl');
+  it('should register activity logger when GEMINI_CLI_ACTIVITY_LOG_TARGET is set', async () => {
+    vi.stubEnv('GEMINI_CLI_ACTIVITY_LOG_TARGET', '/tmp/test.jsonl');
     const events: ServerGeminiStreamEvent[] = [
       {
         type: GeminiEventType.Finished,
@@ -286,12 +286,12 @@ describe('runNonInteractive', () => {
       prompt_id: 'prompt-id-activity-logger',
     });
 
-    expect(mockRegisterActivityLogger).toHaveBeenCalledWith(mockConfig);
+    expect(mockSetupInitialActivityLogger).toHaveBeenCalledWith(mockConfig);
     vi.unstubAllEnvs();
   });
 
-  it('should not register activity logger when GEMINI_CLI_ACTIVITY_LOG_FILE is not set', async () => {
-    vi.stubEnv('GEMINI_CLI_ACTIVITY_LOG_FILE', '');
+  it('should not register activity logger when GEMINI_CLI_ACTIVITY_LOG_TARGET is not set', async () => {
+    vi.stubEnv('GEMINI_CLI_ACTIVITY_LOG_TARGET', '');
     const events: ServerGeminiStreamEvent[] = [
       {
         type: GeminiEventType.Finished,
@@ -309,7 +309,7 @@ describe('runNonInteractive', () => {
       prompt_id: 'prompt-id-activity-logger-off',
     });
 
-    expect(mockRegisterActivityLogger).not.toHaveBeenCalled();
+    expect(mockSetupInitialActivityLogger).not.toHaveBeenCalled();
     vi.unstubAllEnvs();
   });
 

packages/cli/src/nonInteractiveCli.ts

@@ -71,11 +71,11 @@ export async function runNonInteractive({
       },
     });
 
-    if (config.storage && process.env['GEMINI_CLI_ACTIVITY_LOG_FILE']) {
-      const { registerActivityLogger } = await import(
-        './utils/activityLogger.js'
+    if (process.env['GEMINI_CLI_ACTIVITY_LOG_TARGET']) {
+      const { setupInitialActivityLogger } = await import(
+        './utils/devtoolsService.js'
       );
-      registerActivityLogger(config);
+      await setupInitialActivityLogger(config);
     }
 
     const { stdout: workingStdout } = createWorkingStdio();
@@ -250,6 +250,7 @@ export async function runNonInteractive({
         // Otherwise, slashCommandResult falls through to the default prompt
         // handling.
         if (slashCommandResult) {
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
           query = slashCommandResult as Part[];
         }
       }
@@ -271,6 +272,7 @@ export async function runNonInteractive({
             error || 'Exiting due to an error processing the @ command.',
           );
         }
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         query = processedQuery as Part[];
       }
 

packages/cli/src/services/BuiltinCommandLoader.test.ts

@@ -85,6 +85,9 @@ vi.mock('../ui/commands/extensionsCommand.js', () => ({
   extensionsCommand: () => ({}),
 }));
 vi.mock('../ui/commands/helpCommand.js', () => ({ helpCommand: {} }));
+vi.mock('../ui/commands/shortcutsCommand.js', () => ({
+  shortcutsCommand: {},
+}));
 vi.mock('../ui/commands/memoryCommand.js', () => ({ memoryCommand: {} }));
 vi.mock('../ui/commands/modelCommand.js', () => ({
   modelCommand: { name: 'model' },

packages/cli/src/services/BuiltinCommandLoader.ts

@@ -31,6 +31,7 @@ import { directoryCommand } from '../ui/commands/directoryCommand.js';
 import { editorCommand } from '../ui/commands/editorCommand.js';
 import { extensionsCommand } from '../ui/commands/extensionsCommand.js';
 import { helpCommand } from '../ui/commands/helpCommand.js';
+import { shortcutsCommand } from '../ui/commands/shortcutsCommand.js';
 import { rewindCommand } from '../ui/commands/rewindCommand.js';
 import { hooksCommand } from '../ui/commands/hooksCommand.js';
 import { ideCommand } from '../ui/commands/ideCommand.js';
@@ -116,6 +117,7 @@ export class BuiltinCommandLoader implements ICommandLoader {
           ]
         : [extensionsCommand(this.config?.getEnableExtensionReloading())]),
       helpCommand,
+      shortcutsCommand,
       ...(this.config?.getEnableHooksUI() ? [hooksCommand] : []),
       rewindCommand,
       await ideCommand(),

packages/cli/src/services/FileCommandLoader.ts

@@ -125,6 +125,7 @@ export class FileCommandLoader implements ICommandLoader {
       } catch (error) {
         if (
           !signal.aborted &&
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
           (error as { code?: string })?.code !== 'ENOENT'
         ) {
           coreEvents.emitFeedback(

packages/cli/src/test-utils/async.ts

@@ -5,6 +5,7 @@
  */
 
 import { act } from 'react';
+import { vi } from 'vitest';
 
 // The waitFor from vitest doesn't properly wrap in act(), so we have to
 // implement our own like the one in @testing-library/react
@@ -13,7 +14,7 @@ import { act } from 'react';
 // for React state updates.
 export async function waitFor(
   assertion: () => void,
-  { timeout = 1000, interval = 50 } = {},
+  { timeout = 2000, interval = 50 } = {},
 ): Promise<void> {
   const startTime = Date.now();
 
@@ -27,7 +28,11 @@ export async function waitFor(
       }
 
       await act(async () => {
-        await new Promise((resolve) => setTimeout(resolve, interval));
+        if (vi.isFakeTimers()) {
+          await vi.advanceTimersByTimeAsync(interval);
+        } else {
+          await new Promise((resolve) => setTimeout(resolve, interval));
+        }
       });
     }
   }

packages/cli/src/test-utils/customMatchers.ts

@@ -21,7 +21,7 @@ import type { TextBuffer } from '../ui/components/shared/text-buffer.js';
 const invalidCharsRegex = /[\b\x1b]/;
 
 function toHaveOnlyValidCharacters(this: Assertion, buffer: TextBuffer) {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
   const { isNot } = this as any;
   let pass = true;
   const invalidLines: Array<{ line: number; content: string }> = [];
@@ -50,6 +50,7 @@ function toHaveOnlyValidCharacters(this: Assertion, buffer: TextBuffer) {
   };
 }
 
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
 expect.extend({
   toHaveOnlyValidCharacters,
   // eslint-disable-next-line @typescript-eslint/no-explicit-any

packages/cli/src/test-utils/mockCommandContext.ts

@@ -38,12 +38,14 @@ export const createMockCommandContext = (
     },
     services: {
       config: null,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       settings: {
         merged: defaultMergedSettings,
         setValue: vi.fn(),
         forScope: vi.fn().mockReturnValue({ settings: {} }),
       } as unknown as LoadedSettings,
       git: undefined as GitService | undefined,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       logger: {
         log: vi.fn(),
         logMessage: vi.fn(),
@@ -52,6 +54,7 @@ export const createMockCommandContext = (
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
       } as any, // Cast because Logger is a class.
     },
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     ui: {
       addItem: vi.fn(),
       clear: vi.fn(),
@@ -60,6 +63,7 @@ export const createMockCommandContext = (
       setPendingItem: vi.fn(),
       loadHistory: vi.fn(),
       toggleCorgiMode: vi.fn(),
+      toggleShortcutsHelp: vi.fn(),
       toggleVimEnabled: vi.fn(),
       openAgentConfigDialog: vi.fn(),
       closeAgentConfigDialog: vi.fn(),
@@ -69,6 +73,7 @@ export const createMockCommandContext = (
     } as any,
     session: {
       sessionShellAllowlist: new Set<string>(),
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
       stats: {
         sessionStartTime: new Date(),
         lastPromptTokenCount: 0,