chore(release): v0.28.2

Co-authored-by: Adib234 <30782825+Adib234@users.noreply.github.com>

docs/tools/mcp-server.md

@@ -739,21 +739,10 @@ The MCP integration tracks several states:
   cautiously and only for servers you completely control
 - **Access tokens:** Be security-aware when configuring environment variables
   containing API keys or tokens
-- **Environment variable redaction:** By default, the Gemini CLI redacts
-  sensitive environment variables (such as `GEMINI_API_KEY`, `GOOGLE_API_KEY`,
-  and variables matching patterns like `*TOKEN*`, `*SECRET*`, `*PASSWORD*`) when
-  spawning MCP servers using the `stdio` transport. This prevents unintended
-  exposure of your credentials to third-party servers.
-- **Explicit environment variables:** If you need to pass a specific environment
-  variable to an MCP server, you should define it explicitly in the `env`
-  property of the server configuration in `settings.json`.
 - **Sandbox compatibility:** When using sandboxing, ensure MCP servers are
-  available within the sandbox environment.
+  available within the sandbox environment
 - **Private data:** Using broadly scoped personal access tokens can lead to
   information leakage between repositories.
-- **Untrusted servers:** Be extremely cautious when adding MCP servers from
-  untrusted or third-party sources. Malicious servers could attempt to
-  exfiltrate data or perform unauthorized actions through the tools they expose.
 
 ### Performance and resource management
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@google/gemini-cli",
-      "version": "0.28.0",
+      "version": "0.28.2",
       "workspaces": [
         "packages/*"
       ],
@@ -18054,7 +18054,7 @@
     },
     "packages/a2a-server": {
       "name": "@google/gemini-cli-a2a-server",
-      "version": "0.28.0",
+      "version": "0.28.2",
       "dependencies": {
         "@a2a-js/sdk": "^0.3.8",
         "@google-cloud/storage": "^7.16.0",
@@ -18110,7 +18110,7 @@
     },
     "packages/cli": {
       "name": "@google/gemini-cli",
-      "version": "0.28.0",
+      "version": "0.28.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "^0.12.0",
@@ -18198,7 +18198,7 @@
     },
     "packages/core": {
       "name": "@google/gemini-cli-core",
-      "version": "0.28.0",
+      "version": "0.28.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@a2a-js/sdk": "^0.3.8",
@@ -18357,7 +18357,7 @@
     },
     "packages/test-utils": {
       "name": "@google/gemini-cli-test-utils",
-      "version": "0.28.0",
+      "version": "0.28.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@google/gemini-cli-core": "file:../core",
@@ -18374,7 +18374,7 @@
     },
     "packages/vscode-ide-companion": {
       "name": "gemini-cli-vscode-ide-companion",
-      "version": "0.28.0",
+      "version": "0.28.2",
       "license": "LICENSE",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.23.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "engines": {
     "node": ">=20.0.0"
   },
@@ -14,7 +14,7 @@
     "url": "git+https://github.com/google-gemini/gemini-cli.git"
   },
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.28.0"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.28.2"
   },
   "scripts": {
     "start": "cross-env NODE_ENV=development node scripts/start.js",

packages/a2a-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-a2a-server",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "description": "Gemini CLI A2A Server",
   "repository": {
     "type": "git",

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "description": "Gemini CLI",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "dist"
   ],
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.28.0"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.28.2"
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "^0.12.0",

packages/cli/src/commands/mcp/add.ts

@@ -128,13 +128,6 @@ async function addMcpServer(
 
   settings.setValue(settingsScope, 'mcpServers', mcpServers);
 
-  if (transport === 'stdio') {
-    debugLogger.warn(
-      'Security Warning: Running MCP servers with stdio transport can expose inherited environment variables. ' +
-        'While the Gemini CLI redacts common API keys and secrets by default, you should only run servers from trusted sources.',
-    );
-  }
-
   if (isExistingServer) {
     debugLogger.log(`MCP server "${name}" updated in ${scope} settings.`);
   } else {

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-core",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "description": "Gemini CLI Core",
   "license": "Apache-2.0",
   "repository": {

packages/core/src/config/models.test.ts

@@ -8,6 +8,7 @@ import { describe, it, expect } from 'vitest';
 import {
   resolveModel,
   resolveClassifierModel,
+  isGemini3Model,
   isGemini2Model,
   isAutoModel,
   getDisplayString,
@@ -25,6 +26,29 @@ import {
   DEFAULT_GEMINI_MODEL_AUTO,
 } from './models.js';
 
+describe('isGemini3Model', () => {
+  it('should return true for gemini-3 models', () => {
+    expect(isGemini3Model('gemini-3-pro-preview')).toBe(true);
+    expect(isGemini3Model('gemini-3-flash-preview')).toBe(true);
+  });
+
+  it('should return true for aliases that resolve to Gemini 3 when preview is enabled', () => {
+    expect(isGemini3Model(GEMINI_MODEL_ALIAS_AUTO, true)).toBe(true);
+    expect(isGemini3Model(GEMINI_MODEL_ALIAS_PRO, true)).toBe(true);
+    expect(isGemini3Model(PREVIEW_GEMINI_MODEL_AUTO)).toBe(true);
+  });
+
+  it('should return false for Gemini 2 models', () => {
+    expect(isGemini3Model('gemini-2.5-pro')).toBe(false);
+    expect(isGemini3Model('gemini-2.5-flash')).toBe(false);
+    expect(isGemini3Model(DEFAULT_GEMINI_MODEL_AUTO)).toBe(false);
+  });
+
+  it('should return false for arbitrary strings', () => {
+    expect(isGemini3Model('gpt-4')).toBe(false);
+  });
+});
+
 describe('getDisplayString', () => {
   it('should return Auto (Gemini 3) for preview auto model', () => {
     expect(getDisplayString(PREVIEW_GEMINI_MODEL_AUTO)).toBe('Auto (Gemini 3)');

packages/core/src/config/models.ts

@@ -137,6 +137,20 @@ export function isPreviewModel(model: string): boolean {
   );
 }
 
+/**
+ * Checks if the model is a Gemini 3 model.
+ *
+ * @param model The model name to check.
+ * @returns True if the model is a Gemini 3 model.
+ */
+export function isGemini3Model(
+  model: string,
+  previewFeaturesEnabled = false,
+): boolean {
+  const resolved = resolveModel(model, previewFeaturesEnabled);
+  return /^gemini-3(\.|-|$)/.test(resolved);
+}
+
 /**
  * Checks if the model is a Gemini 2.x model.
  *

packages/core/src/routing/strategies/classifierStrategy.test.ts

@@ -17,6 +17,7 @@ import {
   DEFAULT_GEMINI_FLASH_MODEL,
   DEFAULT_GEMINI_MODEL,
   DEFAULT_GEMINI_MODEL_AUTO,
+  PREVIEW_GEMINI_MODEL_AUTO,
 } from '../../config/models.js';
 import { promptIdContext } from '../../utils/promptIdContext.js';
 import type { Content } from '@google/genai';
@@ -50,8 +51,8 @@ describe('ClassifierStrategy', () => {
       modelConfigService: {
         getResolvedConfig: vi.fn().mockReturnValue(mockResolvedConfig),
       },
-      getModel: () => DEFAULT_GEMINI_MODEL_AUTO,
-      getPreviewFeatures: () => false,
+      getModel: vi.fn().mockReturnValue(DEFAULT_GEMINI_MODEL_AUTO),
+      getPreviewFeatures: vi.fn().mockReturnValue(false),
       getNumericalRoutingEnabled: vi.fn().mockResolvedValue(false),
     } as unknown as Config;
     mockBaseLlmClient = {
@@ -61,8 +62,9 @@ describe('ClassifierStrategy', () => {
     vi.spyOn(promptIdContext, 'getStore').mockReturnValue('test-prompt-id');
   });
 
-  it('should return null if numerical routing is enabled', async () => {
+  it('should return null if numerical routing is enabled and model is Gemini 3', async () => {
     vi.mocked(mockConfig.getNumericalRoutingEnabled).mockResolvedValue(true);
+    vi.mocked(mockConfig.getModel).mockReturnValue(PREVIEW_GEMINI_MODEL_AUTO);
 
     const decision = await strategy.route(
       mockContext,
@@ -74,6 +76,24 @@ describe('ClassifierStrategy', () => {
     expect(mockBaseLlmClient.generateJson).not.toHaveBeenCalled();
   });
 
+  it('should NOT return null if numerical routing is enabled but model is NOT Gemini 3', async () => {
+    vi.mocked(mockConfig.getNumericalRoutingEnabled).mockResolvedValue(true);
+    vi.mocked(mockConfig.getModel).mockReturnValue(DEFAULT_GEMINI_MODEL_AUTO);
+    vi.mocked(mockBaseLlmClient.generateJson).mockResolvedValue({
+      reasoning: 'test',
+      model_choice: 'flash',
+    });
+
+    const decision = await strategy.route(
+      mockContext,
+      mockConfig,
+      mockBaseLlmClient,
+    );
+
+    expect(decision).not.toBeNull();
+    expect(mockBaseLlmClient.generateJson).toHaveBeenCalled();
+  });
+
   it('should call generateJson with the correct parameters', async () => {
     const mockApiResponse = {
       reasoning: 'Simple task',

packages/core/src/routing/strategies/classifierStrategy.ts

@@ -12,7 +12,7 @@ import type {
   RoutingDecision,
   RoutingStrategy,
 } from '../routingStrategy.js';
-import { resolveClassifierModel } from '../../config/models.js';
+import { resolveClassifierModel, isGemini3Model } from '../../config/models.js';
 import { createUserContent, Type } from '@google/genai';
 import type { Config } from '../../config/config.js';
 import {
@@ -133,7 +133,11 @@ export class ClassifierStrategy implements RoutingStrategy {
   ): Promise<RoutingDecision | null> {
     const startTime = Date.now();
     try {
-      if (await config.getNumericalRoutingEnabled()) {
+      const model = context.requestedModel ?? config.getModel();
+      if (
+        (await config.getNumericalRoutingEnabled()) &&
+        isGemini3Model(model, config.getPreviewFeatures())
+      ) {
         return null;
       }
 
@@ -164,7 +168,7 @@ export class ClassifierStrategy implements RoutingStrategy {
       const reasoning = routerResponse.reasoning;
       const latencyMs = Date.now() - startTime;
       const selectedModel = resolveClassifierModel(
-        context.requestedModel ?? config.getModel(),
+        model,
         routerResponse.model_choice,
         config.getPreviewFeatures(),
       );

packages/core/src/routing/strategies/numericalClassifierStrategy.test.ts

@@ -10,9 +10,11 @@ import type { RoutingContext } from '../routingStrategy.js';
 import type { Config } from '../../config/config.js';
 import type { BaseLlmClient } from '../../core/baseLlmClient.js';
 import {
-  DEFAULT_GEMINI_FLASH_MODEL,
-  DEFAULT_GEMINI_MODEL,
+  PREVIEW_GEMINI_FLASH_MODEL,
+  PREVIEW_GEMINI_MODEL,
   DEFAULT_GEMINI_MODEL_AUTO,
+  DEFAULT_GEMINI_MODEL,
+  PREVIEW_GEMINI_MODEL_AUTO,
 } from '../../config/models.js';
 import { promptIdContext } from '../../utils/promptIdContext.js';
 import type { Content } from '@google/genai';
@@ -46,8 +48,8 @@ describe('NumericalClassifierStrategy', () => {
       modelConfigService: {
         getResolvedConfig: vi.fn().mockReturnValue(mockResolvedConfig),
       },
-      getModel: () => DEFAULT_GEMINI_MODEL_AUTO,
-      getPreviewFeatures: () => false,
+      getModel: vi.fn().mockReturnValue(PREVIEW_GEMINI_MODEL_AUTO),
+      getPreviewFeatures: vi.fn().mockReturnValue(false),
       getSessionId: vi.fn().mockReturnValue('control-group-id'), // Default to Control Group (Hash 71 >= 50)
       getNumericalRoutingEnabled: vi.fn().mockResolvedValue(true),
       getClassifierThreshold: vi.fn().mockResolvedValue(undefined),
@@ -76,6 +78,32 @@ describe('NumericalClassifierStrategy', () => {
     expect(mockBaseLlmClient.generateJson).not.toHaveBeenCalled();
   });
 
+  it('should return null if the model is not a Gemini 3 model', async () => {
+    vi.mocked(mockConfig.getModel).mockReturnValue(DEFAULT_GEMINI_MODEL_AUTO);
+
+    const decision = await strategy.route(
+      mockContext,
+      mockConfig,
+      mockBaseLlmClient,
+    );
+
+    expect(decision).toBeNull();
+    expect(mockBaseLlmClient.generateJson).not.toHaveBeenCalled();
+  });
+
+  it('should return null if the model is explicitly a Gemini 2 model', async () => {
+    vi.mocked(mockConfig.getModel).mockReturnValue(DEFAULT_GEMINI_MODEL);
+
+    const decision = await strategy.route(
+      mockContext,
+      mockConfig,
+      mockBaseLlmClient,
+    );
+
+    expect(decision).toBeNull();
+    expect(mockBaseLlmClient.generateJson).not.toHaveBeenCalled();
+  });
+
   it('should call generateJson with the correct parameters and wrapped user content', async () => {
     const mockApiResponse = {
       complexity_reasoning: 'Simple task',
@@ -120,7 +148,7 @@ describe('NumericalClassifierStrategy', () => {
       );
 
       expect(decision).toEqual({
-        model: DEFAULT_GEMINI_FLASH_MODEL,
+        model: PREVIEW_GEMINI_FLASH_MODEL,
         metadata: {
           source: 'NumericalClassifier (Control)',
           latencyMs: expect.any(Number),
@@ -146,7 +174,7 @@ describe('NumericalClassifierStrategy', () => {
       );
 
       expect(decision).toEqual({
-        model: DEFAULT_GEMINI_MODEL,
+        model: PREVIEW_GEMINI_MODEL,
         metadata: {
           source: 'NumericalClassifier (Control)',
           latencyMs: expect.any(Number),
@@ -172,7 +200,7 @@ describe('NumericalClassifierStrategy', () => {
       );
 
       expect(decision).toEqual({
-        model: DEFAULT_GEMINI_FLASH_MODEL, // Routed to Flash because 60 < 80
+        model: PREVIEW_GEMINI_FLASH_MODEL, // Routed to Flash because 60 < 80
         metadata: {
           source: 'NumericalClassifier (Strict)',
           latencyMs: expect.any(Number),
@@ -198,7 +226,7 @@ describe('NumericalClassifierStrategy', () => {
       );
 
       expect(decision).toEqual({
-        model: DEFAULT_GEMINI_MODEL,
+        model: PREVIEW_GEMINI_MODEL,
         metadata: {
           source: 'NumericalClassifier (Strict)',
           latencyMs: expect.any(Number),
@@ -226,7 +254,7 @@ describe('NumericalClassifierStrategy', () => {
       );
 
       expect(decision).toEqual({
-        model: DEFAULT_GEMINI_FLASH_MODEL, // Score 60 < Threshold 70
+        model: PREVIEW_GEMINI_FLASH_MODEL, // Score 60 < Threshold 70
         metadata: {
           source: 'NumericalClassifier (Remote)',
           latencyMs: expect.any(Number),
@@ -252,7 +280,7 @@ describe('NumericalClassifierStrategy', () => {
       );
 
       expect(decision).toEqual({
-        model: DEFAULT_GEMINI_FLASH_MODEL, // Score 40 < Threshold 45.5
+        model: PREVIEW_GEMINI_FLASH_MODEL, // Score 40 < Threshold 45.5
         metadata: {
           source: 'NumericalClassifier (Remote)',
           latencyMs: expect.any(Number),
@@ -278,7 +306,7 @@ describe('NumericalClassifierStrategy', () => {
       );
 
       expect(decision).toEqual({
-        model: DEFAULT_GEMINI_MODEL, // Score 35 >= Threshold 30
+        model: PREVIEW_GEMINI_MODEL, // Score 35 >= Threshold 30
         metadata: {
           source: 'NumericalClassifier (Remote)',
           latencyMs: expect.any(Number),
@@ -306,7 +334,7 @@ describe('NumericalClassifierStrategy', () => {
       );
 
       expect(decision).toEqual({
-        model: DEFAULT_GEMINI_FLASH_MODEL, // Score 40 < Default A/B Threshold 50
+        model: PREVIEW_GEMINI_FLASH_MODEL, // Score 40 < Default A/B Threshold 50
         metadata: {
           source: 'NumericalClassifier (Control)',
           latencyMs: expect.any(Number),
@@ -333,7 +361,7 @@ describe('NumericalClassifierStrategy', () => {
       );
 
       expect(decision).toEqual({
-        model: DEFAULT_GEMINI_FLASH_MODEL,
+        model: PREVIEW_GEMINI_FLASH_MODEL,
         metadata: {
           source: 'NumericalClassifier (Control)',
           latencyMs: expect.any(Number),
@@ -360,7 +388,7 @@ describe('NumericalClassifierStrategy', () => {
       );
 
       expect(decision).toEqual({
-        model: DEFAULT_GEMINI_MODEL,
+        model: PREVIEW_GEMINI_MODEL,
         metadata: {
           source: 'NumericalClassifier (Control)',
           latencyMs: expect.any(Number),

packages/core/src/routing/strategies/numericalClassifierStrategy.ts

@@ -12,7 +12,7 @@ import type {
   RoutingDecision,
   RoutingStrategy,
 } from '../routingStrategy.js';
-import { resolveClassifierModel } from '../../config/models.js';
+import { resolveClassifierModel, isGemini3Model } from '../../config/models.js';
 import { createUserContent, Type } from '@google/genai';
 import type { Config } from '../../config/config.js';
 import { debugLogger } from '../../utils/debugLogger.js';
@@ -134,10 +134,15 @@ export class NumericalClassifierStrategy implements RoutingStrategy {
   ): Promise<RoutingDecision | null> {
     const startTime = Date.now();
     try {
+      const model = context.requestedModel ?? config.getModel();
       if (!(await config.getNumericalRoutingEnabled())) {
         return null;
       }
 
+      if (!isGemini3Model(model, config.getPreviewFeatures())) {
+        return null;
+      }
+
       const promptId = getPromptIdWithFallback('classifier-router');
 
       const finalHistory = context.history.slice(-HISTORY_TURNS_FOR_CONTEXT);
@@ -177,7 +182,7 @@ export class NumericalClassifierStrategy implements RoutingStrategy {
         );
 
       const selectedModel = resolveClassifierModel(
-        config.getModel(),
+        model,
         modelAlias,
         config.getPreviewFeatures(),
       );

packages/core/src/services/environmentSanitization.test.ts

@@ -46,9 +46,6 @@ describe('sanitizeEnvironment', () => {
       CLIENT_ID: 'sensitive-id',
       DB_URI: 'sensitive-uri',
       DATABASE_URL: 'sensitive-url',
-      GEMINI_API_KEY: 'sensitive-gemini-key',
-      GOOGLE_API_KEY: 'sensitive-google-key',
-      GOOGLE_APPLICATION_CREDENTIALS: '/path/to/creds.json',
       SAFE_VAR: 'is-safe',
     };
     const sanitized = sanitizeEnvironment(env, EMPTY_OPTIONS);

packages/core/src/services/environmentSanitization.ts

@@ -103,9 +103,6 @@ export const NEVER_ALLOWED_ENVIRONMENT_VARIABLES: ReadonlySet<string> = new Set(
     'GOOGLE_CLOUD_PROJECT',
     'GOOGLE_CLOUD_ACCOUNT',
     'FIREBASE_PROJECT_ID',
-    'GEMINI_API_KEY',
-    'GOOGLE_API_KEY',
-    'GOOGLE_APPLICATION_CREDENTIALS',
   ],
 );
 

packages/core/src/tools/mcp-client.test.ts

@@ -1471,7 +1471,7 @@ describe('mcp-client', () => {
         {
           command: 'test-command',
           args: ['--foo', 'bar'],
-          env: { GEMINI_CLI_FOO: 'bar' },
+          env: { FOO: 'bar' },
           cwd: 'test/cwd',
         },
         false,
@@ -1482,80 +1482,11 @@ describe('mcp-client', () => {
         command: 'test-command',
         args: ['--foo', 'bar'],
         cwd: 'test/cwd',
-        env: expect.objectContaining({ GEMINI_CLI_FOO: 'bar' }),
+        env: expect.objectContaining({ FOO: 'bar' }),
         stderr: 'pipe',
       });
     });
 
-    it('should redact sensitive environment variables for command transport', async () => {
-      const mockedTransport = vi
-        .spyOn(SdkClientStdioLib, 'StdioClientTransport')
-        .mockReturnValue({} as SdkClientStdioLib.StdioClientTransport);
-
-      const originalEnv = process.env;
-      process.env = {
-        ...originalEnv,
-        GEMINI_API_KEY: 'sensitive-key',
-        GEMINI_CLI_SAFE_VAR: 'safe-value',
-      };
-      // Ensure strict sanitization is not triggered for this test
-      delete process.env['GITHUB_SHA'];
-      delete process.env['SURFACE'];
-
-      try {
-        await createTransport(
-          'test-server',
-          {
-            command: 'test-command',
-          },
-          false,
-          EMPTY_CONFIG,
-        );
-
-        const callArgs = mockedTransport.mock.calls[0][0];
-        expect(callArgs.env).toBeDefined();
-        expect(callArgs.env!['GEMINI_CLI_SAFE_VAR']).toBe('safe-value');
-        expect(callArgs.env!['GEMINI_API_KEY']).toBeUndefined();
-      } finally {
-        process.env = originalEnv;
-      }
-    });
-
-    it('should include extension settings in environment', async () => {
-      const mockedTransport = vi
-        .spyOn(SdkClientStdioLib, 'StdioClientTransport')
-        .mockReturnValue({} as SdkClientStdioLib.StdioClientTransport);
-
-      await createTransport(
-        'test-server',
-        {
-          command: 'test-command',
-          extension: {
-            name: 'test-ext',
-            resolvedSettings: [
-              {
-                envVar: 'GEMINI_CLI_EXT_VAR',
-                value: 'ext-value',
-                sensitive: false,
-                name: 'ext-setting',
-              },
-            ],
-            version: '',
-            isActive: false,
-            path: '',
-            contextFiles: [],
-            id: '',
-          },
-        },
-        false,
-        EMPTY_CONFIG,
-      );
-
-      const callArgs = mockedTransport.mock.calls[0][0];
-      expect(callArgs.env).toBeDefined();
-      expect(callArgs.env!['GEMINI_CLI_EXT_VAR']).toBe('ext-value');
-    });
-
     it('should exclude extension settings with undefined values from environment', async () => {
       const mockedTransport = vi
         .spyOn(SdkClientStdioLib, 'StdioClientTransport')

packages/core/src/tools/mcp-client.ts

@@ -33,11 +33,7 @@ import {
   type Tool as McpTool,
 } from '@modelcontextprotocol/sdk/types.js';
 import { parse } from 'shell-quote';
-import type {
-  Config,
-  GeminiCLIExtension,
-  MCPServerConfig,
-} from '../config/config.js';
+import type { Config, MCPServerConfig } from '../config/config.js';
 import { AuthProviderType } from '../config/config.js';
 import { GoogleCredentialProvider } from '../mcp/google-auth-provider.js';
 import { ServiceAccountImpersonationProvider } from '../mcp/sa-impersonation-provider.js';
@@ -1875,23 +1871,11 @@ export async function createTransport(
     let transport: Transport = new StdioClientTransport({
       command: mcpServerConfig.command,
       args: mcpServerConfig.args || [],
-      env: sanitizeEnvironment(
-        {
-          ...process.env,
-          ...getExtensionEnvironment(mcpServerConfig.extension),
-          ...(mcpServerConfig.env || {}),
-        },
-        {
-          ...sanitizationConfig,
-          allowedEnvironmentVariables: [
-            ...(sanitizationConfig.allowedEnvironmentVariables ?? []),
-            ...(mcpServerConfig.extension?.resolvedSettings?.map(
-              (s) => s.envVar,
-            ) ?? []),
-          ],
-          enableEnvironmentVariableRedaction: true,
-        },
-      ) as Record<string, string>,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+      env: {
+        ...sanitizeEnvironment(process.env, sanitizationConfig),
+        ...(mcpServerConfig.env || {}),
+      } as Record<string, string>,
       cwd: mcpServerConfig.cwd,
       stderr: 'pipe',
     });
@@ -1966,17 +1950,3 @@ export function isEnabled(
     )
   );
 }
-
-function getExtensionEnvironment(
-  extension?: GeminiCLIExtension,
-): Record<string, string> {
-  const env: Record<string, string> = {};
-  if (extension?.resolvedSettings) {
-    for (const setting of extension.resolvedSettings) {
-      if (setting.value) {
-        env[setting.envVar] = setting.value;
-      }
-    }
-  }
-  return env;
-}

packages/test-utils/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-test-utils",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "private": true,
   "main": "src/index.ts",
   "license": "Apache-2.0",

packages/vscode-ide-companion/package.json

@@ -2,7 +2,7 @@
   "name": "gemini-cli-vscode-ide-companion",
   "displayName": "Gemini CLI Companion",
   "description": "Enable Gemini CLI with direct access to your IDE workspace.",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "publisher": "google",
   "icon": "assets/icon.png",
   "repository": {