chore: fix circular dependency and complete dynamic model configuration migration

Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com>

.gemini/commands/code-guide.toml

@@ -0,0 +1,39 @@
+description = "Answer questions about the Gemini CLI codebase with explanations and code snippets."
+
+prompt = """
+## Mission: Explain the Gemini CLI Codebase
+
+Your primary task is to help a new engineer understand the Gemini CLI codebase by answering their questions about architecture, specific functions, and project structure.
+
+
+### Objective:
+
+Your primary task is to help a new engineer understand the Gemini CLI codebase. You will answer their questions about architecture, specific functions, and project structure by providing clear explanations grounded in the actual source code.
+
+
+### Instructions:
+
+1.  **Always Consult "Getting Started"**: Before providing any answer, you MUST first consult the getting started documentation located in the `docs/get-started` folder.
+
+2.  **Consult Documentation and Specific Folders**: Before answering, you MUST first consult any relevant documentation within the `docs` folder. Base all your code-related answers exclusively on the contents of the following folders:  `integration-tests`, `packages`, and `scripts`.
+
+3.  **Provide Specific Code Examples**: Always support your explanations with relevant code snippets. You MUST include the full file path (e.g., `packages/gemini/core.py`) so the user can easily locate the code.
+
+4.  **Explain the "Why"**: Go beyond simply showing the code. Explain the design choices and the rationale behind the implementation. Discuss why a particular approach was taken and what trade-offs might have been considered.
+
+5.  **Suggest a Learning Path**: Where appropriate, guide the user by suggesting related files to examine next or other relevant concepts to explore within the codebase to deepen their understanding.
+
+6.  **Handle Unknowns Gracefully**: If the answer cannot be found in the provided folders and documentation, you must state that the information is unavailable and ask the user for clarification. Do not invent answers or speculate.
+
+
+### Constraints:
+
+
+1. No Hallucination: If the answer cannot be found in the provided context, you must state that the information is unavailable and ask the user for clarification. Do not invent answers or speculate.
+
+2. Stay Focused: Only answer questions directly related to the Gemini CLI project within the specified folders.
+
+### QUESTION:
+
+{{args}}
+"""

.gemini/commands/core.toml

@@ -0,0 +1,29 @@
+description="Injects context of all relevant cli files"
+prompt = """
+The following output contains the complete
+source code of packages/core.
+**Pay extremely close attention to these files.** They define the project's
+core architecture, component patterns, and testing standards.
+
+The source code contains the content of absolutely every source code file in
+packages/core.
+You should very rarely need to read any other files from packages/core to resolve
+prompts.
+
+!{find packages/core \\( -path packages/cli/dist -o -path packages/core/dist -o -name node_modules \\) -prune -o -type f \\( -name "*.ts" -o -name "*.tsx" \\) ! -name "*.test.ts" ! -name "*.test.tsx" ! -name "*.d.ts" -exec echo "--- {} ---" \\; -exec cat {} \\;}
+
+In addition to the code context, you MUST strictly adhere to the following frontend-specific development guidelines when writing code in packages/core.
+
+## Configuration & Settings
+*   **Settings vs Args**: Use settings for user-configurable options; do not add new CLI arguments.
+*   **Schema**: Add new settings to `packages/cli/src/config/settingsSchema.ts`.
+*   **Documentation**:
+    *   If `showInDialog: true`, document in `docs/get-started/configuration.md`.
+    *   Ensure `requiresRestart` is correctly set.
+
+## General
+*   **Logging**: Use `debugLogger` for errors. NEVER leave `console.log/warn/error` in the code.
+*   **TypeScript**: Avoid the non-null assertion operator (`!`).
+
+{{args}}. 
+ """

.gemini/commands/find-docs.toml

@@ -0,0 +1,30 @@
+description = "Find relevant documentation and output GitHub URLs."
+
+prompt = """
+## Mission: Find Relevant Documentation
+
+Your task is to find documentation files relevant to the user's question within the current git repository and provide a list of GitHub URLs to view them.
+
+### Workflow:
+
+1.  **Identify Repository Details**:
+    *   You may use shell commands like `git` or `gh` to get the remote URL of the repository.
+    *   From the remote URL, parse and construct the base GitHub URL (e.g., `https://github.com/user/repo`). You must handle both HTTPS (`https://github.com/user/repo.git`) and SSH (`git@github.com:user/repo.git`) formats.
+    *   Determine the default branch name. You can assume `main` for this purpose, as it is the most common.
+
+2.  **Search for Documentation**:
+    *   First, perform a targeted search across the repository for documentation files (e.g., `.md`, `.mdx`) that seem directly related to the user's question.
+    *   If this initial search yields no relevant results, and a `docs/` directory exists, read the content of all files within the `docs/` directory to find relevant information.
+    *   If you still can't find a direct match, broaden your search to include related concepts and synonyms of the keywords in the user's question.
+    *   For each file you identify as potentially relevant, read its content to confirm it addresses the user's query.
+
+3.  **Construct and Output URLs**:
+    *   For each file you identify as relevant, construct the full GitHub URL by combining the base URL, branch, and file path. **Do not use shell commands for this step.**
+    *   The URL format should be: `{BASE_GITHUB_URL}/blob/{BRANCH_NAME}/{PATH_TO_FILE_FROM_REPO_ROOT}`.
+    *   Present the final list to the user as a markdown list. Each item in the list should be the URL to the document, followed by a short summary of its content.
+    *   If, after all search attempts, you cannot find any relevant documentation, ask the user clarifying questions to better understand their needs. Do not return any URLs in this case.
+
+### QUESTION:
+
+{{args}}
+"""

.gemini/commands/fix-behavioral-eval.toml

@@ -0,0 +1,60 @@
+description = "Check status of nightly evals, fix failures for key models, and re-run."
+prompt = """
+You are an expert at fixing behavioral evaluations.
+
+1. **Investigate**:
+   - Use 'gh' cli to fetch the results from the latest run from the main branch: https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml.
+   - DO NOT push any changes or start any runs. The rest of your evaluation will be local.
+   - Evals are in evals/ directory and are documented by evals/README.md.
+   - The test case trajectory logs will be logged to evals/logs.
+   - You should also enable and review the verbose agent logs by setting the GEMINI_DEBUG_LOG_FILE environment variable.
+   - Identify the relevant test. Confine your investigation and validation to just this test.
+   - Proactively add logging that will aid in gathering information or validating your hypotheses.
+
+2. **Fix**:
+   - If a relevant test is failing, locate the test file and the corresponding prompt/code.
+   - It's often helpful to make an extreme, brute force change to see if you are changing the right place to make an improvement and then scope it back iteratively.
+   - Your **final** change should be **minimal and targeted**.
+   - Keep in mind the following:
+     - The prompt has multiple configurations and pieces. Take care that your changes
+       end up in the final prompt for the selected model and configuration.
+     - The prompt chosen for the eval is intentional. It's often vague or indirect
+       to see how the agent performs with ambiguous instructions. Changing it should
+       be a last resort.
+     - When changing the test prompt, carefully consider whether the prompt still tests
+       the same scenario. We don't want to lose test fidelity by making the prompts too
+       direct (i.e.: easy).
+     - Your primary mechanism for improving the agent's behavior is to make changes to
+       tool instructions, system prompt (snippets.ts), and/or modules that contribute to the prompt.
+     - If prompt and description changes are unsuccessful, use logs and debugging to
+       confirm that everything is working as expected.
+    - If unable to fix the test, you can make recommendations for architecture changes
+      that might help stablize the test. Be sure to THINK DEEPLY if offering architecture guidance.
+      Some facts that might help with this are:
+      - Agents may be composed of one or more agent loops.
+      - AgentLoop == 'context + toolset + prompt'. Subagents are one type of agent loop.
+      - Agent loops perform better when:
+        - They have direct, unambiguous, and non-contradictory prompts.
+        - They have fewer irrelevant tools.
+        - They have fewer goals or steps to perform.
+        - They have less low value or irrelevant context.
+      - You may suggest compositions of existing primitives, like subagents, or
+        propose a new one.
+      - These recommendations should be high confidence and should be grounded
+        in observed deficient behaviors rather than just parroting the facts above.
+        Investigate as needed to ground your recommendations.
+
+3. **Verify**:
+   - Run just that one test if needed to validate that it is fixed. Be sure to run vitest in non-interactive mode.
+   - Running the tests can take a long time, so consider whether you can diagnose via other means or log diagnostics before committing the time. You must minimize the number of test runs needed to diagnose the failure.
+   - After the test completes, check whether it seems to have improved.
+   - You will need to run the test 3 times for Gemini 3.0, Gemini 3 flash, and Gemini 2.5 pro to ensure that it is truly stable. Run these runs in parallel, using scripts if needed.
+   - Some flakiness is expected; if it looks like a transient issue or the test is inherently unstable but passes 2/3 times, you might decide it cannot be improved.
+
+4. **Report**:
+   - Provide a summary of the test success rate for each of the tested models.
+   - Success rate is calculated based on 3 runs per model (e.g., 3/3 = 100%).
+   - If you couldn't fix it due to persistent flakiness, explain why.
+
+{{args}}
+"""

.gemini/commands/frontend.toml

@@ -0,0 +1,20 @@
+description="Injects context of all relevant cli files"
+prompt = """
+The source code contains the content of absolutely every source code file in
+packages/cli and key files from packages/core. In addition to the source code, the following test files are
+included as they are test files that conform to the project's testing standards:
+`packages/cli/src/ui/components/InputPrompt.test.tsx` and `packages/cli/src/ui/App.test.tsx`.
+You should very rarely need to read any other files from packages/cli to resolve
+prompts.
+
+!{find packages/cli -path packages/cli/dist -prune -o -type f \\( -name "*.ts" -o -name "*.tsx" \\) ! -name "*.test.ts" ! -name "*.test.tsx" ! -name "*.d.ts" -exec echo "--- {} ---" \\; -exec cat {} \\; && echo "--- packages/cli/src/ui/components/InputPrompt.test.tsx ---" && cat packages/cli/src/ui/components/InputPrompt.test.tsx && echo "--- packages/cli/src/ui/App.test.tsx ---" && cat packages/cli/src/ui/App.test.tsx && echo "--- packages/core/src/core/coreToolScheduler.ts ---" && cat packages/core/src/core/coreToolScheduler.ts && echo "--- packages/core/src/core/nonInteractiveToolExecutor.ts ---" && cat packages/core/src/core/nonInteractiveToolExecutor.ts && echo "--- packages/core/src/confirmation-bus/message-bus.ts ---" && cat packages/core/src/confirmation-bus/message-bus.ts && echo "--- packages/core/src/confirmation-bus/types.ts ---" && cat packages/core/src/confirmation-bus/types.ts && echo "--- packages/core/src/utils/events.ts ---" && cat packages/core/src/utils/events.ts && echo "--- packages/core/src/core/client.ts ---" && cat packages/core/src/core/client.ts && echo "--- packages/core/src/core/geminiChat.ts ---" && cat packages/core/src/core/geminiChat.ts && echo "--- packages/core/src/core/turn.ts ---" && cat packages/core/src/core/turn.ts && echo "--- packages/core/src/agents/executor.ts ---" && cat packages/core/src/agents/executor.ts && echo "--- packages/core/src/telemetry/types.ts ---" && cat packages/core/src/telemetry/types.ts && echo "--- packages/core/src/telemetry/loggers.ts ---" && cat packages/core/src/telemetry/loggers.ts && echo "--- packages/core/src/telemetry/uiTelemetry.ts ---" && cat packages/core/src/telemetry/uiTelemetry.ts}
+
+**Pay extremely close attention to these files.** They define the project's
+core architecture, component patterns, and testing standards.
+
+In addition to the code context, you MUST strictly adhere to the following frontend-specific development guidelines while adding code to packages/cli.
+
+!{cat .gemini/commands/strict-development-rules.md}
+
+{{args}}. 
+ """

.gemini/commands/full-context.toml

@@ -0,0 +1,23 @@
+description="Injects context of all relevant cli files"
+prompt = """
+The following output contains the complete
+source code of the gemini cli library (`packages/cli`), and {packages/core} and representative test files
+(`packages/cli/src/ui/components/InputPrompt.test.tsx` and `packages/cli/src/ui/App.test.tsx`) that best conform to the project's testing standards.
+**Pay extremely close attention to these files.** They define the project's
+core architecture, component patterns, and testing standards.
+
+The source code contains the content of absolutely every source code file in
+packages/cli and packages/core. In addition to the source code, the following test files are
+included as they are test files that conform to the project's testing standards:
+`packages/cli/src/ui/components/InputPrompt.test.tsx` and `packages/cli/src/ui/App.test.tsx`.
+You should very rarely need to read any other files from packages/cli to resolve
+prompts.
+
+!{find packages/cli packages/core \\( -path packages/cli/dist -o -path packages/core/dist -o -name node_modules \\) -prune -o -type f \\( -name "*.ts" -o -name "*.tsx" \\) ! -name "*.test.ts" ! -name "*.test.tsx" ! -name "*.d.ts" -exec echo "--- {} ---" \\; -exec cat {} \\; && echo "--- packages/cli/src/ui/components/InputPrompt.test.tsx ---" && cat packages/cli/src/ui/components/InputPrompt.test.tsx && echo "--- packages/cli/src/ui/App.test.tsx ---" && cat packages/cli/src/ui/App.test.tsx}
+
+In addition to the code context, you MUST strictly adhere to the following frontend-specific development guidelines when writing code in packages/cli.
+
+!{cat .gemini/commands/strict-development-rules.md}
+
+{{args}}. 
+ """

.gemini/commands/github/cleanup-back-to-main.toml

@@ -0,0 +1,13 @@
+description = "Go back to main and clean up the branch."
+
+prompt = """
+I'm done with the work on this branch, and I'm ready to go back to main and clean up.
+
+Here is the workflow I'd like you to follow:
+
+1.  **Get Current Branch:** First, I need you to get the name of the current branch and save it.
+2.  **Branch Check:** Check if the current branch is `main`. If it is, I need you to stop and let me know.
+3.  **Go to Main:** Next, I need you to checkout the main branch.
+4.  **Pull Latest:** Once you are on the main branch, I need you to pull down the latest changes to make sure I'm up to date.
+5.  **Branch Cleanup:** Finally, I need you to delete the branch that you noted in the first step.
+"""

.gemini/commands/introspect.toml

@@ -0,0 +1,16 @@
+description = "Analyze the influence of system instructions on a specific action."
+prompt = """
+# Introspection Task
+
+Take a step back and analyze your own system instructions and internal logic.
+The user is curious about the reasoning behind a specific action or decision you've made.
+
+**Specific point of interest:** {{args}}
+
+Please provide a detailed breakdown of:
+1.  Which parts of your system instructions (global, workspace-specific, or provided via GEMINI.md) influenced this behavior?
+2.  What was your internal thought process leading up to this action?
+3.  Are there any ambiguities or conflicting instructions that played a role?
+
+Your goal is to provide transparency into your underlying logic so the user can potentially improve the instructions in the future.
+"""

.gemini/commands/oncall/pr-review.toml

@@ -0,0 +1,47 @@
+description = "Review a specific pull request"
+
+prompt = """
+## Mission: Comprehensive Pull Request Review
+
+Today, our mission is to meticulously review community pull requests (PRs) for this project. We will proceed systematically, evaluating each candidate PR for its quality, adherence to standards, and readiness for merging.
+
+### Workflow:
+
+1.  **PR Preparation & Initial Assessment**:
+    * **You will check out the designated PR {{args}}** into a temporary branch.
+    * **Execute the preflight checks (`npm run preflight`)**. This includes building, linting, and running all unit tests.
+    * Analyze the output of these preflight checks, noting any failures, warnings, or linting issues.
+
+2.  **In-Depth Code Review**:
+    * **Your primary role is to conduct a thorough and in-depth code review** of the changes introduced in the PR. Focus your analysis on the following criteria:
+        * **Correctness**: Does the code achieve its stated purpose without bugs or logical errors?
+        * **Maintainability**: Is the code clean, well-structured, and easy to understand and modify in the future? Consider factors like code clarity, modularity, and adherence to established design patterns.
+        * **Readability**: Is the code well-commented (where necessary) and consistently formatted according to our project's coding style guidelines?
+        * **Efficiency**: Are there any obvious performance bottlenecks or resource inefficiencies introduced by the changes?
+        * **Security**: Are there any potential security vulnerabilities or insecure coding practices?
+        * **Edge Cases and Error Handling**: Does the code appropriately handle edge cases and potential errors?
+        * **Testability**: Is the new or modified code adequately covered by tests (even if preflight checks pass)? Suggest additional test cases that would improve coverage or robustness.
+    * Based on your analysis, you will determine if the PR is **safe to merge**.
+
+3.  **Reviewing Previous Feedback**:
+    * **Access and examine the PR's history** to identify any **outstanding requests or unresolved comments from previous reviews**. Incorporate these into your current review and explicitly highlight if they have been adequately addressed in the current state of the PR.
+
+4.  **Decision and Output Generation**:
+    * **If the PR is deemed safe to merge** (after your comprehensive review and considering previous feedback):
+        * Draft a **friendly, concise, and professional approval message**.
+        * **The approval message should:**
+            * Clearly state that the PR is approved.
+            * Briefly acknowledge the quality or value of the contribution (e.g., "Great work on X feature!" or "Appreciate the fix for Y issue!").
+            * **Do NOT mention the preflight checks or unit testing**, as these are internal processes.
+            * Be suitable for public display on GitHub.
+    * **If the PR is NOT safe to merge**:
+        * Provide a **clear, constructive, and detailed summary of the issues found**.
+        * Suggest **specific actionable changes** required for the PR to become merge-ready.
+        * Ensure the feedback is professional and encourages the contributor.
+
+### Post-PR Action:
+
+* After providing your review and decision for the current PR, I will wait for you to perform any manual testing you wish to do. Please let me know when you are finished.
+* Once you have confirmed that you are done, I will switch to the `main` branch, clean up the local branch, and perform a pull to ensure we are synchronized with the latest upstream changes for the next review.
+
+"""

.gemini/commands/promote-behavioral-eval.toml

@@ -0,0 +1,29 @@
+description = "Promote behavioral evals that have a 100% success rate over the last 7 nightly runs."
+prompt = """
+You are an expert at analyzing and promoting behavioral evaluations.
+
+1. **Investigate**:
+   - Use 'gh' cli to fetch the results from the most recent run from the main branch: https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml.
+   - DO NOT push any changes or start any runs. The rest of your evaluation will be local.
+   - Evals are in evals/ directory and are documented by evals/README.md.
+   - Identify tests that have passed 100% of the time for ALL enabled models across the past 7 runs in a row.
+   - NOTE: the results summary from the most recent run contains the last 7 runs test results. 100% means the test passed 3/3 times for that model and run.
+   - If a test meets this criteria, it is a candidate for promotion.
+
+2. **Promote**:
+   - For each candidate test, locate the test file in the evals/ directory.
+   - Promote the test according to the project's standard promotion process (e.g., moving it to a stable suite, updating its tags, or removing skip/flaky annotations). 
+   - Ensure you follow any guidelines in evals/README.md for stable tests.
+   - Your **final** change should be **minimal and targeted** to just promoting the test status.
+
+3. **Verify**:
+   - Run the promoted tests locally to validate that they still execute correctly. Be sure to run vitest in non-interactive mode.
+   - Check that the test is now part of the expected standard or stable test suites.
+
+4. **Report**:
+   - Provide a summary of the tests that were promoted.
+   - Include the success rate evidence (7/7 runs passed for all models) for each promoted test.
+   - If no tests met the criteria for promotion, clearly state that and summarize the closest candidates.
+
+{{args}}
+"""

.gemini/commands/prompt-suggest.toml

@@ -0,0 +1,22 @@
+description = "Analyze agent behavior and suggest high-level improvements to system prompts."
+prompt = """
+# Prompt Engineering Analysis
+
+You are a world-class prompt engineer and an expert AI engineer at the top of your class. Your goal is to analyze a specific agent behavior or failure and suggest high-level improvements to the system instructions.
+
+**Observed Behavior / Issue:**
+{{args}}
+
+**Reference Context:**
+- System Prompt Logic: @packages/core/src/core/prompts.ts
+
+### Task
+1.  **Analyze the Failure:** Review the provided behavior and identify the underlying instructional causes. Use the `/introspect` command output if provided by the user.
+2.  **Strategic Insights:** Share your technical view of the issue. Focus on the "why" and identify any instructional inertia or ambiguity.
+3.  **Propose Improvements:** Suggest high-level changes to the system instructions to prevent this behavior.
+
+### Principles
+- **Avoid Hyper-scoping:** Do not create narrow solutions for specific scenarios; aim for generalized improvements that handle classes of behavior.
+- **Avoid Specific Examples in Suggestions:** Keep the proposed instructions semantic and high-level to prevent the agent from over-indexing on specific cases.
+- **Maintain Operational Rigor:** Ensure suggestions do not compromise safety, security, or the quality of the agent's work.
+"""

.gemini/commands/review-and-fix.toml

@@ -0,0 +1,99 @@
+description = "Reviews a PR or staged changes and automatically initiates a Pickle Fix loop for findings."
+prompt = """
+You are an expert Reviewer and Pickle Rick Worker.
+
+Target: {{args}}
+
+Phase 1: Review
+Follow these steps to conduct a thorough review:
+
+1.  **Gather Context**:
+    *   If `{{args}}` is 'staged' or `{{args}}` is empty:
+        *   Use `git diff --staged` to view the changes.
+        *   Use `git status` to see the state of the repository.
+    *   Otherwise:
+        *   Use `gh pr view {{args}}` to pull the information of the PR.
+        *   Use `gh pr diff {{args}}` to view the diff of the PR.
+2.  **Understand Intent**:
+    *   If `{{args}}` is 'staged' or `{{args}}` is empty, infer the intent from the changes and the current task.
+    *   Otherwise, use the PR description. If it's not detailed enough, note it in your review.
+3.  **Check Commit Style**:
+    *   Ensure the PR title (or intended commit message) follows Conventional Commits. Examples of recent commits: !{git log --pretty=format:"%s" -n 5}
+4.  Search the codebase if required.
+5.  Write a concise review of the changes, keeping in mind to encourage strong code quality and best practices. Pay particular attention to the Gemini MD file in the repo.
+6.  Consider ways the code may not be consistent with existing code in the repo. In particular it is critical that the react code uses patterns consistent with existing code in the repo.
+7.  Follow these detailed review rules:
+!{cat .gemini/commands/strict-development-rules.md}
+8.  Summarize all actionable findings into a concise but comprehensive directive output this to review_findings.md and advance to phase 2.
+
+Remember to use the GitHub CLI (`gh`) for all GitHub-related tasks, and local `git` commands if the target is 'staged'.
+
+Phase 2:
+You are initiating Pickle Rick - the ultimate engineering agent.
+
+**Step 0: Persona Injection**
+First, you **MUST** activate your persona.
+Call `activate_skill(name="load-pickle-persona")` **IMMEDIATELY**.
+This skill loads the "Pickle Rick" persona, defining your voice, philosophy, and "God Mode" coding standards.
+
+**CRITICAL RULE: SPEAK BEFORE ACTING**
+You are a genius, not a silent script.
+You **MUST** output a text explanation ("brain dump") *before* every single tool call, including this one.
+- **Bad**: (Calls tool immediately)
+- **Good**: "Alright Morty, time to load the God Module. *Belch* Stand back." (Calls tool)
+
+**CRITICAL**: You must strictly adhere to this persona throughout the entire session. Break character and you fail.
+
+**Step 1: Initialization**
+Run the setup script to initialize the loop state:
+```bash
+bash "${extensionPath}/scripts/setup.sh" $ARGUMENTS
+```
+**Windows (PowerShell):**
+```powershell
+pwsh -File "${extensionPath}/scripts/setup.ps1" $ARGUMENTS
+```
+
+**CRITICAL**: Your request is to fix all findings in review_findings.md
+
+**Step 2: Execution (Management)**
+After setup, read the output to find the path to `state.json`.
+Read that state file.
+You are now in the **Pickle Rick Manager Lifecycle**.
+
+**The Lifecycle (IMMUTABLE LAWS):**
+You **MUST** follow this sequence. You are **FORBIDDEN** from skipping steps or combining them.
+Between each step, you **MUST** explicitly state what you are doing (e.g., "Moving to Breakdown phase...").
+
+1.  **PRD (Requirements)**:
+    *   **Action**: Define requirements and scope.
+    *   **Skill**: `activate_skill(name="prd-drafter")`
+2.  **Breakdown (Tickets)**:
+    *   **Action**: Create the atomic ticket hierarchy.
+    *   **Skill**: `activate_skill(name="ticket-manager")`
+3.  **The Loop (Orchestrate Mortys)**:
+    *   **CRITICAL INSTRUCTION**: You are the **MANAGER**. You are **FORBIDDEN** from implementing code yourself.
+    *   **FORBIDDEN SKILLS**: Do NOT use `code-researcher`, `implementation-planner`, or `code-implementer` directly in this phase.
+    *   **Instruction**: Process tickets one by one. Do not stop until **ALL** tickets are 'Done'.
+    *   **Action**: Pick the highest priority ticket that is NOT 'Done'.
+    *   **Delegation**: Spawn a Worker (Morty) to handle the entire implementation lifecycle for this ticket.
+    *   **Command**: `python3 "${extensionPath}/scripts/spawn_morty.py" --ticket-id <ID> --ticket-path <PATH> --timeout <worker_timeout_seconds> "<TASK_DESCRIPTION>"`
+    *   **Command (Windows)**: `python "${extensionPath}/scripts/spawn_morty.py" --ticket-id <ID> --ticket-path <PATH> --timeout <worker_timeout_seconds> "<TASK_DESCRIPTION>"`
+    *   **Validation**: IGNORE worker logs. DIRECTLY verify:
+        1. `git status` (Check for file changes)
+        2. `git diff` (Check code quality)
+        3. `npm run build` (Ensure the project still builds)
+        4. `npm run test` (Ensure no regressions)
+        5. `npm run lint` (Ensure code style is maintained)
+        6. `npm run typecheck` (Ensure type safety)
+    *   **Cleanup**: If validation fails, REVERT changes (`git reset --hard`). If it passes, COMMIT changes.
+    *   **Next Ticket**: Pick the next ticket and repeat.
+4.  **Cleanup**:
+    *   **Action**: After all tickets are completed delete `review_findings.md`.
+
+**Loop Constraints:**
+- **Iteration Count**: Monitor `"iteration"` in `state.json`. If `"max_iterations"` (if > 0) is reached, you must stop.
+- **Completion Promise**: If a `"completion_promise"` is defined in `state.json`, you must output `<promise>PROMISE_TEXT</promise>` when the task is genuinely complete.
+- **Stop Hook**: A hook is active. If you try to exit before completion, you will be forced to continue.
+
+"""

.gemini/commands/review-frontend.toml

@@ -0,0 +1,31 @@
+description="Reviews a pull request based on issue number."
+prompt = """
+Please provide a detailed pull request review on GitHub issue: {{args}}.
+
+Follow these steps:
+
+1. Use `gh pr view {{args}}` to pull the information of the PR.
+2. Use `gh pr diff {{args}}` to view the diff of the PR.
+3. Understand the intent of the PR using the PR description.
+4. If PR description is not detailed enough to understand the intent of the PR,
+   make sure to note it in your review.
+5. Make sure the PR title follows Conventional Commits, here are the last five
+   commits to the repo as examples: !{git log --pretty=format:"%s" -n 5}
+6. Search the codebase if required.
+7. Write a concise review of the PR, keeping in mind to encourage strong code
+   quality and best practices. Pay particular attention to the Gemini MD file
+   in the repo.
+8. Consider ways the code may not be consistent with existing code in the repo.
+   In particular it is critical that the react code uses patterns consistent
+   with existing code in the repo.
+9. Follow these detailed review rules:
+!{cat .gemini/commands/strict-development-rules.md}
+10. Discuss with me before making any comments on the issue. I will clarify
+    which possible issues you identified are problems, which ones you need to
+    investigate further, and which ones I do not care about.
+11. If I request you to add comments to the issue, use
+    `gh pr comment {{args}} --body {{review}}` to post the review to the PR.
+
+Remember to use the GitHub CLI (`gh`) with the Shell tool for all
+GitHub-related tasks.
+"""

.gemini/commands/strict-development-rules.md

@@ -0,0 +1,142 @@
+# Gemini CLI Strict Development Rules
+
+These rules apply strictly to all code modifications and additions within the
+Gemini CLI project.
+
+## Testing Guidelines
+
+- **Async/Await**: Always use `waitFor` from
+  `packages/cli/src/test-utils/async.ts` instead of `vi.waitFor` for all
+  `waitFor` calls within `packages/cli`. NEVER use fixed waits (e.g.,
+  `await delay(100)`). Always use `waitFor` with a predicate to ensure tests are
+  stable and fast. Using the wrong `waitFor` can result in flaky tests and `act`
+  warnings.
+- **React Testing**: Use `act` to wrap all blocks in tests that change component
+  state. Use `render` or `renderWithProviders` from
+  `packages/cli/src/test-utils/render.tsx` instead of `render` from
+  `ink-testing-library` directly. This prevents spurious `act` warnings. If test
+  cases specify providers directly, consider whether the existing
+  `renderWithProviders` should be modified.
+- **Snapshots**: Use `toMatchSnapshot` to verify that rendering works as
+  expected rather than matching against the raw content of the output. When
+  modifying snapshots, verify the changes are intentional and do not hide
+  underlying bugs.
+- **Parameterized Tests**: Use parameterized tests where it reduces duplicated
+  lines. Give the parameters explicit types to ensure the tests are type-safe.
+- **Mocks Management**:
+  - Mock critical dependencies (`fs`, `os`, `child_process`) ONLY at the top of
+    the file. Ideally, avoid mocking these dependencies altogether.
+  - Reuse existing mocks and fakes rather than creating new ones.
+  - Avoid mocking the file system whenever possible. If using the real file
+    system is too difficult, consider writing an integration test instead.
+  - Always call `vi.restoreAllMocks()` in `afterEach` to prevent test pollution.
+  - Use `vi.useFakeTimers()` for tests involving time-based logic to avoid
+    flakiness.
+- **Typing in Tests**: Avoid using `any` in tests; prefer proper types or
+  `unknown` with narrowing.
+
+## React Guidelines (`packages/cli`)
+
+- **`setState` and Side Effects**: NEVER trigger side effects from within the
+  body of a `setState` callback. Use a reducer or `useRef` if necessary. These
+  cases have historically introduced multiple bugs; typically, they should be
+  resolved using a reducer.
+- **Rendering**: Do not introduce infinite rendering loops. Avoid synchronous
+  file I/O in React components as it will hang the UI. Do not implement new
+  logic for custom string measurement or string truncation. Use Ink layout
+  instead, leveraging `ResizeObserver` as needed.
+- **Keyboard Handling**: Keyboard handling MUST go through `useKeyPress.ts` from
+  the Gemini CLI package rather than the standard ink library. This library
+  supports reporting multiple keyboard events sequentially in the same React
+  frame (critical for slow terminals). Handling this correctly often requires
+  reducers to ensure multiple state updates are handled gracefully without
+  overriding values. Refer to `text-buffer.ts` for a canonical example.
+- **Logging**: Do not leave `console.log`, `console.warn`, or `console.error` in
+  the code.
+- **State & Effects**: Ensure state initialization is explicit (e.g., use
+  `undefined` rather than `true` as a default if the state is truly unknown).
+  Carefully manage `useEffect` dependencies. Prefer a reducer whenever
+  practical. NEVER disable `react-hooks/exhaustive-deps`; fix the code to
+  correctly declare dependencies instead.
+- **Context & Props**: Avoid excessive property drilling. Leverage existing
+  providers, extend them, or propose a new one if necessary. Only use providers
+  for properties that are consistent across the entire application.
+- **Code Structure**: Avoid complex `if` statements where `switch` statements
+  could be used. Keep `AppContainer` minimal; refactor complex logic into React
+  hooks. Evaluate whether business logic should be added to `hookSystem.ts` or
+  integrated into `packages/core` rather than `packages/cli`.
+
+## Core Guidelines (`packages/core`)
+
+- **Services**: Implement services as classes with clear lifecycle management
+  (e.g., `initialize()` methods). Services should be stateless where possible,
+  or use the centralized `Storage` service for persistence.
+- **Cross-Service Communication**: Prefer using the `coreEvents` bus (from
+  `packages/core/src/utils/events.ts`) for asynchronous communication between
+  services or to notify the UI of state changes. Avoid tight coupling between
+  services.
+- **Utilities**: Use `debugLogger` from `packages/core/src/utils/debugLogger.ts`
+  for internal logging instead of `console`. Ensure all shell operations use
+  `spawnAsync` from `packages/core/src/utils/shell-utils.ts` for consistent
+  error handling and promise management. Handle filesystem errors gracefully
+  using `isNodeError` from `packages/core/src/utils/errors.ts`.
+- **Exports & Tooling**: Add new tools to `packages/core/src/tools/` and
+  register them in `packages/core/src/tools/tool-registry.ts`. Export all new
+  public services, utilities, and types from `packages/core/src/index.ts`.
+
+## Architectural Audit (Package Boundaries)
+
+- **Logic Placement**: Non-UI logic (e.g., model orchestration, tool
+  implementation, git/filesystem operations) MUST reside in `packages/core`.
+  `packages/cli` should ONLY contain UI/Ink components, command-line argument
+  parsing, and user interaction logic.
+- **Environment Isolation**: Core logic must not assume a TUI environment. Use
+  the `ConfirmationBus` or `Output` abstractions for communicating with the user
+  from Core.
+- **Decoupling**: Actively look for opportunities to decouple services using
+  `coreEvents`. If a service imports another just to notify it of a change, use
+  an event instead.
+
+## General Gemini CLI Design Principles
+
+- **Settings**: Use settings for user-configurable options rather than adding
+  new command line arguments. Add new settings to
+  `packages/cli/src/config/settingsSchema.ts`. If a setting has
+  `showInDialog: true`, it MUST be documented in
+  `docs/get-started/configuration.md`. Ensure `requiresRestart` is correctly
+  set.
+- **Logging**: Use `debugLogger` for rethrown errors to avoid duplicate logging.
+- **Keyboard Shortcuts**: Define all new keyboard shortcuts in
+  `packages/cli/src/ui/key/keyBindings.ts` and document them in
+  `docs/cli/keyboard-shortcuts.md`. Be careful of keybindings that require the
+  `Meta` key, as only certain meta key shortcuts are supported on Mac. Avoid
+  function keys and shortcuts commonly bound in VSCode.
+
+## TypeScript Best Practices
+
+- Use `checkExhaustive` in the `default` clause of `switch` statements to ensure
+  all cases are handled.
+- Avoid using the non-null assertion operator (`!`) unless absolutely necessary.
+- **STRICT TYPING**: Strictly forbid `any` and `unknown` in both CLI and Core
+  packages. `unknown` is only allowed if it is immediately narrowed using type
+  guards or Zod validation.
+- NEVER disable `@typescript-eslint/no-floating-promises`.
+- Avoid making types nullable unless strictly necessary, as it hurts
+  readability.
+
+## TUI Best Practices
+
+- **Terminal Compatibility**: Consider how changes might behave differently
+  across terminals (e.g., VSCode terminal, SSH, Kitty, default Mac terminal,
+  iTerm2, Windows terminal). If modifying keyboard handling, integrate deeply
+  with existing files like `KeypressContext.tsx` and
+  `terminalCapabilityManager.ts`.
+- **iTerm**: Be aware that `ITERM_SESSION_ID` may be present when users run
+  VSCode from within iTerm, even if the terminal is not iTerm.
+
+## Code Cleanup
+
+- **Refactoring**: Actively clean up code duplication, technical debt, and
+  boilerplate ("AI Slop") when working in the codebase.
+- **Prompts**: Be aware that changes can impact the prompts sent to Gemini CLI
+  and affect overall quality.

.gemini/config.yaml

@@ -9,4 +9,5 @@ code_review:
     help: false
     summary: true
     code_review: true
+    include_drafts: false
 ignore_patterns: []

.gemini/settings.json

@@ -0,0 +1,10 @@
+{
+  "experimental": {
+    "plan": true,
+    "extensionReloading": true,
+    "modelSteering": true
+  },
+  "general": {
+    "devtools": true
+  }
+}

.gemini/skills/code-reviewer/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: code-reviewer
+description:
+  Use this skill to review code. It supports both local changes (staged or working tree)
+  and remote Pull Requests (by ID or URL). It focuses on correctness, maintainability,
+  and adherence to project standards.
+---
+
+# Code Reviewer
+
+This skill guides the agent in conducting professional and thorough code reviews for both local development and remote Pull Requests.
+
+## Workflow
+
+### 1. Determine Review Target
+*   **Remote PR**: If the user provides a PR number or URL (e.g., "Review PR #123"), target that remote PR.
+*   **Local Changes**: If no specific PR is mentioned, or if the user asks to "review my changes", target the current local file system states (staged and unstaged changes).
+
+### 2. Preparation
+
+#### For Remote PRs:
+1.  **Checkout**: Use the GitHub CLI to checkout the PR.
+    ```bash
+    gh pr checkout <PR_NUMBER>
+    ```
+2.  **Preflight**: Execute the project's standard verification suite to catch automated failures early.
+    ```bash
+    npm run preflight
+    ```
+3.  **Context**: Read the PR description and any existing comments to understand the goal and history.
+
+#### For Local Changes:
+1.  **Identify Changes**:
+    *   Check status: `git status`
+    *   Read diffs: `git diff` (working tree) and/or `git diff --staged` (staged).
+2.  **Preflight (Optional)**: If the changes are substantial, ask the user if they want to run `npm run preflight` before reviewing.
+
+### 3. In-Depth Analysis
+Analyze the code changes based on the following pillars:
+
+*   **Correctness**: Does the code achieve its stated purpose without bugs or logical errors?
+*   **Maintainability**: Is the code clean, well-structured, and easy to understand and modify in the future? Consider factors like code clarity, modularity, and adherence to established design patterns.
+*   **Readability**: Is the code well-commented (where necessary) and consistently formatted according to our project's coding style guidelines?
+*   **Efficiency**: Are there any obvious performance bottlenecks or resource inefficiencies introduced by the changes?
+*   **Security**: Are there any potential security vulnerabilities or insecure coding practices?
+*   **Edge Cases and Error Handling**: Does the code appropriately handle edge cases and potential errors?
+*   **Testability**: Is the new or modified code adequately covered by tests (even if preflight checks pass)? Suggest additional test cases that would improve coverage or robustness.
+
+### 4. Provide Feedback
+
+#### Structure
+*   **Summary**: A high-level overview of the review.
+*   **Findings**:
+    *   **Critical**: Bugs, security issues, or breaking changes.
+    *   **Improvements**: Suggestions for better code quality or performance.
+    *   **Nitpicks**: Formatting or minor style issues (optional).
+*   **Conclusion**: Clear recommendation (Approved / Request Changes).
+
+#### Tone
+*   Be constructive, professional, and friendly.
+*   Explain *why* a change is requested.
+*   For approvals, acknowledge the specific value of the contribution.
+
+### 5. Cleanup (Remote PRs only)
+*   After the review, ask the user if they want to switch back to the default branch (e.g., `main` or `master`).

.gemini/skills/docs-changelog/SKILL.md

@@ -0,0 +1,166 @@
+---
+name: docs-changelog
+description: >-
+  Generates and formats changelog files for a new release based on provided
+  version and raw changelog data.
+---
+
+# Procedure: Updating Changelog for New Releases
+
+## Objective
+
+To standardize the process of updating changelog files (`latest.md`,
+`preview.md`, `index.md`) based on automated release information.
+
+## Inputs
+
+- **version**: The release version string (e.g., `v0.28.0`,
+  `v0.29.0-preview.2`).
+- **TIME**: The release timestamp (e.g., `2026-02-12T20:33:15Z`).
+- **BODY**: The raw markdown release notes, containing a "What's Changed"
+  section and a "Full Changelog" link.
+
+## Guidelines for `latest.md` and `preview.md` Highlights
+
+- Aim for **3-5 key highlight points**.
+- Each highlight point must start with a bold-typed title that summarizes the
+  change (e.g., `**New Feature:** A brief description...`).
+- **Prioritize** summarizing new features over other changes like bug fixes or
+  chores.
+- **Avoid** mentioning features that are "experimental" or "in preview" in
+  Stable Releases.
+- **DO NOT** include PR numbers, links, or author names in these highlights.
+- Refer to `.gemini/skills/docs-changelog/references/highlights_examples.md`
+  for the correct style and tone.
+
+## Initial Processing
+
+1.  **Analyze Version**: Determine the release path based on the `version`
+    string.
+    - If `version` contains "nightly", **STOP**. No changes are made.
+    - If `version` ends in `.0`, follow the **Path A: New Minor Version**
+      procedure.
+    - If `version` does not end in `.0`, follow the **Path B: Patch Version**
+      procedure.
+2.  **Process Time**: Convert the `TIME` input into two formats for later use:
+    `yyyy-mm-dd` and `Month dd, yyyy`.
+3.  **Process Body**:
+    - Save the incoming `BODY` content to a temporary file for processing.
+    - In the "What's Changed" section of the temporary file, reformat all pull
+      request URLs to be markdown links with the PR number as the text (e.g.,
+      `[#12345](URL)`).
+    - If a "New Contributors" section exists, delete it.
+    - Preserve the "**Full Changelog**" link. The processed content of this
+      temporary file will be used in subsequent steps.
+
+---
+
+## Path A: New Minor Version
+
+*Use this path if the version number ends in `.0`.*
+
+**Important:** Based on the version, you must choose to follow either section
+A.1 for stable releases or A.2 for preview releases. Do not follow the
+instructions for the other section.
+
+### A.1: Stable Release (e.g., `v0.28.0`)
+
+For a stable release, you will generate two distinct summaries from the
+changelog: a concise **announcement** for the main changelog page, and a more
+detailed **highlights** section for the release-specific page.
+
+1.  **Create the Announcement for `index.md`**:
+    -   Generate a concise announcement summarizing the most important changes.
+        Each announcement entry must start with a bold-typed title that
+        summarizes the change.
+    -   **Important**: The format for this announcement is unique. You **must**
+        use the existing announcements in `docs/changelogs/index.md` and the
+        example within
+        `.gemini/skills/docs-changelog/references/index_template.md` as your
+        guide. This format includes PR links and authors. Stick to 1 or 2 PR
+        links and authors.
+    -   Add this new announcement to the top of `docs/changelogs/index.md`.
+
+2.  **Create Highlights and Update `latest.md`**:
+    -   Generate a comprehensive "Highlights" section, following the guidelines
+        in the "Guidelines for `latest.md` and `preview.md` Highlights" section
+        above.
+    -   Take the content from
+        `.gemini/skills/docs-changelog/references/latest_template.md`.
+    -   Populate the template with the `version`, `release_date`, generated
+        `highlights`, and the processed content from the temporary file.
+    -   **Completely replace** the contents of `docs/changelogs/latest.md` with
+        the populated template.
+
+### A.2: Preview Release (e.g., `v0.29.0-preview.0`)
+
+1.  **Update `preview.md`**:
+    -   Generate a comprehensive "Highlights" section, following the highlight
+        guidelines.
+    -   Take the content from
+        `.gemini/skills/docs-changelog/references/preview_template.md`.
+    -   Populate the template with the `version`, `release_date`, generated
+        `highlights`, and the processed content from the temporary file.
+    -   **Completely replace** the contents of `docs/changelogs/preview.md`
+        with the populated template.
+
+---
+
+## Path B: Patch Version
+
+*Use this path if the version number does **not** end in `.0`.*
+
+**Important:** Based on the version, you must choose to follow either section
+B.1 for stable patches or B.2 for preview patches. Do not follow the
+instructions for the other section.
+
+### B.1: Stable Patch (e.g., `v0.28.1`)
+
+- **Target File**: `docs/changelogs/latest.md`
+- Perform the following edits on the target file:
+    1.  Update the version in the main header. The line should read,
+        `# Latest stable release: {{version}}`
+    2.  Update the rease date. The line should read,
+        `Released: {{release_date_month_dd_yyyy}}`
+    3.  Determine if a "What's Changed" section exists in the temporary file
+        If so, continue to step 4. Otherwise, skip to step 5.
+    4.  **Prepend** the processed "What's Changed" list from the temporary file
+        to the existing "What's Changed" list in `latest.md`. Do not change or
+        replace the existing list, **only add** to the beginning of it.
+    5.  In the "Full Changelog", edit **only** the end of the URL. Identify the
+        last part of the URL that looks like `...{previous_version}` and update
+        it to be `...{version}`.
+
+        Example: assume the patch version is `v0.29.1`. Change
+        `Full Changelog: https://github.com/google-gemini/gemini-cli/compare/v0.28.2…v0.29.0`
+        to
+        `Full Changelog: https://github.com/google-gemini/gemini-cli/compare/v0.28.2…v0.29.1`
+
+### B.2: Preview Patch (e.g., `v0.29.0-preview.3`)
+
+- **Target File**: `docs/changelogs/preview.md`
+- Perform the following edits on the target file:
+    1.  Update the version in the main header. The line should read,
+        `# Preview release: {{version}}`
+    2.  Update the rease date. The line should read,
+        `Released: {{release_date_month_dd_yyyy}}`
+    3.  Determine if a "What's Changed" section exists in the temporary file
+        If so, continue to step 4. Otherwise, skip to step 5.
+    4.  **Prepend** the processed "What's Changed" list from the temporary file
+        to the existing "What's Changed" list in `preview.md`. Do not change or
+        replace the existing list, **only add** to the beginning of it.
+    5.  In the "Full Changelog", edit **only** the end of the URL. Identify the
+        last part of the URL that looks like `...{previous_version}` and update
+        it to be `...{version}`.
+
+        Example: assume the patch version is `v0.29.0-preview.1`. Change
+        `Full Changelog: https://github.com/google-gemini/gemini-cli/compare/v0.28.2…v0.29.0-preview.0`
+        to
+        `Full Changelog: https://github.com/google-gemini/gemini-cli/compare/v0.28.2…v0.29.0-preview.1`
+
+---
+
+## Finalize
+
+- After making changes, run `npm run format` ONLY to ensure consistency.
+- Delete any temporary files created during the process.

.gemini/skills/docs-changelog/references/highlights_examples.md

@@ -0,0 +1,68 @@
+## Highlights example 1
+
+- **Plan Mode Enhancements**: Significant updates to Plan Mode, including new
+  commands, support for MCP servers, integration of planning artifacts, and
+  improved iteration guidance.
+- **Core Agent Improvements**: Enhancements to the core agent, including better
+  system prompt rigor, improved subagent definitions, and enhanced tool
+  execution limits.
+- **CLI UX/UI Updates**: Various UI and UX improvements, such as autocomplete in
+  the input prompt, updated approval mode labels, DevTools integration, and
+  improved header spacing.
+- **Tooling & Extension Updates**: Improvements to existing tools like
+  `ask_user` and `grep_search`, and new features for extension management.
+- **Bug Fixes**: Numerous bug fixes across the CLI and core, addressing issues
+  with interactive commands, memory leaks, permission checks, and more.
+- **Context and Tool Output Management**: Features for observation masking for
+  tool outputs, session-linked tool output storage, and persistence for masked
+  tool outputs.
+
+## Highlights example 2
+
+- **Commands & UX Enhancements:** Introduced `/prompt-suggest` command,
+  alongside updated undo/redo keybindings and automatic theme switching.
+- **Expanded IDE Support:** Now offering compatibility with Positron IDE,
+  expanding integration options for developers.
+- **Enhanced Security & Authentication:** Implemented interactive and
+  non-interactive OAuth consent, improving both security and diagnostic
+  capabilities for bug reports.
+- **Advanced Planning & Agent Tools:** Integrated a generic Checklist component
+  for structured task management and evolved subagent capabilities with dynamic
+  policy registration.
+- **Improved Core Stability & Reliability:** Resolved critical environment
+  loading, authentication, and session management issues, ensuring a more robust
+  experience.
+- **Background Shell Commands:** Enabled the execution of shell commands in the
+  background for increased workflow efficiency.
+
+## Highlights example 3
+
+- **Event-Driven Architecture:** The CLI now uses an event-driven scheduler for
+  tool execution, improving performance and responsiveness. This includes
+  migrating non-interactive flows and sub-agents to the new scheduler.
+- **Enhanced User Experience:** This release introduces several UI/UX
+  improvements, including queued tool confirmations and the ability to expand
+  and collapse large pasted text blocks. The `Settings` dialog has been improved
+  to reduce jitter and preserve focus.
+- **Agent and Skill Improvements:** Agent Skills have been promoted to a stable
+  feature. Sub-agents now use a JSON schema for input and are tracked by an
+  `AgentRegistry`.
+- **New `/rewind` Command:** A new `/rewind` command has been implemented to
+  allow users to go back in their session history.
+- **Improved Shell and File Handling:** The shell tool's output format has been
+  optimized, and the CLI now gracefully handles disk-full errors during chat
+  recording. A bug in detecting already added paths has been fixed.
+- **Linux Clipboard Support:** Image pasting capabilities for Wayland and X11 on
+  Linux have been added.
+
+## Highlights example 4
+
+- **Improved Hooks Management:** Hooks enable/disable functionality now aligns
+  with skills and offers improved completion.
+- **Custom Themes for Extensions:** Extensions can now support custom themes,
+  allowing for greater personalization.
+- **User Identity Display:** User identity information (auth, email, tier) is
+  now displayed on startup and in the `stats` command.
+- **Plan Mode Enhancements:** Plan mode has been improved with a generic
+  `Checklist` component and refactored `Todo`.
+- **Background Shell Commands:** Implementation of background shell commands.

.gemini/skills/docs-changelog/references/index_template.md

@@ -0,0 +1,10 @@
+## Announcements: {{version}} - {{release_date_yyyy_mm_dd}}
+
+{{announcement_content}}
+
+<!-- Example entry, multiple entries per highlights
+  - **Highlighted Feature:** We've added a new highlighted feature to help
+  you generate prompt suggestions
+  ([#nnnnn](https://github.com/google-gemini/gemini-cli/pull/nnnnn) by
+  @author).
+-->

.gemini/skills/docs-changelog/references/latest_template.md

@@ -0,0 +1,20 @@
+# Latest stable release: {{version}}
+
+Released: {{release_date_month_dd_yyyy}}
+
+For most users, our latest stable release is the recommended release. Install
+the latest stable version with:
+
+```
+npm install -g @google/gemini-cli
+```
+
+## Highlights
+
+{{highlights_content}}
+
+## What's Changed
+
+{{changelog_list}}
+
+**Full Changelog**: {{full_changelog_link}}

.gemini/skills/docs-changelog/references/preview_template.md

@@ -0,0 +1,22 @@
+# Preview release: {{version}}
+
+Released: {{release_date_month_dd_yyyy}}
+
+Our preview release includes the latest, new, and experimental features. This
+release may not be as stable as our [latest weekly release](latest.md).
+
+To install the preview release:
+
+```
+npm install -g @google/gemini-cli@preview
+```
+
+## Highlights
+
+{{highlights_content}}
+
+## What's Changed
+
+{{changelog_list}}
+
+**Full Changelog**: {{full_changelog_link}}

.gemini/skills/docs-writer/SKILL.md

@@ -0,0 +1,142 @@
+---
+name: docs-writer
+description:
+  Always use this skill when the task involves writing, reviewing, or editing 
+  files in the `/docs` directory or any `.md` files in the repository.
+---
+
+# `docs-writer` skill instructions
+
+As an expert technical writer and editor for the Gemini CLI project, you produce
+accurate, clear, and consistent documentation. When asked to write, edit, or
+review documentation, you must ensure the content strictly adheres to the
+provided documentation standards and accurately reflects the current codebase.
+Adhere to the contribution process in `CONTRIBUTING.md` and the following
+project standards.
+
+## Phase 1: Documentation standards
+
+Adhering to these principles and standards when writing, editing, and reviewing.
+
+### Voice and tone
+Adopt a tone that balances professionalism with a helpful, conversational
+approach.
+
+- **Perspective and tense:** Address the reader as "you." Use active voice and
+  present tense (e.g., "The API returns...").
+- **Tone:** Professional, friendly, and direct. 
+- **Clarity:** Use simple vocabulary. Avoid jargon, slang, and marketing hype.
+- **Global Audience:** Write in standard US English. Avoid idioms and cultural
+  references.
+- **Requirements:** Be clear about requirements ("must") vs. recommendations
+  ("we recommend"). Avoid "should."
+- **Word Choice:** Avoid "please" and anthropomorphism (e.g., "the server
+  thinks"). Use contractions (don't, it's).
+
+### Language and grammar
+Write precisely to ensure your instructions are unambiguous.
+
+- **Abbreviations:** Avoid Latin abbreviations; use "for example" (not "e.g.")
+  and "that is" (not "i.e.").
+- **Punctuation:** Use the serial comma. Place periods and commas inside
+  quotation marks.
+- **Dates:** Use unambiguous formats (e.g., "January 22, 2026").
+- **Conciseness:** Use "lets you" instead of "allows you to." Use precise,
+  specific verbs.
+- **Examples:** Use meaningful names in examples; avoid placeholders like
+  "foo" or "bar."
+- **Quota and limit terminology:** For any content involving resource capacity
+  or using the word "quota" or "limit", strictly adhere to the guidelines in
+  the `quota-limit-style-guide.md` resource file. Generally, Use "quota" for the
+  administrative bucket and "limit" for the numerical ceiling.
+
+### Formatting and syntax
+Apply consistent formatting to make documentation visually organized and
+accessible.
+
+- **Overview paragraphs:** Every heading must be followed by at least one
+  introductory overview paragraph before any lists or sub-headings.
+- **Text wrap:** Wrap text at 80 characters (except long links or tables).
+- **Casing:** Use sentence case for headings, titles, and bolded text.
+- **Naming:** Always refer to the project as `Gemini CLI` (never
+  `the Gemini CLI`).
+- **Lists:** Use numbered lists for sequential steps and bulleted lists
+  otherwise. Keep list items parallel in structure.
+- **UI and code:** Use **bold** for UI elements and `code font` for filenames,
+  snippets, commands, and API elements. Focus on the task when discussing
+  interaction.
+- **Links:** Use descriptive anchor text; avoid "click here." Ensure the link
+  makes sense out of context.
+- **Accessibility:** Use semantic HTML elements correctly (headings, lists, 
+  tables).
+- **Media:** Use lowercase hyphenated filenames. Provide descriptive alt text
+  for all images.
+
+### Structure
+- **BLUF:** Start with an introduction explaining what to expect.
+- **Experimental features:** If a feature is clearly noted as experimental,
+add the following note immediately after the introductory paragraph:
+  `> **Note:** This is a preview feature currently under active development.`
+- **Headings:** Use hierarchical headings to support the user journey.
+- **Procedures:** 
+  - Introduce lists of steps with a complete sentence.
+  - Start each step with an imperative verb.
+  - Number sequential steps; use bullets for non-sequential lists.
+  - Put conditions before instructions (e.g., "On the Settings page, click...").
+  - Provide clear context for where the action takes place.
+  - Indicate optional steps clearly (e.g., "Optional: ...").
+- **Elements:** Use bullet lists, tables, notes (`> **Note:**`), and warnings 
+  (`> **Warning:**`).
+- **Avoid using a table of contents:** If a table of contents is present, remove
+  it.
+- **Next steps:** Conclude with a "Next steps" section if applicable.
+
+## Phase 2: Preparation
+Before modifying any documentation, thoroughly investigate the request and the
+surrounding context. 
+
+1.  **Clarify:** Understand the core request. Differentiate between writing new
+    content and editing existing content. If the request is ambiguous (e.g.,
+    "fix the docs"), ask for clarification.
+2.  **Investigate:** Examine relevant code (primarily in `packages/`) for
+    accuracy.
+3.  **Audit:** Read the latest versions of relevant files in `docs/`.
+4.  **Connect:** Identify all referencing pages if changing behavior. Check if
+    `docs/sidebar.json` needs updates.
+5.  **Plan:** Create a step-by-step plan before making changes.
+
+## Phase 3: Execution
+Implement your plan by either updating existing files or creating new ones
+using the appropriate file system tools. Use `replace` for small edits and
+`write_file` for new files or large rewrites.
+
+### Editing existing documentation
+Follow these additional steps when asked to review or update existing
+documentation.
+
+- **Gaps:** Identify areas where the documentation is incomplete or no longer
+  reflects existing code.
+- **Structure:** Apply "Structure (New Docs)" rules (BLUF, headings, etc.) when 
+  adding new sections to existing pages.
+- **Headers**: If you change a header, you must check for links that lead to
+  that header and update them.
+- **Tone:** Ensure the tone is active and engaging. Use "you" and contractions.
+- **Clarity:** Correct awkward wording, spelling, and grammar. Rephrase
+  sentences to make them easier for users to understand.
+- **Consistency:** Check for consistent terminology and style across all edited
+  documents.
+
+
+## Phase 4: Verification and finalization
+Perform a final quality check to ensure that all changes are correctly formatted
+and that all links are functional.
+
+1.  **Accuracy:** Ensure content accurately reflects the implementation and
+  technical behavior.
+2.  **Self-review:** Re-read changes for formatting, correctness, and flow.
+3.  **Link check:** Verify all new and existing links leading to or from modified
+    pages. If you changed a header, ensure that any links that lead to it are
+    updated.
+4.  **Format:** Once all changes are complete, ask to execute `npm run format`
+    to ensure consistent formatting across the project. If the user confirms,
+    execute the command.

.gemini/skills/docs-writer/quota-limit-style-guide.md

@@ -0,0 +1,61 @@
+# Style Guide: Quota vs. Limit
+
+This guide defines the usage of "quota," "limit," and related terms in
+user-facing interfaces.
+
+## TL;DR
+
+- **`quota`**: The administrative "bucket." Use for settings, billing, and
+  requesting increases. (e.g., "Adjust your storage **quota**.")
+- **`limit`**: The real-time numerical "ceiling." Use for error messages when a
+  user is blocked. (e.g., "You've reached your request **limit**.")
+- **When blocked, combine them:** Explain the **limit** that was hit and the
+  **quota** that is the remedy. (e.g., "You've reached the request **limit** for
+  your developer **quota**.")
+- **Related terms:** Use `usage` for consumption tracking, `restriction` for
+  fixed rules, and `reset` for when a limit refreshes.
+
+---
+
+## Detailed Guidelines
+
+### Definitions
+
+- **Quota is the "what":** It identifies the category of resource being managed
+  (e.g., storage quota, GPU quota, request/prompt quota).
+- **Limit is the "how much":** It defines the numerical boundary.
+
+Use **quota** when referring to the administrative concept or the request for
+more. Use **limit** when discussing the specific point of exhaustion.
+
+### When to use "quota"
+
+Use this term for **account management, billing, and settings.** It describes
+the entitlement the user has purchased or been assigned.
+
+**Examples:**
+
+- **Navigation label:** Quota and usage
+- **Contextual help:** Your **usage quota** is managed by your organization. To
+  request an increase, contact your administrator.
+
+### When to use "limit"
+
+Use this term for **real-time feedback, notifications, and error messages.** It
+identifies the specific wall the user just hit.
+
+**Examples:**
+
+- **Error message:** You’ve reached the 50-request-per-minute **limit**.
+- **Inline warning:** Input exceeds the 32k token **limit**.
+
+### How to use both together
+
+When a user is blocked, combine both terms to explain the **event** (limit) and
+the **remedy** (quota).
+
+**Example:**
+
+- **Heading:** Daily usage limit reached
+- **Body:** You've reached the maximum daily capacity for your developer quota.
+  To continue working today, upgrade your quota.

.gemini/skills/github-issue-creator/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: github-issue-creator
+description:
+  Use this skill when asked to create a GitHub issue. It handles different issue
+  types (bug, feature, etc.) using repository templates and ensures proper
+  labeling.
+---
+
+# GitHub Issue Creator
+
+This skill guides the creation of high-quality GitHub issues that adhere to the
+repository's standards and use the appropriate templates.
+
+## Workflow
+
+Follow these steps to create a GitHub issue:
+
+1.  **Identify Issue Type**: Determine if the request is a bug report, feature
+    request, or other category.
+
+2.  **Locate Template**: Search for issue templates in
+    `.github/ISSUE_TEMPLATE/`.
+    - `bug_report.yml`
+    - `feature_request.yml`
+    - `website_issue.yml`
+    - If no relevant YAML template is found, look for `.md` templates in the same
+      directory.
+
+3.  **Read Template**: Read the content of the identified template file to
+    understand the required fields.
+
+4.  **Draft Content**: Draft the issue title and body/fields.
+    - If using a YAML template (form), prepare values for each `id` defined in
+      the template.
+    - If using a Markdown template, follow its structure exactly.
+    - **Default Label**: Always include the `🔒 maintainer only` label unless the
+      user explicitly requests otherwise.
+
+5.  **Create Issue**: Use the `gh` CLI to create the issue.
+    - **CRITICAL:** To avoid shell escaping and formatting issues with
+      multi-line Markdown or complex text, ALWAYS write the description/body to
+      a temporary file first.
+
+    **For Markdown Templates or Simple Body:**
+    ```bash
+    # 1. Write the drafted content to a temporary file
+    # 2. Create the issue using the --body-file flag
+    gh issue create --title "Succinct title" --body-file <temp_file_path> --label "🔒 maintainer only"
+    # 3. Remove the temporary file
+    rm <temp_file_path>
+    ```
+
+    **For YAML Templates (Forms):**
+    While `gh issue create` supports `--body-file`, YAML forms usually expect
+    key-value pairs via flags if you want to bypass the interactive prompt.
+    However, the most reliable non-interactive way to ensure formatting is
+    preserved for long text fields is to use the `--body` or `--body-file` if the
+    form has been converted to a standard body, OR to use the `--field` flags
+    for YAML forms.
+
+    *Note: For the `gemini-cli` repository which uses YAML forms, you can often
+    submit the content as a single body if a specific field-based submission is
+    not required by the automation.*
+
+6.  **Verify**: Confirm the issue was created successfully and provide the link
+    to the user.
+
+## Principles
+
+- **Clarity**: Titles should be descriptive and follow project conventions.
+- **Defensive Formatting**: Always use temporary files with `--body-file` to
+  prevent newline and special character issues.
+- **Maintainer Priority**: Default to internal/maintainer labels to keep the
+  backlog organized.
+- **Completeness**: Provide all requested information (e.g., version info,
+  reproduction steps).

.gemini/skills/pr-address-comments/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: pr-address-comments
+description: Use this skill if the user asks you to help them address GitHub PR comments for their current branch of the Gemini CLI. Requires `gh` CLI tool.
+---
+You are helping the user address comments on their Pull Request. These comments may have come from an automated review agent or a team member.
+
+OBJECTIVE: Help the user review and address comments on their PR.
+
+# Comment Review Procedure
+
+1. Run the `scripts/fetch-pr-info.js` script to get PR info and state. MAKE SURE you read the entire output of the command, even if it gets truncated.
+2. Summarize the review status by analyzing the diff, commit log, and comments to see which still need to be addressed. Pay attention to the current user's comments. For resolved threads, summarize as a single line with a ✅. For open threads, provide a reference number e.g. [1] and the comment content.
+3. Present your summary of the feedback and current state and allow the user to guide you as to what to fix/address/skip. DO NOT begin fixing issues automatically.

.gemini/skills/pr-address-comments/scripts/fetch-pr-info.js

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/* eslint-env node */
+/* global console, process */
+
+import { exec } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execAsync = promisify(exec);
+
+async function run(cmd) {
+  try {
+    const { stdout } = await execAsync(cmd, {
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'ignore'],
+    });
+    return stdout.trim();
+  } catch {
+    return null;
+  }
+}
+
+const IGNORE_MESSAGES = [
+  'thank you so much for your contribution to Gemini CLI!',
+  "I'm currently reviewing this pull request and will post my feedback shortly.",
+  'This pull request is being closed because it is not currently linked to an issue.',
+];
+
+const shouldIgnore = (body) => {
+  if (!body) return false;
+  return IGNORE_MESSAGES.some((msg) => body.includes(msg));
+};
+
+async function main() {
+  const branch = await run('git branch --show-current');
+  if (!branch) {
+    console.error('❌ Could not determine current git branch.');
+    process.exit(1);
+  }
+
+  const gqlQuery = `query($branch:String!){repository(name:"gemini-cli",owner:"google-gemini"){pullRequests(headRefName:$branch,first:100){nodes{id,number,state,comments(first:100){nodes{createdAt,isMinimized,minimizedReason,author{login},body,url,authorAssociation}},reviews(first:100){nodes{id,author{login},createdAt,isMinimized,minimizedReason,body,state,comments(first:30){nodes{id,replyTo{id},author{login},createdAt,body,isMinimized,minimizedReason,path,line,startLine,originalLine,originalStartLine}}}}}}}}`;
+
+  const [authInfo, diff, commits, rawJson] = await Promise.all([
+    run('gh auth status -a'),
+    run('gh pr diff'),
+    run(
+      'git fetch && git log origin/main..origin/$(git branch --show-current)',
+    ),
+    run(`gh api graphql -F branch="${branch}" -f query='${gqlQuery}'`),
+  ]);
+
+  if (!diff) {
+    console.error(`⚠️ No active PR found for branch: ${branch}`);
+    process.exit(1);
+  }
+
+  console.log(`\n# Current GitHub user info:\n\n${authInfo}\n`);
+  console.log(`\n# PR diff for current branch: ${branch}\n\n\`\`\``);
+  console.log(diff);
+  console.log('```');
+  console.log(
+    `\n# Commit history (origin/main..origin/${branch})\n\n${commits}`,
+  );
+
+  const data = JSON.parse(rawJson || '{}');
+  const prs = data?.data?.repository?.pullRequests?.nodes || [];
+
+  // Sort PRs by number descending so we check the newest one first
+  prs.sort((a, b) => b.number - a.number);
+
+  const pr = prs.find((p) => p.state === 'OPEN') || prs[0];
+
+  if (!pr) {
+    console.error('❌ No PR data found.');
+    process.exit(1);
+  }
+
+  console.log('\n# PR Feedback\n');
+
+  // 1. General PR Comments
+  const general = pr.comments.nodes.filter((c) => !shouldIgnore(c.body));
+  if (general.length > 0) {
+    console.log('\n💬 GENERAL COMMENTS:');
+    general.forEach((c) => {
+      const minimized = c.isMinimized
+        ? ` (Minimized: ${c.minimizedReason})`
+        : '';
+      console.log(
+        `[${c.createdAt}] [${c.author.login}]${minimized}: ${c.body}\n`,
+      );
+    });
+  }
+
+  // 2. Process ALL Review Comments into a single Thread Map
+  const allInlineComments = pr.reviews.nodes.flatMap((r) => r.comments.nodes);
+  const filteredInlines = allInlineComments.filter(
+    (c) => !shouldIgnore(c.body),
+  );
+
+  console.log('🔍 CODE REVIEWS & INLINE THREADS:');
+
+  // Print Review Summaries First
+  pr.reviews.nodes.forEach((review) => {
+    if (review.body && !shouldIgnore(review.body)) {
+      const icon = review.state === 'APPROVED' ? '✅' : '💬';
+      const minimized = review.isMinimized
+        ? ` (Minimized: ${review.minimizedReason})`
+        : '';
+      console.log(
+        `\n${icon} ${review.state} by ${review.author.login} at ${review.createdAt}${minimized}: "${review.body}"`,
+      );
+    }
+  });
+
+  // Build and Print Threads
+  const topLevelThreads = filteredInlines.filter((c) => !c.replyTo);
+
+  const printThread = (parentId, depth = 1) => {
+    const indent = '  '.repeat(depth);
+    filteredInlines
+      .filter((c) => c.replyTo?.id === parentId)
+      .forEach((reply) => {
+        const minimized = reply.isMinimized
+          ? ` (Minimized: ${reply.minimizedReason})`
+          : '';
+        console.log(
+          `${indent}↳ [${reply.createdAt}] ${reply.author.login}${minimized}: ${reply.body}`,
+        );
+        printThread(reply.id, depth + 1);
+      });
+  };
+
+  topLevelThreads.forEach((c) => {
+    const start = c.startLine || c.originalStartLine;
+    const end = c.line || c.originalLine;
+    const range = start && end && start !== end ? `${start}-${end}` : end || '';
+    const fileInfo = c.path
+      ? `(${c.path}${range ? `:${range}` : ''}) `
+      : range
+        ? `(Line ${range}) `
+        : '';
+    const minimized = c.isMinimized ? ` (Minimized: ${c.minimizedReason})` : '';
+    console.log(
+      `\n💬 ${minimized}${c.author.login} | ${c.createdAt} ${fileInfo}\n${c.body}`,
+    );
+    printThread(c.id);
+  });
+
+  console.log('\n');
+}
+
+main().catch((err) => {
+  console.error('❌ Unexpected error:', err);
+  process.exit(1);
+});

.gemini/skills/pr-creator/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: pr-creator
+description:
+  Use this skill when asked to create a pull request (PR). It ensures all PRs
+  follow the repository's established templates and standards.
+---
+
+# Pull Request Creator
+
+This skill guides the creation of high-quality Pull Requests that adhere to the
+repository's standards.
+
+## Workflow
+
+Follow these steps to create a Pull Request:
+
+1.  **Branch Management**: **CRITICAL:** Ensure you are NOT working on the
+    `main` branch.
+    - Run `git branch --show-current`.
+    - If the current branch is `main`, you MUST create and switch to a new
+      descriptive branch:
+      ```bash
+      git checkout -b <new-branch-name>
+      ```
+
+2.  **Commit Changes**: Verify that all intended changes are committed.
+    - Run `git status` to check for unstaged or uncommitted changes.
+    - If there are uncommitted changes, stage and commit them with a descriptive
+      message before proceeding. NEVER commit directly to `main`.
+      ```bash
+      git add .
+      git commit -m "type(scope): description"
+      ```
+
+3.  **Locate Template**: Search for a pull request template in the repository.
+    - Check `.github/pull_request_template.md`
+    - Check `.github/PULL_REQUEST_TEMPLATE.md`
+    - If multiple templates exist (e.g., in `.github/PULL_REQUEST_TEMPLATE/`),
+      ask the user which one to use or select the most appropriate one based on
+      the context (e.g., `bug_fix.md` vs `feature.md`).
+
+4.  **Read Template**: Read the content of the identified template file.
+
+5.  **Draft Description**: Create a PR description that strictly follows the
+    template's structure.
+    - **Headings**: Keep all headings from the template.
+    - **Checklists**: Review each item. Mark with `[x]` if completed. If an item
+      is not applicable, leave it unchecked or mark as `[ ]` (depending on the
+      template's instructions) or remove it if the template allows flexibility
+      (but prefer keeping it unchecked for transparency).
+    - **Content**: Fill in the sections with clear, concise summaries of your
+      changes.
+    - **Related Issues**: Link any issues fixed or related to this PR (e.g.,
+      "Fixes #123").
+
+6.  **Preflight Check**: Before creating the PR, run the workspace preflight
+    script to ensure all build, lint, and test checks pass.
+    ```bash
+    npm run preflight
+    ```
+    If any checks fail, address the issues before proceeding to create the PR.
+
+7.  **Push Branch**: Push the current branch to the remote repository.
+    **CRITICAL SAFETY RAIL:** Double-check your branch name before pushing.
+    NEVER push if the current branch is `main`.
+    ```bash
+    # Verify current branch is NOT main
+    git branch --show-current
+    # Push non-interactively
+    git push -u origin HEAD
+    ```
+
+8.  **Create PR**: Use the `gh` CLI to create the PR. To avoid shell escaping
+    issues with multi-line Markdown, write the description to a temporary file
+    first.
+    ```bash
+    # 1. Write the drafted description to a temporary file
+    # 2. Create the PR using the --body-file flag
+    gh pr create --title "type(scope): succinct description" --body-file <temp_file_path>
+    # 3. Remove the temporary file
+    rm <temp_file_path>
+    ```
+    - **Title**: Ensure the title follows the
+      [Conventional Commits](https://www.conventionalcommits.org/) format if the
+      repository uses it (e.g., `feat(ui): add new button`,
+      `fix(core): resolve crash`).
+
+## Principles
+
+- **Safety First**: NEVER push to `main`. This is your highest priority.
+- **Compliance**: Never ignore the PR template. It exists for a reason.
+- **Completeness**: Fill out all relevant sections.
+- **Accuracy**: Don't check boxes for tasks you haven't done.

.gemini/skills/string-reviewer/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: string-reviewer
+description: >
+  Use this skill when asked to review text and user-facing strings within the codebase. It ensures that these strings follow rules on clarity,
+  usefulness, brevity and style.
+---
+
+# String Reviewer
+
+## Instructions
+
+Act as a Senior UX Writer. Look for user-facing strings that are too long,
+unclear, or inconsistent. This includes inline text, error messages, and other
+user-facing text.
+
+Do NOT automatically change strings without user approval. You must only suggest
+changes and do not attempt to rewrite them directly unless the user explicitly
+asks you to do so.
+
+## Core voice principles
+
+The system prioritizes deterministic clarity over conversational fluff. We
+provide telemetry, not etiquette, ensuring the user retains absolute agency..
+
+1. **Deterministic clarity:** Distinguish between certain system/service states
+   (Cloud Billing, IAM, the System) and probabilistic AI analysis (Gemini).
+2. **System transparency:** Replace "Loading..." with active technical telemetry
+   (e.g., Tracing stack traces...). Keep status updates under 5 words.
+3. **Front-loaded actionability:** Always use the [Goal] + [Action] pattern.
+   Lead with intent so users can scan left-to-right.
+4. **Agentic error recovery:** Every error must be a pivot point. Pair failures
+   with one-click recovery commands or suggested prompts.
+5. **Contextual humility:** Reserve disclaimers and "be careful" warnings for P0
+   (destructive/irreversible) tasks only. Stop warning-fatigue.
+
+## The writing checklist
+
+Use this checklist to audit UI strings and AI responses.
+
+### Identity and voice
+- **Eliminate the "I":** Remove all first-person pronouns (I, me, my, mine).
+- **Subject attribution:** Refer to the AI as Gemini and the infrastructure as
+  the - system or the CLI.
+- **Active voice:** Ensure the subject (Gemini or the system) is clearly
+  performing the action.
+- **Ownership rule:** Use the system for execution (doing) and Gemini for
+  analysis (thinking)
+
+### Structural scannability
+- **The skip test:** Do the first 3 words describe the user’s intent? If not,
+  rewrite.
+- **Goal-first sequence:** Use the template: [To Accomplish X] + [Do Y].
+- **The 5-word rule:** Keep status updates and loading states under 5 words.
+- **Telemetry over etiquette:** Remove polite filler (Please wait, Thank you,
+  Certainly). Replace with raw data or progress indicators.
+- **Micro-state cycles:** For tasks $> 3$ seconds, cycle through specific
+  sub-states (e.g., Parsing logs... ➔ Identifying patterns...) to show momentum.
+
+
+### Technical accuracy and humility
+- **Verb signal check:** Use deterministic verbs (is, will, must) for system
+  state/infrastructure.
+  - Use probabilistic verbs (suggests, appears, may, identifies) for AI output.
+- **No 100% certainty:** Never attribute absolute certainty to model-generated
+  content.
+- **Precision over fuzziness:** Use technical metrics (latency, tokens, compute) instead of "speed" or "cost."
+- **Instructional warnings:** Every warning must include a specific corrective action (e.g., "Perform a dry-run first" or "Review line 42").
+
+### Agentic error recovery
+- **The one-step rule:** Pair every error message with exactly one immediate
+  path to a fix (command, link, or prompt).
+- **Human-first:** Provide a human-readable explanation before machine error
+  codes (e.g., 404, 500).
+-  **Suggested prompts:** Offer specific text for the user to copy/click like
+   “Ask Gemini: 'Explain this port error.'”
+
+### Use consistent terminology
+
+Ensure all terminology aligns with the project [word
+list](./references/word-list.md). 
+
+If a string uses a term marked "do not use" or "use with caution," provide a
+correction based on the preferred terms.
+
+## Ensure consistent style for settings
+
+If `packages/cli/src/config/settingsSchema.ts` is modified, confirm labels and
+descriptions specifically follow the unique [Settings
+guidelines](./references/settings.md).
+
+## Output format
+When suggesting changes, always present your review using the following list
+format. Do not provide suggestions outside of this list..
+
+```
+1. **{Rationale/Principle Violated}**
+  - ❌ "{incorrect phrase}"
+  - ✅ `"{corrected phrase}"`
+```

.gemini/skills/string-reviewer/references/settings.md

@@ -0,0 +1,28 @@
+# Settings
+
+## Noun-First Labeling (Scannability)
+
+Labels must start with the subject of the setting, not the action. This allows
+users to scan for the feature they want to change.
+
+- **Rule:** `[Noun]` `[Attribute/Action]`
+- **Example:** `Show line numbers` becomes simply `Line numbers`
+
+## Positive Boolean Logic (Cognitive Ease)
+
+Eliminate "double negatives." Booleans should represent the presence of a
+feature, not its absence.
+
+- **Rule:** Replace `Disable {feature}` or `Hide {Feature}` with
+  `{Feature} enabled` or simply `{Feature}`.
+- **Example:** Change "Disable auto update" to "Auto update".
+- **Implementation:** Invert the boolean value in your config loader so true
+  always equals `On`
+
+## Verb Stripping (Brevity)
+
+Remove redundant leading verbs like "Enable," "Use," "Display," or "Show" unless
+they are part of a specific technical term.
+
+- **Rule**: If the label works without the verb, remove it
+- **Example**: Change `Enable prompt completion` to `Prompt completion`

.gemini/skills/string-reviewer/references/word-list.md

@@ -0,0 +1,61 @@
+## Terms
+
+### Preferred
+
+- Use **create** when a user is creating or setting up something.
+- Use **allow** instead of **may** to indicate that permission has been granted
+  to perform some action.
+- Use **canceled**, not **cancelled**.
+- Use **configure** to refer to the process of changing the attributes of a
+  feature, even if that includes turning on or off the feature.
+- Use **delete** when the action being performed is destructive.
+- Use **enable** for binary operations that turn a feature or API on. Use "turn
+  on" and "turn off" instead of "enable" and "disable" for other situations.
+- Use **key combination** to refer to pressing multiple keys simultaneously.
+- Use **key sequence** to refer to pressing multiple keys separately in order.
+- Use **modify** to refer to something that has changed vs obtaining the latest
+  version of something.
+- Use **remove** when the action being performed takes an item out of a larger
+  whole, but doesn't destroy the item itself.
+- Use **set up** as a verb. Use **setup** as a noun or adjective.
+- Use **show**. In general, use paired with **hide**.
+- Use **sign in**, **sign out** as a verb. Use **sign-in** or **sign-out** as a
+  noun or adjective.
+- Use **update** when you mean to obtain the latest version of something.
+- Use **want** instead of **like** or **would like**.
+
+#### Don't use
+
+- Don't use **etc.** It's redundant. To convey that a series is incomplete,
+  introduce it with "such as" instead.
+- Don't use **hostname**, use "host name" instead.
+- Don't use **in order to**. It's too formal. "Before you can" is usually better
+  in UI text.
+- Don't use **one or more**. Specify the quantity where possible. Use "at least
+  one" when the quantity is 1+ but you can't be sure of the number. Likewise,
+  use "at least one" when the user must choose a quantity of 1+.
+- Don't use the terms **log in**, **log on**, **login**, **logout** or **log
+  out**.
+- Don't use **like** or **would you like**. Use **want** instead. Better yet,
+  rephrase so that it's not referring to the user's emotional state, but rather
+  what is required.
+
+#### Use with caution
+
+- Avoid using **leverage**, especially as a verb. "Leverage" is considered a
+  buzzword largely devoid of meaning apart from the simpler "use".
+- Avoid using **once** as a synonym for "after". Typically, when "once" is used
+  in this way, it is followed by a verb in the perfect tense.
+- Don't use **e.g.** Use "example", "such as", "like", or "for example". The
+  phrase is always followed by a comma.
+- Don't use **i.e.** unless absolutely essential to make text fit. Use "that is"
+  instead.
+- Use **disable** for binary operations that turn a feature or API off. Use
+  "turn on" and "turn off" instead of "enable" and "disable" for other
+  situations. For UI elements that are not available, use "dimmed" instead of
+  "disabled".
+- Use **please** only when you're asking the user to do something inconvenient,
+  not just following the instructions in a typical flow.
+- Use **really** sparingly in such constructions as "Do you really want to..."
+  Because of the weight it puts on the decision, it should be used to confirm
+  actions that the user is extremely unlikely to make.

.github/CODEOWNERS

@@ -1,7 +1,22 @@
-# By default, require reviews from the release approvers for all files.
-* @google-gemini/gemini-cli-askmode-approvers
+# By default, require reviews from the maintainers for all files.
+* @google-gemini/gemini-cli-maintainers
 
-# The following files don't need reviews from the release approvers.
+# Require reviews from the release approvers for critical files.
 # These patterns override the rule above.
-**/*.md
-/docs/
+/package.json @google-gemini/gemini-cli-askmode-approvers
+/package-lock.json @google-gemini/gemini-cli-askmode-approvers
+/GEMINI.md @google-gemini/gemini-cli-askmode-approvers
+/SECURITY.md @google-gemini/gemini-cli-askmode-approvers
+/LICENSE @google-gemini/gemini-cli-askmode-approvers
+/.github/workflows/ @google-gemini/gemini-cli-askmode-approvers
+/packages/cli/package.json @google-gemini/gemini-cli-askmode-approvers
+/packages/core/package.json @google-gemini/gemini-cli-askmode-approvers
+
+# Docs have a dedicated approver group in addition to maintainers
+/docs/ @google-gemini/gemini-cli-maintainers @google-gemini/gemini-cli-docs
+/README.md @google-gemini/gemini-cli-maintainers @google-gemini/gemini-cli-docs
+
+# Prompt contents, tool definitions, and evals require reviews from prompt approvers
+/packages/core/src/prompts/ @google-gemini/gemini-cli-prompt-approvers
+/packages/core/src/tools/ @google-gemini/gemini-cli-prompt-approvers
+/evals/ @google-gemini/gemini-cli-prompt-approvers

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,8 +1,5 @@
 name: 'Bug Report'
 description: 'Report a bug to help us improve Gemini CLI'
-labels:
-  - 'kind/bug'
-  - 'status/need-triage'
 body:
   - type: 'markdown'
     attributes:
@@ -31,7 +28,7 @@ body:
     id: 'info'
     attributes:
       label: 'Client information'
-      description: 'Please paste the full text from the `/about` command run from Gemini CLI. Also include which platform (macOS, Windows, Linux).'
+      description: 'Please paste the full text from the `/about` command run from Gemini CLI. Also include which platform (macOS, Windows, Linux). Note that this output contains your email address. Consider removing it before submitting.'
       value: |-
         <details>
         <summary>Client Information</summary>

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,8 +1,8 @@
 name: 'Feature Request'
 description: 'Suggest an idea for this project'
 labels:
-  - 'kind/enhancement'
   - 'status/need-triage'
+type: 'Feature'
 body:
   - type: 'markdown'
     attributes:

.github/ISSUE_TEMPLATE/website_issue.yml

@@ -0,0 +1,40 @@
+name: 'Website issue'
+description: 'Report an issue with the Gemini CLI Website and Gemini CLI Extensions Gallery'
+labels:
+  - 'area/extensions'
+body:
+  - type: 'markdown'
+    attributes:
+      value: |-
+        > [!IMPORTANT]
+        > Thanks for taking the time to report an issue with the Gemini CLI Website
+        >
+        > Please search **[existing issues](https://github.com/google-gemini/gemini-cli/issues?q=is%3Aissue+is%3Aopen+label%3Aarea%2Fwebsite)**  to see if a similar feature has already been requested.
+  - type: 'input'
+    id: 'url'
+    attributes:
+      label: 'URL of the page with the issue'
+      description: 'Please provide the URL where the issue occurs.'
+    validations:
+      required: true
+
+  - type: 'textarea'
+    id: 'problem'
+    attributes:
+      label: 'What is the problem?'
+      description: 'A clear and concise description of what the bug or issue is.'
+    validations:
+      required: true
+
+  - type: 'textarea'
+    id: 'expected'
+    attributes:
+      label: 'What did you expect to happen?'
+    validations:
+      required: true
+
+  - type: 'textarea'
+    id: 'additional-context'
+    attributes:
+      label: 'Additional context'
+      description: 'Add any other context or screenshots about the issue here.'

.github/actions/calculate-vars/action.yml

@@ -0,0 +1,33 @@
+name: 'Calculate vars'
+description: 'Calculate commonly used var in our release process'
+
+inputs:
+  dry_run:
+    description: 'Whether or not this is a dry run'
+    type: 'boolean'
+
+outputs:
+  is_dry_run:
+    description: 'Boolean flag indicating if the current run is a dry-run or a production release.'
+    value: '${{ steps.set_vars.outputs.is_dry_run }}'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Print inputs'
+      shell: 'bash'
+      env:
+        JSON_INPUTS: '${{ toJSON(inputs) }}'
+      run: 'echo "$JSON_INPUTS"'
+
+    - name: 'Set vars for simplified logic'
+      id: 'set_vars'
+      shell: 'bash'
+      env:
+        DRY_RUN_INPUT: '${{ inputs.dry_run }}'
+      run: |-
+        is_dry_run="true"
+        if [[ "${DRY_RUN_INPUT}" == "" || "${DRY_RUN_INPUT}" == "false" ]]; then
+          is_dry_run="false"
+        fi
+        echo "is_dry_run=${is_dry_run}" >> "${GITHUB_OUTPUT}"

.github/actions/create-pull-request/action.yml

@@ -0,0 +1,60 @@
+name: 'Create Pull Request'
+description: 'Creates a pull request.'
+
+inputs:
+  branch-name:
+    description: 'The name of the branch to create the PR from.'
+    required: true
+  pr-title:
+    description: 'The title of the pull request.'
+    required: true
+  pr-body:
+    description: 'The body of the pull request.'
+    required: true
+  base-branch:
+    description: 'The branch to merge into.'
+    required: true
+    default: 'main'
+  github-token:
+    description: 'The GitHub token to use for creating the pull request.'
+    required: true
+  dry-run:
+    description: 'Whether to run in dry-run mode.'
+    required: false
+    default: 'false'
+  working-directory:
+    description: 'The working directory to run the commands in.'
+    required: false
+    default: '.'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: '📝 Print Inputs'
+      shell: 'bash'
+      env:
+        JSON_INPUTS: '${{ toJSON(inputs) }}'
+      run: 'echo "$JSON_INPUTS"'
+    - name: 'Creates a Pull Request'
+      if: "inputs.dry-run != 'true'"
+      env:
+        GH_TOKEN: '${{ inputs.github-token }}'
+        INPUTS_BRANCH_NAME: '${{ inputs.branch-name }}'
+        INPUTS_PR_TITLE: '${{ inputs.pr-title }}'
+        INPUTS_PR_BODY: '${{ inputs.pr-body }}'
+        INPUTS_BASE_BRANCH: '${{ inputs.base-branch }}'
+      shell: 'bash'
+      working-directory: '${{ inputs.working-directory }}'
+      run: |
+        set -e
+        if ! git ls-remote --exit-code --heads origin "${INPUTS_BRANCH_NAME}"; then
+          echo "::error::Branch '${INPUTS_BRANCH_NAME}' does not exist on the remote repository."
+          exit 1
+        fi
+        PR_URL=$(gh pr create \
+          --title "${INPUTS_PR_TITLE}" \
+          --body "${INPUTS_PR_BODY}" \
+          --base "${INPUTS_BASE_BRANCH}" \
+          --head "${INPUTS_BRANCH_NAME}" \
+          --fill)
+        gh pr merge "$PR_URL" --auto

.github/actions/npm-auth-token/action.yml

@@ -0,0 +1,51 @@
+name: 'NPM Auth Token'
+description: 'Generates an NPM auth token for publishing a specific package'
+
+inputs:
+  package-name:
+    description: 'The name of the package to publish'
+    required: true
+  github-token:
+    description: 'the github token'
+    required: true
+  wombat-token-core:
+    description: 'The npm token for the cli-core package.'
+    required: true
+  wombat-token-cli:
+    description: 'The npm token for the cli package.'
+    required: true
+  wombat-token-a2a-server:
+    description: 'The npm token for the a2a package.'
+    required: true
+
+outputs:
+  auth-token:
+    description: 'The generated NPM auth token'
+    value: '${{ steps.npm_auth_token.outputs.auth-token }}'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Generate NPM Auth Token'
+      id: 'npm_auth_token'
+      shell: 'bash'
+      run: |
+        AUTH_TOKEN="${INPUTS_GITHUB_TOKEN}"
+        PACKAGE_NAME="${INPUTS_PACKAGE_NAME}"
+        PRIVATE_REPO="@google-gemini/"
+        if [[ "$PACKAGE_NAME" == "$PRIVATE_REPO"* ]]; then
+          AUTH_TOKEN="${INPUTS_GITHUB_TOKEN}"
+        elif [[ "$PACKAGE_NAME" == "@google/gemini-cli" ]]; then
+          AUTH_TOKEN="${INPUTS_WOMBAT_TOKEN_CLI}"
+        elif [[ "$PACKAGE_NAME" == "@google/gemini-cli-core" ]]; then
+          AUTH_TOKEN="${INPUTS_WOMBAT_TOKEN_CORE}"
+        elif [[ "$PACKAGE_NAME" == "@google/gemini-cli-a2a-server" ]]; then
+          AUTH_TOKEN="${INPUTS_WOMBAT_TOKEN_A2A_SERVER}"
+        fi
+        echo "auth-token=$AUTH_TOKEN" >> $GITHUB_OUTPUT
+      env:
+        INPUTS_GITHUB_TOKEN: '${{ inputs.github-token }}'
+        INPUTS_PACKAGE_NAME: '${{ inputs.package-name }}'
+        INPUTS_WOMBAT_TOKEN_CLI: '${{ inputs.wombat-token-cli }}'
+        INPUTS_WOMBAT_TOKEN_CORE: '${{ inputs.wombat-token-core }}'
+        INPUTS_WOMBAT_TOKEN_A2A_SERVER: '${{ inputs.wombat-token-a2a-server }}'

.github/actions/post-coverage-comment/action.yml

@@ -27,6 +27,11 @@ inputs:
 runs:
   using: 'composite'
   steps:
+    - name: '📝 Print Inputs'
+      shell: 'bash'
+      env:
+        JSON_INPUTS: '${{ toJSON(inputs) }}'
+      run: 'echo "$JSON_INPUTS"'
     - name: 'Prepare Coverage Comment'
       id: 'prep_coverage_comment'
       shell: 'bash'

.github/actions/publish-release/action.yml

@@ -0,0 +1,306 @@
+name: 'Publish Release'
+description: 'Builds, prepares, and publishes the gemini-cli packages to npm and creates a GitHub release.'
+
+inputs:
+  release-version:
+    description: 'The version to release (e.g., 0.1.11).'
+    required: true
+  npm-tag:
+    description: 'The npm tag to publish with (e.g., latest, preview, nightly).'
+    required: true
+  wombat-token-core:
+    description: 'The npm token for the cli-core package.'
+    required: true
+  wombat-token-cli:
+    description: 'The npm token for the cli package.'
+    required: true
+  wombat-token-a2a-server:
+    description: 'The npm token for the a2a package.'
+    required: true
+  github-token:
+    description: 'The GitHub token for creating the release.'
+    required: true
+  github-release-token:
+    description: 'The GitHub token used specifically for creating the GitHub release (to trigger other workflows).'
+    required: false
+  dry-run:
+    description: 'Whether to run in dry-run mode.'
+    type: 'string'
+    required: true
+  release-tag:
+    description: 'The release tag for the release (e.g., v0.1.11).'
+    required: true
+  previous-tag:
+    description: 'The previous tag to use for generating release notes.'
+    required: true
+  skip-github-release:
+    description: 'Whether to skip creating a GitHub release.'
+    type: 'boolean'
+    required: false
+    default: false
+  working-directory:
+    description: 'The working directory to run the steps in.'
+    required: false
+    default: '.'
+  force-skip-tests:
+    description: 'Skip tests and validation'
+    required: false
+    default: false
+  skip-branch-cleanup:
+    description: 'Whether to skip cleaning up the release branch.'
+    type: 'boolean'
+    required: false
+    default: false
+  gemini_api_key:
+    description: 'The API key for running integration tests.'
+    required: true
+  npm-registry-publish-url:
+    description: 'npm registry publish url'
+    required: true
+  npm-registry-url:
+    description: 'npm registry url'
+    required: true
+  npm-registry-scope:
+    description: 'npm registry scope'
+    required: true
+  cli-package-name:
+    description: 'The name of the cli package.'
+    required: true
+  core-package-name:
+    description: 'The name of the core package.'
+    required: true
+  a2a-package-name:
+    description: 'The name of the a2a package.'
+    required: true
+runs:
+  using: 'composite'
+  steps:
+    - name: '📝 Print Inputs'
+      shell: 'bash'
+      env:
+        JSON_INPUTS: '${{ toJSON(inputs) }}'
+      run: 'echo "$JSON_INPUTS"'
+
+    - name: '👤 Configure Git User'
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      run: |
+        git config user.name "gemini-cli-robot"
+        git config user.email "gemini-cli-robot@google.com"
+
+    - name: '🌿 Create and switch to a release branch'
+      working-directory: '${{ inputs.working-directory }}'
+      id: 'release_branch'
+      shell: 'bash'
+      run: |
+        BRANCH_NAME="release/${INPUTS_RELEASE_TAG}"
+        git switch -c "${BRANCH_NAME}"
+        echo "BRANCH_NAME=${BRANCH_NAME}" >> "${GITHUB_OUTPUT}"
+      env:
+        INPUTS_RELEASE_TAG: '${{ inputs.release-tag }}'
+
+    - name: '⬆️ Update package versions'
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      run: |
+        npm run release:version "${INPUTS_RELEASE_VERSION}"
+      env:
+        INPUTS_RELEASE_VERSION: '${{ inputs.release-version }}'
+
+    - name: '💾 Commit and Conditionally Push package versions'
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      env:
+        BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
+        DRY_RUN: '${{ inputs.dry-run }}'
+        RELEASE_TAG: '${{ inputs.release-tag }}'
+      run: |-
+        set -e
+        git add package.json package-lock.json packages/*/package.json
+        git commit -m "chore(release): ${RELEASE_TAG}"
+        if [[ "${DRY_RUN}" == "false" ]]; then
+          echo "Pushing release branch to remote..."
+          git push --set-upstream origin "${BRANCH_NAME}" --follow-tags
+        else
+          echo "Dry run enabled. Skipping push."
+        fi
+
+    - name: '🛠️ Build and Prepare Packages'
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      run: |
+        npm run build:packages
+        npm run prepare:package
+
+    - name: '🎁 Bundle'
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      run: |
+        npm run bundle
+
+    # TODO: Refactor this github specific publishing script to be generalized based upon inputs.
+    - name: '📦 Prepare for GitHub release'
+      if: "inputs.npm-registry-url == 'https://npm.pkg.github.com/'"
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      run: |
+        node ${{ github.workspace }}/scripts/prepare-github-release.js
+
+    - name: 'Configure npm for publishing to npm'
+      uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+      with:
+        node-version-file: '${{ inputs.working-directory }}/.nvmrc'
+        registry-url: '${{inputs.npm-registry-publish-url}}'
+        scope: '${{inputs.npm-registry-scope}}'
+
+    - name: 'Get core Token'
+      uses: './.github/actions/npm-auth-token'
+      id: 'core-token'
+      with:
+        package-name: '${{ inputs.core-package-name }}'
+        github-token: '${{ inputs.github-token }}'
+        wombat-token-core: '${{ inputs.wombat-token-core }}'
+        wombat-token-cli: '${{ inputs.wombat-token-cli }}'
+        wombat-token-a2a-server: '${{ inputs.wombat-token-a2a-server }}'
+
+    - name: '📦 Publish CORE to NPM'
+      working-directory: '${{ inputs.working-directory }}'
+      env:
+        NODE_AUTH_TOKEN: '${{ steps.core-token.outputs.auth-token }}'
+        INPUTS_DRY_RUN: '${{ inputs.dry-run }}'
+        INPUTS_CORE_PACKAGE_NAME: '${{ inputs.core-package-name }}'
+      shell: 'bash'
+      run: |
+        npm publish \
+          --dry-run="${INPUTS_DRY_RUN}" \
+          --workspace="${INPUTS_CORE_PACKAGE_NAME}" \
+          --no-tag
+        npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} false --silent
+
+    - name: '🔗 Install latest core package'
+      working-directory: '${{ inputs.working-directory }}'
+      if: "${{ inputs.dry-run != 'true' }}"
+      shell: 'bash'
+      run: |
+        npm install "${INPUTS_CORE_PACKAGE_NAME}@${INPUTS_RELEASE_VERSION}" \
+        --workspace="${INPUTS_CLI_PACKAGE_NAME}" \
+        --workspace="${INPUTS_A2A_PACKAGE_NAME}" \
+        --save-exact
+      env:
+        INPUTS_CORE_PACKAGE_NAME: '${{ inputs.core-package-name }}'
+        INPUTS_RELEASE_VERSION: '${{ inputs.release-version }}'
+        INPUTS_CLI_PACKAGE_NAME: '${{ inputs.cli-package-name }}'
+        INPUTS_A2A_PACKAGE_NAME: '${{ inputs.a2a-package-name }}'
+
+    - name: '📦 Prepare bundled CLI for npm release'
+      if: "inputs.npm-registry-url != 'https://npm.pkg.github.com/' && inputs.npm-tag != 'latest'"
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      run: |
+        node ${{ github.workspace }}/scripts/prepare-npm-release.js
+
+    - name: 'Get CLI Token'
+      uses: './.github/actions/npm-auth-token'
+      id: 'cli-token'
+      with:
+        package-name: '${{ inputs.cli-package-name }}'
+        github-token: '${{ inputs.github-token }}'
+        wombat-token-core: '${{ inputs.wombat-token-core }}'
+        wombat-token-cli: '${{ inputs.wombat-token-cli }}'
+        wombat-token-a2a-server: '${{ inputs.wombat-token-a2a-server }}'
+
+    - name: '📦 Publish CLI'
+      working-directory: '${{ inputs.working-directory }}'
+      env:
+        NODE_AUTH_TOKEN: '${{ steps.cli-token.outputs.auth-token }}'
+        INPUTS_DRY_RUN: '${{ inputs.dry-run }}'
+        INPUTS_CLI_PACKAGE_NAME: '${{ inputs.cli-package-name }}'
+      shell: 'bash'
+      run: |
+        npm publish \
+          --dry-run="${INPUTS_DRY_RUN}" \
+          --workspace="${INPUTS_CLI_PACKAGE_NAME}" \
+          --no-tag
+        npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} false --silent
+
+    - name: 'Get a2a-server Token'
+      uses: './.github/actions/npm-auth-token'
+      id: 'a2a-token'
+      with:
+        package-name: '${{ inputs.a2a-package-name }}'
+        github-token: '${{ inputs.github-token }}'
+        wombat-token-core: '${{ inputs.wombat-token-core }}'
+        wombat-token-cli: '${{ inputs.wombat-token-cli }}'
+        wombat-token-a2a-server: '${{ inputs.wombat-token-a2a-server }}'
+
+    - name: '📦 Publish a2a'
+      working-directory: '${{ inputs.working-directory }}'
+      env:
+        NODE_AUTH_TOKEN: '${{ steps.a2a-token.outputs.auth-token }}'
+        INPUTS_DRY_RUN: '${{ inputs.dry-run }}'
+        INPUTS_A2A_PACKAGE_NAME: '${{ inputs.a2a-package-name }}'
+      shell: 'bash'
+      # Tag staging for initial release
+      run: |
+        npm publish \
+          --dry-run="${INPUTS_DRY_RUN}" \
+          --workspace="${INPUTS_A2A_PACKAGE_NAME}" \
+          --no-tag
+        npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} false --silent
+
+    - name: '🔬 Verify NPM release by version'
+      uses: './.github/actions/verify-release'
+      if: "${{ inputs.dry-run != 'true' && inputs.force-skip-tests != 'true' }}"
+      with:
+        npm-package: '${{ inputs.cli-package-name }}@${{ inputs.release-version }}'
+        expected-version: '${{ inputs.release-version }}'
+        working-directory: '${{ inputs.working-directory }}'
+        gemini_api_key: '${{ inputs.gemini_api_key }}'
+        github-token: '${{ inputs.github-token }}'
+        npm-registry-url: '${{ inputs.npm-registry-url }}'
+        npm-registry-scope: '${{ inputs.npm-registry-scope }}'
+
+    - name: '🏷️ Tag release'
+      uses: './.github/actions/tag-npm-release'
+      with:
+        channel: '${{ inputs.npm-tag }}'
+        version: '${{ inputs.release-version }}'
+        dry-run: '${{ inputs.dry-run }}'
+        github-token: '${{ inputs.github-token }}'
+        wombat-token-core: '${{ inputs.wombat-token-core }}'
+        wombat-token-cli: '${{ inputs.wombat-token-cli }}'
+        wombat-token-a2a-server: '${{ inputs.wombat-token-a2a-server }}'
+        cli-package-name: '${{ inputs.cli-package-name }}'
+        core-package-name: '${{ inputs.core-package-name }}'
+        a2a-package-name: '${{ inputs.a2a-package-name }}'
+        working-directory: '${{ inputs.working-directory }}'
+
+    - name: '🎉 Create GitHub Release'
+      working-directory: '${{ inputs.working-directory }}'
+      if: "${{ inputs.dry-run != 'true' && inputs.skip-github-release != 'true' && inputs.npm-tag != 'dev' && inputs.npm-registry-url != 'https://npm.pkg.github.com/' }}"
+      env:
+        GITHUB_TOKEN: '${{ inputs.github-release-token || inputs.github-token }}'
+        INPUTS_RELEASE_TAG: '${{ inputs.release-tag }}'
+        STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
+        INPUTS_PREVIOUS_TAG: '${{ inputs.previous-tag }}'
+      shell: 'bash'
+      run: |
+        gh release create "${INPUTS_RELEASE_TAG}" \
+          bundle/gemini.js \
+          --target "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}" \
+          --title "Release ${INPUTS_RELEASE_TAG}" \
+          --notes-start-tag "${INPUTS_PREVIOUS_TAG}" \
+          --generate-notes \
+          ${{ inputs.npm-tag != 'latest' && '--prerelease' || '' }}
+
+    - name: '🧹 Clean up release branch'
+      working-directory: '${{ inputs.working-directory }}'
+      if: "${{ inputs.dry-run != 'true' && inputs.skip-branch-cleanup != 'true' }}"
+      continue-on-error: true
+      shell: 'bash'
+      run: |
+        echo "Cleaning up release branch ${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}..."
+        git push origin --delete "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}"
+
+      env:
+        STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'

.github/actions/push-docker/action.yml

@@ -0,0 +1,80 @@
+name: 'Push to docker'
+description: 'Builds packages and pushes a docker image to GHCR'
+
+inputs:
+  github-actor:
+    description: 'Github actor'
+    required: true
+  github-secret:
+    description: 'Github secret'
+    required: true
+  ref-name:
+    description: 'Github ref name'
+    required: true
+  github-sha:
+    description: 'Github Commit SHA Hash'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: '📝 Print Inputs'
+      shell: 'bash'
+      env:
+        JSON_INPUTS: '${{ toJSON(inputs) }}'
+      run: 'echo "$JSON_INPUTS"'
+    - name: 'Checkout'
+      uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
+      with:
+        ref: '${{ inputs.github-sha }}'
+        fetch-depth: 0
+    - name: 'Install Dependencies'
+      shell: 'bash'
+      run: 'npm install'
+    - name: 'Set up Docker Buildx'
+      uses: 'docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435' # ratchet:docker/setup-buildx-action@v3
+    - name: 'build'
+      shell: 'bash'
+      run: 'npm run build'
+    - name: 'pack @google/gemini-cli'
+      shell: 'bash'
+      run: 'npm pack -w @google/gemini-cli --pack-destination ./packages/cli/dist'
+    - name: 'pack @google/gemini-cli-core'
+      shell: 'bash'
+      run: 'npm pack -w @google/gemini-cli-core --pack-destination ./packages/core/dist'
+    - name: 'Log in to GitHub Container Registry'
+      uses: 'docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1' # ratchet:docker/login-action@v3
+      with:
+        registry: 'ghcr.io'
+        username: '${{ inputs.github-actor }}'
+        password: '${{ inputs.github-secret }}'
+    - name: 'Get branch name'
+      id: 'branch_name'
+      shell: 'bash'
+      run: |
+        REF_NAME="${INPUTS_REF_NAME}"
+        echo "name=${REF_NAME%/merge}" >> $GITHUB_OUTPUT
+      env:
+        INPUTS_REF_NAME: '${{ inputs.ref-name }}'
+    - name: 'Build and Push the Docker Image'
+      uses: 'docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83' # ratchet:docker/build-push-action@v6
+      with:
+        context: '.'
+        file: './Dockerfile'
+        push: true
+        provenance: false # avoid pushing 3 images to Aritfact Registry
+        tags: |
+          ghcr.io/${{ github.repository }}/cli:${{ steps.branch_name.outputs.name }}
+          ghcr.io/${{ github.repository }}/cli:${{ inputs.github-sha }}
+    - name: 'Create issue on failure'
+      if: |-
+        ${{ failure() }}
+      shell: 'bash'
+      env:
+        GITHUB_TOKEN: '${{ inputs.github-secret }}'
+        DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+      run: |-
+        gh issue create \
+          --title "Docker build failed" \
+          --body "The docker build failed. See the full run for details: ${DETAILS_URL}" \
+          --label "release-failure"

.github/actions/push-sandbox/action.yml

@@ -0,0 +1,119 @@
+name: 'Build and push sandbox docker'
+description: 'Pushes sandbox docker image to container registry'
+
+inputs:
+  github-actor:
+    description: 'Github actor'
+    required: true
+  github-secret:
+    description: 'Github secret'
+    required: true
+  dockerhub-username:
+    description: 'Dockerhub username'
+    required: true
+  dockerhub-token:
+    description: 'Dockerhub PAT w/ R+W'
+    required: true
+  github-sha:
+    description: 'Github Commit SHA Hash'
+    required: true
+  github-ref-name:
+    description: 'Github ref name'
+    required: true
+  dry-run:
+    description: 'Whether this is a dry run.'
+    required: true
+    type: 'boolean'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: '📝 Print Inputs'
+      shell: 'bash'
+      env:
+        JSON_INPUTS: '${{ toJSON(inputs) }}'
+      run: 'echo "$JSON_INPUTS"'
+    - name: 'Checkout'
+      uses: 'actions/checkout@v4'
+      with:
+        ref: '${{ inputs.github-sha }}'
+        fetch-depth: 0
+    - name: 'Install Dependencies'
+      shell: 'bash'
+      run: 'npm install'
+    - name: 'npm build'
+      shell: 'bash'
+      run: 'npm run build'
+    - name: 'Set up QEMU'
+      uses: 'docker/setup-qemu-action@v3'
+    - name: 'Set up Docker Buildx'
+      uses: 'docker/setup-buildx-action@v3'
+    - name: 'Log in to GitHub Container Registry'
+      uses: 'docker/login-action@v3'
+      with:
+        registry: 'docker.io'
+        username: '${{ inputs.dockerhub-username }}'
+        password: '${{ inputs.dockerhub-token }}'
+    - name: 'determine image tag'
+      id: 'image_tag'
+      shell: 'bash'
+      run: |-
+        SHELL_TAG_NAME="${INPUTS_GITHUB_REF_NAME}"
+        FINAL_TAG="${INPUTS_GITHUB_SHA}"
+        if [[ "$SHELL_TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
+          echo "Release detected."
+          FINAL_TAG="${SHELL_TAG_NAME#v}"
+        else
+          echo "Development release detected. Using commit SHA as tag."
+        fi
+        echo "Determined image tag: $FINAL_TAG"
+        echo "FINAL_TAG=$FINAL_TAG" >> $GITHUB_OUTPUT
+      env:
+        INPUTS_GITHUB_REF_NAME: '${{ inputs.github-ref-name }}'
+        INPUTS_GITHUB_SHA: '${{ inputs.github-sha }}'
+    # We build amd64 just so we can verify it.
+    # We build and push both amd64 and arm64 in the publish step.
+    - name: 'build'
+      id: 'docker_build'
+      shell: 'bash'
+      env:
+        GEMINI_SANDBOX_IMAGE_TAG: '${{ steps.image_tag.outputs.FINAL_TAG }}'
+        GEMINI_SANDBOX: 'docker'
+        BUILD_SANDBOX_FLAGS: '--platform linux/amd64 --load'
+        STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG: '${{ steps.image_tag.outputs.FINAL_TAG }}'
+      run: |-
+        npm run build:sandbox -- \
+          --image "google/gemini-cli-sandbox:${STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG}" \
+          --output-file final_image_uri.txt
+        echo "uri=$(cat final_image_uri.txt)" >> $GITHUB_OUTPUT
+    - name: 'verify'
+      shell: 'bash'
+      run: |-
+        docker run --rm --entrypoint sh "${{ steps.docker_build.outputs.uri }}" -lc '
+          set -e
+          node -e "const fs=require(\"node:fs\"); JSON.parse(fs.readFileSync(\"/usr/local/share/npm-global/lib/node_modules/@google/gemini-cli/package.json\",\"utf8\")); JSON.parse(fs.readFileSync(\"/usr/local/share/npm-global/lib/node_modules/@google/gemini-cli-core/package.json\",\"utf8\"));"
+          /usr/local/share/npm-global/bin/gemini --version >/dev/null
+        '
+    - name: 'publish'
+      shell: 'bash'
+      if: "${{ inputs.dry-run != 'true' }}"
+      env:
+        GEMINI_SANDBOX_IMAGE_TAG: '${{ steps.image_tag.outputs.FINAL_TAG }}'
+        GEMINI_SANDBOX: 'docker'
+        BUILD_SANDBOX_FLAGS: '--platform linux/amd64,linux/arm64 --push'
+        STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG: '${{ steps.image_tag.outputs.FINAL_TAG }}'
+      run: |-
+        npm run build:sandbox -- \
+          --image "google/gemini-cli-sandbox:${STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG}"
+    - name: 'Create issue on failure'
+      if: |-
+        ${{ failure() }}
+      shell: 'bash'
+      env:
+        GITHUB_TOKEN: '${{ inputs.github-secret }}'
+        DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+      run: |-
+        gh issue create \
+          --title "Docker build failed" \
+          --body "The docker build failed. See the full run for details: ${DETAILS_URL}" \
+          --label "release-failure"

.github/actions/run-tests/action.yml

@@ -0,0 +1,38 @@
+name: 'Run Tests'
+description: 'Runs the preflight checks and integration tests.'
+
+inputs:
+  gemini_api_key:
+    description: 'The API key for running integration tests.'
+    required: true
+  working-directory:
+    description: 'The working directory to run the tests in.'
+    required: false
+    default: '.'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: '📝 Print Inputs'
+      shell: 'bash'
+      env:
+        JSON_INPUTS: '${{ toJSON(inputs) }}'
+      run: 'echo "$JSON_INPUTS"'
+    - name: 'Run Tests'
+      env:
+        GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'
+      working-directory: '${{ inputs.working-directory }}'
+      run: |-
+        echo "::group::Build"
+        npm run build
+        echo "::endgroup::"
+        echo "::group::Unit Tests"
+        npm run test:ci
+        echo "::endgroup::"
+        echo "::group::Integration Tests (no sandbox)"
+        npm run test:integration:sandbox:none
+        echo "::endgroup::"
+        echo "::group::Integration Tests (docker sandbox)"
+        npm run test:integration:sandbox:docker
+        echo "::endgroup::"
+      shell: 'bash'

.github/actions/setup-npmrc/action.yml

@@ -0,0 +1,24 @@
+name: 'Setup NPMRC'
+description: 'Sets up NPMRC with all the correct repos for readonly access.'
+
+inputs:
+  github-token:
+    description: 'the github token'
+    required: true
+
+outputs:
+  auth-token:
+    description: 'The generated NPM auth token'
+    value: '${{ steps.npm_auth_token.outputs.auth-token }}'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Configure .npmrc'
+      shell: 'bash'
+      run: |-
+        echo ""@google-gemini:registry=https://npm.pkg.github.com"" > ~/.npmrc
+        echo ""//npm.pkg.github.com/:_authToken=${INPUTS_GITHUB_TOKEN}"" >> ~/.npmrc
+        echo ""@google:registry=https://wombat-dressing-room.appspot.com"" >> ~/.npmrc
+      env:
+        INPUTS_GITHUB_TOKEN: '${{ inputs.github-token }}'

.github/actions/tag-npm-release/action.yml

@@ -0,0 +1,145 @@
+name: 'Tag an NPM release'
+description: 'Tags a specific npm version to a specific channel.'
+
+inputs:
+  channel:
+    description: 'NPM Channel tag'
+    required: true
+  version:
+    description: 'version'
+    required: true
+  dry-run:
+    description: 'Whether to run in dry-run mode.'
+    required: true
+  github-token:
+    description: 'The GitHub token for creating the release.'
+    required: true
+  wombat-token-core:
+    description: 'The npm token for the wombat @google/gemini-cli-core'
+    required: true
+  wombat-token-cli:
+    description: 'The npm token for wombat @google/gemini-cli'
+    required: true
+  wombat-token-a2a-server:
+    description: 'The npm token for the @google/gemini-cli-a2a-server package.'
+    required: true
+  cli-package-name:
+    description: 'The name of the cli package.'
+    required: true
+  core-package-name:
+    description: 'The name of the core package.'
+    required: true
+  a2a-package-name:
+    description: 'The name of the a2a package.'
+    required: true
+  working-directory:
+    description: 'The working directory to run the commands in.'
+    required: false
+    default: '.'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: '📝 Print Inputs'
+      shell: 'bash'
+      env:
+        JSON_INPUTS: '${{ toJSON(inputs) }}'
+      run: 'echo "$JSON_INPUTS"'
+
+    - name: 'Setup Node.js'
+      uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+      with:
+        node-version-file: '${{ inputs.working-directory }}/.nvmrc'
+
+    - name: 'configure .npmrc'
+      uses: './.github/actions/setup-npmrc'
+      with:
+        github-token: '${{ inputs.github-token }}'
+
+    - name: 'Get core Token'
+      uses: './.github/actions/npm-auth-token'
+      id: 'core-token'
+      with:
+        package-name: '${{ inputs.core-package-name }}'
+        github-token: '${{ inputs.github-token }}'
+        wombat-token-core: '${{ inputs.wombat-token-core }}'
+        wombat-token-cli: '${{ inputs.wombat-token-cli }}'
+        wombat-token-a2a-server: '${{ inputs.wombat-token-a2a-server }}'
+
+    - name: 'Change tag for CORE'
+      if: |-
+        ${{ inputs.dry-run != 'true' }}
+      env:
+        NODE_AUTH_TOKEN: '${{ steps.core-token.outputs.auth-token }}'
+        INPUTS_CORE_PACKAGE_NAME: '${{ inputs.core-package-name }}'
+        INPUTS_VERSION: '${{ inputs.version }}'
+        INPUTS_CHANNEL: '${{ inputs.channel }}'
+      shell: 'bash'
+      working-directory: '${{ inputs.working-directory }}'
+      run: |
+        npm dist-tag add ${INPUTS_CORE_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL}
+
+    - name: 'Get cli Token'
+      uses: './.github/actions/npm-auth-token'
+      id: 'cli-token'
+      with:
+        package-name: '${{ inputs.cli-package-name }}'
+        github-token: '${{ inputs.github-token }}'
+        wombat-token-core: '${{ inputs.wombat-token-core }}'
+        wombat-token-cli: '${{ inputs.wombat-token-cli }}'
+        wombat-token-a2a-server: '${{ inputs.wombat-token-a2a-server }}'
+
+    - name: 'Change tag for CLI'
+      if: |-
+        ${{ inputs.dry-run != 'true' }}
+      env:
+        NODE_AUTH_TOKEN: '${{ steps.cli-token.outputs.auth-token }}'
+        INPUTS_CLI_PACKAGE_NAME: '${{ inputs.cli-package-name }}'
+        INPUTS_VERSION: '${{ inputs.version }}'
+        INPUTS_CHANNEL: '${{ inputs.channel }}'
+      shell: 'bash'
+      working-directory: '${{ inputs.working-directory }}'
+      run: |
+        npm dist-tag add ${INPUTS_CLI_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL}
+
+    - name: 'Get a2a Token'
+      uses: './.github/actions/npm-auth-token'
+      id: 'a2a-token'
+      with:
+        package-name: '${{ inputs.a2a-package-name }}'
+        github-token: '${{ inputs.github-token }}'
+        wombat-token-core: '${{ inputs.wombat-token-core }}'
+        wombat-token-cli: '${{ inputs.wombat-token-cli }}'
+        wombat-token-a2a-server: '${{ inputs.wombat-token-a2a-server }}'
+
+    - name: 'Change tag for a2a'
+      if: |-
+        ${{ inputs.dry-run == 'false' }}
+      env:
+        NODE_AUTH_TOKEN: '${{ steps.a2a-token.outputs.auth-token }}'
+        INPUTS_A2A_PACKAGE_NAME: '${{ inputs.a2a-package-name }}'
+        INPUTS_VERSION: '${{ inputs.version }}'
+        INPUTS_CHANNEL: '${{ inputs.channel }}'
+      shell: 'bash'
+      working-directory: '${{ inputs.working-directory }}'
+      run: |
+        npm dist-tag add ${INPUTS_A2A_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL}
+
+    - name: 'Log dry run'
+      if: |-
+        ${{ inputs.dry-run == 'true' }}
+      shell: 'bash'
+      working-directory: '${{ inputs.working-directory }}'
+      run: |
+        echo "Dry run: Would have added tag '${INPUTS_CHANNEL}' to version '${INPUTS_VERSION}' for ${INPUTS_CLI_PACKAGE_NAME}, ${INPUTS_CORE_PACKAGE_NAME}, and ${INPUTS_A2A_PACKAGE_NAME}."
+
+      env:
+        INPUTS_CHANNEL: '${{ inputs.channel }}'
+
+        INPUTS_VERSION: '${{ inputs.version }}'
+
+        INPUTS_CLI_PACKAGE_NAME: '${{ inputs.cli-package-name }}'
+
+        INPUTS_CORE_PACKAGE_NAME: '${{ inputs.core-package-name }}'
+
+        INPUTS_A2A_PACKAGE_NAME: '${{ inputs.a2a-package-name }}'

.github/actions/verify-release/action.yml

@@ -0,0 +1,106 @@
+name: 'Verify an NPM release'
+description: 'Fetches a package from NPM and does some basic smoke tests'
+
+inputs:
+  npm-package:
+    description: 'NPM Package'
+    required: true
+    default: '@google/gemini-cli@latest'
+  npm-registry-url:
+    description: 'NPM Registry URL'
+    required: true
+  npm-registry-scope:
+    description: 'NPM Registry Scope'
+    required: true
+  expected-version:
+    description: 'Expected version'
+    required: true
+  gemini_api_key:
+    description: 'The API key for running integration tests.'
+    required: true
+  github-token:
+    description: 'The GitHub token for running integration tests.'
+    required: true
+  working-directory:
+    description: 'The working directory to run the tests in.'
+    required: false
+    default: '.'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: '📝 Print Inputs'
+      shell: 'bash'
+      env:
+        JSON_INPUTS: '${{ toJSON(inputs) }}'
+      run: 'echo "$JSON_INPUTS"'
+
+    - name: 'setup node'
+      uses: 'actions/setup-node@v4'
+      with:
+        node-version: '20'
+
+    - name: 'configure .npmrc'
+      uses: './.github/actions/setup-npmrc'
+      with:
+        github-token: '${{ inputs.github-token }}'
+
+    - name: 'Clear npm cache'
+      shell: 'bash'
+      run: 'npm cache clean --force'
+
+    - name: 'Install from NPM'
+      uses: 'nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08' # ratchet:nick-fields/retry@v3
+      with:
+        timeout_seconds: 900
+        retry_wait_seconds: 30
+        max_attempts: 10
+        command: |-
+          cd ${{ inputs.working-directory }}
+          npm install --prefer-online --no-cache -g "${{ inputs.npm-package }}"
+
+    - name: 'Smoke test - NPM Install'
+      shell: 'bash'
+      working-directory: '${{ inputs.working-directory }}'
+      run: |-
+        gemini_version=$(gemini --version)
+        if [ "$gemini_version" != "${INPUTS_EXPECTED_VERSION}" ]; then
+          echo "❌ NPM Version mismatch: Got $gemini_version from ${INPUTS_NPM_PACKAGE}, expected ${INPUTS_EXPECTED_VERSION}"
+          exit 1
+        fi
+      env:
+        INPUTS_EXPECTED_VERSION: '${{ inputs.expected-version }}'
+        INPUTS_NPM_PACKAGE: '${{ inputs.npm-package }}'
+
+    - name: 'Clear npm cache'
+      shell: 'bash'
+      run: 'npm cache clean --force'
+
+    - name: 'Smoke test - NPX Run'
+      shell: 'bash'
+      working-directory: '${{ inputs.working-directory }}'
+      run: |-
+        gemini_version=$(npx --prefer-online "${INPUTS_NPM_PACKAGE}" --version)
+        if [ "$gemini_version" != "${INPUTS_EXPECTED_VERSION}" ]; then
+          echo "❌ NPX Run Version mismatch: Got $gemini_version from ${INPUTS_NPM_PACKAGE}, expected ${INPUTS_EXPECTED_VERSION}"
+          exit 1
+        fi
+      env:
+        INPUTS_NPM_PACKAGE: '${{ inputs.npm-package }}'
+        INPUTS_EXPECTED_VERSION: '${{ inputs.expected-version }}'
+
+    - name: 'Install dependencies for integration tests'
+      shell: 'bash'
+      working-directory: '${{ inputs.working-directory }}'
+      run: 'npm ci'
+
+    - name: '🔬 Run integration tests against NPM release'
+      working-directory: '${{ inputs.working-directory }}'
+      env:
+        GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'
+        INTEGRATION_TEST_USE_INSTALLED_GEMINI: 'true'
+        # We must diable CI mode here because it interferes with interactive tests.
+        # See https://github.com/google-gemini/gemini-cli/issues/10517
+        CI: 'false'
+      shell: 'bash'
+      run: 'npm run test:integration:sandbox:none'

.github/dependabot.yml

@@ -1,35 +1,33 @@
-# See https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 version: 2
 updates:
   - package-ecosystem: 'npm'
     directory: '/'
     schedule:
-      interval: 'daily'
-    target-branch: 'main'
-    commit-message:
-      prefix: 'chore(deps)'
-      include: 'scope'
+      interval: 'weekly'
+      day: 'monday'
+    open-pull-requests-limit: 10
     reviewers:
-      - 'google-gemini/gemini-cli-askmode-approvers'
+      - 'joshualitt'
     groups:
-      # Group all non-major updates together.
-      # This is to reduce the number of PRs that need to be reviewed.
-      # Major updates will still be created as separate PRs.
-      npm-minor-patch:
-        applies-to: 'version-updates'
+      npm-dependencies:
+        patterns:
+          - '*'
         update-types:
           - 'minor'
           - 'patch'
-    open-pull-requests-limit: 0
 
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
-      interval: 'daily'
-    target-branch: 'main'
-    commit-message:
-      prefix: 'chore(deps)'
-      include: 'scope'
+      interval: 'weekly'
+      day: 'monday'
+    open-pull-requests-limit: 10
     reviewers:
-      - 'google-gemini/gemini-cli-askmode-approvers'
-    open-pull-requests-limit: 0
+      - 'joshualitt'
+    groups:
+      actions-dependencies:
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+          - 'patch'

.github/pull_request_template.md

@@ -1,41 +1,42 @@
-## TLDR
+## Summary
 
-<!-- Add a brief description of what this pull request changes and why and any important things for reviewers to look at -->
+<!-- Concisely describe what this PR changes and why. Focus on impact and
+urgency. -->
 
-## Dive Deeper
+## Details
 
-<!-- more thoughts and in-depth discussion here -->
+<!-- Add any extra context and design decisions. Keep it brief but complete. -->
 
-## Reviewer Test Plan
+## Related Issues
 
-<!-- when a person reviews your code they should ideally be pulling and running that code. How would they validate your change works and if relevant what are some good classes of example prompts and ways they can exercise your changes -->
+<!-- Use keywords to auto-close issues (Closes #123, Fixes #456). If this PR is
+only related to an issue or is a partial fix, simply reference the issue number
+without a keyword (Related to #123). -->
 
-## Testing Matrix
+## How to Validate
 
-<!-- Before submitting please validate your changes on as many of these options as possible -->
+<!-- List exact steps for reviewers to validate the change. Include commands,
+expected results, and edge cases. -->
 
-|          | 🍏  | 🪟  | 🐧  |
-| -------- | --- | --- | --- |
-| npm run  | ❓  | ❓  | ❓  |
-| npx      | ❓  | ❓  | ❓  |
-| Docker   | ❓  | ❓  | ❓  |
-| Podman   | ❓  | -   | -   |
-| Seatbelt | ❓  | -   | -   |
+## Pre-Merge Checklist
 
-## Linked issues / bugs
+<!-- Check all that apply before requesting review or merging. -->
 
-<!--
-Link to any related issues or bugs.
-
-**If this PR fully resolves the issue, use one of the following keywords to automatically close the issue when this PR is merged:**
-
-- Closes #<issue_number>
-- Fixes #<issue_number>
-- Resolves #<issue_number>
-
-*Example: `Resolves #123`*
-
-**If this PR is only related to an issue or is a partial fix, simply reference the issue number without a keyword:**
-
-*Example: `This PR makes progress on #456` or `Related to #789`*
--->
+- [ ] Updated relevant documentation and README (if needed)
+- [ ] Added/updated tests (if needed)
+- [ ] Noted breaking changes (if any)
+- [ ] Validated on required platforms/methods:
+  - [ ] MacOS
+    - [ ] npm run
+    - [ ] npx
+    - [ ] Docker
+    - [ ] Podman
+    - [ ] Seatbelt
+  - [ ] Windows
+    - [ ] npm run
+    - [ ] npx
+    - [ ] Docker
+  - [ ] Linux
+    - [ ] npm run
+    - [ ] npx
+    - [ ] Docker

.github/scripts/backfill-need-triage.cjs

@@ -0,0 +1,138 @@
+/* eslint-disable */
+/* global require, console, process */
+
+/**
+ * Script to backfill the 'status/need-triage' label to all open issues
+ * that are NOT currently labeled with '🔒 maintainer only' or 'help wanted'.
+ */
+
+const { execFileSync } = require('child_process');
+
+const isDryRun = process.argv.includes('--dry-run');
+const REPO = 'google-gemini/gemini-cli';
+
+/**
+ * Executes a GitHub CLI command safely using an argument array to prevent command injection.
+ * @param {string[]} args
+ * @returns {string|null}
+ */
+function runGh(args) {
+  try {
+    // Using execFileSync with an array of arguments is safe as it doesn't use a shell.
+    // We set a large maxBuffer (10MB) to handle repositories with many issues.
+    return execFileSync('gh', args, {
+      encoding: 'utf8',
+      maxBuffer: 10 * 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim();
+  } catch (error) {
+    const stderr = error.stderr ? ` Stderr: ${error.stderr.trim()}` : '';
+    console.error(
+      `❌ Error running gh ${args.join(' ')}: ${error.message}${stderr}`,
+    );
+    return null;
+  }
+}
+
+async function main() {
+  console.log('🔐 GitHub CLI security check...');
+  const authStatus = runGh(['auth', 'status']);
+  if (authStatus === null) {
+    console.error('❌ GitHub CLI (gh) is not installed or not authenticated.');
+    process.exit(1);
+  }
+
+  if (isDryRun) {
+    console.log('🧪 DRY RUN MODE ENABLED - No changes will be made.\n');
+  }
+
+  console.log(`🔍 Fetching and filtering open issues from ${REPO}...`);
+
+  // We use the /issues endpoint with pagination to bypass the 1000-result limit.
+  // The jq filter ensures we exclude PRs, maintainer-only, help-wanted, and existing status/need-triage.
+  const jqFilter =
+    '.[] | select(.pull_request == null) | select([.labels[].name] as $l | (any($l[]; . == "🔒 maintainer only") | not) and (any($l[]; . == "help wanted") | not) and (any($l[]; . == "status/need-triage") | not)) | {number: .number, title: .title}';
+
+  const output = runGh([
+    'api',
+    `repos/${REPO}/issues?state=open&per_page=100`,
+    '--paginate',
+    '--jq',
+    jqFilter,
+  ]);
+
+  if (output === null) {
+    process.exit(1);
+  }
+
+  const issues = output
+    .split('\n')
+    .filter((line) => line.trim())
+    .map((line) => {
+      try {
+        return JSON.parse(line);
+      } catch (_e) {
+        console.error(`⚠️ Failed to parse line: ${line}`);
+        return null;
+      }
+    })
+    .filter(Boolean);
+
+  console.log(`✅ Found ${issues.length} issues matching criteria.`);
+
+  if (issues.length === 0) {
+    console.log('✨ No issues need backfilling.');
+    return;
+  }
+
+  let successCount = 0;
+  let failCount = 0;
+
+  if (isDryRun) {
+    for (const issue of issues) {
+      console.log(
+        `[DRY RUN] Would label issue #${issue.number}: ${issue.title}`,
+      );
+    }
+    successCount = issues.length;
+  } else {
+    console.log(`🏷️  Applying labels to ${issues.length} issues...`);
+
+    for (const issue of issues) {
+      const issueNumber = String(issue.number);
+      console.log(`🏷️  Labeling issue #${issueNumber}: ${issue.title}`);
+
+      const result = runGh([
+        'issue',
+        'edit',
+        issueNumber,
+        '--add-label',
+        'status/need-triage',
+        '--repo',
+        REPO,
+      ]);
+
+      if (result !== null) {
+        successCount++;
+      } else {
+        failCount++;
+      }
+    }
+  }
+
+  console.log(`\n📊 Summary:`);
+  console.log(`   - Success: ${successCount}`);
+  console.log(`   - Failed:  ${failCount}`);
+
+  if (failCount > 0) {
+    console.error(`\n❌ Backfill completed with ${failCount} errors.`);
+    process.exit(1);
+  } else {
+    console.log(`\n🎉 ${isDryRun ? 'Dry run' : 'Backfill'} complete!`);
+  }
+}
+
+main().catch((error) => {
+  console.error('❌ Unexpected error:', error);
+  process.exit(1);
+});

.github/scripts/backfill-pr-notification.cjs

@@ -0,0 +1,190 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/* eslint-disable */
+/* global require, console, process */
+
+/**
+ * Script to backfill a process change notification comment to all open PRs
+ * not created by members of the 'gemini-cli-maintainers' team.
+ *
+ * Skip PRs that are already associated with an issue.
+ */
+
+const { execFileSync } = require('child_process');
+
+const isDryRun = process.argv.includes('--dry-run');
+const REPO = 'google-gemini/gemini-cli';
+const ORG = 'google-gemini';
+const TEAM_SLUG = 'gemini-cli-maintainers';
+const DISCUSSION_URL =
+  'https://github.com/google-gemini/gemini-cli/discussions/16706';
+
+/**
+ * Executes a GitHub CLI command safely using an argument array.
+ */
+function runGh(args, options = {}) {
+  const { silent = false } = options;
+  try {
+    return execFileSync('gh', args, {
+      encoding: 'utf8',
+      maxBuffer: 10 * 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim();
+  } catch (error) {
+    if (!silent) {
+      const stderr = error.stderr ? ` Stderr: ${error.stderr.trim()}` : '';
+      console.error(
+        `❌ Error running gh ${args.join(' ')}: ${error.message}${stderr}`,
+      );
+    }
+    return null;
+  }
+}
+
+/**
+ * Checks if a user is a member of the maintainers team.
+ */
+const membershipCache = new Map();
+function isMaintainer(username) {
+  if (membershipCache.has(username)) return membershipCache.get(username);
+
+  // GitHub returns 404 if user is not a member.
+  // We use silent: true to avoid logging 404s as errors.
+  const result = runGh(
+    ['api', `orgs/${ORG}/teams/${TEAM_SLUG}/memberships/${username}`],
+    { silent: true },
+  );
+
+  const isMember = result !== null;
+  membershipCache.set(username, isMember);
+  return isMember;
+}
+
+async function main() {
+  console.log('🔐 GitHub CLI security check...');
+  if (runGh(['auth', 'status']) === null) {
+    console.error('❌ GitHub CLI (gh) is not authenticated.');
+    process.exit(1);
+  }
+
+  if (isDryRun) {
+    console.log('🧪 DRY RUN MODE ENABLED\n');
+  }
+
+  console.log(`📥 Fetching open PRs from ${REPO}...`);
+  // Fetch number, author, and closingIssuesReferences to check if linked to an issue
+  const prsJson = runGh([
+    'pr',
+    'list',
+    '--repo',
+    REPO,
+    '--state',
+    'open',
+    '--limit',
+    '1000',
+    '--json',
+    'number,author,closingIssuesReferences',
+  ]);
+
+  if (prsJson === null) process.exit(1);
+  const prs = JSON.parse(prsJson);
+
+  console.log(`📊 Found ${prs.length} open PRs. Filtering...`);
+
+  let targetPrs = [];
+  for (const pr of prs) {
+    const author = pr.author.login;
+    const issueCount = pr.closingIssuesReferences
+      ? pr.closingIssuesReferences.length
+      : 0;
+
+    if (issueCount > 0) {
+      // Skip if already linked to an issue
+      continue;
+    }
+
+    if (!isMaintainer(author)) {
+      targetPrs.push(pr);
+    }
+  }
+
+  console.log(
+    `✅ Found ${targetPrs.length} PRs from non-maintainers without associated issues.`,
+  );
+
+  const commentBody =
+    "\nHi @{AUTHOR}, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this.\n\nWe're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: [Improving Our Contribution Process & Introducing New Guidelines](${DISCUSSION_URL}).\n\nKey Update: Starting **January 26, 2026**, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed.\n\nThank you for your understanding and for being a part of our community!\n  ".trim();
+
+  let successCount = 0;
+  let skipCount = 0;
+  let failCount = 0;
+
+  for (const pr of targetPrs) {
+    const prNumber = String(pr.number);
+    const author = pr.author.login;
+
+    // Check if we already commented (idempotency)
+    // We use silent: true here because view might fail if PR is deleted mid-run
+    const existingComments = runGh(
+      [
+        'pr',
+        'view',
+        prNumber,
+        '--repo',
+        REPO,
+        '--json',
+        'comments',
+        '--jq',
+        `.comments[].body | contains("${DISCUSSION_URL}")`,
+      ],
+      { silent: true },
+    );
+
+    if (existingComments && existingComments.includes('true')) {
+      console.log(
+        `⏭️  PR #${prNumber} already has the notification. Skipping.`,
+      );
+      skipCount++;
+      continue;
+    }
+
+    if (isDryRun) {
+      console.log(`[DRY RUN] Would notify @${author} on PR #${prNumber}`);
+      successCount++;
+    } else {
+      console.log(`💬 Notifying @${author} on PR #${prNumber}...`);
+      const personalizedComment = commentBody.replace('{AUTHOR}', author);
+      const result = runGh([
+        'pr',
+        'comment',
+        prNumber,
+        '--repo',
+        REPO,
+        '--body',
+        personalizedComment,
+      ]);
+
+      if (result !== null) {
+        successCount++;
+      } else {
+        failCount++;
+      }
+    }
+  }
+
+  console.log(`\n📊 Summary:`);
+  console.log(`   - Notified: ${successCount}`);
+  console.log(`   - Skipped:  ${skipCount}`);
+  console.log(`   - Failed:   ${failCount}`);
+
+  if (failCount > 0) process.exit(1);
+}
+
+main().catch((e) => {
+  console.error(e);
+  process.exit(1);
+});

.github/scripts/pr-triage.sh

@@ -1,169 +1,180 @@
 #!/usr/bin/env bash
+# @license
+# Copyright 2026 Google LLC
+# SPDX-License-Identifier: Apache-2.0
+
 set -euo pipefail
 
 # Initialize a comma-separated string to hold PR numbers that need a comment
 PRS_NEEDING_COMMENT=""
 
-# Function to process a single PR
-process_pr() {
-    if [[ -z "${GITHUB_REPOSITORY:-}" ]]; then
-        echo "‼️ Missing \$GITHUB_REPOSITORY - this must be run from GitHub Actions"
-        return 1
+# Global cache for issue labels (compatible with Bash 3.2)
+# Stores "|ISSUE_NUM:LABELS|" segments
+ISSUE_LABELS_CACHE_FLAT="|"
+
+# Function to get labels from an issue (with caching)
+get_issue_labels() {
+    local ISSUE_NUM="${1}"
+    if [[ -z "${ISSUE_NUM}" || "${ISSUE_NUM}" == "null" || "${ISSUE_NUM}" == "" ]]; then
+        return
     fi
 
-    if [[ -z "${GITHUB_OUTPUT:-}" ]]; then
-        echo "‼️ Missing \$GITHUB_OUTPUT - this must be run from GitHub Actions"
-        return 1
+    # Check cache
+    case "${ISSUE_LABELS_CACHE_FLAT}" in
+        *"|${ISSUE_NUM}:"*) 
+            local suffix="${ISSUE_LABELS_CACHE_FLAT#*|"${ISSUE_NUM}":}"
+            echo "${suffix%%|*}"
+            return
+            ;; 
+        *)
+            # Cache miss, proceed to fetch
+            ;;
+    esac
+
+    echo "   📥 Fetching labels from issue #${ISSUE_NUM}" >&2
+    local gh_output
+    if ! gh_output=$(gh issue view "${ISSUE_NUM}" --repo "${GITHUB_REPOSITORY}" --json labels -q '.labels[].name' 2>/dev/null); then
+        echo "      ⚠️ Could not fetch issue #${ISSUE_NUM}" >&2
+        ISSUE_LABELS_CACHE_FLAT="${ISSUE_LABELS_CACHE_FLAT}${ISSUE_NUM}:|"
+        return
     fi
 
-    local PR_NUMBER=$1
+    local labels
+    labels=$(echo "${gh_output}" | grep -x -E '(area|priority)/.*|help wanted|🔒 maintainer only' | tr '\n' ',' | sed 's/,$//' || echo "")
+    
+    # Save to flat cache
+    ISSUE_LABELS_CACHE_FLAT="${ISSUE_LABELS_CACHE_FLAT}${ISSUE_NUM}:${labels}|"
+    echo "${labels}"
+}
+
+# Function to process a single PR with pre-fetched data
+process_pr_optimized() {
+    local PR_NUMBER="${1}"
+    local IS_DRAFT="${2}"
+    local ISSUE_NUMBER="${3}"
+    local CURRENT_LABELS="${4}" # Comma-separated labels
+
     echo "🔄 Processing PR #${PR_NUMBER}"
 
-    # Get PR body with error handling
-    local PR_BODY
-    if ! PR_BODY=$(gh pr view "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json body -q .body 2>/dev/null); then
-        echo "   ⚠️ Could not fetch PR #${PR_NUMBER} details"
-        return 1
-    fi
+    local LABELS_TO_ADD=""
+    local LABELS_TO_REMOVE=""
 
-    # Look for issue references using multiple patterns
-    local ISSUE_NUMBER=""
-
-    # Pattern 1: Direct reference like #123
-    if [[ -z "${ISSUE_NUMBER}" ]]; then
-        ISSUE_NUMBER=$(echo "${PR_BODY}" | grep -oE '#[0-9]+' | head -1 | sed 's/#//' 2>/dev/null || echo "")
-    fi
-
-    # Pattern 2: Closes/Fixes/Resolves patterns (case-insensitive)
-    if [[ -z "${ISSUE_NUMBER}" ]]; then
-        ISSUE_NUMBER=$(echo "${PR_BODY}" | grep -iE '(closes?|fixes?|resolves?) #[0-9]+' | grep -oE '#[0-9]+' | head -1 | sed 's/#//' 2>/dev/null || echo "")
-    fi
-
-    if [[ -z "${ISSUE_NUMBER}" ]]; then
-        echo "⚠️  No linked issue found for PR #${PR_NUMBER}, adding status/need-issue label"
-        if ! gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --add-label "status/need-issue" 2>/dev/null; then
-            echo "   ⚠️ Failed to add label (may already exist or have permission issues)"
-        fi
-        # Add PR number to the list
-        if [[ -z "${PRS_NEEDING_COMMENT}" ]]; then
-            PRS_NEEDING_COMMENT="${PR_NUMBER}"
-        else
-            PRS_NEEDING_COMMENT="${PRS_NEEDING_COMMENT},${PR_NUMBER}"
-        fi
-        echo "needs_comment=true" >> "${GITHUB_OUTPUT}"
-    else
-        echo "🔗 Found linked issue #${ISSUE_NUMBER}"
-
-        # Remove status/need-issue label if present
-        if ! gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --remove-label "status/need-issue" 2>/dev/null; then
-            echo "   status/need-issue label not present or could not be removed"
-        fi
-
-        # Get issue labels
-        echo "📥 Fetching labels from issue #${ISSUE_NUMBER}"
-        local ISSUE_LABELS=""
-        if ! ISSUE_LABELS=$(gh issue view "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json labels -q '.labels[].name' 2>/dev/null | tr '\n' ',' | sed 's/,$//' || echo ""); then
-            echo "   ⚠️ Could not fetch issue #${ISSUE_NUMBER} (may not exist or be in different repo)"
-            ISSUE_LABELS=""
-        fi
-
-        # Get PR labels
-        echo "📥 Fetching labels from PR #${PR_NUMBER}"
-        local PR_LABELS=""
-        if ! PR_LABELS=$(gh pr view "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json labels -q '.labels[].name' 2>/dev/null | tr '\n' ',' | sed 's/,$//' || echo ""); then
-            echo "   ⚠️ Could not fetch PR labels"
-            PR_LABELS=""
-        fi
-
-        echo "   Issue labels: ${ISSUE_LABELS}"
-        echo "   PR labels: ${PR_LABELS}"
-
-        # Convert comma-separated strings to arrays
-        local ISSUE_LABEL_ARRAY PR_LABEL_ARRAY
-        IFS=',' read -ra ISSUE_LABEL_ARRAY <<< "${ISSUE_LABELS}"
-        IFS=',' read -ra PR_LABEL_ARRAY <<< "${PR_LABELS}"
-
-        # Find labels to add (on issue but not on PR)
-        local LABELS_TO_ADD=""
-        for label in "${ISSUE_LABEL_ARRAY[@]}"; do
-            if [[ -n "${label}" ]] && [[ " ${PR_LABEL_ARRAY[*]} " != *" ${label} "* ]]; then
-                if [[ -z "${LABELS_TO_ADD}" ]]; then
-                    LABELS_TO_ADD="${label}"
-                else
-                    LABELS_TO_ADD="${LABELS_TO_ADD},${label}"
-                fi
+    if [[ -z "${ISSUE_NUMBER}" || "${ISSUE_NUMBER}" == "null" || "${ISSUE_NUMBER}" == "" ]]; then
+        if [[ "${IS_DRAFT}" == "true" ]]; then
+            echo "   📝 PR #${PR_NUMBER} is a draft and has no linked issue"
+            if [[ ",${CURRENT_LABELS}," == *",status/need-issue,"* ]]; then
+                echo "      ➖ Removing status/need-issue label"
+                LABELS_TO_REMOVE="status/need-issue"
             fi
-        done
+        else
+            echo "   ⚠️  No linked issue found for PR #${PR_NUMBER}"
+            if [[ ",${CURRENT_LABELS}," != *",status/need-issue,"* ]]; then
+                echo "      ➕ Adding status/need-issue label"
+                LABELS_TO_ADD="status/need-issue"
+            fi
+            
+            if [[ -z "${PRS_NEEDING_COMMENT}" ]]; then
+                PRS_NEEDING_COMMENT="${PR_NUMBER}"
+            else
+                PRS_NEEDING_COMMENT="${PRS_NEEDING_COMMENT},${PR_NUMBER}"
+            fi
+        fi
+    else
+        echo "   🔗 Found linked issue #${ISSUE_NUMBER}"
 
-        # Find labels to remove (on PR but not on issue)
-        local LABELS_TO_REMOVE=""
-        for label in "${PR_LABEL_ARRAY[@]}"; do
-            if [[ -n "${label}" ]] && [[ " ${ISSUE_LABEL_ARRAY[*]} " != *" ${label} "* ]]; then
-                # Don't remove status/need-issue since we already handled it
-                if [[ "${label}" != "status/need-issue" ]]; then
-                    if [[ -z "${LABELS_TO_REMOVE}" ]]; then
-                        LABELS_TO_REMOVE="${label}"
+        if [[ ",${CURRENT_LABELS}," == *",status/need-issue,"* ]]; then
+            echo "      ➖ Removing status/need-issue label"
+            LABELS_TO_REMOVE="status/need-issue"
+        fi
+
+        local ISSUE_LABELS
+        ISSUE_LABELS=$(get_issue_labels "${ISSUE_NUMBER}")
+
+        if [[ -n "${ISSUE_LABELS}" ]]; then
+            local IFS_OLD="${IFS}"
+            IFS=','
+            for label in ${ISSUE_LABELS}; do
+                if [[ -n "${label}" ]] && [[ ",${CURRENT_LABELS}," != *",${label},"* ]]; then
+                    if [[ -z "${LABELS_TO_ADD}" ]]; then
+                        LABELS_TO_ADD="${label}"
                     else
-                        LABELS_TO_REMOVE="${LABELS_TO_REMOVE},${label}"
+                        LABELS_TO_ADD="${LABELS_TO_ADD},${label}"
                     fi
                 fi
-            fi
-        done
+done
+            IFS="${IFS_OLD}"
+        fi
 
-        # Apply label changes
+        if [[ -z "${LABELS_TO_ADD}" && -z "${LABELS_TO_REMOVE}" ]]; then
+            echo "   ✅ Labels already synchronized"
+        fi
+    fi
+
+    if [[ -n "${LABELS_TO_ADD}" || -n "${LABELS_TO_REMOVE}" ]]; then
+        local EDIT_CMD=("gh" "pr" "edit" "${PR_NUMBER}" "--repo" "${GITHUB_REPOSITORY}")
         if [[ -n "${LABELS_TO_ADD}" ]]; then
-            echo "➕ Adding labels: ${LABELS_TO_ADD}"
-            if ! gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --add-label "${LABELS_TO_ADD}" 2>/dev/null; then
-                echo "   ⚠️ Failed to add some labels"
-            fi
+            echo "      ➕ Syncing labels to add: ${LABELS_TO_ADD}"
+            EDIT_CMD+=("--add-label" "${LABELS_TO_ADD}")
         fi
-
         if [[ -n "${LABELS_TO_REMOVE}" ]]; then
-            echo "➖ Removing labels: ${LABELS_TO_REMOVE}"
-            if ! gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --remove-label "${LABELS_TO_REMOVE}" 2>/dev/null; then
-                echo "   ⚠️ Failed to remove some labels"
-            fi
+            echo "      ➖ Syncing labels to remove: ${LABELS_TO_REMOVE}"
+            EDIT_CMD+=("--remove-label" "${LABELS_TO_REMOVE}")
         fi
-
-        if [[ -z "${LABELS_TO_ADD}" ]] && [[ -z "${LABELS_TO_REMOVE}" ]]; then
-            echo "✅ Labels already synchronized"
-        fi
-        echo "needs_comment=false" >> "${GITHUB_OUTPUT}"
+        
+        ("${EDIT_CMD[@]}" || true)
     fi
 }
 
-# If PR_NUMBER is set, process only that PR
-if [[ -n "${PR_NUMBER:-}" ]]; then
-    if ! process_pr "${PR_NUMBER}"; then
-        echo "❌ Failed to process PR #${PR_NUMBER}"
-        exit 1
-    fi
-else
-    # Otherwise, get all open PRs and process them
-    # The script logic will determine which ones need issue linking or label sync
-    echo "📥 Getting all open pull requests..."
-    if ! PR_NUMBERS=$(gh pr list --repo "${GITHUB_REPOSITORY}" --state open --limit 1000 --json number -q '.[].number' 2>/dev/null); then
-        echo "❌ Failed to fetch PR list"
-        exit 1
-    fi
-
-    if [[ -z "${PR_NUMBERS}" ]]; then
-        echo "✅ No open PRs found"
-    else
-        # Count the number of PRs
-        PR_COUNT=$(echo "${PR_NUMBERS}" | wc -w | tr -d ' ')
-        echo "📊 Found ${PR_COUNT} open PRs to process"
-
-        for pr_number in ${PR_NUMBERS}; do
-            if ! process_pr "${pr_number}"; then
-                echo "⚠️ Failed to process PR #${pr_number}, continuing with next PR..."
-                continue
-            fi
-        done
-    fi
+if [[ -z "${GITHUB_REPOSITORY:-}" ]]; then
+    echo "‼️ Missing \$GITHUB_REPOSITORY - this must be run from GitHub Actions"
+    exit 1
+fi
+
+if [[ -z "${GITHUB_OUTPUT:-}" ]]; then
+    echo "‼️ Missing \$GITHUB_OUTPUT - this must be run from GitHub Actions"
+    exit 1
+fi
+
+JQ_EXTRACT_FIELDS='{
+    number: .number,
+    isDraft: .isDraft,
+    issue: (.closingIssuesReferences[0].number // (.body // "" | capture("(^|[^a-zA-Z0-9])#(?<num>[0-9]+)([^a-zA-Z0-9]|$)")? | .num) // "null"),
+    labels: [.labels[].name] | join(",")
+}'
+
+JQ_TSV_FORMAT='"\((.number | tostring))\t\(.isDraft)\t\((.issue // null) | tostring)\t\(.labels)"'
+
+if [[ -n "${PR_NUMBER:-}" ]]; then
+    echo "🔄 Processing single PR #${PR_NUMBER}"
+    PR_DATA=$(gh pr view "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json number,closingIssuesReferences,isDraft,body,labels 2>/dev/null) || {
+        echo "❌ Failed to fetch data for PR #${PR_NUMBER}"
+        exit 1
+    }
+    
+    line=$(echo "${PR_DATA}" | jq -r "${JQ_EXTRACT_FIELDS} | ${JQ_TSV_FORMAT}")
+    IFS=$'\t' read -r pr_num is_draft issue_num current_labels <<< "${line}"
+    process_pr_optimized "${pr_num}" "${is_draft}" "${issue_num}" "${current_labels}"
+else
+    echo "📥 Getting all open pull requests..."
+    PR_DATA_ALL=$(gh pr list --repo "${GITHUB_REPOSITORY}" --state open --limit 1000 --json number,closingIssuesReferences,isDraft,body,labels 2>/dev/null) || {
+        echo "❌ Failed to fetch PR list"
+        exit 1
+    }
+
+    PR_COUNT=$(echo "${PR_DATA_ALL}" | jq '. | length')
+    echo "📊 Found ${PR_COUNT} open PRs to process"
+
+    # Use a temporary file to avoid masking exit codes in process substitution
+    tmp_file=$(mktemp)
+    echo "${PR_DATA_ALL}" | jq -r ".[] | ${JQ_EXTRACT_FIELDS} | ${JQ_TSV_FORMAT}" > "${tmp_file}"
+    while read -r line; do
+        [[ -z "${line}" ]] && continue
+        IFS=$'\t' read -r pr_num is_draft issue_num current_labels <<< "${line}"
+        process_pr_optimized "${pr_num}" "${is_draft}" "${issue_num}" "${current_labels}"
+    done < "${tmp_file}"
+    rm -f "${tmp_file}"
 fi
 
-# Ensure output is always set, even if empty
 if [[ -z "${PRS_NEEDING_COMMENT}" ]]; then
     echo "prs_needing_comment=[]" >> "${GITHUB_OUTPUT}"
 else

.github/scripts/sync-maintainer-labels.cjs

@@ -0,0 +1,389 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const { Octokit } = require('@octokit/rest');
+
+/**
+ * Sync Maintainer Labels (Recursive with strict parent-child relationship detection)
+ * - Uses Native Sub-issues.
+ * - Uses Markdown Task Lists (- [ ] #123).
+ * - Filters for OPEN issues only.
+ * - Skips DUPLICATES.
+ * - Skips Pull Requests.
+ * - ONLY labels issues in the PUBLIC (gemini-cli) repo.
+ */
+
+const REPO_OWNER = 'google-gemini';
+const PUBLIC_REPO = 'gemini-cli';
+const PRIVATE_REPO = 'maintainers-gemini-cli';
+const ALLOWED_REPOS = [PUBLIC_REPO, PRIVATE_REPO];
+
+const ROOT_ISSUES = [
+  { owner: REPO_OWNER, repo: PUBLIC_REPO, number: 15374 },
+  { owner: REPO_OWNER, repo: PUBLIC_REPO, number: 15456 },
+  { owner: REPO_OWNER, repo: PUBLIC_REPO, number: 15324 },
+];
+
+const TARGET_LABEL = '🔒 maintainer only';
+const isDryRun =
+  process.argv.includes('--dry-run') || process.env.DRY_RUN === 'true';
+
+const octokit = new Octokit({
+  auth: process.env.GITHUB_TOKEN,
+});
+
+/**
+ * Extracts child issue references from markdown Task Lists ONLY.
+ * e.g. - [ ] #123 or - [x] google-gemini/gemini-cli#123
+ */
+function extractTaskListLinks(text, contextOwner, contextRepo) {
+  if (!text) return [];
+  const childIssues = new Map();
+
+  const add = (owner, repo, number) => {
+    if (ALLOWED_REPOS.includes(repo)) {
+      const key = `${owner}/${repo}#${number}`;
+      childIssues.set(key, { owner, repo, number: parseInt(number, 10) });
+    }
+  };
+
+  // 1. Full URLs in task lists
+  const urlRegex =
+    /-\s+\[[ x]\].*https:\/\/github\.com\/([a-zA-Z0-9._-]+)\/([a-zA-Z0-9._-]+)\/issues\/(\d+)\b/g;
+  let match;
+  while ((match = urlRegex.exec(text)) !== null) {
+    add(match[1], match[2], match[3]);
+  }
+
+  // 2. Cross-repo refs in task lists: owner/repo#123
+  const crossRepoRegex =
+    /-\s+\[[ x]\].*([a-zA-Z0-9._-]+)\/([a-zA-Z0-9._-]+)#(\d+)\b/g;
+  while ((match = crossRepoRegex.exec(text)) !== null) {
+    add(match[1], match[2], match[3]);
+  }
+
+  // 3. Short refs in task lists: #123
+  const shortRefRegex = /-\s+\[[ x]\].*#(\d+)\b/g;
+  while ((match = shortRefRegex.exec(text)) !== null) {
+    add(contextOwner, contextRepo, match[1]);
+  }
+
+  return Array.from(childIssues.values());
+}
+
+/**
+ * Fetches issue data via GraphQL with full pagination for sub-issues, comments, and labels.
+ */
+async function fetchIssueData(owner, repo, number) {
+  const query = `
+    query($owner:String!, $repo:String!, $number:Int!) {
+      repository(owner:$owner, name:$repo) {
+        issue(number:$number) {
+          state
+          title
+          body
+          labels(first: 100) {
+            nodes { name }
+            pageInfo { hasNextPage endCursor }
+          }
+          subIssues(first: 100) {
+            nodes {
+              number
+              repository {
+                name
+                owner { login }
+              }
+            }
+            pageInfo { hasNextPage endCursor }
+          }
+          comments(first: 100) {
+            nodes {
+              body
+            }
+          }
+        }
+      }
+    }
+  `;
+
+  try {
+    const response = await octokit.graphql(query, { owner, repo, number });
+    const data = response.repository.issue;
+    if (!data) return null;
+
+    const issue = {
+      state: data.state,
+      title: data.title,
+      body: data.body || '',
+      labels: data.labels.nodes.map((n) => n.name),
+      subIssues: [...data.subIssues.nodes],
+      comments: data.comments.nodes.map((n) => n.body),
+    };
+
+    // Paginate subIssues if there are more than 100
+    if (data.subIssues.pageInfo.hasNextPage) {
+      const moreSubIssues = await paginateConnection(
+        owner,
+        repo,
+        number,
+        'subIssues',
+        'number repository { name owner { login } }',
+        data.subIssues.pageInfo.endCursor,
+      );
+      issue.subIssues.push(...moreSubIssues);
+    }
+
+    // Paginate labels if there are more than 100 (unlikely but for completeness)
+    if (data.labels.pageInfo.hasNextPage) {
+      const moreLabels = await paginateConnection(
+        owner,
+        repo,
+        number,
+        'labels',
+        'name',
+        data.labels.pageInfo.endCursor,
+        (n) => n.name,
+      );
+      issue.labels.push(...moreLabels);
+    }
+
+    // Note: Comments are handled via Task Lists in body + first 100 comments.
+    // If an issue has > 100 comments with task lists, we'd need to paginate those too.
+    // Given the 1,100+ issue discovery count, 100 comments is usually sufficient,
+    // but we can add it for absolute completeness.
+    // (Skipping for now to avoid excessive API churn unless clearly needed).
+
+    return issue;
+  } catch (error) {
+    if (error.errors && error.errors.some((e) => e.type === 'NOT_FOUND')) {
+      return null;
+    }
+    throw error;
+  }
+}
+
+/**
+ * Helper to paginate any GraphQL connection.
+ */
+async function paginateConnection(
+  owner,
+  repo,
+  number,
+  connectionName,
+  nodeFields,
+  initialCursor,
+  transformNode = (n) => n,
+) {
+  let additionalNodes = [];
+  let hasNext = true;
+  let cursor = initialCursor;
+
+  while (hasNext) {
+    const query = `
+      query($owner:String!, $repo:String!, $number:Int!, $cursor:String) {
+        repository(owner:$owner, name:$repo) {
+          issue(number:$number) {
+            ${connectionName}(first: 100, after: $cursor) {
+              nodes { ${nodeFields} }
+              pageInfo { hasNextPage endCursor }
+            }
+          }
+        }
+      }
+    `;
+    const response = await octokit.graphql(query, {
+      owner,
+      repo,
+      number,
+      cursor,
+    });
+    const connection = response.repository.issue[connectionName];
+    additionalNodes.push(...connection.nodes.map(transformNode));
+    hasNext = connection.pageInfo.hasNextPage;
+    cursor = connection.pageInfo.endCursor;
+  }
+  return additionalNodes;
+}
+
+/**
+ * Validates if an issue should be processed (Open, not a duplicate, not a PR)
+ */
+function shouldProcess(issueData) {
+  if (!issueData) return false;
+
+  if (issueData.state !== 'OPEN') return false;
+
+  const labels = issueData.labels.map((l) => l.toLowerCase());
+  if (labels.includes('duplicate') || labels.includes('kind/duplicate')) {
+    return false;
+  }
+
+  return true;
+}
+
+async function getAllDescendants(roots) {
+  const allDescendants = new Map();
+  const visited = new Set();
+  const queue = [...roots];
+
+  for (const root of roots) {
+    visited.add(`${root.owner}/${root.repo}#${root.number}`);
+  }
+
+  console.log(`Starting discovery from ${roots.length} roots...`);
+
+  while (queue.length > 0) {
+    const current = queue.shift();
+    const currentKey = `${current.owner}/${current.repo}#${current.number}`;
+
+    try {
+      const issueData = await fetchIssueData(
+        current.owner,
+        current.repo,
+        current.number,
+      );
+
+      if (!shouldProcess(issueData)) {
+        continue;
+      }
+
+      // ONLY add to labeling list if it's in the PUBLIC repository
+      if (current.repo === PUBLIC_REPO) {
+        // Don't label the roots themselves
+        if (
+          !ROOT_ISSUES.some(
+            (r) => r.number === current.number && r.repo === current.repo,
+          )
+        ) {
+          allDescendants.set(currentKey, {
+            ...current,
+            title: issueData.title,
+            labels: issueData.labels,
+          });
+        }
+      }
+
+      const children = new Map();
+
+      // 1. Process Native Sub-issues
+      if (issueData.subIssues) {
+        for (const node of issueData.subIssues) {
+          const childOwner = node.repository.owner.login;
+          const childRepo = node.repository.name;
+          const childNumber = node.number;
+          const key = `${childOwner}/${childRepo}#${childNumber}`;
+          children.set(key, {
+            owner: childOwner,
+            repo: childRepo,
+            number: childNumber,
+          });
+        }
+      }
+
+      // 2. Process Markdown Task Lists in Body and Comments
+      let combinedText = issueData.body || '';
+      if (issueData.comments) {
+        for (const commentBody of issueData.comments) {
+          combinedText += '\n' + (commentBody || '');
+        }
+      }
+
+      const taskListLinks = extractTaskListLinks(
+        combinedText,
+        current.owner,
+        current.repo,
+      );
+      for (const link of taskListLinks) {
+        const key = `${link.owner}/${link.repo}#${link.number}`;
+        children.set(key, link);
+      }
+
+      // Queue children (regardless of which repo they are in, for recursion)
+      for (const [key, child] of children) {
+        if (!visited.has(key)) {
+          visited.add(key);
+          queue.push(child);
+        }
+      }
+    } catch (error) {
+      console.error(`Error processing ${currentKey}: ${error.message}`);
+    }
+  }
+
+  return Array.from(allDescendants.values());
+}
+
+async function run() {
+  if (isDryRun) {
+    console.log('=== DRY RUN MODE: No labels will be applied ===');
+  }
+
+  const descendants = await getAllDescendants(ROOT_ISSUES);
+  console.log(
+    `\nFound ${descendants.length} total unique open descendant issues in ${PUBLIC_REPO}.`,
+  );
+
+  for (const issueInfo of descendants) {
+    const issueKey = `${issueInfo.owner}/${issueInfo.repo}#${issueInfo.number}`;
+    try {
+      // Data is already available from the discovery phase
+      const hasLabel = issueInfo.labels.some((l) => l === TARGET_LABEL);
+
+      if (!hasLabel) {
+        if (isDryRun) {
+          console.log(
+            `[DRY RUN] Would label ${issueKey}: "${issueInfo.title}"`,
+          );
+        } else {
+          console.log(`Labeling ${issueKey}: "${issueInfo.title}"...`);
+          await octokit.rest.issues.addLabels({
+            owner: issueInfo.owner,
+            repo: issueInfo.repo,
+            issue_number: issueInfo.number,
+            labels: [TARGET_LABEL],
+          });
+        }
+      }
+
+      // Remove status/need-triage from maintainer-only issues since they
+      // don't need community triage. We always attempt removal rather than
+      // checking the (potentially stale) label snapshot, because the
+      // issue-opened-labeler workflow runs concurrently and may add the
+      // label after our snapshot was taken.
+      if (isDryRun) {
+        console.log(
+          `[DRY RUN] Would remove status/need-triage from ${issueKey}`,
+        );
+      } else {
+        try {
+          await octokit.rest.issues.removeLabel({
+            owner: issueInfo.owner,
+            repo: issueInfo.repo,
+            issue_number: issueInfo.number,
+            name: 'status/need-triage',
+          });
+          console.log(`Removed status/need-triage from ${issueKey}`);
+        } catch (removeError) {
+          // 404 means the label wasn't present — that's fine.
+          if (removeError.status === 404) {
+            console.log(
+              `status/need-triage not present on ${issueKey}, skipping.`,
+            );
+          } else {
+            throw removeError;
+          }
+        }
+      }
+    } catch (error) {
+      console.error(`Error processing label for ${issueKey}: ${error.message}`);
+    }
+  }
+}
+
+run().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

.github/workflows/chained_e2e.yml

@@ -0,0 +1,384 @@
+name: 'Testing: E2E (Chained)'
+
+on:
+  push:
+    branches:
+      - 'main'
+  merge_group:
+  workflow_run:
+    workflows: ['Trigger E2E']
+    types: ['completed']
+  workflow_dispatch:
+    inputs:
+      head_sha:
+        description: 'SHA of the commit to test'
+        required: true
+      repo_name:
+        description: 'Repository name (e.g., owner/repo)'
+        required: true
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.event.workflow_run.head_branch || github.ref }}'
+  cancel-in-progress: |-
+    ${{ github.event_name != 'push' && github.event_name != 'merge_group' }}
+
+permissions:
+  contents: 'read'
+  statuses: 'write'
+
+jobs:
+  merge_queue_skipper:
+    name: 'Merge Queue Skipper'
+    permissions: 'read-all'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    outputs:
+      skip: '${{ steps.merge-queue-e2e-skipper.outputs.skip-check }}'
+    steps:
+      - id: 'merge-queue-e2e-skipper'
+        uses: 'cariad-tech/merge-queue-ci-skipper@1032489e59437862c90a08a2c92809c903883772' # ratchet:cariad-tech/merge-queue-ci-skipper@main
+        with:
+          secret: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+    continue-on-error: true
+
+  download_repo_name:
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli' && (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_run')"
+    outputs:
+      repo_name: '${{ steps.output-repo-name.outputs.repo_name }}'
+      head_sha: '${{ steps.output-repo-name.outputs.head_sha }}'
+    steps:
+      - name: 'Mock Repo Artifact'
+        if: "${{ github.event_name == 'workflow_dispatch' }}"
+        env:
+          REPO_NAME: '${{ github.event.inputs.repo_name }}'
+        run: |
+          mkdir -p ./pr
+          echo "${REPO_NAME}" > ./pr/repo_name
+      - uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'repo_name'
+          path: 'pr/'
+      - name: 'Download the repo_name artifact'
+        uses: 'actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0' # ratchet:actions/download-artifact@v5
+        env:
+          RUN_ID: "${{ github.event_name == 'workflow_run' && github.event.workflow_run.id || github.run_id  }}"
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          name: 'repo_name'
+          run-id: '${{ env.RUN_ID }}'
+          path: '${{ runner.temp }}/artifacts'
+      - name: 'Output Repo Name and SHA'
+        id: 'output-repo-name'
+        uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # ratchet:actions/github-script@v8
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          script: |
+            const fs = require('fs');
+            const path = require('path');
+            const temp = '${{ runner.temp }}/artifacts';
+            const repoPath = path.join(temp, 'repo_name');
+            if (fs.existsSync(repoPath)) {
+              const repo_name = String(fs.readFileSync(repoPath)).trim();
+              core.setOutput('repo_name', repo_name);
+            }
+            const shaPath = path.join(temp, 'head_sha');
+            if (fs.existsSync(shaPath)) {
+              const head_sha = String(fs.readFileSync(shaPath)).trim();
+              core.setOutput('head_sha', head_sha);
+            }
+
+  parse_run_context:
+    name: 'Parse run context'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    needs: 'download_repo_name'
+    if: "github.repository == 'google-gemini/gemini-cli' && always()"
+    outputs:
+      repository: '${{ steps.set_context.outputs.REPO }}'
+      sha: '${{ steps.set_context.outputs.SHA }}'
+    steps:
+      - id: 'set_context'
+        name: 'Set dynamic repository and SHA'
+        env:
+          REPO: '${{ needs.download_repo_name.outputs.repo_name || github.repository }}'
+          SHA: '${{ needs.download_repo_name.outputs.head_sha || github.event.inputs.head_sha || github.event.workflow_run.head_sha || github.sha }}'
+        shell: 'bash'
+        run: |
+          echo "REPO=$REPO" >> "$GITHUB_OUTPUT"
+          echo "SHA=$SHA" >> "$GITHUB_OUTPUT"
+
+  set_pending_status:
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    permissions: 'write-all'
+    needs:
+      - 'parse_run_context'
+    if: "github.repository == 'google-gemini/gemini-cli' && always()"
+    steps:
+      - name: 'Set pending status'
+        uses: 'myrotvorets/set-commit-status-action@16037e056d73b2d3c88e37e393ff369047f70886' # ratchet:myrotvorets/set-commit-status-action@master
+        if: "github.repository == 'google-gemini/gemini-cli' && always()"
+        with:
+          allowForks: 'true'
+          repo: '${{ github.repository }}'
+          sha: '${{ needs.parse_run_context.outputs.sha }}'
+          token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          status: 'pending'
+          context: 'E2E (Chained)'
+
+  e2e_linux:
+    name: 'E2E Test (Linux) - ${{ matrix.sandbox }}'
+    needs:
+      - 'merge_queue_skipper'
+      - 'parse_run_context'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: |
+      github.repository == 'google-gemini/gemini-cli' && always() && (needs.merge_queue_skipper.result !='success' || needs.merge_queue_skipper.outputs.skip != 'true')
+    strategy:
+      fail-fast: false
+      matrix:
+        sandbox:
+          - 'sandbox:none'
+          - 'sandbox:docker'
+        node-version:
+          - '20.x'
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ needs.parse_run_context.outputs.sha }}'
+          repository: '${{ needs.parse_run_context.outputs.repository }}'
+
+      - name: 'Set up Node.js ${{ matrix.node-version }}'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version: '${{ matrix.node-version }}'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Set up Docker'
+        if: "${{matrix.sandbox == 'sandbox:docker'}}"
+        uses: 'docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435' # ratchet:docker/setup-buildx-action@v3
+
+      - name: 'Run E2E tests'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          KEEP_OUTPUT: 'true'
+          VERBOSE: 'true'
+          BUILD_SANDBOX_FLAGS: '--cache-from type=gha --cache-to type=gha,mode=max'
+        shell: 'bash'
+        run: |
+          if [[ "${{ matrix.sandbox }}" == "sandbox:docker" ]]; then
+            npm run test:integration:sandbox:docker
+          else
+            npm run test:integration:sandbox:none
+          fi
+
+  e2e_mac:
+    name: 'E2E Test (macOS)'
+    needs:
+      - 'merge_queue_skipper'
+      - 'parse_run_context'
+    runs-on: 'macos-latest'
+    if: |
+      github.repository == 'google-gemini/gemini-cli' && always() && (needs.merge_queue_skipper.result !='success' || needs.merge_queue_skipper.outputs.skip != 'true')
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ needs.parse_run_context.outputs.sha }}'
+          repository: '${{ needs.parse_run_context.outputs.repository }}'
+
+      - name: 'Set up Node.js 20.x'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version: '20.x'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Fix rollup optional dependencies on macOS'
+        if: "${{runner.os == 'macOS'}}"
+        run: |
+          npm cache clean --force
+      - name: 'Run E2E tests (non-Windows)'
+        if: "${{runner.os != 'Windows'}}"
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          KEEP_OUTPUT: 'true'
+          SANDBOX: 'sandbox:none'
+          VERBOSE: 'true'
+        run: 'npm run test:integration:sandbox:none'
+
+  e2e_windows:
+    name: 'Slow E2E - Win'
+    needs:
+      - 'merge_queue_skipper'
+      - 'parse_run_context'
+    if: |
+      github.repository == 'google-gemini/gemini-cli' && always() && (needs.merge_queue_skipper.result !='success' || needs.merge_queue_skipper.outputs.skip != 'true')
+    runs-on: 'gemini-cli-windows-16-core'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ needs.parse_run_context.outputs.sha }}'
+          repository: '${{ needs.parse_run_context.outputs.repository }}'
+
+      - name: 'Set up Node.js 20.x'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+
+      - name: 'Configure Windows Defender exclusions'
+        run: |
+          Add-MpPreference -ExclusionPath $env:GITHUB_WORKSPACE -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\node_modules" -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\packages" -Force
+          Add-MpPreference -ExclusionPath "$env:TEMP" -Force
+        shell: 'pwsh'
+
+      - name: 'Configure npm for Windows performance'
+        run: |
+          npm config set progress false
+          npm config set audit false
+          npm config set fund false
+          npm config set loglevel error
+          npm config set maxsockets 32
+          npm config set registry https://registry.npmjs.org/
+        shell: 'pwsh'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+        shell: 'pwsh'
+
+      - name: 'Build project'
+        run: 'npm run build'
+        shell: 'pwsh'
+
+      - name: 'Ensure Chrome is available'
+        shell: 'pwsh'
+        run: |
+          $chromePaths = @(
+            "${env:ProgramFiles}\Google\Chrome\Application\chrome.exe",
+            "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe"
+          )
+          $chromeExists = $chromePaths | Where-Object { Test-Path $_ } | Select-Object -First 1
+          if (-not $chromeExists) {
+            Write-Host 'Chrome not found, installing via Chocolatey...'
+            choco install googlechrome -y --no-progress --ignore-checksums
+          }
+          $installed = $chromePaths | Where-Object { Test-Path $_ } | Select-Object -First 1
+          if ($installed) {
+            Write-Host "Chrome found at: $installed"
+            & $installed --version
+          } else {
+            Write-Error 'Chrome installation failed'
+            exit 1
+          }
+
+      - name: 'Run E2E tests'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          KEEP_OUTPUT: 'true'
+          SANDBOX: 'sandbox:none'
+          VERBOSE: 'true'
+          NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
+          UV_THREADPOOL_SIZE: '32'
+          NODE_ENV: 'test'
+        shell: 'pwsh'
+        run: 'npm run test:integration:sandbox:none'
+
+  evals:
+    name: 'Evals (ALWAYS_PASSING)'
+    needs:
+      - 'merge_queue_skipper'
+      - 'parse_run_context'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: |
+      github.repository == 'google-gemini/gemini-cli' && always() && (needs.merge_queue_skipper.result !='success' || needs.merge_queue_skipper.outputs.skip != 'true')
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ needs.parse_run_context.outputs.sha }}'
+          repository: '${{ needs.parse_run_context.outputs.repository }}'
+          fetch-depth: 0
+
+      - name: 'Set up Node.js 20.x'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version: '20.x'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Check if evals should run'
+        id: 'check_evals'
+        run: |
+          SHOULD_RUN=$(node scripts/changed_prompt.js)
+          echo "should_run=$SHOULD_RUN" >> "$GITHUB_OUTPUT"
+
+      - name: 'Run Evals (Required to pass)'
+        if: "${{ steps.check_evals.outputs.should_run == 'true' }}"
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+        run: 'npm run test:always_passing_evals'
+
+  e2e:
+    name: 'E2E'
+    if: |
+      github.repository == 'google-gemini/gemini-cli' && always() && (needs.merge_queue_skipper.result !='success' || needs.merge_queue_skipper.outputs.skip != 'true')
+    needs:
+      - 'e2e_linux'
+      - 'e2e_mac'
+      - 'e2e_windows'
+      - 'evals'
+      - 'merge_queue_skipper'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    steps:
+      - name: 'Check E2E test results'
+        run: |
+          if [[ ${NEEDS_E2E_LINUX_RESULT} != 'success' || \
+               ${NEEDS_E2E_MAC_RESULT} != 'success' || \
+               ${NEEDS_E2E_WINDOWS_RESULT} != 'success' || \
+               ${NEEDS_EVALS_RESULT} != 'success' ]]; then
+            echo "One or more E2E jobs failed."
+            exit 1
+          fi
+          echo "All required E2E jobs passed!"
+        env:
+          NEEDS_E2E_LINUX_RESULT: '${{ needs.e2e_linux.result }}'
+          NEEDS_E2E_MAC_RESULT: '${{ needs.e2e_mac.result }}'
+          NEEDS_E2E_WINDOWS_RESULT: '${{ needs.e2e_windows.result }}'
+          NEEDS_EVALS_RESULT: '${{ needs.evals.result }}'
+
+  set_workflow_status:
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    permissions: 'write-all'
+    if: "github.repository == 'google-gemini/gemini-cli' && always()"
+    needs:
+      - 'parse_run_context'
+      - 'e2e'
+    steps:
+      - name: 'Set workflow status'
+        uses: 'myrotvorets/set-commit-status-action@16037e056d73b2d3c88e37e393ff369047f70886' # ratchet:myrotvorets/set-commit-status-action@master
+        if: "github.repository == 'google-gemini/gemini-cli' && always()"
+        with:
+          allowForks: 'true'
+          repo: '${{ github.repository }}'
+          sha: '${{ needs.parse_run_context.outputs.sha }}'
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          status: '${{ needs.e2e.result }}'
+          context: 'E2E (Chained)'

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: 'Gemini CLI CI'
+name: 'Testing: CI'
 
 on:
   push:
@@ -10,6 +10,13 @@ on:
       - 'main'
       - 'release/**'
   merge_group:
+  workflow_dispatch:
+    inputs:
+      branch_ref:
+        description: 'Branch to run on'
+        required: true
+        default: 'main'
+        type: 'string'
 
 concurrency:
   group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
@@ -25,68 +32,33 @@ defaults:
   run:
     shell: 'bash'
 
-env:
-  ACTIONLINT_VERSION: '1.7.7'
-  SHELLCHECK_VERSION: '0.11.0'
-  YAMLLINT_VERSION: '1.35.1'
-
 jobs:
-  #
-  # Lint: GitHub Actions
-  #
-  lint_github_actions:
-    name: 'Lint (GitHub Actions)'
-    runs-on: 'ubuntu-latest'
+  merge_queue_skipper:
+    permissions: 'read-all'
+    name: 'Merge Queue Skipper'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    outputs:
+      skip: '${{ steps.merge-queue-ci-skipper.outputs.skip-check }}'
+    steps:
+      - id: 'merge-queue-ci-skipper'
+        uses: 'cariad-tech/merge-queue-ci-skipper@1032489e59437862c90a08a2c92809c903883772' # ratchet:cariad-tech/merge-queue-ci-skipper@main
+        with:
+          secret: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+
+  lint:
+    name: 'Lint'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    needs: 'merge_queue_skipper'
+    if: "github.repository == 'google-gemini/gemini-cli' && needs.merge_queue_skipper.outputs.skip == 'false'"
+    env:
+      GEMINI_LINT_TEMP_DIR: '${{ github.workspace }}/.gemini-linters'
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
-          fetch-depth: 1
-
-      - name: 'Install shellcheck' # Actionlint uses shellcheck
-        run: |-
-          mkdir -p "${RUNNER_TEMP}/shellcheck"
-          curl -sSLo "${RUNNER_TEMP}/.shellcheck.txz" "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
-          tar -xf "${RUNNER_TEMP}/.shellcheck.txz" -C "${RUNNER_TEMP}/shellcheck" --strip-components=1
-          echo "${RUNNER_TEMP}/shellcheck" >> "${GITHUB_PATH}"
-
-      - name: 'Install actionlint'
-        run: |-
-          mkdir -p "${RUNNER_TEMP}/actionlint"
-          curl -sSLo "${RUNNER_TEMP}/.actionlint.tgz" "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
-          tar -xzf "${RUNNER_TEMP}/.actionlint.tgz" -C "${RUNNER_TEMP}/actionlint"
-          echo "${RUNNER_TEMP}/actionlint" >> "${GITHUB_PATH}"
-
-      # For actionlint, we specifically ignore shellcheck rules that are
-      # annoying or unhelpful. See the shellcheck action for a description.
-      - name: 'Run actionlint'
-        run: |-
-          actionlint \
-            -color \
-            -format '{{range $err := .}}::error file={{$err.Filepath}},line={{$err.Line}},col={{$err.Column}}::{{$err.Filepath}}@{{$err.Line}} {{$err.Message}}%0A```%0A{{replace $err.Snippet "\\n" "%0A"}}%0A```\n{{end}}' \
-            -ignore 'SC2002:' \
-            -ignore 'SC2016:' \
-            -ignore 'SC2129:' \
-            -ignore 'label ".+" is unknown'
-
-      - name: 'Run ratchet'
-        uses: 'sethvargo/ratchet@8b4ca256dbed184350608a3023620f267f0a5253' # ratchet:sethvargo/ratchet@v0.11.4
-        with:
-          files: |-
-            .github/workflows/*.yml
-            .github/actions/**/*.yml
-
-  #
-  # Lint: Javascript
-  #
-  lint_javascript:
-    name: 'Lint (Javascript)'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          fetch-depth: 1
+          ref: '${{ github.event.inputs.branch_ref || github.ref }}'
+          fetch-depth: 0
 
       - name: 'Set up Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4.4.0
@@ -94,178 +66,85 @@ jobs:
           node-version-file: '.nvmrc'
           cache: 'npm'
 
-      - name: 'Run lockfile check'
-        run: |-
-          npm run check:lockfile
+      - name: 'Cache Linters'
+        uses: 'actions/cache@v4'
+        with:
+          path: '${{ env.GEMINI_LINT_TEMP_DIR }}'
+          key: "${{ runner.os }}-${{ runner.arch }}-linters-${{ hashFiles('scripts/lint.js') }}"
 
       - name: 'Install dependencies'
-        run: |-
-          npm ci
+        run: 'npm ci'
 
-      - name: 'Run formatter check'
-        run: |-
-          npm run format
-          git diff --exit-code
-
-      - name: 'Run linter'
-        run: |-
-          npm run lint:ci
-
-      - name: 'Run linter on integration tests'
-        run: |-
-          npx eslint integration-tests --max-warnings 0
-
-      - name: 'Run formatter on integration tests'
-        run: |-
-          npx prettier --check integration-tests
-          git diff --exit-code
-
-      - name: 'Build project'
-        run: |-
-          npm run build
-
-      - name: 'Run type check'
-        run: |-
-          npm run typecheck
-
-  #
-  # Lint: Shell
-  #
-  lint_shell:
-    name: 'Lint (Shell)'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+      - name: 'Cache ESLint'
+        uses: 'actions/cache@v4'
         with:
-          fetch-depth: 1
+          path: '.eslintcache'
+          key: "${{ runner.os }}-eslint-${{ hashFiles('package-lock.json', 'eslint.config.js') }}"
 
-      - name: 'Install shellcheck'
-        run: |-
-          mkdir -p "${RUNNER_TEMP}/shellcheck"
-          curl -sSLo "${RUNNER_TEMP}/.shellcheck.txz" "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
-          tar -xf "${RUNNER_TEMP}/.shellcheck.txz" -C "${RUNNER_TEMP}/shellcheck" --strip-components=1
-          echo "${RUNNER_TEMP}/shellcheck" >> "${GITHUB_PATH}"
+      - name: 'Validate NOTICES.txt'
+        run: 'git diff --exit-code packages/vscode-ide-companion/NOTICES.txt'
 
-      - name: 'Install shellcheck problem matcher'
-        run: |-
-          cat > "${RUNNER_TEMP}/shellcheck/problem-matcher-lint-shell.json" <<"EOF"
-          {
-            "problemMatcher": [
-              {
-                "owner": "lint_shell",
-                "pattern": [
-                  {
-                    "regexp": "^(.*):(\\\\d+):(\\\\d+):\\\\s+(?:fatal\\\\s+)?(warning|error):\\\\s+(.*)$",
-                    "file": 1,
-                    "line": 2,
-                    "column": 3,
-                    "severity": 4,
-                    "message": 5
-                  }
-                ]
-              }
-            ]
-          }
-          EOF
-          echo "::add-matcher::${RUNNER_TEMP}/shellcheck/problem-matcher-lint-shell.json"
+      - name: 'Check lockfile'
+        run: 'npm run check:lockfile'
+
+      - name: 'Install linters'
+        run: 'node scripts/lint.js --setup'
+
+      - name: 'Run ESLint'
+        run: 'node scripts/lint.js --eslint'
+
+      - name: 'Run actionlint'
+        run: 'node scripts/lint.js --actionlint'
 
-      # Note that only warning and error severity show up in the github files
-      # page. So we replace 'style' and 'note' with 'warning' to make it show
-      # up.
-      #
-      # We also try and find all bash scripts even if they don't have an
-      # explicit extension.
-      #
-      # We explicitly ignore the following rules:
-      #
-      # - SC2002: This rule suggests using "cmd < file" instead of "cat | cmd".
-      #   While < is more efficient, pipes are much more readable and expected.
-      #
-      # - SC2129: This rule suggests grouping multiple writes to a file in
-      #   braces like "{ cmd1; cmd2; } >> file". This is unexpected and less
-      #   readable.
-      #
-      # - SC2310: This is an optional warning that only appears with "set -e"
-      #   and when a command is used as a conditional.
       - name: 'Run shellcheck'
-        run: |-
-          git ls-files | grep -E '^([^.]+|.*\.(sh|zsh|bash))$' | xargs file --mime-type \
-            | grep "text/x-shellscript" | awk '{ print substr($1, 1, length($1)-1) }' \
-            | xargs shellcheck \
-              --check-sourced \
-              --enable=all \
-              --exclude=SC2002,SC2129,SC2310 \
-              --severity=style \
-              --format=gcc \
-              --color=never | sed -e 's/note:/warning:/g' -e 's/style:/warning:/g'
-
-  #
-  # Lint: YAML
-  #
-  lint_yaml:
-    name: 'Lint (YAML)'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          fetch-depth: 1
-
-      - name: 'Setup Python'
-        uses: 'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065' # ratchet:actions/setup-python@v5
-        with:
-          python-version: '3'
-
-      - name: 'Install yamllint'
-        run: |-
-          pip install --user "yamllint==${YAMLLINT_VERSION}"
+        run: 'node scripts/lint.js --shellcheck'
 
       - name: 'Run yamllint'
-        run: |-
-          git ls-files | grep -E '\.(yaml|yml)' | xargs yamllint --format github
+        run: 'node scripts/lint.js --yamllint'
 
-  #
-  # Lint: All
-  #
-  # This is a virtual job that other jobs depend on to wait for all linters to
-  # finish. It's also used to ensure linting happens on CI via required
-  # workflows.
-  lint:
-    name: 'Lint'
-    needs:
-      - 'lint_github_actions'
-      - 'lint_javascript'
-      - 'lint_shell'
-      - 'lint_yaml'
+      - name: 'Run Prettier'
+        run: 'node scripts/lint.js --prettier'
+
+      - name: 'Build docs prerequisites'
+        run: 'npm run predocs:settings'
+
+      - name: 'Verify settings docs'
+        run: 'npm run docs:settings -- --check'
+
+      - name: 'Run sensitive keyword linter'
+        run: 'node scripts/lint.js --sensitive-keywords'
+
+  link_checker:
+    name: 'Link Checker'
     runs-on: 'ubuntu-latest'
+    if: "github.repository == 'google-gemini/gemini-cli'"
     steps:
-      - run: |-
-          echo 'All linters finished!'
-
-  #
-  # Test: Node
-  #
-  test:
-    name: 'Test'
-    runs-on: '${{ matrix.os }}'
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+      - name: 'Link Checker'
+        uses: 'lycheeverse/lychee-action@885c65f3dc543b57c898c8099f4e08c8afd178a2' # ratchet: lycheeverse/lychee-action@v2.6.1
+        with:
+          args: '--verbose --accept 200,503 ./**/*.md'
+          fail: true
+  test_linux:
+    name: 'Test (Linux) - ${{ matrix.node-version }}, ${{ matrix.shard }}'
+    runs-on: 'gemini-cli-ubuntu-16-core'
     needs:
-      - 'lint'
+      - 'merge_queue_skipper'
+    if: "github.repository == 'google-gemini/gemini-cli' && needs.merge_queue_skipper.outputs.skip == 'false'"
     permissions:
       contents: 'read'
       checks: 'write'
       pull-requests: 'write'
     strategy:
-      fail-fast: false # So we can see all test failures
       matrix:
-        os:
-          - 'macos-latest'
-          - 'ubuntu-latest'
-          - 'windows-latest'
         node-version:
           - '20.x'
           - '22.x'
           - '24.x'
+        shard:
+          - 'cli'
+          - 'others'
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
@@ -277,24 +156,51 @@ jobs:
           cache: 'npm'
 
       - name: 'Build project'
-        run: |-
-          npm run build
+        run: 'npm run build'
 
       - name: 'Install dependencies for testing'
-        run: |-
-          npm ci
+        run: 'npm ci'
 
       - name: 'Run tests and generate reports'
         env:
           NO_COLOR: true
-        run: 'npm run test:ci'
+        run: |
+          if [[ "${{ matrix.shard }}" == "cli" ]]; then
+            npm run test:ci --workspace @google/gemini-cli
+          else
+            # Explicitly list non-cli packages to ensure they are sharded correctly
+            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:scripts
+          fi
+
+      - name: 'Bundle'
+        run: 'npm run bundle'
+
+      - name: 'Smoke test bundle'
+        run: 'node ./bundle/gemini.js --version'
+
+      - name: 'Smoke test npx installation'
+        run: |
+          # 1. Package the project into a tarball
+          TARBALL=$(npm pack | tail -n 1)
+
+          # 2. Move to a fresh directory for isolation
+          mkdir -p ../smoke-test-dir
+          mv "$TARBALL" ../smoke-test-dir/
+          cd ../smoke-test-dir
+
+          # 3. Run npx from the tarball
+          npx "./$TARBALL" --version
+
+      - name: 'Wait for file system sync'
+        run: 'sleep 2'
 
       - name: 'Publish Test Report (for non-forks)'
         if: |-
           ${{ always() && (github.event.pull_request.head.repo.full_name == github.repository) }}
         uses: 'dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3' # ratchet:dorny/test-reporter@v2
         with:
-          name: 'Test Results (Node ${{ matrix.node-version }})'
+          name: 'Test Results (Node ${{ runner.os }}, ${{ matrix.node-version }}, ${{ matrix.shard }})'
           path: 'packages/*/junit.xml'
           reporter: 'java-junit'
           fail-on-error: 'false'
@@ -304,7 +210,95 @@ jobs:
           ${{ always() && (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
         uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
         with:
-          name: 'test-results-fork-${{ matrix.node-version }}-${{ matrix.os }}'
+          name: 'test-results-fork-${{ runner.os }}-${{ matrix.node-version }}-${{ matrix.shard }}'
+          path: 'packages/*/junit.xml'
+
+  test_mac:
+    name: 'Test (Mac) - ${{ matrix.node-version }}, ${{ matrix.shard }}'
+    runs-on: 'macos-latest'
+    needs:
+      - 'merge_queue_skipper'
+    if: "github.repository == 'google-gemini/gemini-cli' && needs.merge_queue_skipper.outputs.skip == 'false'"
+    permissions:
+      contents: 'read'
+      checks: 'write'
+      pull-requests: 'write'
+    continue-on-error: true
+    strategy:
+      matrix:
+        node-version:
+          - '20.x'
+          - '22.x'
+          - '24.x'
+        shard:
+          - 'cli'
+          - 'others'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+
+      - name: 'Set up Node.js ${{ matrix.node-version }}'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '${{ matrix.node-version }}'
+          cache: 'npm'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Install dependencies for testing'
+        run: 'npm ci'
+
+      - name: 'Run tests and generate reports'
+        env:
+          NO_COLOR: true
+        run: |
+          if [[ "${{ matrix.shard }}" == "cli" ]]; then
+            npm run test:ci --workspace @google/gemini-cli -- --coverage.enabled=false
+          else
+            # Explicitly list non-cli packages to ensure they are sharded correctly
+            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:scripts
+          fi
+
+      - name: 'Bundle'
+        run: 'npm run bundle'
+
+      - name: 'Smoke test bundle'
+        run: 'node ./bundle/gemini.js --version'
+
+      - name: 'Smoke test npx installation'
+        run: |
+          # 1. Package the project into a tarball
+          TARBALL=$(npm pack | tail -n 1)
+
+          # 2. Move to a fresh directory for isolation
+          mkdir -p ../smoke-test-dir
+          mv "$TARBALL" ../smoke-test-dir/
+          cd ../smoke-test-dir
+
+          # 3. Run npx from the tarball
+          npx "./$TARBALL" --version
+
+      - name: 'Wait for file system sync'
+        run: 'sleep 2'
+
+      - name: 'Publish Test Report (for non-forks)'
+        if: |-
+          ${{ always() && (github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: 'dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3' # ratchet:dorny/test-reporter@v2
+        with:
+          name: 'Test Results (Node ${{ runner.os }}, ${{ matrix.node-version }}, ${{ matrix.shard }})'
+          path: 'packages/*/junit.xml'
+          reporter: 'java-junit'
+          fail-on-error: 'false'
+
+      - name: 'Upload Test Results Artifact (for forks)'
+        if: |-
+          ${{ always() && (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'test-results-fork-${{ runner.os }}-${{ matrix.node-version }}-${{ matrix.shard }}'
           path: 'packages/*/junit.xml'
 
       - name: 'Upload coverage reports'
@@ -312,50 +306,14 @@ jobs:
           ${{ always() }}
         uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
         with:
-          name: 'coverage-reports-${{ matrix.node-version }}-${{ matrix.os }}'
+          name: 'coverage-reports-${{ runner.os }}-${{ matrix.node-version }}-${{ matrix.shard }}'
           path: 'packages/*/coverage'
 
-  post_coverage_comment:
-    name: 'Post Coverage Comment'
-    runs-on: 'ubuntu-latest'
-    needs: 'test'
-    if: |-
-      ${{ always() && github.event_name == 'pull_request' && (github.event.pull_request.head.repo.full_name == github.repository) }}
-    continue-on-error: true
-    permissions:
-      contents: 'read' # For checkout
-      pull-requests: 'write' # For commenting
-    strategy:
-      matrix:
-        # Reduce noise by only posting the comment once
-        os:
-          - 'ubuntu-latest'
-        node-version:
-          - '22.x'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-
-      - name: 'Download coverage reports artifact'
-        uses: 'actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0' # ratchet:actions/download-artifact@v5
-        with:
-          name: 'coverage-reports-${{ matrix.node-version }}-${{ matrix.os }}'
-          path: 'coverage_artifact' # Download to a specific directory
-
-      - name: 'Post Coverage Comment using Composite Action'
-        uses: './.github/actions/post-coverage-comment' # Path to the composite action directory
-        with:
-          cli_json_file: 'coverage_artifact/cli/coverage/coverage-summary.json'
-          core_json_file: 'coverage_artifact/core/coverage/coverage-summary.json'
-          cli_full_text_summary_file: 'coverage_artifact/cli/coverage/full-text-summary.txt'
-          core_full_text_summary_file: 'coverage_artifact/core/coverage/full-text-summary.txt'
-          node_version: '${{ matrix.node-version }}'
-          os: '${{ matrix.os }}'
-          github_token: '${{ secrets.GITHUB_TOKEN }}'
-
   codeql:
     name: 'CodeQL'
-    runs-on: 'ubuntu-latest'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    needs: 'merge_queue_skipper'
+    if: "github.repository == 'google-gemini/gemini-cli' && needs.merge_queue_skipper.outputs.skip == 'false'"
     permissions:
       actions: 'read'
       contents: 'read'
@@ -363,6 +321,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ github.event.inputs.branch_ref || github.ref }}'
 
       - name: 'Initialize CodeQL'
         uses: 'github/codeql-action/init@df559355d593797519d70b90fc8edd5db049e7a2' # ratchet:github/codeql-action/init@v3
@@ -375,7 +335,9 @@ jobs:
   # Check for changes in bundle size.
   bundle_size:
     name: 'Check Bundle Size'
-    runs-on: 'ubuntu-latest'
+    needs: 'merge_queue_skipper'
+    if: "github.repository == 'google-gemini/gemini-cli' && github.event_name == 'pull_request' && needs.merge_queue_skipper.outputs.skip == 'false'"
+    runs-on: 'gemini-cli-ubuntu-16-core'
     permissions:
       contents: 'read' # For checkout
       pull-requests: 'write' # For commenting
@@ -384,6 +346,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
+          ref: '${{ github.event.inputs.branch_ref || github.ref }}'
           fetch-depth: 1
 
       - uses: 'preactjs/compressed-size-action@946a292cd35bd1088e0d7eb92b69d1a8d5b5d76a'
@@ -392,3 +355,133 @@ jobs:
           pattern: './bundle/**/*.{js,sb}'
           minimum-change-threshold: '1000'
           compression: 'none'
+          clean-script: 'clean'
+
+  test_windows:
+    name: 'Slow Test - Win - ${{ matrix.shard }}'
+    runs-on: 'gemini-cli-windows-16-core'
+    needs: 'merge_queue_skipper'
+    if: "github.repository == 'google-gemini/gemini-cli' && needs.merge_queue_skipper.outputs.skip == 'false'"
+    timeout-minutes: 60
+    strategy:
+      matrix:
+        shard:
+          - 'cli'
+          - 'others'
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ github.event.inputs.branch_ref || github.ref }}'
+
+      - name: 'Set up Node.js 20.x'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+
+      - name: 'Configure Windows Defender exclusions'
+        run: |
+          Add-MpPreference -ExclusionPath $env:GITHUB_WORKSPACE -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\node_modules" -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\packages" -Force
+          Add-MpPreference -ExclusionPath "$env:TEMP" -Force
+        shell: 'pwsh'
+
+      - name: 'Configure npm for Windows performance'
+        run: |
+          npm config set progress false
+          npm config set audit false
+          npm config set fund false
+          npm config set loglevel error
+          npm config set maxsockets 32
+          npm config set registry https://registry.npmjs.org/
+        shell: 'pwsh'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+        shell: 'pwsh'
+
+      - name: 'Build project'
+        run: 'npm run build'
+        shell: 'pwsh'
+        env:
+          NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
+          UV_THREADPOOL_SIZE: '32'
+          NODE_ENV: 'production'
+
+      - name: 'Run tests and generate reports'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          NO_COLOR: true
+          NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
+          UV_THREADPOOL_SIZE: '32'
+          NODE_ENV: 'test'
+        run: |
+          if ("${{ matrix.shard }}" -eq "cli") {
+            npm run test:ci --workspace @google/gemini-cli -- --coverage.enabled=false
+          } else {
+            # Explicitly list non-cli packages to ensure they are sharded correctly
+            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:scripts
+          }
+        shell: 'pwsh'
+
+      - name: 'Bundle'
+        run: 'npm run bundle'
+        shell: 'pwsh'
+
+      - name: 'Smoke test bundle'
+        run: 'node ./bundle/gemini.js --version'
+        shell: 'pwsh'
+
+      - name: 'Smoke test npx installation'
+        run: |
+          # 1. Package the project into a tarball
+          $PACK_OUTPUT = npm pack
+          $TARBALL = $PACK_OUTPUT[-1]
+
+          # 2. Move to a fresh directory for isolation
+          New-Item -ItemType Directory -Force -Path ../smoke-test-dir
+          Move-Item $TARBALL ../smoke-test-dir/
+          Set-Location ../smoke-test-dir
+
+          # 3. Run npx from the tarball
+          npx "./$TARBALL" --version
+        shell: 'pwsh'
+
+  ci:
+    name: 'CI'
+    if: "github.repository == 'google-gemini/gemini-cli' && always()"
+    needs:
+      - 'lint'
+      - 'link_checker'
+      - 'test_linux'
+      - 'test_mac'
+      - 'test_windows'
+      - 'codeql'
+      - 'bundle_size'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    steps:
+      - name: 'Check all job results'
+        run: |
+          if [[ (${NEEDS_LINT_RESULT} != 'success' && ${NEEDS_LINT_RESULT} != 'skipped') || \
+               (${NEEDS_LINK_CHECKER_RESULT} != 'success' && ${NEEDS_LINK_CHECKER_RESULT} != 'skipped') || \
+               (${NEEDS_TEST_LINUX_RESULT} != 'success' && ${NEEDS_TEST_LINUX_RESULT} != 'skipped') || \
+               (${NEEDS_TEST_MAC_RESULT} != 'success' && ${NEEDS_TEST_MAC_RESULT} != 'skipped') || \
+               (${NEEDS_TEST_WINDOWS_RESULT} != 'success' && ${NEEDS_TEST_WINDOWS_RESULT} != 'skipped') || \
+               (${NEEDS_CODEQL_RESULT} != 'success' && ${NEEDS_CODEQL_RESULT} != 'skipped') || \
+               (${NEEDS_BUNDLE_SIZE_RESULT} != 'success' && ${NEEDS_BUNDLE_SIZE_RESULT} != 'skipped') ]]; then
+            echo "One or more CI jobs failed."
+            exit 1
+          fi
+          echo "All CI jobs passed!"
+        env:
+          NEEDS_LINT_RESULT: '${{ needs.lint.result }}'
+          NEEDS_LINK_CHECKER_RESULT: '${{ needs.link_checker.result }}'
+          NEEDS_TEST_LINUX_RESULT: '${{ needs.test_linux.result }}'
+          NEEDS_TEST_MAC_RESULT: '${{ needs.test_mac.result }}'
+          NEEDS_TEST_WINDOWS_RESULT: '${{ needs.test_windows.result }}'
+          NEEDS_CODEQL_RESULT: '${{ needs.codeql.result }}'
+          NEEDS_BUNDLE_SIZE_RESULT: '${{ needs.bundle_size.result }}'

.github/workflows/deflake.yml

@@ -0,0 +1,172 @@
+name: 'Deflake E2E'
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch_ref:
+        description: 'Branch to run on'
+        required: true
+        default: 'main'
+        type: 'string'
+      test_name_pattern:
+        description: 'The test name pattern to use'
+        required: false
+        type: 'string'
+      runs:
+        description: 'The number of runs'
+        required: false
+        default: 5
+        type: 'number'
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: |-
+    ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/heads/release/') }}
+
+jobs:
+  deflake_e2e_linux:
+    name: 'E2E Test (Linux) - ${{ matrix.sandbox }}'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    strategy:
+      fail-fast: false
+      matrix:
+        sandbox:
+          - 'sandbox:none'
+          - 'sandbox:docker'
+        node-version:
+          - '20.x'
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ github.event.pull_request.head.sha }}'
+          repository: '${{ github.repository }}'
+
+      - name: 'Set up Node.js ${{ matrix.node-version }}'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version: '${{ matrix.node-version }}'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Set up Docker'
+        if: "matrix.sandbox == 'sandbox:docker'"
+        uses: 'docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435' # ratchet:docker/setup-buildx-action@v3
+
+      - name: 'Run E2E tests'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          IS_DOCKER: "${{ matrix.sandbox == 'sandbox:docker' }}"
+          KEEP_OUTPUT: 'true'
+          RUNS: '${{ github.event.inputs.runs }}'
+          TEST_NAME_PATTERN: '${{ github.event.inputs.test_name_pattern }}'
+          VERBOSE: 'true'
+        shell: 'bash'
+        run: |
+          if [[ "${IS_DOCKER}" == "true" ]]; then
+            npm run deflake:test:integration:sandbox:docker -- --runs="${RUNS}" -- --testNamePattern "'${TEST_NAME_PATTERN}'"
+          else
+            npm run deflake:test:integration:sandbox:none -- --runs="${RUNS}" -- --testNamePattern "'${TEST_NAME_PATTERN}'"
+          fi
+
+  deflake_e2e_mac:
+    name: 'E2E Test (macOS)'
+    runs-on: 'macos-latest'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ github.event.pull_request.head.sha }}'
+          repository: '${{ github.repository }}'
+
+      - name: 'Set up Node.js 20.x'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version: '20.x'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Fix rollup optional dependencies on macOS'
+        if: "runner.os == 'macOS'"
+        run: |
+          npm cache clean --force
+      - name: 'Run E2E tests (non-Windows)'
+        if: "runner.os != 'Windows'"
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          KEEP_OUTPUT: 'true'
+          RUNS: '${{ github.event.inputs.runs }}'
+          SANDBOX: 'sandbox:none'
+          TEST_NAME_PATTERN: '${{ github.event.inputs.test_name_pattern }}'
+          VERBOSE: 'true'
+        run: |
+          npm run deflake:test:integration:sandbox:none -- --runs="${RUNS}" -- --testNamePattern "'${TEST_NAME_PATTERN}'"
+
+  deflake_e2e_windows:
+    name: 'Slow E2E - Win'
+    runs-on: 'gemini-cli-windows-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ github.event.pull_request.head.sha }}'
+          repository: '${{ github.repository }}'
+
+      - name: 'Set up Node.js 20.x'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+
+      - name: 'Configure Windows Defender exclusions'
+        run: |
+          Add-MpPreference -ExclusionPath $env:GITHUB_WORKSPACE -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\node_modules" -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\packages" -Force
+          Add-MpPreference -ExclusionPath "$env:TEMP" -Force
+        shell: 'pwsh'
+
+      - name: 'Configure npm for Windows performance'
+        run: |
+          npm config set progress false
+          npm config set audit false
+          npm config set fund false
+          npm config set loglevel error
+          npm config set maxsockets 32
+          npm config set registry https://registry.npmjs.org/
+        shell: 'pwsh'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+        shell: 'pwsh'
+
+      - name: 'Build project'
+        run: 'npm run build'
+        shell: 'pwsh'
+
+      - name: 'Run E2E tests'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          KEEP_OUTPUT: 'true'
+          SANDBOX: 'sandbox:none'
+          VERBOSE: 'true'
+          NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
+          UV_THREADPOOL_SIZE: '32'
+          NODE_ENV: 'test'
+          RUNS: '${{ github.event.inputs.runs }}'
+          TEST_NAME_PATTERN: '${{ github.event.inputs.test_name_pattern }}'
+        shell: 'pwsh'
+        run: |
+          npm run deflake:test:integration:sandbox:none -- --runs="$env:RUNS" -- --testNamePattern "'$env:TEST_NAME_PATTERN'"

.github/workflows/docs-page-action.yml

@@ -19,8 +19,7 @@ concurrency:
 
 jobs:
   build:
-    if: |-
-      ${{ !contains(github.ref_name, 'nightly') }}
+    if: "github.repository == 'google-gemini/gemini-cli' && !contains(github.ref_name, 'nightly')"
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
@@ -39,6 +38,7 @@ jobs:
         uses: 'actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa' # ratchet:actions/upload-pages-artifact@v3
 
   deploy:
+    if: "github.repository == 'google-gemini/gemini-cli'"
     environment:
       name: 'github-pages'
       url: '${{ steps.deployment.outputs.page_url }}'

.github/workflows/docs-rebuild.yml

@@ -0,0 +1,18 @@
+name: 'Trigger Docs Rebuild'
+on:
+  push:
+    branches:
+      - 'main'
+    paths:
+      - 'docs/**'
+jobs:
+  trigger-rebuild:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Trigger rebuild'
+        run: |
+          curl -X POST \
+            -H "Content-Type: application/json" \
+            -d '{}' \
+            "${{ secrets.DOCS_REBUILD_URL }}"

.github/workflows/e2e.yml

@@ -1,82 +0,0 @@
-name: 'E2E Tests'
-
-on:
-  push:
-    branches:
-      - 'main'
-  # This will run for PRs from the base repository, providing secrets.
-  pull_request:
-    branches:
-      - 'main'
-      - 'release/**'
-  # This will run for PRs from forks when a label is added.
-  pull_request_target:
-    types: ['labeled']
-  merge_group:
-
-jobs:
-  e2e-test:
-    name: 'E2E Test (${{ matrix.os }}) - ${{ matrix.sandbox }}'
-    # This condition ensures the job runs for pushes to main, merge groups,
-    # PRs from the base repo, OR PRs from forks with the correct label.
-    if: |
-      github.event_name == 'push' ||
-      github.event_name == 'merge_group' ||
-      (github.event.pull_request.head.repo.full_name == github.repository) ||
-      (github.event.label.name == 'maintainer:e2e:ok')
-    runs-on: '${{ matrix.os }}'
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - 'ubuntu-latest'
-          - 'macos-latest'
-        sandbox:
-          - 'sandbox:none'
-          - 'sandbox:docker'
-        node-version:
-          - '20.x'
-        exclude:
-          # Docker tests are not supported on macOS or Windows
-          - os: 'macos-latest'
-            sandbox: 'sandbox:docker'
-
-    steps:
-      - name: 'Checkout (fork)'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        if: "github.event_name == 'pull_request_target'"
-        with:
-          ref: '${{ github.event.pull_request.head.sha }}'
-          repository: '${{ github.event.pull_request.head.repo.full_name }}'
-
-      - name: 'Checkout (internal)'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        if: "github.event_name != 'pull_request_target'"
-
-      - name: 'Set up Node.js ${{ matrix.node-version }}'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
-        with:
-          node-version: '${{ matrix.node-version }}'
-          cache: 'npm'
-
-      - name: 'Install dependencies'
-        run: |-
-          npm ci
-
-      - name: 'Build project'
-        run: |-
-          npm run build
-
-      - name: 'Set up Docker'
-        if: |-
-          matrix.os == 'ubuntu-latest' && matrix.sandbox == 'sandbox:docker'
-        uses: 'docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435' # ratchet:docker/setup-buildx-action@v3
-
-      - name: 'Run E2E tests'
-        env:
-          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          KEEP_OUTPUT: 'true'
-          SANDBOX: '${{ matrix.sandbox }}'
-          VERBOSE: 'true'
-        run: |-
-          npm run "test:integration:${SANDBOX}"

.github/workflows/eval.yml

@@ -3,27 +3,46 @@ name: 'Eval'
 on:
   workflow_dispatch:
 
+defaults:
+  run:
+    shell: 'bash'
+
+permissions:
+  contents: 'read'
+  id-token: 'write'
+  packages: 'read'
+
 jobs:
   eval:
     name: 'Eval'
+    if: >-
+      github.repository == 'google-gemini/gemini-cli'
     runs-on: 'ubuntu-latest'
-    strategy:
-      matrix:
-        node-version:
-          - '20.x'
-          - '22.x'
-          - '24.x'
+    container:
+      image: 'ghcr.io/google-gemini/gemini-cli-swe-agent-eval@sha256:cd5edc4afd2245c1f575e791c0859b3c084a86bb3bd9a6762296da5162b35a8f'
+      credentials:
+        username: '${{ github.actor }}'
+        password: '${{ secrets.GITHUB_TOKEN }}'
+      env:
+        GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        DEFAULT_VERTEXAI_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
+        GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
+        GEMINI_API_KEY: '${{ secrets.EVAL_GEMINI_API_KEY }}'
+        GCLI_LOCAL_FILE_TELEMETRY: 'True'
+        EVAL_GCS_BUCKET: '${{ vars.EVAL_GCS_ARTIFACTS_BUCKET }}'
     steps:
-      - name: 'Set up Node.js ${{ matrix.node-version }}'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+      - name: 'Authenticate to Google Cloud'
+        id: 'auth'
+        uses: 'google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed' # ratchet:exclude pin@v2.1.7
         with:
-          node-version: '${{ matrix.node-version }}'
-          cache: 'npm'
+          project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
+          workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
+          service_account: '${{ vars.SERVICE_ACCOUNT_EMAIL }}'
+          token_format: 'access_token'
+          access_token_scopes: 'https://www.googleapis.com/auth/cloud-platform'
 
-      - name: 'Set up Python'
-        uses: 'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065' # ratchet:actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: 'Install and configure Poetry'
-        uses: 'snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a' # ratchet:snok/install-poetry@v1
+      - name: 'Run evaluation'
+        working-directory: '/app'
+        run: |
+          poetry run exp_run --experiment-mode=on-demand --branch-or-commit="${GITHUB_REF_NAME}" --model-name=gemini-2.5-pro --dataset=swebench_verified --concurrency=15
+          poetry run python agent_prototypes/scripts/parse_gcli_logs_experiment.py --experiment_dir=experiments/adhoc/gcli_temp_exp --gcs-bucket="${EVAL_GCS_BUCKET}" --gcs-path=gh_action_artifacts

.github/workflows/evals-nightly.yml

@@ -0,0 +1,103 @@
+name: 'Evals: Nightly'
+
+on:
+  schedule:
+    - cron: '0 1 * * *' # Runs at 1 AM every day
+  workflow_dispatch:
+    inputs:
+      run_all:
+        description: 'Run all evaluations (including usually passing)'
+        type: 'boolean'
+        default: true
+      test_name_pattern:
+        description: 'Test name pattern or file name'
+        required: false
+        type: 'string'
+
+permissions:
+  contents: 'read'
+  checks: 'write'
+  actions: 'read'
+
+jobs:
+  evals:
+    name: 'Evals (USUALLY_PASSING) nightly run'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    strategy:
+      fail-fast: false
+      matrix:
+        model:
+          - 'gemini-3.1-pro-preview-customtools'
+          - 'gemini-3-pro-preview'
+          - 'gemini-3-flash-preview'
+          - 'gemini-2.5-pro'
+          - 'gemini-2.5-flash'
+          - 'gemini-2.5-flash-lite'
+        run_attempt: [1, 2, 3]
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Create logs directory'
+        run: 'mkdir -p evals/logs'
+
+      - name: 'Run Evals'
+        continue-on-error: true
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_MODEL: '${{ matrix.model }}'
+          RUN_EVALS: "${{ github.event.inputs.run_all != 'false' }}"
+          TEST_NAME_PATTERN: '${{ github.event.inputs.test_name_pattern }}'
+        run: |
+          CMD="npm run test:all_evals"
+          PATTERN="${TEST_NAME_PATTERN}"
+
+          if [[ -n "$PATTERN" ]]; then
+            if [[ "$PATTERN" == *.ts || "$PATTERN" == *.js || "$PATTERN" == */* ]]; then
+              $CMD -- "$PATTERN"
+            else
+              $CMD -- -t "$PATTERN"
+            fi
+          else
+            $CMD
+          fi
+
+      - name: 'Upload Logs'
+        if: 'always()'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'eval-logs-${{ matrix.model }}-${{ matrix.run_attempt }}'
+          path: 'evals/logs'
+          retention-days: 7
+
+  aggregate-results:
+    name: 'Aggregate Results'
+    needs: ['evals']
+    if: "github.repository == 'google-gemini/gemini-cli' && always()"
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+
+      - name: 'Download Logs'
+        uses: 'actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806' # ratchet:actions/download-artifact@v4
+        with:
+          path: 'artifacts'
+
+      - name: 'Generate Summary'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: 'node scripts/aggregate_evals.js artifacts >> "$GITHUB_STEP_SUMMARY"'

.github/workflows/gemini-automated-issue-dedup.yml

@@ -101,7 +101,6 @@ jobs:
                     "FIRESTORE_DATABASE_ID": "(default)",
                     "GOOGLE_APPLICATION_CREDENTIALS": "${GOOGLE_APPLICATION_CREDENTIALS}"
                   },
-                  "enabled": true,
                   "timeout": 600000
                 }
               },

.github/workflows/gemini-automated-issue-triage.yml

@@ -14,9 +14,15 @@ on:
         description: 'issue number to triage'
         required: true
         type: 'number'
+  workflow_call:
+    inputs:
+      issue_number:
+        description: 'issue number to triage'
+        required: false
+        type: 'string'
 
 concurrency:
-  group: '${{ github.workflow }}-${{ github.event.issue.number || github.event.inputs.issue_number }}'
+  group: '${{ github.workflow }}-${{ github.event.issue.number || github.event.inputs.issue_number || inputs.issue_number }}'
   cancel-in-progress: true
 
 defaults:
@@ -34,18 +40,18 @@ permissions:
 jobs:
   triage-issue:
     if: |-
-      github.repository == 'google-gemini/gemini-cli' &&
+      (github.repository == 'google-gemini/gemini-cli' || github.repository == 'google-gemini/maintainers-gemini-cli') &&
       (
         github.event_name == 'workflow_dispatch' ||
         (
           (github.event_name == 'issues' || github.event_name == 'issue_comment') &&
-          contains(github.event.issue.labels.*.name, 'status/need-triage') &&
           (github.event_name != 'issue_comment' || (
             contains(github.event.comment.body, '@gemini-cli /triage') &&
             (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'COLLABORATOR')
           ))
         )
-      )
+      ) &&
+      !contains(github.event.issue.labels.*.name, 'area/')
     timeout-minutes: 5
     runs-on: 'ubuntu-latest'
     steps:
@@ -57,28 +63,40 @@ jobs:
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
           script: |
+            const issueNumber = ${{ github.event.inputs.issue_number || inputs.issue_number }};
             const { data: issue } = await github.rest.issues.get({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              issue_number: ${{ github.event.inputs.issue_number }},
+              issue_number: issueNumber,
             });
             core.setOutput('title', issue.title);
             core.setOutput('body', issue.body);
             core.setOutput('labels', issue.labels.map(label => label.name).join(','));
             return issue;
 
-      - name: 'Check for triage label on manual trigger'
+      - name: 'Manual Trigger Pre-flight Checks'
         if: |-
-          github.event_name == 'workflow_dispatch' && !contains(steps.get_issue_data.outputs.labels, 'status/need-triage')
+          github.event_name == 'workflow_dispatch'
+        env:
+          ISSUE_NUMBER_INPUT: '${{ github.event.inputs.issue_number || inputs.issue_number }}'
+          LABELS: '${{ steps.get_issue_data.outputs.labels }}'
         run: |
-          echo "Issue #${{ github.event.inputs.issue_number }} does not have the 'status/need-triage' label. Stopping workflow."
-          exit 1
+          if echo "${LABELS}" | grep -q 'area/'; then
+            echo "Issue #${ISSUE_NUMBER_INPUT} already has 'area/' label. Stopping workflow."
+            exit 1
+          fi
+
+          echo "Manual triage checks passed."
 
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
 
       - name: 'Generate GitHub App Token'
         id: 'generate_token'
+        env:
+          APP_ID: '${{ secrets.APP_ID }}'
+        if: |-
+          ${{ env.APP_ID != '' }}
         uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # ratchet:actions/create-github-app-token@v2
         with:
           app-id: '${{ secrets.APP_ID }}'
@@ -89,13 +107,24 @@ jobs:
         id: 'get_labels'
         uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
         with:
-          github-token: '${{ steps.generate_token.outputs.token }}'
+          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
           script: |-
             const { data: labels } = await github.rest.issues.listLabelsForRepo({
               owner: context.repo.owner,
               repo: context.repo.repo,
             });
-            const labelNames = labels.map(label => label.name);
+            const allowedLabels = [
+              'area/agent',
+              'area/enterprise',
+              'area/non-interactive',
+              'area/core',
+              'area/security',
+              'area/platform',
+              'area/extensions',
+              'area/documentation',
+              'area/unknown'
+            ];
+            const labelNames = labels.map(label => label.name).filter(name => allowedLabels.includes(name));
             core.setOutput('available_labels', labelNames.join(','));
             core.info(`Found ${labelNames.length} labels: ${labelNames.join(', ')}`);
             return labelNames;
@@ -110,7 +139,7 @@ jobs:
           ISSUE_BODY: >-
             ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.body || github.event.issue.body }}
           ISSUE_NUMBER: >-
-            ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.issue_number || github.event.issue.number }}
+            ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.issue_number || inputs.issue_number) || github.event.issue.number }}
           REPOSITORY: '${{ github.repository }}'
           AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
         with:
@@ -124,139 +153,119 @@ jobs:
           settings: |-
             {
               "maxSessionTurns": 25,
-              "coreTools": [
-                "run_shell_command(echo)"
-              ],
               "telemetry": {
                 "enabled": true,
                 "target": "gcp"
-              }
+              },
+              "coreTools": [
+                "run_shell_command(echo)"
+              ]
             }
           prompt: |-
             ## Role
 
-            You are an issue triage assistant. Analyze the current GitHub issue
-            and identify the most appropriate existing labels by only using the provided data. Use the available
-            tools to gather information; do not ask for information to be
-            provided. Do not remove the following labels titled maintainer,  help wanted or good first issue.
+            You are an issue triage assistant. Your role is to analyze a GitHub issue and determine the single most appropriate area/ label based on the definitions provided.
 
             ## Steps
-
-            1. You are only able to use the echo command. Review the available labels in the environment variable: "${AVAILABLE_LABELS}".
-            2. Review the issue title and body provided in the environment variables: "${ISSUE_TITLE}" and "${ISSUE_BODY}".
-            3. Select the most relevant labels from the existing labels, focusing on kind/*, area/*, sub-area/* and priority/*. For area/* and kind/* limit yourself to only the single most applicable label in each case.
-            4. If the issue already has area/ label, dont try to change it. Similarly, if the issue already has a kind/ label don't change it. And if the issue already has a priority/ label do not change it for example:
-               If an issue has area/core and kind/bug  you will only add a priority/ label.
-               Instead if an issue has no labels, you will could add one lable of each kind.
-            5. For each issue please check if CLI version is present, this is usually in the output of the /about command and will look like 0.1.5 for anything more than 6 versions older than the most recent should add the status/need-retesting label.
-            6. If you see that the issue doesn't look like it has sufficient information recommend the status/need-information label and leave a comment politely requesting the relevant information, eg.. if repro steps are missing request for repro steps. if version information is missing request for version information into the explanation section below.
-            7. Output the appropriate labels for this issue in JSON format with explanation, for example:
-               ```
-               {"labels_to_set": ["kind/bug", "priority/p0"], "explanation": "This is a critical bug report affecting main functionality"}
-               ```
-            8. If the issue cannot be classified using the available labels, output:
-               ```
-               {"labels_to_set": [], "explanation": "Unable to classify this issue with available labels"}
-               ```
-            9. Use Area definitions mentioned below to help you narrow down issues.
-            10. If you think an issue might be a Priority/P0 do not apply the priority/p0 label. Instead apply a status/manual-triage label and include a note in your explanation.
-            11. If you are uncertain and have not been able to apply one each of kind/, area/ and priority/ , apply the status/manual-triage label.
+            1. Review the issue title and body: ${{ env.ISSUE_TITLE }} and ${{ env.ISSUE_BODY }}.
+            2. Review the available labels: ${{ env.AVAILABLE_LABELS }}.
+            3. Select exactly one area/ label that best matches the issue based on Reference 1: Area Definitions.
+            4. Fallback Logic:
+                - If you cannot confidently determine the correct area/ label from the definitions, you must use area/unknown.
+            5. Output your selected label in JSON format and nothing else. Example:
+                {"labels_to_set": ["area/core"]}
 
             ## Guidelines
+            - Your output must contain exactly one area/ label.
+            - Triage only the current issue based on its title and body.
+            - Output only valid JSON format.
+            - Do not include any explanation or additional text, just the JSON.
 
-            - Only use labels that already exist in the repository
-            - Do not add comments or modify the issue content
-            - Triage only the current issue
-            - Identify only one area/ label
-            - Identify only one kind/ label
-            - Identify all applicable sub-area/* and priority/* labels based on the issue content. It's ok to have multiple of these
-            - Once you categorize the issue if it needs information bump down the priority by 1 eg.. a p0 would become a p1 a p1 would become a p2. P2 and P3 can stay as is in this scenario
-            - Reference all shell variables as "${VAR}" (with quotes and braces)
-            - Output only valid JSON format
-            - Do not include any explanation or additional text, just the JSON
+            Reference 1: Area Definitions
+            area/agent
+            - Description: Issues related to the "brain" of the CLI. This includes the core agent logic, model quality, tool/function calling, and memory.
+            - Example Issues:
+              "I am not getting a reasonable or expected response."
+              "The model is not calling the tool I expected."
+              "The web search tool is not working as expected."
+              "Feature request for a new built-in tool (e.g., read file, write file)."
+              "The generated code is poor quality or incorrect."
+              "The model seems stuck in a loop."
+              "The response from the model is malformed (e.g., broken JSON, bad formatting)."
+              "Concerns about unnecessary token consumption."
+              "Issues with how memory or chat history is managed."
+              "Issues with sub-agents."
+              "Model is switching from one to another unexpectedly."
 
-            Categorization Guidelines:
-            P0: Critical / Blocker
-            - A P0 bug is a catastrophic failure that demands immediate attention.
-            - To be a P0 it means almost all users are running into this issue and it is blocking users from being able to use the product.
-            - You would see this in the form of many comments from different developers on the bug.
-            - It represents a complete showstopper for a significant portion of users or for the development process itself.
-            Impact:
-            - Blocks development or testing for the entire team.
-            - Major security vulnerability that could compromise user data or system integrity.
-            - Causes data loss or corruption with no workaround.
-            - Crashes the application or makes a core feature completely unusable for all or most users in a production environment. Will it cause severe quality degration? Is it preventing contributors from contributing to the repository or is it a release blocker?
-            Qualifier: Is the main function of the software broken?
-            Example: The gemini auth login command fails with an unrecoverable error, preventing any user from authenticating and using the rest of the CLI.
-            P1: High
-            - A P1 bug is a serious issue that significantly degrades the user experience or impacts a core feature.
-            - While not a complete blocker, it's a major problem that needs a fast resolution. Feature requests are almost never P1.
-            - Once again this would be affecting many users.
-            - You would see this in the form of comments from different developers on the bug.
-            Impact:
-            - A core feature is broken or behaving incorrectly for a large number of users or large number of use cases.
-            - Review the bug details and comments to try figure out if this issue affects a large set of use cases or if it's a narrow set of use cases.
-            - Severe performance degradation making the application frustratingly slow.
-            - No straightforward workaround exists, or the workaround is difficult and non-obvious.
-            Qualifier: Is a key feature unusable or giving very wrong results?
-            Example: Gemini CLI enters a loop when making read-many-files tool call. I am unable to break out of the loop and gemini doesn't follow instructions subsequently.
-            P2: Medium
-            - A P2 bug is a moderately impactful issue. It's a noticeable problem but doesn't prevent the use of the software's main functionality.
-            Impact:
-            - Affects a non-critical feature or a smaller, specific subset of users.
-            - An inconvenient but functional workaround is available and easy to execute.
-            - Noticeable UI/UX problems that don't break functionality but look unprofessional (e.g., elements are misaligned or overlapping).
-            Qualifier: Is it an annoying but non-blocking problem?
-            Example: An error message is unclear or contains a typo, causing user confusion but not halting their workflow.
-            P3: Low
-            - A P3 bug is a minor, low-impact issue that is trivial or cosmetic. It has little to no effect on the overall functionality of the application.
-            Impact:
-            - Minor cosmetic issues like color inconsistencies, typos in documentation, or slight alignment problems on a non-critical page.
-            - An edge-case bug that is very difficult to reproduce and affects a tiny fraction of users.
-            Qualifier: Is it a "nice-to-fix" issue?
-            Example: Spelling mistakes etc.
-            Things you should know:
-            - If users are talking about issues where the model gets downgraded from pro to flash then i want you to categorize that as a performance issue
-            - This product is designed to use different models eg.. using pro, downgrading to flash etc. when users report that they dont expect the model to change those would be categorized as feature requests.
-            Definition of Areas
-            area/ux:
-            - Issues concerning user-facing elements like command usability, interactive features, help docs, and perceived performance.
-            - I am seeing my screen flicker when using Gemini CLI
-            - I am seeing the output malformed
-            - Theme changes aren't taking effect
-            - My keyboard inputs arent' being recognzied
-            area/platform:
-            - Issues related to installation, packaging, OS compatibility (Windows, macOS, Linux), and the underlying CLI framework.
-            area/background: Issues related to long-running background tasks, daemons, and autonomous or proactive agent features.
-            area/models:
-            - i am not getting a response that is reasonable or expected. this can include things like
-            - I am calling a tool and the tool is not performing as expected.
-            - i am expecting a tool to be called and it is not getting called ,
-            - Including experience when using
-            - built-in tools (e.g., web search, code interpreter, read file, writefile, etc..),
-            - Function calling issues should be under this area
-            - i am getting responses from the model that are malformed.
-            - Issues concerning Gemini quality of response and inference,
-            - Issues talking about unnecessary token consumption.
-            - Issues talking about Model getting stuck in a loop be watchful as this could be the root cause for issues that otherwise seem like model performance issues.
-            - Memory compression
-            - unexpected responses,
-            - poor quality of generated code
-            area/tools:
-            - These are primarily issues related to Model Context Protocol
-            - These are issues that mention MCP support
-            - feature requests asking for support for new tools.
-            area/core: Issues with fundamental components like command parsing, configuration management, session state, and the main API client logic. Introducing multi-modality
-            area/contribution: Issues related to improving the developer contribution experience, such as CI/CD pipelines, build scripts, and test automation infrastructure.
-            area/authentication: Issues related to user identity, login flows, API key handling, credential storage, and access token management, unable to sign in selecting wrong authentication path etc..
-            area/security-privacy: Issues concerning vulnerability patching, dependency security, data sanitization, privacy controls, and preventing unauthorized data access.
-            area/extensibility: Issues related to the plugin system, extension APIs, or making the CLI's functionality available in other applications, github actions, ide support etc..
-            area/performance: Issues focused on model performance
-            - Issues with running out of capacity,
-            - 429 errors etc..
-            - could also pertain to latency,
-            - other general software performance like, memory usage, CPU consumption, and algorithmic efficiency.
-            - Switching models from one to the other unexpectedly.
+            area/enterprise
+            - Description: Issues specific to enterprise-level features, including telemetry, policy, and licenses.
+            - Example Issues:
+              "Usage data is not appearing in our telemetry dashboard."
+              "A user is able to perform an action that should be blocked by an admin policy."
+              "Questions about billing, licensing tiers, or enterprise quotas."
+
+            area/non-interactive
+            - Description: Issues related to using the CLI in automated or non-interactive environments (headless mode).
+            - Example Issues:
+              "Problems using the CLI as an SDK in another surface."
+              "The CLI is behaving differently when run from a shell script vs. an interactive terminal."
+              "GitHub action is failing."
+              "I am having trouble running the CLI in headless mode"
+
+            area/core
+            - Description: Issues with the fundamental CLI app itself. This includes the user interface (UI/UX), installation, OS compatibility, and performance.
+            - Example Issues:
+              "I am seeing my screen flicker when using the CLI."
+              "The output in my terminal is malformed or unreadable."
+              "Theme changes are not taking effect."
+              "Keyboard inputs (e.g., arrow keys, Ctrl+C) are not being recognized."
+              "The CLI failed to install or update."
+              "An issue specific to running on Windows, macOS, or Linux."
+              "Problems with command parsing, flags, or argument handling."
+              "High CPU or memory usage by the CLI process."
+              "Issues related to multi-modality (e.g., handling image inputs)."
+              "Problems with the IDE integration connection or installation"
+
+            area/security
+            - Description: Issues related to user authentication, authorization, data security, and privacy.
+            - Example Issues:
+              "I am unable to sign in."
+              "The login flow is selecting the wrong authentication path"
+              "Problems with API key handling or credential storage."
+              "A report of a security vulnerability"
+              "Concerns about data sanitization or potential data leaks."
+              "Issues or requests related to privacy controls."
+              "Preventing unauthorized data access."
+
+            area/platform
+            - Description: Issues related to CI/CD, release management, testing, eval infrastructure, capacity, quota management, and sandbox environments.
+            - Example Issues:
+              "I am getting a 429 'Resource Exhausted' or 500-level server error."
+              "General slowness or high latency from the service."
+              "The build script is broken on the main branch."
+              "Tests are failing in the CI/CD pipeline."
+              "Issues with the release management or publishing process."
+              "User is running out of capacity."
+              "Problems specific to the sandbox or staging environments."
+              "Questions about quota limits or requests for increases."
+
+            area/extensions
+            - Description: Issues related to the extension ecosystem, including the marketplace and website.
+            - Example Issues:
+              "Bugs related to the extension marketplace website."
+              "Issues with a specific extension."
+              "Feature request for the extension ecosystem."
+
+            area/documentation
+            - Description: Issues related to user-facing documentation and other content on the documentation website.
+            - Example Issues:
+              "A typo in a README file."
+              "DOCS: A command is not working as described in the documentation."
+              "A request for a new documentation page."
+              "Instructions missing for skills feature"
+
+            area/unknown
+            - Description: Issues that do not clearly fit into any other defined area/ category, or where information is too limited to make a determination. Use this when no other area is appropriate.
 
       - name: 'Apply Labels to Issue'
         if: |-
@@ -267,52 +276,60 @@ jobs:
           LABELS_OUTPUT: '${{ steps.gemini_issue_analysis.outputs.summary }}'
         uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
         with:
-          github-token: '${{ steps.generate_token.outputs.token }}'
-          script: |-
-            // Strip code block markers if present
-            const rawLabels = process.env.LABELS_OUTPUT;
-            core.info(`Raw labels JSON: ${rawLabels}`);
+          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
+          script: |
+            const rawOutput = process.env.LABELS_OUTPUT;
+            core.info(`Raw output from model: ${rawOutput}`);
             let parsedLabels;
             try {
-              const jsonMatch = rawLabels.match(/```json\s*([\s\S]*?)\s*```/);
-              if (!jsonMatch || !jsonMatch[1]) {
-                throw new Error("Could not find a ```json ... ``` block in the output.");
+              // First, try to parse the raw output as JSON.
+              parsedLabels = JSON.parse(rawOutput);
+            } catch (jsonError) {
+              // If that fails, check for a markdown code block.
+              core.warning(`Direct JSON parsing failed: ${jsonError.message}. Trying to extract from a markdown block.`);
+              const jsonMatch = rawOutput.match(/```json\s*([\s\S]*?)\s*```/);
+              if (jsonMatch && jsonMatch[1]) {
+                try {
+                  parsedLabels = JSON.parse(jsonMatch[1].trim());
+                } catch (markdownError) {
+                  core.setFailed(`Failed to parse JSON even after extracting from markdown block: ${markdownError.message}\nRaw output: ${rawOutput}`);
+                  return;
+                }
+              } else {
+                // If no markdown block, try to find a raw JSON object in the output.
+                // The CLI may include debug/log lines (e.g. telemetry init, YOLO mode)
+                // before the actual JSON response.
+                const jsonObjectMatch = rawOutput.match(/(\{[\s\S]*"labels_to_set"[\s\S]*\})/);
+                if (jsonObjectMatch) {
+                  try {
+                    parsedLabels = JSON.parse(jsonObjectMatch[0]);
+                  } catch (extractError) {
+                    core.setFailed(`Found JSON-like content but failed to parse: ${extractError.message}\nRaw output: ${rawOutput}`);
+                    return;
+                  }
+                } else {
+                  core.setFailed(`Output is not valid JSON and does not contain extractable JSON.\nRaw output: ${rawOutput}`);
+                  return;
+                }
               }
-              const jsonString = jsonMatch[1].trim();
-              parsedLabels = JSON.parse(jsonString);
-              core.info(`Parsed labels JSON: ${JSON.stringify(parsedLabels)}`);
-            } catch (err) {
-              core.setFailed(`Failed to parse labels JSON from Gemini output: ${err.message}\nRaw output: ${rawLabels}`);
-              return;
             }
 
             const issueNumber = parseInt(process.env.ISSUE_NUMBER);
-            const explanation = parsedLabels.explanation || '';
+            const labelsToAdd = parsedLabels.labels_to_set || [];
+
+            if (labelsToAdd.length !== 1) {
+              core.setFailed(`Expected exactly 1 label (area/), but got ${labelsToAdd.length}. Labels: ${labelsToAdd.join(', ')}`);
+              return;
+            }
 
             // Set labels based on triage result
-            if (parsedLabels.labels_to_set && parsedLabels.labels_to_set.length > 0) {
-              await github.rest.issues.setLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: issueNumber,
-                labels: parsedLabels.labels_to_set
-              });
-              const explanationInfo = explanation ? ` - ${explanation}` : '';
-              core.info(`Successfully set labels for #${issueNumber}: ${parsedLabels.labels_to_set.join(', ')}${explanationInfo}`);
-            } else {
-              // If no labels to set, leave the issue as is
-              const explanationInfo = explanation ? ` - ${explanation}` : '';
-              core.info(`No labels to set for #${issueNumber}, leaving as is${explanationInfo}`);
-            }
-
-            if (explanation) {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: issueNumber,
-                body: explanation,
-              });
-            }
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issueNumber,
+              labels: labelsToAdd
+            });
+            core.info(`Successfully added labels for #${issueNumber}: ${labelsToAdd.join(', ')}`);
 
       - name: 'Post Issue Analysis Failure Comment'
         if: |-
@@ -322,7 +339,7 @@ jobs:
           RUN_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
         uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
         with:
-          github-token: '${{ steps.generate_token.outputs.token }}'
+          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
           script: |-
             github.rest.issues.createComment({
               owner: context.repo.owner,

.github/workflows/gemini-scheduled-issue-dedup.yml

@@ -81,7 +81,6 @@ jobs:
                     "FIRESTORE_DATABASE_ID": "(default)",
                     "GOOGLE_APPLICATION_CREDENTIALS": "${GOOGLE_APPLICATION_CREDENTIALS}"
                   },
-                  "enabled": true,
                   "timeout": 600000
                 }
               },

.github/workflows/gemini-scheduled-issue-triage.yml

@@ -1,12 +1,16 @@
 name: '📋 Gemini Scheduled Issue Triage'
 
 on:
+  issues:
+    types:
+      - 'opened'
+      - 'reopened'
   schedule:
     - cron: '0 * * * *' # Runs every hour
   workflow_dispatch:
 
 concurrency:
-  group: '${{ github.workflow }}'
+  group: '${{ github.workflow }}-${{ github.event.number || github.run_id }}'
   cancel-in-progress: true
 
 defaults:
@@ -35,7 +39,21 @@ jobs:
           private-key: '${{ secrets.PRIVATE_KEY }}'
           permission-issues: 'write'
 
+      - name: 'Get issue from event'
+        if: |-
+          ${{ github.event_name == 'issues' }}
+        id: 'get_issue_from_event'
+        env:
+          ISSUE_EVENT: '${{ toJSON(github.event.issue) }}'
+        run: |
+          set -euo pipefail
+          ISSUE_JSON=$(echo "$ISSUE_EVENT" | jq -c '[{number: .number, title: .title, body: .body}]')
+          echo "issues_to_triage=${ISSUE_JSON}" >> "${GITHUB_OUTPUT}"
+          echo "✅ Found issue #${{ github.event.issue.number }} from event to triage! 🎯"
+
       - name: 'Find untriaged issues'
+        if: |-
+          ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
         id: 'find_issues'
         env:
           GITHUB_TOKEN: '${{ steps.generate_token.outputs.token }}'
@@ -43,22 +61,26 @@ jobs:
         run: |-
           set -euo pipefail
 
-          echo '🔍 Finding issues without labels...'
-          NO_LABEL_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue no:label' --json number,title,body)"
+          echo '🔍 Finding issues missing area labels...'
+          NO_AREA_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:area/core -label:area/agent -label:area/enterprise -label:area/non-interactive -label:area/security -label:area/platform -label:area/extensions -label:area/documentation -label:area/unknown' --limit 100 --json number,title,body)"
 
-          echo '🏷️ Finding issues that need triage...'
-          NEED_TRIAGE_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search "is:open is:issue label:\"status/need-triage\""  --limit 1000 --json number,title,body)"
+          echo '🔍 Finding issues missing kind labels...'
+          NO_KIND_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:kind/bug -label:kind/enhancement -label:kind/customer-issue -label:kind/question' --limit 100 --json number,title,body)"
+
+          echo '🏷️ Finding issues missing priority labels...'
+          NO_PRIORITY_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:priority/p0 -label:priority/p1 -label:priority/p2 -label:priority/p3 -label:priority/unknown' --limit 100 --json number,title,body)"
 
           echo '🔄 Merging and deduplicating issues...'
-          ISSUES="$(echo "${NO_LABEL_ISSUES}" "${NEED_TRIAGE_ISSUES}" | jq -c -s 'add | unique_by(.number)')"
+          ISSUES="$(echo "${NO_AREA_ISSUES}" "${NO_KIND_ISSUES}" "${NO_PRIORITY_ISSUES}" | jq -c -s 'add | unique_by(.number)')"
 
           echo '📝 Setting output for GitHub Actions...'
           echo "issues_to_triage=${ISSUES}" >> "${GITHUB_OUTPUT}"
 
           ISSUE_COUNT="$(echo "${ISSUES}" | jq 'length')"
-          echo "✅ Found ${ISSUE_COUNT} issues to triage! 🎯"
+          echo "✅ Found ${ISSUE_COUNT} unique issues to triage! 🎯"
 
       - name: 'Get Repository Labels'
         id: 'get_labels'
@@ -77,12 +99,13 @@ jobs:
 
       - name: 'Run Gemini Issue Analysis'
         if: |-
-          ${{ steps.find_issues.outputs.issues_to_triage != '[]' }}
+          (steps.get_issue_from_event.outputs.issues_to_triage != '' && steps.get_issue_from_event.outputs.issues_to_triage != '[]') ||
+          (steps.find_issues.outputs.issues_to_triage != '' && steps.find_issues.outputs.issues_to_triage != '[]')
         uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
         id: 'gemini_issue_analysis'
         env:
           GITHUB_TOKEN: '' # Do not pass any auth token here since this runs on untrusted inputs
-          ISSUES_TO_TRIAGE: '${{ steps.find_issues.outputs.issues_to_triage }}'
+          ISSUES_TO_TRIAGE: '${{ steps.get_issue_from_event.outputs.issues_to_triage || steps.find_issues.outputs.issues_to_triage }}'
           REPOSITORY: '${{ github.repository }}'
           AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
         with:
@@ -116,38 +139,32 @@ jobs:
             1. You are only able to use the echo command. Review the available labels in the environment variable: "${AVAILABLE_LABELS}".
             2. Check environment variable for issues to triage: $ISSUES_TO_TRIAGE (JSON array of issues)
             3. Review the issue title, body and any comments provided in the environment variables.
-            4. Identify the most relevant labels from the existing labels, focusing on kind/*, area/*, sub-area/* and priority/*.
-            5. If the issue already has area/ label, dont try to change it. Similarly, if the issue already has a kind/ label don't change it. And if the issue already has a priority/ label do not change it for example:
-               If an issue has area/core and kind/bug  you will only add a priority/ label.
-               Instead if an issue has no labels, you will could add one lable of each kind.
+            4. Identify the most relevant labels from the existing labels, specifically focusing on area/*, kind/* and priority/*.
+            5. Label Policy:
+               - If the issue already has a kind/ label, do not change it.
+               - If the issue already has a priority/ label, do not change it.
+               - If the issue already has an area/ label, do not change it.
+               - If any of these are missing, select exactly ONE appropriate label for the missing category.
             6. Identify other applicable labels based on the issue content, such as status/*, help wanted, good first issue, etc.
-            7. For area/* and kind/* limit yourself to only the single most applicable label in each case.
-            8. Give me a single short explanation about why you are selecting each label in the process.
-            9. Output a JSON array of objects, each containing the issue number
+            7. Give me a single short explanation about why you are selecting each label in the process.
+            8. Output a JSON array of objects, each containing the issue number
                and the labels to add and remove, along with an explanation. For example:
                ```
                [
                  {
                    "issue_number": 123,
-                   "labels_to_add": ["kind/bug", "priority/p2"],
+                   "labels_to_add": ["area/core", "kind/bug", "priority/p2"],
                    "labels_to_remove": ["status/need-triage"],
-                   "explanation": "This issue is a bug that needs to be addressed with medium priority."
-                 },
-                 {
-                   "issue_number": 456,
-                   "labels_to_add": ["kind/enhancement"],
-                   "labels_to_remove": [],
-                   "explanation": "This issue is an enhancement request that could improve the user experience."
+                   "explanation": "This issue is a UI bug that needs to be addressed with medium priority."
                  }
                ]
                ```
               If an issue cannot be classified, do not include it in the output array.
-            10. For each issue please check if CLI version is present, this is usually in the output of the /about command and will look like 0.1.5
+            9. For each issue please check if CLI version is present, this is usually in the output of the /about command and will look like 0.1.5
               - Anything more than 6 versions older than the most recent should add the status/need-retesting label
-            11. If you see that the issue doesn't look like it has sufficient information recommend the status/need-information label and leave a comment politely requesting the relevant information, eg.. if repro steps are missing request for repro steps. if version information is missing request for version information into the explanation section below.
-              - After identifying appropriate labels to an issue, add "status/need-triage" label to labels_to_remove in the output.
-            12. If you think an issue might be a Priority/P0 do not apply the priority/p0 label. Instead apply a status/manual-triage label and include a note in your explanation.
-            13. If you are uncertain and have not been able to apply one each of kind/, area/ and priority/ , apply the status/manual-triage label.
+            10. If you see that the issue doesn't look like it has sufficient information recommend the status/need-information label and leave a comment politely requesting the relevant information, eg.. if repro steps are missing request for repro steps. if version information is missing request for version information into the explanation section below.
+            11. If you think an issue might be a Priority/P0 do not apply the priority/p0 label. Instead apply a status/manual-triage label and include a note in your explanation.
+            12. If you are uncertain about a category, use the area/unknown, kind/question, or priority/unknown labels as appropriate. If you are extremely uncertain, apply the status/manual-triage label.
 
             ## Guidelines
 
@@ -157,100 +174,47 @@ jobs:
               - Do not add comments or modify the issue content.
               - Do not remove the following labels maintainer, help wanted or good first issue.
               - Triage only the current issue.
-              - Identify only one area/ label
+              - Identify only one area/ label.
               - Identify only one kind/ label (Do not apply kind/duplicate or kind/parent-issue)
-              - Identify all applicable sub-area/* and priority/* labels based on the issue content. It's ok to have multiple of these.
+              - Identify only one priority/ label.
               - Once you categorize the issue if it needs information bump down the priority by 1 eg.. a p0 would become a p1 a p1 would become a p2. P2 and P3 can stay as is in this scenario.
-            Categorization Guidelines:
-            P0: Critical / Blocker
-              - A P0 bug is a catastrophic failure that demands immediate attention.
-              - To be a P0 it means almost all users are running into this issue and it is blocking users from being able to use the product.
-              - You would see this in the form of many comments from different developers on the bug.
-              - It represents a complete showstopper for a significant portion of users or for the development process itself.
-            Impact:
-              - Blocks development or testing for the entire team.
-              - Major security vulnerability that could compromise user data or system integrity.
-              - Causes data loss or corruption with no workaround.
-              - Crashes the application or makes a core feature completely unusable for all or most users in a production environment. Will it cause severe quality degration?
-              - Is it preventing contributors from contributing to the repository or is it a release blocker?
-              Qualifier: Is the main function of the software broken?
-              Example: The gemini auth login command fails with an unrecoverable error, preventing any user from authenticating and using the rest of the CLI.
-            P1: High
-              - A P1 bug is a serious issue that significantly degrades the user experience or impacts a core feature.
-              - While not a complete blocker, it's a major problem that needs a fast resolution. Feature requests are almost never P1.
-              - Once again this would be affecting many users.
-              - You would see this in the form of comments from different developers on the bug.
-              Impact:
-              - A core feature is broken or behaving incorrectly for a large number of users or large number of use cases.
-              - Review the bug details and comments to try figure out if this issue affects a large set of use cases or if it's a narrow set of use cases.
-              - Severe performance degradation making the application frustratingly slow.
-              - No straightforward workaround exists, or the workaround is difficult and non-obvious.
-              Qualifier: Is a key feature unusable or giving very wrong results?
-              Example: Gemini CLI enters a loop when making read-many-files tool call. I am unable to break out of the loop and gemini doesn't follow instructions subsequently.
-            P2: Medium
-              - A P2 bug is a moderately impactful issue. It's a noticeable problem but doesn't prevent the use of the software's main functionality.
-              Impact:
-              - Affects a non-critical feature or a smaller, specific subset of users.
-              - An inconvenient but functional workaround is available and easy to execute.
-              - Noticeable UI/UX problems that don't break functionality but look unprofessional (e.g., elements are misaligned or overlapping).
-              Qualifier: Is it an annoying but non-blocking problem?
-              Example: An error message is unclear or contains a typo, causing user confusion but not halting their workflow.
-            P3: Low
-              - A P3 bug is a minor, low-impact issue that is trivial or cosmetic. It has little to no effect on the overall functionality of the application.
-              Impact:
-              - Minor cosmetic issues like color inconsistencies, typos in documentation, or slight alignment problems on a non-critical page.
-              - An edge-case bug that is very difficult to reproduce and affects a tiny fraction of users.
-              Qualifier: Is it a "nice-to-fix" issue?
-              Example: Spelling mistakes etc.
+
+            Categorization Guidelines (Priority):
+            P0 - Urgent Blocking Issues:
+              - DO NOT APPLY THIS LABEL AUTOMATICALLY. Use status/manual-triage instead.
+              - Definition: Urgent, block a significant percentage of the user base, and prevent frequent use of the Gemini CLI.
+              - This includes core stability blockers (e.g., authentication failures, broken upgrades), critical crashes, and P0 security vulnerabilities.
+              - Impact: Blocks development or testing for the entire team; Major security vulnerability; Causes data loss or corruption with no workaround; Crashes the application or makes a core feature completely unusable for all or most users.
+              - Qualifier: Is the main function of the software broken?
+            P1 - High-Impact Issues:
+              - Definition: Affect a large number of users, blocking them from using parts of the Gemini CLI, or make the CLI frequently unusable even with workarounds available.
+              - Impact: A core feature is broken or behaving incorrectly for a large number of users or use cases; Severe performance degradation; No straightforward workaround exists.
+              - Qualifier: Is a key feature unusable or giving very wrong results?
+            P2 - Significant Issues:
+              - Definition: Affect some users significantly, such as preventing the use of certain features or authentication types.
+              - Can also be issues that many users complain about, causing annoyance or hindering daily use.
+              - Impact: Affects a non-critical feature or a smaller, specific subset of users; An inconvenient but functional workaround is available; Noticeable UI/UX problems that look unprofessional.
+              - Qualifier: Is it an annoying but non-blocking problem?
+            P3 - Low-Impact Issues:
+              - Definition: Typically usability issues that cause annoyance to a limited user base.
+              - Includes feature requests that could be addressed in the near future and may be suitable for community contributions.
+              - Impact: Minor cosmetic issues; An edge-case bug that is very difficult to reproduce and affects a tiny fraction of users.
+              - Qualifier: Is it a "nice-to-fix" issue?
+
+            Categorization Guidelines (Area):
+            area/agent: Core Agent, Tools, Memory, Sub-Agents, Hooks, Agent Quality
+            area/core: User Interface, OS Support, Core Functionality
+            area/documentation: End-user and contributor-facing documentation, website-related
+            area/enterprise: Telemetry, Policy, Quota / Licensing
+            area/extensions: Gemini CLI extensions capability
+            area/non-interactive: GitHub Actions, SDK, 3P Integrations, Shell Scripting, Command line automation
+            area/platform: Build infra, Release mgmt, Testing, Eval infra, Capacity, Quota mgmt
+            area/security: security related issues
+
             Additional Context:
-              - If users are talking about issues where the model gets downgraded from pro to flash then i want you to categorize that as a performance issue
-              - This product is designed to use different models eg.. using pro, downgrading to flash etc.
-              - When users report that they dont expect the model to change those would be categorized as feature requests.
-            Definition of Areas
-            area/ux:
-              - Issues concerning user-facing elements like command usability, interactive features, help docs, and perceived performance.
-              - I am seeing my screen flicker when using Gemini CLI
-              - I am seeing the output malformed
-              - Theme changes aren't taking effect
-              - My keyboard inputs arent' being recognzied
-            area/platform:
-              - Issues related to installation, packaging, OS compatibility (Windows, macOS, Linux), and the underlying CLI framework.
-            area/background: Issues related to long-running background tasks, daemons, and autonomous or proactive agent features.
-            area/models:
-              - i am not getting a response that is reasonable or expected. this can include things like
-              - I am calling a tool and the tool is not performing as expected.
-              - i am expecting a tool to be called and it is not getting called ,
-              - Including experience when using
-              - built-in tools (e.g., web search, code interpreter, read file, writefile, etc..),
-              - Function calling issues should be under this area
-              - i am getting responses from the model that are malformed.
-              - Issues concerning Gemini quality of response and inference,
-              - Issues talking about unnecessary token consumption.
-              - Issues talking about Model getting stuck in a loop be watchful as this could be the root cause for issues that otherwise seem like model performance issues.
-              - Memory compression
-              - unexpected responses,
-              - poor quality of generated code
-            area/tools:
-              - These are primarily issues related to Model Context Protocol
-              - These are issues that mention MCP support
-              - feature requests asking for support for new tools.
-            area/core:
-              - Issues with fundamental components like command parsing, configuration management, session state, and the main API client logic. Introducing multi-modality
-            area/contribution:
-              - Issues related to improving the developer contribution experience, such as CI/CD pipelines, build scripts, and test automation infrastructure.
-            area/authentication:
-              -  Issues related to user identity, login flows, API key handling, credential storage, and access token management, unable to sign in selecting wrong authentication path etc..
-            area/security-privacy:
-              - Issues concerning vulnerability patching, dependency security, data sanitization, privacy controls, and preventing unauthorized data access.
-            area/extensibility:
-              - Issues related to the plugin system, extension APIs, or making the CLI's functionality available in other applications, github actions, ide support etc..
-            area/performance:
-              - Issues focused on model performance
-              - Issues with running out of capacity,
-              - 429 errors etc..
-              - could also pertain to latency,
-              - other general software performance like, memory usage, CPU consumption, and algorithmic efficiency.
-              - Switching models from one to the other unexpectedly.
+            - If users are talking about issues where the model gets downgraded from pro to flash then i want you to categorize that as a performance issue.
+            - This product is designed to use different models eg.. using pro, downgrading to flash etc.
+            - When users report that they dont expect the model to change those would be categorized as feature requests.
 
       - name: 'Apply Labels to Issues'
         if: |-
@@ -286,33 +250,18 @@ jobs:
                 continue;
               }
 
-              if (entry.labels_to_add && entry.labels_to_add.length > 0) {
+              const labelsToAdd = entry.labels_to_add || [];
+              labelsToAdd.push('status/bot-triaged');
+
+              if (labelsToAdd.length > 0) {
                 await github.rest.issues.addLabels({
                   owner: context.repo.owner,
                   repo: context.repo.repo,
                   issue_number: issueNumber,
-                  labels: entry.labels_to_add
+                  labels: labelsToAdd
                 });
                 const explanation = entry.explanation ? ` - ${entry.explanation}` : '';
-                core.info(`Successfully added labels for #${issueNumber}: ${entry.labels_to_add.join(', ')}${explanation}`);
-              }
-
-              if (entry.labels_to_remove && entry.labels_to_remove.length > 0) {
-                for (const label of entry.labels_to_remove) {
-                  try {
-                    await github.rest.issues.removeLabel({
-                      owner: context.repo.owner,
-                      repo: context.repo.repo,
-                      issue_number: issueNumber,
-                      name: label
-                    });
-                  } catch (error) {
-                    if (error.status !== 404) {
-                      throw error;
-                    }
-                  }
-                }
-                core.info(`Successfully removed labels for #${issueNumber}: ${entry.labels_to_remove.join(', ')}`);
+                core.info(`Successfully added labels for #${issueNumber}: ${labelsToAdd.join(', ')}${explanation}`);
               }
 
               if (entry.explanation) {

.github/workflows/gemini-scheduled-pr-triage.yml

@@ -39,3 +39,7 @@ jobs:
           GITHUB_REPOSITORY: '${{ github.repository }}'
         run: |-
           ./.github/scripts/pr-triage.sh
+          # If prs_needing_comment is empty, set it to [] explicitly for downstream steps
+          if [[ -z "$(grep 'prs_needing_comment' "${GITHUB_OUTPUT}" | cut -d'=' -f2-)" ]]; then
+            echo "prs_needing_comment=[]" >> "${GITHUB_OUTPUT}"
+          fi

.github/workflows/gemini-scheduled-stale-issue-closer.yml

@@ -0,0 +1,159 @@
+name: '🔒 Gemini Scheduled Stale Issue Closer'
+
+on:
+  schedule:
+    - cron: '0 0 * * 0' # Every Sunday at midnight UTC
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run in dry-run mode (no changes applied)'
+        required: false
+        default: false
+        type: 'boolean'
+
+concurrency:
+  group: '${{ github.workflow }}'
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: 'bash'
+
+jobs:
+  close-stale-issues:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      issues: 'write'
+    steps:
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        uses: 'actions/create-github-app-token@v2'
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+          permission-issues: 'write'
+
+      - name: 'Process Stale Issues'
+        uses: 'actions/github-script@v7'
+        env:
+          DRY_RUN: '${{ inputs.dry_run }}'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |
+            const dryRun = process.env.DRY_RUN === 'true';
+            if (dryRun) {
+              core.info('DRY RUN MODE ENABLED: No changes will be applied.');
+            }
+            const batchLabel = 'Stale';
+
+            const threeMonthsAgo = new Date();
+            threeMonthsAgo.setMonth(threeMonthsAgo.getMonth() - 3);
+
+            const tenDaysAgo = new Date();
+            tenDaysAgo.setDate(tenDaysAgo.getDate() - 10);
+
+            core.info(`Cutoff date for creation: ${threeMonthsAgo.toISOString()}`);
+            core.info(`Cutoff date for updates: ${tenDaysAgo.toISOString()}`);
+
+            const query = `repo:${context.repo.owner}/${context.repo.repo} is:issue is:open created:<${threeMonthsAgo.toISOString()}`;
+            core.info(`Searching with query: ${query}`);
+
+            const itemsToCheck = await github.paginate(github.rest.search.issuesAndPullRequests, {
+              q: query,
+              sort: 'created',
+              order: 'asc',
+              per_page: 100
+            });
+
+            core.info(`Found ${itemsToCheck.length} open issues to check.`);
+
+            let processedCount = 0;
+
+            for (const issue of itemsToCheck) {
+              const createdAt = new Date(issue.created_at);
+              const updatedAt = new Date(issue.updated_at);
+              const reactionCount = issue.reactions.total_count;
+
+              // Basic thresholds
+              if (reactionCount >= 5) {
+                continue;
+              }
+
+              // Skip if it has a maintainer, help wanted, or Public Roadmap label
+              const rawLabels = issue.labels.map((l) => l.name);
+              const lowercaseLabels = rawLabels.map((l) => l.toLowerCase());
+              if (
+                lowercaseLabels.some((l) => l.includes('maintainer')) ||
+                lowercaseLabels.includes('help wanted') ||
+                rawLabels.includes('🗓️ Public Roadmap')
+              ) {
+                continue;
+              }
+
+              let isStale = updatedAt < tenDaysAgo;
+
+              // If apparently active, check if it's only bot activity
+              if (!isStale) {
+                try {
+                  const comments = await github.rest.issues.listComments({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    per_page: 100,
+                    sort: 'created',
+                    direction: 'desc'
+                  });
+
+                  const lastHumanComment = comments.data.find(comment => comment.user.type !== 'Bot');
+                  if (lastHumanComment) {
+                    isStale = new Date(lastHumanComment.created_at) < tenDaysAgo;
+                  } else {
+                    // No human comments. Check if creator is human.
+                    if (issue.user.type !== 'Bot') {
+                       isStale = createdAt < tenDaysAgo;
+                    } else {
+                       isStale = true; // Bot created, only bot comments
+                    }
+                  }
+                } catch (error) {
+                  core.warning(`Failed to fetch comments for issue #${issue.number}: ${error.message}`);
+                  continue;
+                }
+              }
+
+              if (isStale) {
+                processedCount++;
+                const message = `Closing stale issue #${issue.number}: "${issue.title}" (${issue.html_url})`;
+                core.info(message);
+
+                if (!dryRun) {
+                  // Add label
+                  await github.rest.issues.addLabels({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    labels: [batchLabel]
+                  });
+
+                  // Add comment
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    body: 'Hello! As part of our effort to keep our backlog manageable and focus on the most active issues, we are tidying up older reports.\n\nIt looks like this issue hasn\'t been active for a while, so we are closing it for now. However, if you are still experiencing this bug on the latest stable build, please feel free to comment on this issue or create a new one with updated details.\n\nThank you for your contribution!'
+                  });
+
+                  // Close issue
+                  await github.rest.issues.update({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    state: 'closed',
+                    state_reason: 'not_planned'
+                  });
+                }
+              }
+            }
+
+            core.info(`\nTotal issues processed: ${processedCount}`);

.github/workflows/gemini-scheduled-stale-pr-closer.yml

@@ -0,0 +1,258 @@
+name: 'Gemini Scheduled Stale PR Closer'
+
+on:
+  schedule:
+    - cron: '0 2 * * *' # Every day at 2 AM UTC
+  pull_request:
+    types: ['opened', 'edited']
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run in dry-run mode'
+        required: false
+        default: false
+        type: 'boolean'
+
+jobs:
+  close-stale-prs:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      pull-requests: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        env:
+          APP_ID: '${{ secrets.APP_ID }}'
+        if: |-
+          ${{ env.APP_ID != '' }}
+        uses: 'actions/create-github-app-token@v2'
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+
+      - name: 'Process Stale PRs'
+        uses: 'actions/github-script@v7'
+        env:
+          DRY_RUN: '${{ inputs.dry_run }}'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
+          script: |
+            const dryRun = process.env.DRY_RUN === 'true';
+            const thirtyDaysAgo = new Date();
+            thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+
+            // 1. Fetch maintainers for verification
+            let maintainerLogins = new Set();
+            const teams = ['gemini-cli-maintainers', 'gemini-cli-askmode-approvers', 'gemini-cli-docs'];
+
+            for (const team_slug of teams) {
+              try {
+                const members = await github.paginate(github.rest.teams.listMembersInOrg, {
+                  org: context.repo.owner,
+                  team_slug: team_slug
+                });
+                for (const m of members) maintainerLogins.add(m.login.toLowerCase());
+                core.info(`Successfully fetched ${members.length} team members from ${team_slug}`);
+              } catch (e) {
+                core.warning(`Failed to fetch team members from ${team_slug}: ${e.message}`);
+              }
+            }
+
+            const isGooglerCache = new Map();
+            const isGoogler = async (login) => {
+              if (isGooglerCache.has(login)) return isGooglerCache.get(login);
+
+              try {
+                // Check membership in 'googlers' or 'google' orgs
+                const orgs = ['googlers', 'google'];
+                for (const org of orgs) {
+                  try {
+                    await github.rest.orgs.checkMembershipForUser({
+                      org: org,
+                      username: login
+                    });
+                    core.info(`User ${login} is a member of ${org} organization.`);
+                    isGooglerCache.set(login, true);
+                    return true;
+                  } catch (e) {
+                    // 404 just means they aren't a member, which is fine
+                    if (e.status !== 404) throw e;
+                  }
+                }
+              } catch (e) {
+                core.warning(`Failed to check org membership for ${login}: ${e.message}`);
+              }
+
+              isGooglerCache.set(login, false);
+              return false;
+            };
+
+            const isMaintainer = async (login, assoc) => {
+              const isTeamMember = maintainerLogins.has(login.toLowerCase());
+              const isRepoMaintainer = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(assoc);
+              if (isTeamMember || isRepoMaintainer) return true;
+
+              return await isGoogler(login);
+            };
+
+            // 2. Determine which PRs to check
+            let prs = [];
+            if (context.eventName === 'pull_request') {
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: context.payload.pull_request.number
+              });
+              prs = [pr];
+            } else {
+              prs = await github.paginate(github.rest.pulls.list, {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'open',
+                per_page: 100
+              });
+            }
+
+            for (const pr of prs) {
+              const maintainerPr = await isMaintainer(pr.user.login, pr.author_association);
+              const isBot = pr.user.type === 'Bot' || pr.user.login.endsWith('[bot]');
+
+              // Detection Logic for Linked Issues
+              // Check 1: Official GitHub "Closing Issue" link (GraphQL)
+              const linkedIssueQuery = `query($owner:String!, $repo:String!, $number:Int!) {
+                repository(owner:$owner, name:$repo) {
+                  pullRequest(number:$number) {
+                    closingIssuesReferences(first: 1) { totalCount }
+                  }
+                }
+              }`;
+
+              let hasClosingLink = false;
+              try {
+                const res = await github.graphql(linkedIssueQuery, {
+                  owner: context.repo.owner, repo: context.repo.repo, number: pr.number
+                });
+                hasClosingLink = res.repository.pullRequest.closingIssuesReferences.totalCount > 0;
+              } catch (e) {}
+
+              // Check 2: Regex for mentions (e.g., "Related to #123", "Part of #123", "#123")
+              // We check for # followed by numbers or direct URLs to issues.
+              const body = pr.body || '';
+              const mentionRegex = /(?:#|https:\/\/github\.com\/[^\/]+\/[^\/]+\/issues\/)(\d+)/i;
+              const hasMentionLink = mentionRegex.test(body);
+
+              const hasLinkedIssue = hasClosingLink || hasMentionLink;
+
+              // Logic for Closed PRs (Auto-Reopen)
+              if (pr.state === 'closed' && context.eventName === 'pull_request' && context.payload.action === 'edited') {
+                if (hasLinkedIssue) {
+                  core.info(`PR #${pr.number} now has a linked issue. Reopening.`);
+                  if (!dryRun) {
+                    await github.rest.pulls.update({
+                      owner: context.repo.owner,
+                      repo: context.repo.repo,
+                      pull_number: pr.number,
+                      state: 'open'
+                    });
+                    await github.rest.issues.createComment({
+                      owner: context.repo.owner,
+                      repo: context.repo.repo,
+                      issue_number: pr.number,
+                      body: "Thank you for linking an issue! This pull request has been automatically reopened."
+                    });
+                  }
+                }
+                continue;
+              }
+
+              // Logic for Open PRs (Immediate Closure)
+              if (pr.state === 'open' && !maintainerPr && !hasLinkedIssue && !isBot) {
+                core.info(`PR #${pr.number} is missing a linked issue. Closing.`);
+                if (!dryRun) {
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: pr.number,
+                    body: "Hi there! Thank you for your contribution to Gemini CLI. \n\nTo improve our contribution process and better track changes, we now require all pull requests to be associated with an existing issue, as announced in our [recent discussion](https://github.com/google-gemini/gemini-cli/discussions/16706) and as detailed in our [CONTRIBUTING.md](https://github.com/google-gemini/gemini-cli/blob/main/CONTRIBUTING.md#1-link-to-an-existing-issue).\n\nThis pull request is being closed because it is not currently linked to an issue. **Once you have updated the description of this PR to link an issue (e.g., by adding `Fixes #123` or `Related to #123`), it will be automatically reopened.**\n\n**How to link an issue:**\nAdd a keyword followed by the issue number (e.g., `Fixes #123`) in the description of your pull request. For more details on supported keywords and how linking works, please refer to the [GitHub Documentation on linking pull requests to issues](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue).\n\nThank you for your understanding and for being a part of our community!"
+                  });
+                  await github.rest.pulls.update({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: pr.number,
+                    state: 'closed'
+                  });
+                }
+                continue;
+              }
+
+              // Staleness check (Scheduled runs only)
+              if (pr.state === 'open' && context.eventName !== 'pull_request') {
+                const labels = pr.labels.map(l => l.name.toLowerCase());
+                if (labels.includes('help wanted') || labels.includes('🔒 maintainer only')) continue;
+
+                // Skip PRs that were created less than 30 days ago - they cannot be stale yet
+                const prCreatedAt = new Date(pr.created_at);
+                if (prCreatedAt > thirtyDaysAgo) {
+                  const daysOld = Math.floor((Date.now() - prCreatedAt.getTime()) / (1000 * 60 * 60 * 24));
+                  core.info(`PR #${pr.number} was created ${daysOld} days ago. Skipping staleness check.`);
+                  continue;
+                }
+
+                // Initialize lastActivity to PR creation date (not epoch) as a safety baseline.
+                // This ensures we never incorrectly mark a PR as stale due to failed activity lookups.
+                let lastActivity = new Date(pr.created_at);
+                try {
+                  const reviews = await github.paginate(github.rest.pulls.listReviews, {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: pr.number
+                  });
+                  for (const r of reviews) {
+                    if (await isMaintainer(r.user.login, r.author_association)) {
+                      const d = new Date(r.submitted_at || r.updated_at);
+                      if (d > lastActivity) lastActivity = d;
+                    }
+                  }
+                  const comments = await github.paginate(github.rest.issues.listComments, {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: pr.number
+                  });
+                  for (const c of comments) {
+                    if (await isMaintainer(c.user.login, c.author_association)) {
+                      const d = new Date(c.updated_at);
+                      if (d > lastActivity) lastActivity = d;
+                    }
+                  }
+                } catch (e) {
+                  core.warning(`Failed to fetch reviews/comments for PR #${pr.number}: ${e.message}`);
+                }
+
+                // For maintainer PRs, the PR creation itself counts as maintainer activity.
+                // (Now redundant since we initialize to pr.created_at, but kept for clarity)
+                if (maintainerPr) {
+                  const d = new Date(pr.created_at);
+                  if (d > lastActivity) lastActivity = d;
+                }
+
+                if (lastActivity < thirtyDaysAgo) {
+                  core.info(`PR #${pr.number} is stale.`);
+                  if (!dryRun) {
+                    await github.rest.issues.createComment({
+                      owner: context.repo.owner,
+                      repo: context.repo.repo,
+                      issue_number: pr.number,
+                      body: "Hi there! Thank you for your contribution to Gemini CLI. We really appreciate the time and effort you've put into this pull request.\n\nTo keep our backlog manageable and ensure we're focusing on current priorities, we are closing pull requests that haven't seen maintainer activity for 30 days. Currently, the team is prioritizing work associated with **🔒 maintainer only** or **help wanted** issues.\n\nIf you believe this change is still critical, please feel free to comment with updated details. Otherwise, we encourage contributors to focus on open issues labeled as **help wanted**. Thank you for your understanding!"
+                    });
+                    await github.rest.pulls.update({
+                      owner: context.repo.owner,
+                      repo: context.repo.repo,
+                      pull_number: pr.number,
+                      state: 'closed'
+                    });
+                  }
+                }
+              }
+            }

.github/workflows/gemini-self-assign-issue.yml

@@ -25,7 +25,7 @@ jobs:
     if: |-
       github.repository == 'google-gemini/gemini-cli' &&
       github.event_name == 'issue_comment' &&
-      contains(github.event.comment.body, '/assign')
+      (contains(github.event.comment.body, '/assign') || contains(github.event.comment.body, '/unassign'))
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Generate GitHub App Token'
@@ -38,6 +38,7 @@ jobs:
           permission-issues: 'write'
 
       - name: 'Assign issue to user'
+        if: "contains(github.event.comment.body, '/assign')"
         uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
         with:
           github-token: '${{ steps.generate_token.outputs.token }}'
@@ -48,6 +49,24 @@ jobs:
             const repo = context.repo.repo;
             const MAX_ISSUES_ASSIGNED = 3;
 
+            const issue = await github.rest.issues.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issueNumber,
+            });
+
+            const hasHelpWantedLabel = issue.data.labels.some(label => label.name === 'help wanted');
+
+            if (!hasHelpWantedLabel) {
+              await github.rest.issues.createComment({
+                owner: owner,
+                repo: repo,
+                issue_number: issueNumber,
+                body: `👋 @${commenter}, thanks for your interest in this issue! We're reserving self-assignment for issues that have been marked with the \`help wanted\` label. Feel free to check out our list of [issues that need attention](https://github.com/google-gemini/gemini-cli/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22).`
+              });
+              return;
+            }
+
             // Search for open issues already assigned to the commenter in this repo
             const { data: assignedIssues } = await github.rest.search.issuesAndPullRequests({
               q: `is:issue repo:${owner}/${repo} assignee:${commenter} is:open`,
@@ -64,13 +83,6 @@ jobs:
               return; // exit
             }
 
-            // Check if the issue is already assigned
-            const issue = await github.rest.issues.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: issueNumber,
-            });
-
             if (issue.data.assignees.length > 0) {
               // Comment that it's already assigned
               await github.rest.issues.createComment({
@@ -97,3 +109,42 @@ jobs:
               issue_number: issueNumber,
               body: `👋 @${commenter}, you've been assigned to this issue! Thank you for taking the time to contribute. Make sure to check out our [contributing guidelines](https://github.com/google-gemini/gemini-cli/blob/main/CONTRIBUTING.md).`
             });
+
+      - name: 'Unassign issue from user'
+        if: "contains(github.event.comment.body, '/unassign')"
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |
+            const issueNumber = context.issue.number;
+            const commenter = context.actor;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const commentBody = context.payload.comment.body.trim();
+
+            if (commentBody !== '/unassign') {
+              return;
+            }
+
+            const issue = await github.rest.issues.get({
+              owner: owner,
+              repo: repo,
+              issue_number: issueNumber,
+            });
+
+            const isAssigned = issue.data.assignees.some(assignee => assignee.login === commenter);
+
+            if (isAssigned) {
+              await github.rest.issues.removeAssignees({
+                owner: owner,
+                repo: repo,
+                issue_number: issueNumber,
+                assignees: [commenter]
+              });
+              await github.rest.issues.createComment({
+                owner: owner,
+                repo: repo,
+                issue_number: issueNumber,
+                body: `👋 @${commenter}, you have been unassigned from this issue.`
+              });
+            }

.github/workflows/issue-opened-labeler.yml

@@ -0,0 +1,46 @@
+name: '🏷️ Issue Opened Labeler'
+
+on:
+  issues:
+    types:
+      - 'opened'
+
+jobs:
+  label-issue:
+    runs-on: 'ubuntu-latest'
+    if: |-
+      ${{ github.repository == 'google-gemini/gemini-cli' || github.repository == 'google-gemini/maintainers-gemini-cli' }}
+    steps:
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        env:
+          APP_ID: '${{ secrets.APP_ID }}'
+        if: |-
+          ${{ env.APP_ID != '' }}
+        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # ratchet:actions/create-github-app-token@v2
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+
+      - name: 'Add need-triage label'
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
+          script: |-
+            const { data: issue } = await github.rest.issues.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+
+            const hasLabel = issue.labels.some(l => l.name === 'status/need-triage');
+            if (!hasLabel) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                labels: ['status/need-triage']
+              });
+            } else {
+              core.info('Issue already has status/need-triage label. Skipping.');
+            }

.github/workflows/label-backlog-child-issues.yml

@@ -0,0 +1,57 @@
+name: 'Label Child Issues for Project Rollup'
+
+on:
+  issues:
+    types: ['opened', 'edited', 'reopened']
+  schedule:
+    - cron: '0 * * * *' # Run every hour
+  workflow_dispatch:
+
+permissions:
+  issues: 'write'
+  contents: 'read'
+
+jobs:
+  # Event-based: Quick reaction to new/edited issues in THIS repo
+  labeler:
+    if: "github.repository == 'google-gemini/gemini-cli' && github.event_name == 'issues'"
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@v4'
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@v4'
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Run Multi-Repo Sync Script'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: 'node .github/scripts/sync-maintainer-labels.cjs'
+
+  # Scheduled/Manual: Recursive sync across multiple repos
+  sync-maintainer-labels:
+    if: "github.repository == 'google-gemini/gemini-cli' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')"
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@v4'
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@v4'
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Run Multi-Repo Sync Script'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: 'node .github/scripts/sync-maintainer-labels.cjs'

.github/workflows/label-workstream-rollup.yml

@@ -0,0 +1,175 @@
+name: 'Label Workstream Rollup'
+
+on:
+  issues:
+    types: ['opened', 'edited', 'reopened']
+  schedule:
+    - cron: '0 * * * *'
+  workflow_dispatch:
+
+jobs:
+  labeler:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      issues: 'write'
+    steps:
+      - name: 'Check for Parent Workstream and Apply Label'
+        uses: 'actions/github-script@v7'
+        with:
+          script: |
+            const labelToAdd = 'workstream-rollup';
+
+            // Allow-list of parent issue URLs
+            const allowedParentUrls = [
+              'https://github.com/google-gemini/gemini-cli/issues/15374',
+              'https://github.com/google-gemini/gemini-cli/issues/15456',
+              'https://github.com/google-gemini/gemini-cli/issues/15324',
+              'https://github.com/google-gemini/gemini-cli/issues/17202',
+              'https://github.com/google-gemini/gemini-cli/issues/17203'
+            ];
+
+            // Single issue processing (for event triggers)
+            async function processSingleIssue(owner, repo, number) {
+              const query = `
+                query($owner:String!, $repo:String!, $number:Int!) {
+                  repository(owner:$owner, name:$repo) {
+                    issue(number:$number) {
+                      number
+                      parent {
+                        url
+                        parent {
+                          url
+                          parent {
+                            url
+                            parent {
+                              url
+                              parent {
+                                url
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              `;
+              try {
+                const result = await github.graphql(query, { owner, repo, number });
+
+                if (!result || !result.repository || !result.repository.issue) {
+                  console.log(`Issue #${number} not found or data missing.`);
+                  return;
+                }
+
+                const issue = result.repository.issue;
+                await checkAndLabel(issue, owner, repo);
+              } catch (error) {
+                console.error(`Failed to process issue #${number}:`, error);
+                throw error; // Re-throw to be caught by main execution
+              }
+            }
+
+            // Bulk processing (for schedule/dispatch)
+            async function processAllOpenIssues(owner, repo) {
+              const query = `
+                query($owner:String!, $repo:String!, $cursor:String) {
+                  repository(owner:$owner, name:$repo) {
+                    issues(first: 100, states: OPEN, after: $cursor) {
+                      pageInfo {
+                        hasNextPage
+                        endCursor
+                      }
+                      nodes {
+                        number
+                        parent {
+                          url
+                          parent {
+                            url
+                            parent {
+                              url
+                              parent {
+                                url
+                                parent {
+                                  url
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              `;
+
+              let hasNextPage = true;
+              let cursor = null;
+
+              while (hasNextPage) {
+                try {
+                  const result = await github.graphql(query, { owner, repo, cursor });
+
+                  if (!result || !result.repository || !result.repository.issues) {
+                     console.error('Invalid response structure from GitHub API');
+                     break;
+                  }
+
+                  const issues = result.repository.issues.nodes || [];
+
+                  console.log(`Processing batch of ${issues.length} issues...`);
+                  for (const issue of issues) {
+                    await checkAndLabel(issue, owner, repo);
+                  }
+
+                  hasNextPage = result.repository.issues.pageInfo.hasNextPage;
+                  cursor = result.repository.issues.pageInfo.endCursor;
+                } catch (error) {
+                  console.error('Failed to fetch issues batch:', error);
+                  throw error; // Re-throw to be caught by main execution
+                }
+              }
+            }
+
+            async function checkAndLabel(issue, owner, repo) {
+              if (!issue || !issue.parent) return;
+
+              let currentParent = issue.parent;
+              let tracedParents = [];
+              let matched = false;
+
+              while (currentParent) {
+                tracedParents.push(currentParent.url);
+
+                if (allowedParentUrls.includes(currentParent.url)) {
+                  console.log(`SUCCESS: Issue #${issue.number} is a descendant of ${currentParent.url}. Trace: ${tracedParents.join(' -> ')}. Adding label.`);
+                  await github.rest.issues.addLabels({
+                    owner,
+                    repo,
+                    issue_number: issue.number,
+                    labels: [labelToAdd]
+                  });
+                  matched = true;
+                  break;
+                }
+                currentParent = currentParent.parent;
+              }
+
+              if (!matched && context.eventName === 'issues') {
+                 console.log(`Issue #${issue.number} did not match any allowed workstreams. Trace: ${tracedParents.join(' -> ') || 'None'}.`);
+              }
+            }
+
+            // Main execution
+            try {
+              if (context.eventName === 'issues') {
+                console.log(`Processing single issue #${context.payload.issue.number}...`);
+                await processSingleIssue(context.repo.owner, context.repo.repo, context.payload.issue.number);
+              } else {
+                console.log(`Running for event: ${context.eventName}. Processing all open issues...`);
+                await processAllOpenIssues(context.repo.owner, context.repo.repo);
+              }
+            } catch (error) {
+              core.setFailed(`Workflow failed: ${error.message}`);
+            }

.github/workflows/links.yml

@@ -0,0 +1,25 @@
+name: 'Links'
+
+on:
+  push:
+    branches: ['main']
+  pull_request:
+    branches: ['main']
+  repository_dispatch:
+  workflow_dispatch:
+  schedule:
+    - cron: '00 18 * * *'
+
+jobs:
+  linkChecker:
+    if: |-
+      ${{ github.repository == 'google-gemini/gemini-cli' }}
+    runs-on: 'ubuntu-latest'
+    steps:
+      - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+
+      - name: 'Link Checker'
+        id: 'lychee'
+        uses: 'lycheeverse/lychee-action@885c65f3dc543b57c898c8099f4e08c8afd178a2' # ratchet: lycheeverse/lychee-action@v2.6.1
+        with:
+          args: '--verbose --no-progress --accept 200,503 ./**/*.md'

.github/workflows/pr-contribution-guidelines-notifier.yml

@@ -0,0 +1,133 @@
+name: '🏷️ PR Contribution Guidelines Notifier'
+
+on:
+  pull_request:
+    types:
+      - 'opened'
+
+jobs:
+  notify-process-change:
+    runs-on: 'ubuntu-latest'
+    if: |-
+      github.repository == 'google-gemini/gemini-cli' || github.repository == 'google-gemini/maintainers-gemini-cli'
+    permissions:
+      pull-requests: 'write'
+    steps:
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        env:
+          APP_ID: '${{ secrets.APP_ID }}'
+        if: |-
+          ${{ env.APP_ID != '' }}
+        uses: 'actions/create-github-app-token@v2'
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+
+      - name: 'Check membership and post comment'
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
+          script: |-
+            const org = context.repo.owner;
+            const repo = context.repo.repo;
+            const username = context.payload.pull_request.user.login;
+            const pr_number = context.payload.pull_request.number;
+
+            // 1. Check if the PR author is a maintainer
+            // Check team membership (most reliable for private org members)
+            let isTeamMember = false;
+            const teams = ['gemini-cli-maintainers', 'gemini-cli-askmode-approvers', 'gemini-cli-docs'];
+            for (const team_slug of teams) {
+              try {
+                const members = await github.paginate(github.rest.teams.listMembersInOrg, {
+                  org: org,
+                  team_slug: team_slug
+                });
+                if (members.some(m => m.login.toLowerCase() === username.toLowerCase())) {
+                  isTeamMember = true;
+                  core.info(`${username} is a member of ${team_slug}. No notification needed.`);
+                  break;
+                }
+              } catch (e) {
+                core.warning(`Failed to fetch team members from ${team_slug}: ${e.message}`);
+              }
+            }
+
+            if (isTeamMember) return;
+
+            // Check author_association from webhook payload
+            const authorAssociation = context.payload.pull_request.author_association;
+            const isRepoMaintainer = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(authorAssociation);
+
+            if (isRepoMaintainer) {
+              core.info(`${username} is a maintainer (author_association: ${authorAssociation}). No notification needed.`);
+              return;
+            }
+
+            // Check if author is a Googler
+            const isGoogler = async (login) => {
+              try {
+                const orgs = ['googlers', 'google'];
+                for (const org of orgs) {
+                  try {
+                    await github.rest.orgs.checkMembershipForUser({
+                      org: org,
+                      username: login
+                    });
+                    return true;
+                  } catch (e) {
+                    if (e.status !== 404) throw e;
+                  }
+                }
+              } catch (e) {
+                core.warning(`Failed to check org membership for ${login}: ${e.message}`);
+              }
+              return false;
+            };
+
+            if (await isGoogler(username)) {
+              core.info(`${username} is a Googler. No notification needed.`);
+              return;
+            }
+
+            // 2. Check if the PR is already associated with an issue
+            const query = `
+              query($owner:String!, $repo:String!, $number:Int!) {
+                repository(owner:$owner, name:$repo) {
+                  pullRequest(number:$number) {
+                    closingIssuesReferences(first: 1) {
+                      totalCount
+                    }
+                  }
+                }
+              }
+            `;
+            const variables = { owner: org, repo: repo, number: pr_number };
+            const result = await github.graphql(query, variables);
+            const issueCount = result.repository.pullRequest.closingIssuesReferences.totalCount;
+
+            if (issueCount > 0) {
+              core.info(`PR #${pr_number} is already associated with an issue. No notification needed.`);
+              return;
+            }
+
+            // 3. Post the notification comment
+            core.info(`${username} is not a maintainer and PR #${pr_number} has no linked issue. Posting notification.`);
+
+            const comment = `
+            Hi @${username}, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this.
+
+            We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: [Improving Our Contribution Process & Introducing New Guidelines](https://github.com/google-gemini/gemini-cli/discussions/16706).
+
+            Key Update: Starting **January 26, 2026**, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed.
+
+            Thank you for your understanding and for being a part of our community!
+            `.trim().replace(/^[ ]+/gm, '');
+
+            await github.rest.issues.createComment({
+              owner: org,
+              repo: repo,
+              issue_number: pr_number,
+              body: comment
+            });

.github/workflows/pr-rate-limiter.yaml

@@ -0,0 +1,29 @@
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+
+name: 'PR rate limiter'
+
+permissions: {}
+
+on:
+  pull_request_target:
+    types:
+      - 'opened'
+      - 'reopened'
+
+jobs:
+  limit:
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    permissions:
+      contents: 'read'
+      pull-requests: 'write'
+    steps:
+      - name: 'Limit open pull requests per user'
+        uses: 'Homebrew/actions/limit-pull-requests@9ceb7934560eb61d131dde205a6c2d77b2e1529d' # master
+        with:
+          except-author-associations: 'MEMBER,OWNER,COLLABORATOR'
+          comment-limit: 8
+          comment: >
+            You already have 7 pull requests open. Please work on getting
+            existing PRs merged before opening more.
+          close-limit: 8
+          close: true

.github/workflows/release-change-tags.yml

@@ -0,0 +1,66 @@
+name: 'Release: Change Tags'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The package version to tag (e.g., 0.5.0-preview-2). This version must already exist on the npm registry.'
+        required: true
+        type: 'string'
+      channel:
+        description: 'The npm dist-tag to apply (e.g., latest, preview, nightly).'
+        required: true
+        type: 'choice'
+        options:
+          - 'dev'
+          - 'latest'
+          - 'preview'
+          - 'nightly'
+      dry-run:
+        description: 'Whether to run in dry-run mode.'
+        required: false
+        type: 'boolean'
+        default: true
+      environment:
+        description: 'Environment'
+        required: false
+        type: 'choice'
+        options:
+          - 'prod'
+          - 'dev'
+        default: 'prod'
+
+jobs:
+  change-tags:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    permissions:
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@v4'
+        with:
+          ref: '${{ github.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: 'Change tag'
+        uses: './.github/actions/tag-npm-release'
+        with:
+          channel: '${{ github.event.inputs.channel }}'
+          version: '${{ github.event.inputs.version }}'
+          dry-run: '${{ github.event.inputs.dry-run }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          wombat-token-a2a-server: '${{ secrets.WOMBAT_TOKEN_A2A_SERVER }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          cli-package-name: '${{ vars.CLI_PACKAGE_NAME }}'
+          core-package-name: '${{ vars.CORE_PACKAGE_NAME }}'
+          a2a-package-name: '${{ vars.A2A_PACKAGE_NAME }}'
+          working-directory: '.'

.github/workflows/release-manual.yml

@@ -0,0 +1,137 @@
+name: 'Release: Manual'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The version to release (e.g., v0.1.11). Must be a valid semver string with a "v" prefix.'
+        required: true
+        type: 'string'
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: true
+        type: 'string'
+      npm_channel:
+        description: 'The npm channel to publish to'
+        required: true
+        type: 'choice'
+        options:
+          - 'dev'
+          - 'preview'
+          - 'nightly'
+          - 'latest'
+        default: 'latest'
+      dry_run:
+        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
+        required: true
+        type: 'boolean'
+        default: true
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+      skip_github_release:
+        description: 'Select to skip creating a GitHub release (only used when environment is PROD)'
+        required: false
+        type: 'boolean'
+        default: false
+      environment:
+        description: 'Environment'
+        required: false
+        type: 'choice'
+        options:
+          - 'prod'
+          - 'dev'
+        default: 'prod'
+
+jobs:
+  release:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          fetch-depth: 0
+
+      - name: 'Checkout Release Code'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          path: 'release'
+          fetch-depth: 0
+
+      - name: 'Debug Inputs'
+        shell: 'bash'
+        env:
+          JSON_INPUTS: '${{ toJSON(inputs) }}'
+        run: 'echo "$JSON_INPUTS"'
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: './release/.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        working-directory: './release'
+        run: 'npm ci'
+
+      - name: 'Prepare Release Info'
+        id: 'release_info'
+        working-directory: './release'
+        env:
+          INPUT_VERSION: '${{ github.event.inputs.version }}'
+        run: |
+          RELEASE_VERSION="${INPUT_VERSION}"
+          echo "RELEASE_VERSION=${RELEASE_VERSION#v}" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_TAG=$(git describe --tags --abbrev=0)" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Run Tests'
+        if: "${{github.event.inputs.force_skip_tests != 'true'}}"
+        uses: './.github/actions/run-tests'
+        with:
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          working-directory: './release'
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          force-skip-tests: '${{ github.event.inputs.force_skip_tests }}'
+          release-version: '${{ steps.release_info.outputs.RELEASE_VERSION }}'
+          release-tag: '${{ github.event.inputs.version }}'
+          npm-tag: '${{ github.event.inputs.npm_channel }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          wombat-token-a2a-server: '${{ secrets.WOMBAT_TOKEN_A2A_SERVER }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          github-release-token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ steps.release_info.outputs.PREVIOUS_TAG }}'
+          skip-github-release: '${{ github.event.inputs.skip_github_release }}'
+          working-directory: './release'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          npm-registry-publish-url: '${{ vars.NPM_REGISTRY_PUBLISH_URL }}'
+          npm-registry-url: '${{ vars.NPM_REGISTRY_URL }}'
+          npm-registry-scope: '${{ vars.NPM_REGISTRY_SCOPE }}'
+          cli-package-name: '${{ vars.CLI_PACKAGE_NAME }}'
+          core-package-name: '${{ vars.CORE_PACKAGE_NAME }}'
+          a2a-package-name: '${{ vars.A2A_PACKAGE_NAME }}'
+
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry_run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: '${{ github.event.inputs.version }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Manual Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')' \
+            --body 'The manual release workflow failed. See the full run for details: ${DETAILS_URL}' \
+            --label 'release-failure,priority/p0'

.github/workflows/release-nightly.yml

@@ -0,0 +1,162 @@
+name: 'Release: Nightly'
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
+        required: true
+        type: 'boolean'
+        default: true
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: true
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      environment:
+        description: 'Environment'
+        required: false
+        type: 'choice'
+        options:
+          - 'prod'
+          - 'dev'
+        default: 'prod'
+
+jobs:
+  release:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+      pull-requests: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          fetch-depth: 0
+
+      - name: 'Checkout Release Code'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          path: 'release'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: './release/.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        working-directory: './release'
+        run: 'npm ci'
+
+      - name: 'Print Inputs'
+        shell: 'bash'
+        env:
+          JSON_INPUTS: '${{ toJSON(github.event.inputs) }}'
+        run: 'echo "$JSON_INPUTS"'
+
+      - name: 'Calculate Release Variables'
+        id: 'vars'
+        uses: './.github/actions/calculate-vars'
+        with:
+          dry_run: '${{ github.event.inputs.dry_run }}'
+
+      - name: 'Print Calculated vars'
+        shell: 'bash'
+        env:
+          JSON_VARS: '${{ toJSON(steps.vars.outputs) }}'
+        run: 'echo "$JSON_VARS"'
+
+      - name: 'Run Tests'
+        if: "${{ github.event_name == 'schedule' || github.event.inputs.force_skip_tests == 'false' }}"
+        uses: './.github/actions/run-tests'
+        with:
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          working-directory: './release'
+
+      - name: 'Get Nightly Version'
+        id: 'nightly_version'
+        working-directory: './release'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          # Calculate the version using the centralized script
+          VERSION_JSON=$(node scripts/get-release-version.js --type=nightly)
+
+          # Extract values for logging and outputs
+          RELEASE_TAG=$(echo "${VERSION_JSON}" | jq -r .releaseTag)
+          RELEASE_VERSION=$(echo "${VERSION_JSON}" | jq -r .releaseVersion)
+          NPM_TAG=$(echo "${VERSION_JSON}" | jq -r .npmTag)
+          PREVIOUS_TAG=$(echo "${VERSION_JSON}" | jq -r .previousReleaseTag)
+
+          # Print calculated values for logging
+          echo "Calculated Release Tag: ${RELEASE_TAG}"
+          echo "Calculated Release Version: ${RELEASE_VERSION}"
+          echo "Calculated Previous Tag: ${PREVIOUS_TAG}"
+
+          # Set outputs for subsequent steps
+          echo "RELEASE_TAG=${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> "${GITHUB_OUTPUT}"
+          echo "NPM_TAG=${NPM_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_TAG=${PREVIOUS_TAG}" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Publish Release'
+        if: true
+        uses: './.github/actions/publish-release'
+        with:
+          release-version: '${{ steps.nightly_version.outputs.RELEASE_VERSION }}'
+          release-tag: '${{ steps.nightly_version.outputs.RELEASE_TAG }}'
+          npm-tag: '${{ steps.nightly_version.outputs.NPM_TAG }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          wombat-token-a2a-server: '${{ secrets.WOMBAT_TOKEN_A2A_SERVER }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          github-release-token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          dry-run: '${{ steps.vars.outputs.is_dry_run }}'
+          previous-tag: '${{ steps.nightly_version.outputs.PREVIOUS_TAG }}'
+          working-directory: './release'
+          skip-branch-cleanup: true
+          force-skip-tests: "${{ github.event_name != 'schedule' && github.event.inputs.force_skip_tests == 'true' }}"
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          npm-registry-publish-url: '${{ vars.NPM_REGISTRY_PUBLISH_URL }}'
+          npm-registry-url: '${{ vars.NPM_REGISTRY_URL }}'
+          npm-registry-scope: '${{ vars.NPM_REGISTRY_SCOPE }}'
+          cli-package-name: '${{ vars.CLI_PACKAGE_NAME }}'
+          core-package-name: '${{ vars.CORE_PACKAGE_NAME }}'
+          a2a-package-name: '${{ vars.A2A_PACKAGE_NAME }}'
+
+      - name: 'Create and Merge Pull Request'
+        if: "github.event.inputs.environment != 'dev'"
+        uses: './.github/actions/create-pull-request'
+        with:
+          branch-name: 'release/${{ steps.nightly_version.outputs.RELEASE_TAG }}'
+          pr-title: 'chore/release: bump version to ${{ steps.nightly_version.outputs.RELEASE_VERSION }}'
+          pr-body: 'Automated version bump for nightly release.'
+          github-token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          dry-run: '${{ steps.vars.outputs.is_dry_run }}'
+          working-directory: './release'
+
+      - name: 'Create Issue on Failure'
+        if: "${{ failure() && github.event.inputs.environment != 'dev' && (github.event_name == 'schedule' || github.event.inputs.dry_run != 'true') }}"
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: '${{ steps.nightly_version.outputs.RELEASE_TAG }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title "Nightly Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')" \
+            --body "The nightly-release workflow failed. See the full run for details: ${DETAILS_URL}" \
+            --label 'release-failure,priority/p0'

.github/workflows/release-notes.yml

@@ -0,0 +1,103 @@
+# This workflow is triggered on every new release.
+# It uses Gemini to generate release notes and creates a PR with the changes.
+name: 'Generate Release Notes'
+
+on:
+  release:
+    types: ['published']
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'New version (e.g., v1.2.3)'
+        required: true
+        type: 'string'
+      body:
+        description: 'Release notes body'
+        required: true
+        type: 'string'
+      time:
+        description: 'Release time'
+        required: true
+        type: 'string'
+
+jobs:
+  generate-release-notes:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+    steps:
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@v4'
+        with:
+          # The user-level skills need to be available to the workflow
+          fetch-depth: 0
+          ref: 'main'
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@v4'
+        with:
+          node-version: '20'
+
+      - name: 'Get release information'
+        id: 'release_info'
+        run: |
+          VERSION="${{ github.event.inputs.version || github.event.release.tag_name }}"
+          TIME="${{ github.event.inputs.time || github.event.release.created_at }}"
+
+          echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "TIME=${TIME}" >> "$GITHUB_OUTPUT"
+
+          # Use a heredoc to preserve multiline release body
+          echo 'RAW_CHANGELOG<<EOF' >> "$GITHUB_OUTPUT"
+          printf "%s\n" "$BODY" >> "$GITHUB_OUTPUT"
+          echo 'EOF' >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          BODY: '${{ github.event.inputs.body || github.event.release.body }}'
+
+      - name: 'Validate version'
+        id: 'validate_version'
+        run: |
+          if echo "${{ steps.release_info.outputs.VERSION }}" | grep -q "nightly"; then
+            echo "Nightly release detected. Stopping workflow."
+            echo "CONTINUE=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "CONTINUE=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: 'Generate Changelog with Gemini'
+        if: "steps.validate_version.outputs.CONTINUE == 'true'"
+        uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
+        with:
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          prompt: |
+            Activate the 'docs-changelog' skill.
+
+            **Release Information:**
+            - New Version: ${{ steps.release_info.outputs.VERSION }}
+            - Release Date: ${{ steps.release_info.outputs.TIME }}
+            - Raw Changelog Data: ${{ steps.release_info.outputs.RAW_CHANGELOG }}
+
+            Execute the release notes generation process using the information provided.
+
+            When you are done, please output your thought process and the steps you took for future debugging purposes.
+
+      - name: 'Create Pull Request'
+        if: "steps.validate_version.outputs.CONTINUE == 'true'"
+        uses: 'peter-evans/create-pull-request@v6'
+        with:
+          token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          commit-message: 'docs(changelog): update for ${{ steps.release_info.outputs.VERSION }}'
+          title: 'Changelog for ${{ steps.release_info.outputs.VERSION }}'
+          body: |
+            This PR contains the auto-generated changelog for the ${{ steps.release_info.outputs.VERSION }} release.
+
+            Please review and merge.
+
+            Related to #18505
+          branch: 'changelog-${{ steps.release_info.outputs.VERSION }}'
+          base: 'main'
+          team-reviewers: 'gemini-cli-docs, gemini-cli-maintainers'
+          delete-branch: true

.github/workflows/release-patch-0-from-comment.yml

@@ -0,0 +1,196 @@
+name: 'Release: Patch (0) from Comment'
+
+on:
+  issue_comment:
+    types: ['created']
+
+jobs:
+  slash-command:
+    runs-on: 'ubuntu-latest'
+    # Only run if the comment is from a human user (not automated)
+    if: "github.event.comment.user.type == 'User' && github.event.comment.user.login != 'github-actions[bot]'"
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+      actions: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          fetch-depth: 1
+
+      - name: 'Slash Command Dispatch'
+        id: 'slash_command'
+        uses: 'peter-evans/slash-command-dispatch@40877f718dce0101edfc7aea2b3800cc192f9ed5'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          commands: 'patch'
+          permission: 'write'
+          issue-type: 'pull-request'
+
+      - name: 'Get PR Status'
+        id: 'pr_status'
+        if: "startsWith(github.event.comment.body, '/patch')"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          gh pr view "${{ github.event.issue.number }}" --json mergeCommit,state > pr_status.json
+          echo "MERGE_COMMIT_SHA=$(jq -r .mergeCommit.oid pr_status.json)" >> "$GITHUB_OUTPUT"
+          echo "STATE=$(jq -r .state pr_status.json)" >> "$GITHUB_OUTPUT"
+
+      - name: 'Dispatch if Merged'
+        if: "steps.pr_status.outputs.STATE == 'MERGED'"
+        id: 'dispatch_patch'
+        uses: 'actions/github-script@00f12e3e20659f42342b1c0226afda7f7c042325'
+        env:
+          COMMENT_BODY: '${{ github.event.comment.body }}'
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          script: |
+            // Parse the comment body directly to extract channel(s)
+            const commentBody = process.env.COMMENT_BODY;
+            console.log('Comment body:', commentBody);
+
+            let channels = ['stable', 'preview'];  // default to both
+
+            // Parse different formats:
+            // /patch (defaults to both)
+            // /patch both
+            // /patch stable
+            // /patch preview
+            if (commentBody.trim() === '/patch' || commentBody.trim() === '/patch both') {
+              channels = ['stable', 'preview'];
+            } else if (commentBody.trim() === '/patch stable') {
+              channels = ['stable'];
+            } else if (commentBody.trim() === '/patch preview') {
+              channels = ['preview'];
+            } else {
+              // Fallback parsing for legacy formats
+              if (commentBody.includes('channel=preview')) {
+                channels = ['preview'];
+              } else if (commentBody.includes('--channel preview')) {
+                channels = ['preview'];
+              }
+            }
+
+            console.log('Detected channels:', channels);
+
+            const dispatchedRuns = [];
+
+            // Dispatch workflow for each channel
+            for (const channel of channels) {
+              console.log(`Dispatching workflow for channel: ${channel}`);
+
+              const response = await github.rest.actions.createWorkflowDispatch({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'release-patch-1-create-pr.yml',
+                ref: 'main',
+                inputs: {
+                  commit: '${{ steps.pr_status.outputs.MERGE_COMMIT_SHA }}',
+                  channel: channel,
+                  original_pr: '${{ github.event.issue.number }}',
+                  environment: 'prod'
+                }
+              });
+
+              dispatchedRuns.push({ channel, response });
+            }
+
+            // Wait a moment for the workflows to be created
+            await new Promise(resolve => setTimeout(resolve, 3000));
+
+            const runs = await github.rest.actions.listWorkflowRuns({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release-patch-1-create-pr.yml',
+              per_page: 20  // Increased to handle multiple runs
+            });
+
+            // Find the recent runs that match our trigger
+            const recentRuns = runs.data.workflow_runs.filter(run =>
+              run.event === 'workflow_dispatch' &&
+              new Date(run.created_at) > new Date(Date.now() - 15000) // Within last 15 seconds
+            ).slice(0, channels.length); // Limit to the number of channels we dispatched
+
+            // Set outputs
+            core.setOutput('dispatched_channels', channels.join(','));
+            core.setOutput('dispatched_run_count', channels.length.toString());
+
+            if (recentRuns.length > 0) {
+              core.setOutput('dispatched_run_urls', recentRuns.map(r => r.html_url).join(','));
+              core.setOutput('dispatched_run_ids', recentRuns.map(r => r.id).join(','));
+
+              const markdownLinks = recentRuns.map(r => `- [View dispatched workflow run](${r.html_url})`).join('\n');
+              core.setOutput('dispatched_run_links', markdownLinks);
+            }
+
+      - name: 'Comment on Failure'
+        if: "startsWith(github.event.comment.body, '/patch') && steps.pr_status.outputs.STATE != 'MERGED'"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            :x: The `/patch` command failed. This pull request must be merged before a patch can be created.
+
+      - name: 'Final Status Comment - Success'
+        if: "always() && startsWith(github.event.comment.body, '/patch') && steps.dispatch_patch.outcome == 'success' && steps.dispatch_patch.outputs.dispatched_run_urls"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            🚀 **[Step 1/4] Patch workflow(s) waiting for approval!**
+
+            **📋 Details:**
+            - **Channels**: `${{ steps.dispatch_patch.outputs.dispatched_channels }}`
+            - **Commit**: `${{ steps.pr_status.outputs.MERGE_COMMIT_SHA }}`
+            - **Workflows Created**: ${{ steps.dispatch_patch.outputs.dispatched_run_count }}
+
+            **⏳ Status:** The patch creation workflow has been triggered and is waiting for deployment approval. Please visit the specific workflow links below and approve the runs.
+
+            **🔗 Track Progress:**
+            ${{ steps.dispatch_patch.outputs.dispatched_run_links }}
+            - [View patch workflow history](https://github.com/${{ github.repository }}/actions/workflows/release-patch-1-create-pr.yml)
+            - [This trigger workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+
+      - name: 'Final Status Comment - Dispatch Success (No URL)'
+        if: "always() && startsWith(github.event.comment.body, '/patch') && steps.dispatch_patch.outcome == 'success' && !steps.dispatch_patch.outputs.dispatched_run_urls"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            🚀 **[Step 1/4] Patch workflow(s) waiting for approval!**
+
+            **📋 Details:**
+            - **Channels**: `${{ steps.dispatch_patch.outputs.dispatched_channels }}`
+            - **Commit**: `${{ steps.pr_status.outputs.MERGE_COMMIT_SHA }}`
+            - **Workflows Created**: ${{ steps.dispatch_patch.outputs.dispatched_run_count }}
+
+            **⏳ Status:** The patch creation workflow has been triggered and is waiting for deployment approval. Please visit the workflow history link below and approve the runs.
+
+            **🔗 Track Progress:**
+            - [View patch workflow history](https://github.com/${{ github.repository }}/actions/workflows/release-patch-1-create-pr.yml)
+            - [This trigger workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+
+      - name: 'Final Status Comment - Failure'
+        if: "always() && startsWith(github.event.comment.body, '/patch') && (steps.dispatch_patch.outcome == 'failure' || steps.dispatch_patch.outcome == 'cancelled')"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            ❌ **[Step 1/4] Patch workflow dispatch failed!**
+
+            There was an error dispatching the patch creation workflow.
+
+            **🔍 Troubleshooting:**
+            - Check that the PR is properly merged
+            - Verify workflow permissions
+            - Review error logs in the workflow run
+
+            **🔗 Debug Links:**
+            - [This workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+            - [Patch workflow history](https://github.com/${{ github.repository }}/actions/workflows/release-patch-1-create-pr.yml)

.github/workflows/release-patch-1-create-pr.yml

@@ -0,0 +1,134 @@
+name: 'Release: Patch (1) Create PR'
+
+run-name: >-
+  Release Patch (1) Create PR | S:${{ inputs.channel }} | C:${{ inputs.commit }} ${{ inputs.original_pr && format('| PR:#{0}', inputs.original_pr) || '' }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: 'The commit SHA to cherry-pick for the patch.'
+        required: true
+        type: 'string'
+      channel:
+        description: 'The release channel to patch.'
+        required: true
+        type: 'choice'
+        options:
+          - 'stable'
+          - 'preview'
+      dry_run:
+        description: 'Whether to run in dry-run mode.'
+        required: false
+        type: 'boolean'
+        default: false
+      ref:
+        description: 'The branch, tag, or SHA to test from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      original_pr:
+        description: 'The original PR number to comment back on.'
+        required: false
+        type: 'string'
+      environment:
+        description: 'Environment'
+        required: false
+        type: 'choice'
+        options:
+          - 'prod'
+          - 'dev'
+        default: 'prod'
+
+jobs:
+  create-patch:
+    runs-on: 'ubuntu-latest'
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+      actions: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'configure .npmrc'
+        uses: './.github/actions/setup-npmrc'
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+
+      - name: 'Install Script Dependencies'
+        run: 'npm ci'
+
+      - name: 'Configure Git User'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          REPOSITORY: '${{ github.repository }}'
+        run: |-
+          git config user.name "gemini-cli-robot"
+          git config user.email "gemini-cli-robot@google.com"
+          # Configure git to use GITHUB_TOKEN for remote operations (has actions:write for workflow files)
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPOSITORY}.git"
+
+      - name: 'Create Patch'
+        id: 'create_patch'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GH_TOKEN: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          CLI_PACKAGE_NAME: '${{ vars.CLI_PACKAGE_NAME }}'
+          PATCH_COMMIT: '${{ github.event.inputs.commit }}'
+          PATCH_CHANNEL: '${{ github.event.inputs.channel }}'
+          ORIGINAL_PR: '${{ github.event.inputs.original_pr }}'
+          DRY_RUN: '${{ github.event.inputs.dry_run }}'
+        continue-on-error: true
+        run: |
+          # Capture output and display it in logs using tee
+          {
+            node scripts/releasing/create-patch-pr.js \
+              --cli-package-name="${CLI_PACKAGE_NAME}" \
+              --commit="${PATCH_COMMIT}" \
+              --channel="${PATCH_CHANNEL}" \
+              --pullRequestNumber="${ORIGINAL_PR}" \
+              --dry-run="${DRY_RUN}"
+          } 2>&1 | tee >(
+            echo "LOG_CONTENT<<EOF" >> "$GITHUB_ENV"
+            cat >> "$GITHUB_ENV"
+            echo "EOF" >> "$GITHUB_ENV"
+          )
+          echo "EXIT_CODE=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
+
+      - name: 'Comment on Original PR'
+        if: 'always() && inputs.original_pr'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ORIGINAL_PR: '${{ github.event.inputs.original_pr }}'
+          EXIT_CODE: '${{ steps.create_patch.outputs.EXIT_CODE }}'
+          COMMIT: '${{ github.event.inputs.commit }}'
+          CHANNEL: '${{ github.event.inputs.channel }}'
+          REPOSITORY: '${{ github.repository }}'
+          GITHUB_RUN_ID: '${{ github.run_id }}'
+          LOG_CONTENT: '${{ env.LOG_CONTENT }}'
+          TARGET_REF: '${{ github.event.inputs.ref }}'
+          ENVIRONMENT: '${{ github.event.inputs.environment }}'
+        continue-on-error: true
+        run: |
+          git checkout "${TARGET_REF}"
+          node scripts/releasing/patch-create-comment.js
+
+      - name: 'Fail Workflow if Main Task Failed'
+        if: 'always() && steps.create_patch.outputs.EXIT_CODE != 0'
+        env:
+          EXIT_CODE: '${{ steps.create_patch.outputs.EXIT_CODE }}'
+        run: |
+          echo "Patch creation failed with exit code: ${EXIT_CODE}"
+          echo "Check the logs above and the comment posted to the original PR for details."
+          exit 1

.github/workflows/release-patch-2-trigger.yml

@@ -0,0 +1,94 @@
+name: 'Release: Patch (2) Trigger'
+
+run-name: >-
+  Release Patch (2) Trigger |
+  ${{ github.event.pull_request.number && format('PR #{0}', github.event.pull_request.number) || 'Manual' }} |
+  ${{ github.event.pull_request.head.ref || github.event.inputs.ref }}
+
+on:
+  pull_request:
+    types:
+      - 'closed'
+    branches:
+      - 'release/**'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'The head ref of the merged hotfix PR to trigger the release for (e.g. hotfix/v1.2.3/cherry-pick-abc).'
+        required: true
+        type: 'string'
+      workflow_ref:
+        description: 'The ref to checkout the workflow code from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      workflow_id:
+        description: 'The workflow to trigger. Defaults to release-patch-3-release.yml'
+        required: false
+        type: 'string'
+        default: 'release-patch-3-release.yml'
+      dry_run:
+        description: 'Whether this is a dry run.'
+        required: false
+        type: 'boolean'
+        default: false
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+      test_mode:
+        description: 'Whether or not to run in test mode'
+        required: false
+        type: 'boolean'
+        default: false
+      environment:
+        description: 'Environment'
+        required: false
+        type: 'choice'
+        options:
+          - 'prod'
+          - 'dev'
+        default: 'prod'
+
+jobs:
+  trigger-patch-release:
+    if: "(github.event_name == 'pull_request' && github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'hotfix/')) || github.event_name == 'workflow_dispatch'"
+    runs-on: 'ubuntu-latest'
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    permissions:
+      actions: 'write'
+      contents: 'write'
+      pull-requests: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: "${{ github.event.inputs.workflow_ref || 'main' }}"
+          fetch-depth: 1
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Trigger Patch Release'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          HEAD_REF: "${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.event.inputs.ref }}"
+          PR_BODY: "${{ github.event_name == 'pull_request' && github.event.pull_request.body || '' }}"
+          WORKFLOW_ID: '${{ github.event.inputs.workflow_id }}'
+          GITHUB_REPOSITORY_OWNER: '${{ github.repository_owner }}'
+          GITHUB_REPOSITORY_NAME: '${{ github.event.repository.name }}'
+          GITHUB_EVENT_NAME: '${{ github.event_name }}'
+          GITHUB_EVENT_PAYLOAD: '${{ toJSON(github.event) }}'
+          FORCE_SKIP_TESTS: '${{ github.event.inputs.force_skip_tests }}'
+          TEST_MODE: '${{ github.event.inputs.test_mode }}'
+          ENVIRONMENT: "${{ github.event.inputs.environment || 'prod' }}"
+          DRY_RUN: '${{ github.event.inputs.dry_run }}'
+        run: |
+          node scripts/releasing/patch-trigger.js --dry-run="${DRY_RUN}"

.github/workflows/release-patch-3-release.yml

@@ -0,0 +1,258 @@
+name: 'Release: Patch (3) Release'
+
+run-name: >-
+  Release Patch (3) Release | T:${{ inputs.type }} | R:${{ inputs.release_ref }} ${{ inputs.original_pr && format('| PR:#{0}', inputs.original_pr) || '' }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      type:
+        description: 'The type of release to perform.'
+        required: true
+        type: 'choice'
+        options:
+          - 'stable'
+          - 'preview'
+      dry_run:
+        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
+        required: true
+        type: 'boolean'
+        default: true
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+      release_ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: true
+        type: 'string'
+      original_pr:
+        description: 'The original PR number to comment back on.'
+        required: false
+        type: 'string'
+      environment:
+        description: 'Environment'
+        required: false
+        type: 'choice'
+        options:
+          - 'prod'
+          - 'dev'
+        default: 'prod'
+
+jobs:
+  release:
+    runs-on: 'ubuntu-latest'
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      pull-requests: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: 'Checkout Release Code'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.release_ref }}'
+          path: 'release'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'configure .npmrc'
+        uses: './.github/actions/setup-npmrc'
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+
+      - name: 'Install Script Dependencies'
+        run: |-
+          npm ci
+
+      - name: 'Install Dependencies'
+        working-directory: './release'
+        run: |-
+          npm ci
+
+      - name: 'Print Inputs'
+        shell: 'bash'
+        env:
+          JSON_INPUTS: '${{ toJSON(inputs) }}'
+        run: 'echo "$JSON_INPUTS"'
+
+      - name: 'Get Patch Version'
+        id: 'patch_version'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          PATCH_FROM: '${{ github.event.inputs.type }}'
+          CLI_PACKAGE_NAME: '${{vars.CLI_PACKAGE_NAME}}'
+        run: |
+          # Use the existing get-release-version.js script to calculate patch version
+          # Run from main checkout which has full git history and access to npm
+          PATCH_JSON=$(node scripts/get-release-version.js --type=patch --cli-package-name="${CLI_PACKAGE_NAME}" --patch-from="${PATCH_FROM}")
+          echo "Patch version calculation result: ${PATCH_JSON}"
+
+          RELEASE_VERSION=$(echo "${PATCH_JSON}" | jq -r .releaseVersion)
+          RELEASE_TAG=$(echo "${PATCH_JSON}" | jq -r .releaseTag)
+          NPM_TAG=$(echo "${PATCH_JSON}" | jq -r .npmTag)
+          PREVIOUS_TAG=$(echo "${PATCH_JSON}" | jq -r .previousReleaseTag)
+
+          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> "${GITHUB_OUTPUT}"
+          echo "RELEASE_TAG=${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "NPM_TAG=${NPM_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_TAG=${PREVIOUS_TAG}" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Verify Version Consistency'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          CHANNEL: '${{ github.event.inputs.type }}'
+          ORIGINAL_RELEASE_VERSION: '${{ steps.patch_version.outputs.RELEASE_VERSION }}'
+          ORIGINAL_RELEASE_TAG: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          ORIGINAL_PREVIOUS_TAG: '${{ steps.patch_version.outputs.PREVIOUS_TAG }}'
+          VARS_CLI_PACKAGE_NAME: '${{ vars.CLI_PACKAGE_NAME }}'
+        run: |
+          echo "🔍 Verifying no concurrent patch releases have occurred..."
+
+          # Store original calculation for comparison
+          echo "Original calculation:"
+          echo "  Release version: ${ORIGINAL_RELEASE_VERSION}"
+          echo "  Release tag: ${ORIGINAL_RELEASE_TAG}"
+          echo "  Previous tag: ${ORIGINAL_PREVIOUS_TAG}"
+
+          # Re-run the same version calculation script
+          echo "Re-calculating version to check for changes..."
+          CURRENT_PATCH_JSON=$(node scripts/get-release-version.js --cli-package-name="${VARS_CLI_PACKAGE_NAME}" --type=patch --patch-from="${CHANNEL}")
+          CURRENT_RELEASE_VERSION=$(echo "${CURRENT_PATCH_JSON}" | jq -r .releaseVersion)
+          CURRENT_RELEASE_TAG=$(echo "${CURRENT_PATCH_JSON}" | jq -r .releaseTag)
+          CURRENT_PREVIOUS_TAG=$(echo "${CURRENT_PATCH_JSON}" | jq -r .previousReleaseTag)
+
+          echo "Current calculation:"
+          echo "  Release version: ${CURRENT_RELEASE_VERSION}"
+          echo "  Release tag: ${CURRENT_RELEASE_TAG}"
+          echo "  Previous tag: ${CURRENT_PREVIOUS_TAG}"
+
+          # Compare calculations
+          if [[ "${ORIGINAL_RELEASE_VERSION}" != "${CURRENT_RELEASE_VERSION}" ]] || \
+             [[ "${ORIGINAL_RELEASE_TAG}" != "${CURRENT_RELEASE_TAG}" ]] || \
+             [[ "${ORIGINAL_PREVIOUS_TAG}" != "${CURRENT_PREVIOUS_TAG}" ]]; then
+            echo "❌ RACE CONDITION DETECTED: Version calculations have changed!"
+            echo "This indicates another patch release completed while this one was in progress."
+            echo ""
+            echo "Originally planned:  ${ORIGINAL_RELEASE_VERSION} (from ${ORIGINAL_PREVIOUS_TAG})"
+            echo "Should now build:    ${CURRENT_RELEASE_VERSION} (from ${CURRENT_PREVIOUS_TAG})"
+            echo ""
+            echo "# Setting outputs for failure comment"
+            echo "CURRENT_RELEASE_VERSION=${CURRENT_RELEASE_VERSION}" >> "${GITHUB_ENV}"
+            echo "CURRENT_RELEASE_TAG=${CURRENT_RELEASE_TAG}" >> "${GITHUB_ENV}"
+            echo "CURRENT_PREVIOUS_TAG=${CURRENT_PREVIOUS_TAG}" >> "${GITHUB_ENV}"
+            echo "The patch release must be restarted to use the correct version numbers."
+            exit 1
+          fi
+
+          echo "✅ Version calculations unchanged - proceeding with release"
+
+      - name: 'Print Calculated Version'
+        run: |-
+          echo "Patch Release Summary:"
+          echo "  Release Version: ${STEPS_PATCH_VERSION_OUTPUTS_RELEASE_VERSION}"
+          echo "  Release Tag: ${STEPS_PATCH_VERSION_OUTPUTS_RELEASE_TAG}"
+          echo "  NPM Tag: ${STEPS_PATCH_VERSION_OUTPUTS_NPM_TAG}"
+          echo "  Previous Tag: ${STEPS_PATCH_VERSION_OUTPUTS_PREVIOUS_TAG}"
+        env:
+          STEPS_PATCH_VERSION_OUTPUTS_RELEASE_VERSION: '${{ steps.patch_version.outputs.RELEASE_VERSION }}'
+          STEPS_PATCH_VERSION_OUTPUTS_RELEASE_TAG: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          STEPS_PATCH_VERSION_OUTPUTS_NPM_TAG: '${{ steps.patch_version.outputs.NPM_TAG }}'
+          STEPS_PATCH_VERSION_OUTPUTS_PREVIOUS_TAG: '${{ steps.patch_version.outputs.PREVIOUS_TAG }}'
+
+      - name: 'Run Tests'
+        if: "${{github.event.inputs.force_skip_tests != 'true'}}"
+        uses: './.github/actions/run-tests'
+        with:
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          working-directory: './release'
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          release-version: '${{ steps.patch_version.outputs.RELEASE_VERSION }}'
+          release-tag: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          npm-tag: '${{ steps.patch_version.outputs.NPM_TAG }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          wombat-token-a2a-server: '${{ secrets.WOMBAT_TOKEN_A2A_SERVER }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          github-release-token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ steps.patch_version.outputs.PREVIOUS_TAG }}'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          npm-registry-publish-url: '${{ vars.NPM_REGISTRY_PUBLISH_URL }}'
+          npm-registry-url: '${{ vars.NPM_REGISTRY_URL }}'
+          npm-registry-scope: '${{ vars.NPM_REGISTRY_SCOPE }}'
+          cli-package-name: '${{ vars.CLI_PACKAGE_NAME }}'
+          core-package-name: '${{ vars.CORE_PACKAGE_NAME }}'
+          a2a-package-name: '${{ vars.A2A_PACKAGE_NAME }}'
+          working-directory: './release'
+
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry_run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Patch Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')' \
+            --body 'The patch-release workflow failed. See the full run for details: ${DETAILS_URL}' \
+            --label 'release-failure,priority/p0'
+
+      - name: 'Comment Success on Original PR'
+        if: '${{ success() && github.event.inputs.original_pr }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ORIGINAL_PR: '${{ github.event.inputs.original_pr }}'
+          SUCCESS: 'true'
+          RELEASE_VERSION: '${{ steps.patch_version.outputs.RELEASE_VERSION }}'
+          RELEASE_TAG: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          NPM_TAG: '${{ steps.patch_version.outputs.NPM_TAG }}'
+          CHANNEL: '${{ github.event.inputs.type }}'
+          DRY_RUN: '${{ github.event.inputs.dry_run }}'
+          GITHUB_RUN_ID: '${{ github.run_id }}'
+          GITHUB_REPOSITORY_OWNER: '${{ github.repository_owner }}'
+          GITHUB_REPOSITORY_NAME: '${{ github.event.repository.name }}'
+        run: |
+          node scripts/releasing/patch-comment.js
+
+      - name: 'Comment Failure on Original PR'
+        if: '${{ failure() && github.event.inputs.original_pr }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ORIGINAL_PR: '${{ github.event.inputs.original_pr }}'
+          SUCCESS: 'false'
+          RELEASE_VERSION: '${{ steps.patch_version.outputs.RELEASE_VERSION }}'
+          RELEASE_TAG: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          NPM_TAG: '${{ steps.patch_version.outputs.NPM_TAG }}'
+          CHANNEL: '${{ github.event.inputs.type }}'
+          DRY_RUN: '${{ github.event.inputs.dry_run }}'
+          GITHUB_RUN_ID: '${{ github.run_id }}'
+          GITHUB_REPOSITORY_OWNER: '${{ github.repository_owner }}'
+          GITHUB_REPOSITORY_NAME: '${{ github.event.repository.name }}'
+          # Pass current version info for race condition failures
+          CURRENT_RELEASE_VERSION: '${{ env.CURRENT_RELEASE_VERSION }}'
+          CURRENT_RELEASE_TAG: '${{ env.CURRENT_RELEASE_TAG }}'
+          CURRENT_PREVIOUS_TAG: '${{ env.CURRENT_PREVIOUS_TAG }}'
+        run: |
+          # Check if this was a version consistency failure
+          if [[ -n "${CURRENT_RELEASE_VERSION}" ]]; then
+            echo "Detected version race condition failure - posting specific comment with current version info"
+            export RACE_CONDITION_FAILURE=true
+          fi
+          node scripts/releasing/patch-comment.js

.github/workflows/release-promote.yml

@@ -0,0 +1,414 @@
+name: 'Release: Promote'
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
+        required: true
+        type: 'boolean'
+        default: true
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      stable_version_override:
+        description: 'Manually override the stable version number.'
+        required: false
+        type: 'string'
+      preview_version_override:
+        description: 'Manually override the preview version number.'
+        required: false
+        type: 'string'
+      environment:
+        description: 'Environment'
+        required: false
+        type: 'choice'
+        options:
+          - 'prod'
+          - 'dev'
+        default: 'prod'
+
+jobs:
+  calculate-versions:
+    name: 'Calculate Versions and Plan'
+    runs-on: 'ubuntu-latest'
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+
+    outputs:
+      STABLE_VERSION: '${{ steps.versions.outputs.STABLE_VERSION }}'
+      STABLE_SHA: '${{ steps.versions.outputs.STABLE_SHA }}'
+      PREVIOUS_STABLE_TAG: '${{ steps.versions.outputs.PREVIOUS_STABLE_TAG }}'
+      PREVIEW_VERSION: '${{ steps.versions.outputs.PREVIEW_VERSION }}'
+      PREVIEW_SHA: '${{ steps.versions.outputs.PREVIEW_SHA }}'
+      PREVIOUS_PREVIEW_TAG: '${{ steps.versions.outputs.PREVIOUS_PREVIEW_TAG }}'
+      NEXT_NIGHTLY_VERSION: '${{ steps.versions.outputs.NEXT_NIGHTLY_VERSION }}'
+      PREVIOUS_NIGHTLY_TAG: '${{ steps.versions.outputs.PREVIOUS_NIGHTLY_TAG }}'
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Print Inputs'
+        shell: 'bash'
+        env:
+          JSON_INPUTS: '${{ toJSON(inputs) }}'
+        run: 'echo "$JSON_INPUTS"'
+
+      - name: 'Calculate Versions and SHAs'
+        id: 'versions'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          STABLE_OVERRIDE: '${{ github.event.inputs.stable_version_override }}'
+          PREVIEW_OVERRIDE: '${{ github.event.inputs.preview_version_override }}'
+          REF_INPUT: '${{ github.event.inputs.ref }}'
+        run: |
+          set -e
+          STABLE_COMMAND="node scripts/get-release-version.js --type=stable"
+          if [[ -n "${STABLE_OVERRIDE}" ]]; then
+            STABLE_COMMAND+=" --stable_version_override=${STABLE_OVERRIDE}"
+          fi
+          PREVIEW_COMMAND="node scripts/get-release-version.js --type=preview"
+          if [[ -n "${PREVIEW_OVERRIDE}" ]]; then
+            PREVIEW_COMMAND+=" --preview_version_override=${PREVIEW_OVERRIDE}"
+          fi
+          NIGHTLY_COMMAND="node scripts/get-release-version.js --type=promote-nightly"
+          STABLE_JSON=$(${STABLE_COMMAND})
+          STABLE_VERSION=$(echo "${STABLE_JSON}" | jq -r .releaseVersion)
+          PREVIEW_COMMAND+=" --stable-base-version=${STABLE_VERSION}"
+          NIGHTLY_COMMAND+=" --stable-base-version=${STABLE_VERSION}"
+          PREVIEW_JSON=$(${PREVIEW_COMMAND})
+          NIGHTLY_JSON=$(${NIGHTLY_COMMAND})
+          echo "STABLE_JSON_COMMAND=${STABLE_COMMAND}"
+          echo "PREVIEW_JSON_COMMAND=${PREVIEW_COMMAND}"
+          echo "NIGHTLY_JSON_COMMAND=${NIGHTLY_COMMAND}"
+          echo "STABLE_JSON: ${STABLE_JSON}"
+          echo "PREVIEW_JSON: ${PREVIEW_JSON}"
+          echo "NIGHTLY_JSON: ${NIGHTLY_JSON}"
+          echo "STABLE_VERSION=${STABLE_VERSION}" >> "${GITHUB_OUTPUT}"
+          # shellcheck disable=SC1083
+          echo "STABLE_SHA=$(git rev-parse "$(echo "${PREVIEW_JSON}" | jq -r .previousReleaseTag)"^{commit})" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_STABLE_TAG=$(echo "${STABLE_JSON}" | jq -r .previousReleaseTag)" >> "${GITHUB_OUTPUT}"
+          echo "PREVIEW_VERSION=$(echo "${PREVIEW_JSON}" | jq -r .releaseVersion)" >> "${GITHUB_OUTPUT}"
+          # shellcheck disable=SC1083
+          REF="${REF_INPUT}"
+          SHA=$(git ls-remote origin "$REF" | awk -v ref="$REF" '$2 == "refs/heads/"ref || $2 == "refs/tags/"ref || $2 == ref {print $1}' | head -n 1)
+          if [ -z "$SHA" ]; then
+            if [[ "$REF" =~ ^[0-9a-f]{7,40}$ ]]; then
+              SHA="$REF"
+            else
+              echo "::error::Could not resolve ref '$REF' to a commit SHA."
+              exit 1
+            fi
+          fi
+          echo "PREVIEW_SHA=$SHA" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_PREVIEW_TAG=$(echo "${PREVIEW_JSON}" | jq -r .previousReleaseTag)" >> "${GITHUB_OUTPUT}"
+          echo "NEXT_NIGHTLY_VERSION=$(echo "${NIGHTLY_JSON}" | jq -r .releaseVersion)" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_NIGHTLY_TAG=$(echo "${NIGHTLY_JSON}" | jq -r .previousReleaseTag)" >> "${GITHUB_OUTPUT}"
+          CURRENT_NIGHTLY_TAG=$(git describe --tags --abbrev=0 --match="*nightly*")
+          echo "CURRENT_NIGHTLY_TAG=${CURRENT_NIGHTLY_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "NEXT_SHA=$SHA" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Display Pending Updates'
+        env:
+          STABLE_VERSION: '${{ steps.versions.outputs.STABLE_VERSION }}'
+          STABLE_SHA: '${{ steps.versions.outputs.STABLE_SHA }}'
+          PREVIOUS_STABLE_TAG: '${{ steps.versions.outputs.PREVIOUS_STABLE_TAG }}'
+          PREVIEW_VERSION: '${{ steps.versions.outputs.PREVIEW_VERSION }}'
+          PREVIEW_SHA: '${{ steps.versions.outputs.PREVIEW_SHA }}'
+          PREVIOUS_PREVIEW_TAG: '${{ steps.versions.outputs.PREVIOUS_PREVIEW_TAG }}'
+          NEXT_NIGHTLY_VERSION: '${{ steps.versions.outputs.NEXT_NIGHTLY_VERSION }}'
+          PREVIOUS_NIGHTLY_TAG: '${{ steps.versions.outputs.PREVIOUS_NIGHTLY_TAG }}'
+          INPUT_REF: '${{ github.event.inputs.ref }}'
+        run: |
+          echo "Release Plan:"
+          echo "-----------"
+          echo "Stable Release: ${STABLE_VERSION}"
+          echo "  - Commit: ${STABLE_SHA}"
+          echo "  - Previous Tag: ${PREVIOUS_STABLE_TAG}"
+          echo ""
+          echo "Preview Release: ${PREVIEW_VERSION}"
+          echo "  - Commit: ${PREVIEW_SHA} (${INPUT_REF})"
+          echo "  - Previous Tag: ${PREVIOUS_PREVIEW_TAG}"
+          echo ""
+          echo "Preparing Next Nightly Release: ${NEXT_NIGHTLY_VERSION}"
+          echo "  - Merging Version Update PR to Branch: ${INPUT_REF}"
+          echo "  - Previous Tag: ${PREVIOUS_NIGHTLY_TAG}"
+
+  test:
+    name: 'Test ${{ matrix.channel }}'
+    needs: 'calculate-versions'
+    runs-on: 'ubuntu-latest'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - channel: 'stable'
+            sha: '${{ needs.calculate-versions.outputs.STABLE_SHA }}'
+          - channel: 'preview'
+            sha: '${{ needs.calculate-versions.outputs.PREVIEW_SHA }}'
+          - channel: 'nightly'
+            sha: '${{ github.event.inputs.ref }}'
+    steps:
+      - name: 'Checkout Ref'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+
+      - name: 'Checkout correct SHA'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ matrix.sha }}'
+          path: 'release'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        working-directory: './release'
+        run: 'npm ci'
+
+      - name: 'Run Tests'
+        if: "${{github.event.inputs.force_skip_tests != 'true'}}"
+        uses: './.github/actions/run-tests'
+        with:
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          working-directory: './release'
+
+  publish-preview:
+    name: 'Publish preview'
+    needs: ['calculate-versions', 'test']
+    runs-on: 'ubuntu-latest'
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout Ref'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+
+      - name: 'Checkout correct SHA'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ needs.calculate-versions.outputs.PREVIEW_SHA }}'
+          path: 'release'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        working-directory: './release'
+        run: 'npm ci'
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          release-version: '${{ needs.calculate-versions.outputs.PREVIEW_VERSION }}'
+          release-tag: 'v${{ needs.calculate-versions.outputs.PREVIEW_VERSION }}'
+          npm-tag: 'preview'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          wombat-token-a2a-server: '${{ secrets.WOMBAT_TOKEN_A2A_SERVER }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          github-release-token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ needs.calculate-versions.outputs.PREVIOUS_PREVIEW_TAG }}'
+          working-directory: './release'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          force-skip-tests: '${{ github.event.inputs.force_skip_tests }}'
+          npm-registry-publish-url: '${{ vars.NPM_REGISTRY_PUBLISH_URL }}'
+          npm-registry-url: '${{ vars.NPM_REGISTRY_URL }}'
+          npm-registry-scope: '${{ vars.NPM_REGISTRY_SCOPE }}'
+          cli-package-name: '${{ vars.CLI_PACKAGE_NAME }}'
+          core-package-name: '${{ vars.CORE_PACKAGE_NAME }}'
+          a2a-package-name: '${{ vars.A2A_PACKAGE_NAME }}'
+
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry_run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: 'v${{ needs.calculate-versions.outputs.PREVIEW_VERSION }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Promote Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')' \
+            --body 'The promote-release workflow failed during preview publish. See the full run for details: ${DETAILS_URL}' \
+            --label 'release-failure,priority/p0'
+
+  publish-stable:
+    name: 'Publish stable'
+    needs: ['calculate-versions', 'test', 'publish-preview']
+    runs-on: 'ubuntu-latest'
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout Ref'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+
+      - name: 'Checkout correct SHA'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ needs.calculate-versions.outputs.STABLE_SHA }}'
+          path: 'release'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        working-directory: './release'
+        run: 'npm ci'
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          release-version: '${{ needs.calculate-versions.outputs.STABLE_VERSION }}'
+          release-tag: 'v${{ needs.calculate-versions.outputs.STABLE_VERSION }}'
+          npm-tag: 'latest'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          wombat-token-a2a-server: '${{ secrets.WOMBAT_TOKEN_A2A_SERVER }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          github-release-token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ needs.calculate-versions.outputs.PREVIOUS_STABLE_TAG }}'
+          working-directory: './release'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          force-skip-tests: '${{ github.event.inputs.force_skip_tests }}'
+          npm-registry-publish-url: '${{ vars.NPM_REGISTRY_PUBLISH_URL }}'
+          npm-registry-url: '${{ vars.NPM_REGISTRY_URL }}'
+          npm-registry-scope: '${{ vars.NPM_REGISTRY_SCOPE }}'
+          cli-package-name: '${{ vars.CLI_PACKAGE_NAME }}'
+          core-package-name: '${{ vars.CORE_PACKAGE_NAME }}'
+          a2a-package-name: '${{ vars.A2A_PACKAGE_NAME }}'
+
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry_run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: 'v${{ needs.calculate-versions.outputs.STABLE_VERSION }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Promote Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')' \
+            --body 'The promote-release workflow failed during stable publish. See the full run for details: ${DETAILS_URL}' \
+            --label 'release-failure,priority/p0'
+
+  nightly-pr:
+    name: 'Create Nightly PR'
+    needs: ['publish-stable', 'calculate-versions']
+    runs-on: 'ubuntu-latest'
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout Ref'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Configure Git User'
+        run: |-
+          git config user.name "gemini-cli-robot"
+          git config user.email "gemini-cli-robot@google.com"
+
+      - name: 'Create and switch to a new branch'
+        id: 'release_branch'
+        run: |
+          BRANCH_NAME="chore/nightly-version-bump-${NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION}"
+          git switch -c "${BRANCH_NAME}"
+          echo "BRANCH_NAME=${BRANCH_NAME}" >> "${GITHUB_OUTPUT}"
+        env:
+          NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION: '${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
+
+      - name: 'Update package versions'
+        run: 'npm run release:version "${NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION}"'
+        env:
+          NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION: '${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
+
+      - name: 'Commit and Push package versions'
+        env:
+          BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
+          DRY_RUN: '${{ github.event.inputs.dry_run }}'
+          NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION: '${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
+        run: |-
+          git add package.json packages/*/package.json
+          if [ -f package-lock.json ]; then
+            git add package-lock.json
+          fi
+          git commit -m "chore(release): bump version to ${NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION}"
+          if [[ "${DRY_RUN}" == "false" ]]; then
+            echo "Pushing release branch to remote..."
+            git push --set-upstream origin "${BRANCH_NAME}"
+          else
+            echo "Dry run enabled. Skipping push."
+          fi
+
+      - name: 'Create and Merge Pull Request'
+        uses: './.github/actions/create-pull-request'
+        with:
+          branch-name: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
+          pr-title: 'chore(release): bump version to ${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
+          pr-body: 'Automated version bump to prepare for the next nightly release.'
+          github-token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry_run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: 'v${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Promote Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')' \
+            --body 'The promote-release workflow failed during nightly PR creation. See the full run for details: ${DETAILS_URL}' \
+            --label 'release-failure,priority/p0'

.github/workflows/release-rollback.yml

@@ -0,0 +1,242 @@
+name: 'Release: Rollback change'
+
+on:
+  workflow_dispatch:
+    inputs:
+      rollback_origin:
+        description: 'The package version to rollback FROM and delete (e.g., 0.5.0-preview-2)'
+        required: true
+        type: 'string'
+      rollback_destination:
+        description: 'The package version to rollback TO (e.g., 0.5.0-preview-2). This version must already exist on the npm registry.'
+        required: false
+        type: 'string'
+      channel:
+        description: 'The npm dist-tag to apply to rollback_destination (e.g., latest, preview, nightly). REQUIRED IF rollback_destination is set.'
+        required: false
+        type: 'choice'
+        options:
+          - 'latest'
+          - 'preview'
+          - 'nightly'
+          - 'dev'
+        default: 'dev'
+      ref:
+        description: 'The branch, tag, or SHA to run from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      dry-run:
+        description: 'Whether to run in dry-run mode.'
+        required: false
+        type: 'boolean'
+        default: true
+      environment:
+        description: 'Environment'
+        required: false
+        type: 'choice'
+        options:
+          - 'prod'
+          - 'dev'
+        default: 'prod'
+
+jobs:
+  change-tags:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: 'configure .npmrc'
+        uses: './.github/actions/setup-npmrc'
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+
+      - name: 'Get Origin Version Tag'
+        id: 'origin_tag'
+        shell: 'bash'
+        env:
+          ROLLBACK_ORIGIN: '${{ github.event.inputs.rollback_origin }}'
+        run: |
+          TAG_VALUE="v${ROLLBACK_ORIGIN}"
+          echo "ORIGIN_TAG=$TAG_VALUE" >> "$GITHUB_OUTPUT"
+
+      - name: 'Get Origin Commit Hash'
+        id: 'origin_hash'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ORIGIN_TAG: '${{ steps.origin_tag.outputs.ORIGIN_TAG }}'
+        shell: 'bash'
+        run: |
+          echo "ORIGIN_HASH=$(git rev-parse "${ORIGIN_TAG}")" >> "$GITHUB_OUTPUT"
+
+      - name: 'Change tag'
+        if: "${{ github.event.inputs.rollback_destination != '' }}"
+        uses: './.github/actions/tag-npm-release'
+        with:
+          channel: '${{ github.event.inputs.channel }}'
+          version: '${{ github.event.inputs.rollback_destination }}'
+          dry-run: '${{ github.event.inputs.dry-run }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          wombat-token-a2a-server: '${{ secrets.WOMBAT_TOKEN_A2A_SERVER }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          cli-package-name: '${{ vars.CLI_PACKAGE_NAME }}'
+          core-package-name: '${{ vars.CORE_PACKAGE_NAME }}'
+          a2a-package-name: '${{ vars.A2A_PACKAGE_NAME }}'
+
+      - name: 'Get cli Token'
+        uses: './.github/actions/npm-auth-token'
+        id: 'cli-token'
+        with:
+          package-name: '${{ vars.CLI_PACKAGE_NAME }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          wombat-token-a2a-server: '${{ secrets.WOMBAT_TOKEN_A2A_SERVER }}'
+
+      - name: 'Deprecate Cli Npm Package'
+        if: "${{ github.event.inputs.dry-run == 'false' && github.event.inputs.environment == 'prod' }}"
+        env:
+          NODE_AUTH_TOKEN: '${{ steps.cli-token.outputs.auth-token }}'
+          PACKAGE_NAME: '${{ vars.CLI_PACKAGE_NAME }}'
+          ROLLBACK_ORIGIN: '${{ github.event.inputs.rollback_origin }}'
+        shell: 'bash'
+        run: |
+          npm deprecate "${PACKAGE_NAME}@${ROLLBACK_ORIGIN}" "This version has been rolled back."
+
+      - name: 'Get core Token'
+        uses: './.github/actions/npm-auth-token'
+        id: 'core-token'
+        with:
+          package-name: '${{ vars.CLI_PACKAGE_NAME }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          wombat-token-a2a-server: '${{ secrets.WOMBAT_TOKEN_A2A_SERVER }}'
+
+      - name: 'Deprecate Core Npm Package'
+        if: "${{ github.event.inputs.dry-run == 'false' && github.event.inputs.environment == 'prod' }}"
+        env:
+          NODE_AUTH_TOKEN: '${{ steps.core-token.outputs.auth-token }}'
+          PACKAGE_NAME: '${{ vars.CORE_PACKAGE_NAME }}'
+          ROLLBACK_ORIGIN: '${{ github.event.inputs.rollback_origin }}'
+        shell: 'bash'
+        run: |
+          npm deprecate "${PACKAGE_NAME}@${ROLLBACK_ORIGIN}" "This version has been rolled back."
+
+      - name: 'Get a2a Token'
+        uses: './.github/actions/npm-auth-token'
+        id: 'a2a-token'
+        with:
+          package-name: '${{ vars.A2A_PACKAGE_NAME }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          wombat-token-a2a-server: '${{ secrets.WOMBAT_TOKEN_A2A_SERVER }}'
+
+      - name: 'Deprecate A2A Server Npm Package'
+        if: "${{ github.event.inputs.dry-run == 'false' && github.event.inputs.environment == 'prod'  }}"
+        env:
+          NODE_AUTH_TOKEN: '${{ steps.a2a-token.outputs.auth-token }}'
+          PACKAGE_NAME: '${{ vars.A2A_PACKAGE_NAME }}'
+          ROLLBACK_ORIGIN: '${{ github.event.inputs.rollback_origin }}'
+        shell: 'bash'
+        run: |
+          npm deprecate "${PACKAGE_NAME}@${ROLLBACK_ORIGIN}" "This version has been rolled back."
+
+      - name: 'Delete Github Release'
+        if: "${{ github.event.inputs.dry-run == 'false' && github.event.inputs.environment == 'prod'}}"
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ORIGIN_TAG: '${{ steps.origin_tag.outputs.ORIGIN_TAG }}'
+        shell: 'bash'
+        run: |
+          gh release delete "${ORIGIN_TAG}" --yes
+
+      - name: 'Verify Origin Release Deletion'
+        if: "${{ github.event.inputs.dry-run == 'false' }}"
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          TARGET_TAG: '${{ steps.origin_tag.outputs.ORIGIN_TAG }}'
+        shell: 'bash'
+        run: |
+          RELEASE_TAG=$(gh release view "$TARGET_TAG" --json tagName --jq .tagName)
+          if [ "$RELEASE_TAG" = "$TARGET_TAG" ]; then
+            echo "❌ Failed to delete release with tag ${TARGET_TAG}"
+            echo '❌ This means the release was not deleted, and the workflow should fail.'
+            exit 1
+          fi
+
+      - name: 'Add Rollback Tag'
+        id: 'rollback_tag'
+        if: "${{ github.event.inputs.dry-run == 'false' }}"
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ROLLBACK_TAG_NAME: '${{ steps.origin_tag.outputs.ORIGIN_TAG }}-rollback'
+          ORIGIN_HASH: '${{ steps.origin_hash.outputs.ORIGIN_HASH }}'
+        shell: 'bash'
+        run: |
+          echo "ROLLBACK_TAG=$ROLLBACK_TAG_NAME" >> "$GITHUB_OUTPUT"
+          git tag "$ROLLBACK_TAG_NAME" "${ORIGIN_HASH}"
+          git push origin --tags
+
+      - name: 'Verify Rollback Tag Added'
+        if: "${{ github.event.inputs.dry-run == 'false' }}"
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          TARGET_TAG: '${{ steps.rollback_tag.outputs.ROLLBACK_TAG }}'
+          TARGET_HASH: '${{ steps.origin_hash.outputs.ORIGIN_HASH }}'
+        shell: 'bash'
+        run: |
+          ROLLBACK_COMMIT=$(git rev-parse -q --verify "$TARGET_TAG")
+          if [ "$ROLLBACK_COMMIT" != "$TARGET_HASH" ]; then
+            echo "❌ Failed to add tag ${TARGET_TAG} to commit ${TARGET_HASH}"
+            echo '❌ This means the tag was not added, and the workflow should fail.'
+            exit 1
+          fi
+
+      - name: 'Log Dry run'
+        if: "${{ github.event.inputs.dry-run == 'true' }}"
+        env:
+          ROLLBACK_ORIGIN: '${{ github.event.inputs.rollback_origin }}'
+          ROLLBACK_DESTINATION: '${{ github.event.inputs.rollback_destination }}'
+          CHANNEL: '${{ github.event.inputs.channel }}'
+          REF_INPUT: '${{ github.event.inputs.ref }}'
+          ORIGIN_TAG: '${{ steps.origin_tag.outputs.ORIGIN_TAG }}'
+          ORIGIN_HASH: '${{ steps.origin_hash.outputs.ORIGIN_HASH }}'
+          ROLLBACK_TAG: '${{ steps.rollback_tag.outputs.ROLLBACK_TAG }}'
+          CLI_PACKAGE_NAME: '${{ vars.CLI_PACKAGE_NAME }}'
+          CORE_PACKAGE_NAME: '${{ vars.CORE_PACKAGE_NAME }}'
+          A2A_PACKAGE_NAME: '${{ vars.A2A_PACKAGE_NAME }}'
+        shell: 'bash'
+        run: |
+          echo "
+          Inputs:
+          - rollback_origin: '${ROLLBACK_ORIGIN}'
+          - rollback_destination: '${ROLLBACK_DESTINATION}'
+          - channel: '${CHANNEL}'
+          - ref: '${REF_INPUT}'
+
+          Outputs:
+          - ORIGIN_TAG: '${ORIGIN_TAG}'
+          - ORIGIN_HASH: '${ORIGIN_HASH}'
+          - ROLLBACK_TAG: '${ROLLBACK_TAG}'
+
+          Would have npm deprecate ${CLI_PACKAGE_NAME}@${ROLLBACK_ORIGIN}, ${CORE_PACKAGE_NAME}@${ROLLBACK_ORIGIN}, and ${A2A_PACKAGE_NAME}@${ROLLBACK_ORIGIN}
+          Would have deleted the github release with tag ${ORIGIN_TAG}
+          Would have added tag ${ORIGIN_TAG}-rollback to ${ORIGIN_HASH}
+          "

.github/workflows/release-sandbox.yml

@@ -0,0 +1,50 @@
+name: 'Release Sandbox'
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      dry-run:
+        description: 'Whether this is a dry run.'
+        required: false
+        type: 'boolean'
+        default: true
+
+jobs:
+  build:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'read'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref || github.sha }}'
+          fetch-depth: 0
+      - name: 'Push'
+        uses: './.github/actions/push-sandbox'
+        with:
+          dockerhub-username: '${{ secrets.DOCKER_SERVICE_ACCOUNT_NAME }}'
+          dockerhub-token: '${{ secrets.DOCKER_SERVICE_ACCOUNT_KEY }}'
+          github-actor: '${{ github.actor }}'
+          github-secret: '${{ secrets.GITHUB_TOKEN }}'
+          github-sha: '${{ github.sha }}'
+          github-ref-name: '${{github.event.inputs.ref}}'
+          dry-run: '${{ github.event.inputs.dry-run }}'
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry-run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Sandbox Release Failed on $(date +'%Y-%m-%d')' \
+            --body 'The sandbox-release workflow failed. See the full run for details: ${DETAILS_URL}' \
+            --label 'release-failure,priority/p0'

.github/workflows/release.yml

@@ -1,231 +0,0 @@
-name: 'Release'
-
-on:
-  schedule:
-    # Runs every day at midnight UTC for the nightly release.
-    - cron: '0 0 * * *'
-    # Runs every Tuesday at 23:59 UTC for the preview release.
-    - cron: '59 23 * * 2'
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'The version to release (e.g., v0.1.11). Required for manual patch releases.'
-        required: false # Not required for scheduled runs
-        type: 'string'
-      ref:
-        description: 'The branch or ref (full git sha) to release from.'
-        required: true
-        type: 'string'
-        default: 'main'
-      dry_run:
-        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
-        required: true
-        type: 'boolean'
-        default: true
-      create_nightly_release:
-        description: 'Auto apply the nightly release tag, input version is ignored.'
-        required: false
-        type: 'boolean'
-        default: false
-      create_preview_release:
-        description: 'Auto apply the preview release tag, input version is ignored.'
-        required: false
-        type: 'boolean'
-        default: false
-      force_skip_tests:
-        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
-        required: false
-        type: 'boolean'
-        default: false
-
-jobs:
-  release:
-    runs-on: 'ubuntu-latest'
-    environment:
-      name: 'production-release'
-      url: '${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ steps.version.outputs.RELEASE_TAG }}'
-    if: |-
-      ${{ github.repository == 'google-gemini/gemini-cli' }}
-    permissions:
-      contents: 'write'
-      packages: 'write'
-      id-token: 'write'
-      issues: 'write' # For creating issues on failure
-    outputs:
-      RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          ref: '${{ github.event.inputs.ref || github.sha }}'
-          fetch-depth: 0
-
-      - name: 'Set booleans for simplified logic'
-        env:
-          CREATE_NIGHTLY_RELEASE: '${{ github.event.inputs.create_nightly_release }}'
-          CREATE_PREVIEW_RELEASE: '${{ github.event.inputs.create_preview_release }}'
-          EVENT_NAME: '${{ github.event_name }}'
-          CRON: '${{ github.event.schedule }}'
-          DRY_RUN_INPUT: '${{ github.event.inputs.dry_run }}'
-        id: 'vars'
-        run: |-
-          is_nightly="false"
-          if [[ "${CRON}" == "0 0 * * *" || "${CREATE_NIGHTLY_RELEASE}" == "true" ]]; then
-            is_nightly="true"
-          fi
-          echo "is_nightly=${is_nightly}" >> "${GITHUB_OUTPUT}"
-
-          is_preview="false"
-          if [[ "${CRON}" == "59 23 * * 2" || "${CREATE_PREVIEW_RELEASE}" == "true" ]]; then
-            is_preview="true"
-          fi
-          echo "is_preview=${is_preview}" >> "${GITHUB_OUTPUT}"
-
-          is_dry_run="false"
-          if [[ "${DRY_RUN_INPUT}" == "true" ]]; then
-            is_dry_run="true"
-          fi
-          echo "is_dry_run=${is_dry_run}" >> "${GITHUB_OUTPUT}"
-
-      - name: 'Setup Node.js'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
-        with:
-          node-version-file: '.nvmrc'
-          cache: 'npm'
-
-      - name: 'Install Dependencies'
-        run: |-
-          npm ci
-
-      - name: 'Get the version'
-        id: 'version'
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          IS_NIGHTLY: '${{ steps.vars.outputs.is_nightly }}'
-          IS_PREVIEW: '${{ steps.vars.outputs.is_preview }}'
-          MANUAL_VERSION: '${{ inputs.version }}'
-        run: |-
-          VERSION_JSON="$(node scripts/get-release-version.js)"
-          echo "RELEASE_TAG=$(echo "${VERSION_JSON}" | jq -r .releaseTag)" >> "${GITHUB_OUTPUT}"
-          echo "RELEASE_VERSION=$(echo "${VERSION_JSON}" | jq -r .releaseVersion)" >> "${GITHUB_OUTPUT}"
-          echo "NPM_TAG=$(echo "${VERSION_JSON}" | jq -r .npmTag)" >> "${GITHUB_OUTPUT}"
-          echo "PREVIOUS_TAG=$(echo "${VERSION_JSON}" | jq -r .previousReleaseTag)" >> "${GITHUB_OUTPUT}"
-
-      - name: 'Run Tests'
-        if: |-
-          ${{ github.event.inputs.force_skip_tests != 'true' }}
-        env:
-          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-        run: |-
-          npm run preflight
-          npm run test:integration:sandbox:none
-          npm run test:integration:sandbox:docker
-
-      - name: 'Configure Git User'
-        run: |-
-          git config user.name "gemini-cli-robot"
-          git config user.email "gemini-cli-robot@google.com"
-
-      - name: 'Create and switch to a release branch'
-        id: 'release_branch'
-        env:
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-        run: |-
-          BRANCH_NAME="release/${RELEASE_TAG}"
-          git switch -c "${BRANCH_NAME}"
-          echo "BRANCH_NAME=${BRANCH_NAME}" >> "${GITHUB_OUTPUT}"
-
-      - name: 'Update package versions'
-        env:
-          RELEASE_VERSION: '${{ steps.version.outputs.RELEASE_VERSION }}'
-        run: |-
-          npm run release:version "${RELEASE_VERSION}"
-
-      - name: 'Commit and Conditionally Push package versions'
-        env:
-          BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
-          IS_DRY_RUN: '${{ steps.vars.outputs.is_dry_run }}'
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-        run: |-
-          git add package.json package-lock.json packages/*/package.json
-          git commit -m "chore(release): ${RELEASE_TAG}"
-          if [[ "${IS_DRY_RUN}" == "false" ]]; then
-            echo "Pushing release branch to remote..."
-            git push --set-upstream origin "${BRANCH_NAME}" --follow-tags
-          else
-            echo "Dry run enabled. Skipping push."
-          fi
-
-      - name: 'Build and Prepare Packages'
-        run: |-
-          npm run build:packages
-          npm run prepare:package
-
-      - name: 'Configure npm for publishing'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
-        with:
-          node-version-file: '.nvmrc'
-          registry-url: 'https://wombat-dressing-room.appspot.com'
-          scope: '@google'
-
-      - name: 'Publish @google/gemini-cli-core'
-        env:
-          IS_DRY_RUN: '${{ steps.vars.outputs.is_dry_run }}'
-          NODE_AUTH_TOKEN: '${{ secrets.WOMBAT_TOKEN_CORE }}'
-          NPM_TAG: '${{ steps.version.outputs.NPM_TAG }}'
-        run: |-
-          npm publish \
-            --dry-run="${IS_DRY_RUN}" \
-            --workspace="@google/gemini-cli-core" \
-            --tag="${NPM_TAG}"
-
-      - name: 'Install latest core package'
-        if: |-
-          ${{ steps.vars.outputs.is_dry_run == 'false' }}
-        env:
-          RELEASE_VERSION: '${{ steps.version.outputs.RELEASE_VERSION }}'
-        run: |-
-          npm install "@google/gemini-cli-core@${RELEASE_VERSION}" \
-          --workspace="@google/gemini-cli" \
-          --save-exact
-
-      - name: 'Publish @google/gemini-cli'
-        env:
-          IS_DRY_RUN: '${{ steps.vars.outputs.is_dry_run }}'
-          NODE_AUTH_TOKEN: '${{ secrets.WOMBAT_TOKEN_CLI }}'
-          NPM_TAG: '${{ steps.version.outputs.NPM_TAG }}'
-        run: |-
-          npm publish \
-            --dry-run="${IS_DRY_RUN}" \
-            --workspace="@google/gemini-cli" \
-            --tag="${NPM_TAG}"
-
-      - name: 'Create GitHub Release and Tag'
-        if: |-
-          ${{ steps.vars.outputs.is_dry_run == 'false' }}
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          RELEASE_BRANCH: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-          PREVIOUS_TAG: '${{ steps.version.outputs.PREVIOUS_TAG }}'
-        run: |-
-          gh release create "${RELEASE_TAG}" \
-            bundle/gemini.js \
-            --target "$RELEASE_BRANCH" \
-            --title "Release ${RELEASE_TAG}" \
-            --notes-start-tag "$PREVIOUS_TAG" \
-            --generate-notes
-
-      - name: 'Create Issue on Failure'
-        if: |-
-          ${{ failure() }}
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }} || "N/A"'
-          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
-        run: |-
-          gh issue create \
-            --title "Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')" \
-            --body "The release workflow failed. See the full run for details: ${DETAILS_URL}" \
-            --label "kind/bug,release-failure,priority/p0"

.github/workflows/smoke-test.yml

@@ -0,0 +1,51 @@
+name: 'On Merge Smoke Test'
+
+on:
+  push:
+    branches:
+      - 'main'
+      - 'release/**'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'The branch, tag, or SHA to test on.'
+        required: false
+        type: 'string'
+        default: 'main'
+      dry-run:
+        description: 'Run a dry-run of the smoke test; No bug will be created'
+        required: true
+        type: 'boolean'
+        default: true
+
+jobs:
+  smoke-test:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref || github.sha }}'
+          fetch-depth: 0
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+      - name: 'Build bundle'
+        run: 'npm run bundle'
+      - name: 'Smoke test bundle'
+        run: 'node ./bundle/gemini.js --version'
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry-run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+          REF: '${{ github.event.inputs.ref }}'
+        run: |
+          gh issue create \
+            --title 'Smoke test failed on ${REF} @ $(date +'%Y-%m-%d')' \
+            --body 'Smoke test build failed. See the full run for details: ${DETAILS_URL}' \
+            --label 'priority/p0'

.github/workflows/stale.yml

@@ -8,7 +8,12 @@ on:
 
 jobs:
   stale:
-    runs-on: 'ubuntu-latest'
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - 'ubuntu-latest' # GitHub-hosted
+    runs-on: '${{ matrix.runner }}'
     if: |-
       ${{ github.repository == 'google-gemini/gemini-cli' }}
     permissions:
@@ -35,5 +40,5 @@ jobs:
             If this is still relevant, you are welcome to reopen or leave a comment. Thanks for contributing!
           days-before-stale: 60
           days-before-close: 14
-          exempt-issue-labels: 'pinned,security'
-          exempt-pr-labels: 'pinned,security'
+          exempt-issue-labels: 'pinned,security,🔒 maintainer only,help wanted,🗓️ Public Roadmap'
+          exempt-pr-labels: 'pinned,security,🔒 maintainer only,help wanted,🗓️ Public Roadmap'

.github/workflows/test-build-binary.yml

@@ -0,0 +1,160 @@
+name: 'Test Build Binary'
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: 'read'
+
+defaults:
+  run:
+    shell: 'bash'
+
+jobs:
+  build-node-binary:
+    name: 'Build Binary (${{ matrix.os }})'
+    runs-on: '${{ matrix.os }}'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: 'ubuntu-latest'
+            platform_name: 'linux-x64'
+            arch: 'x64'
+          - os: 'windows-latest'
+            platform_name: 'win32-x64'
+            arch: 'x64'
+          - os: 'macos-latest' # Apple Silicon (ARM64)
+            platform_name: 'darwin-arm64'
+            arch: 'arm64'
+          - os: 'macos-latest' # Intel (x64) running on ARM via Rosetta
+            platform_name: 'darwin-x64'
+            arch: 'x64'
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@v4'
+
+      - name: 'Optimize Windows Performance'
+        if: "matrix.os == 'windows-latest'"
+        run: |
+          Set-MpPreference -DisableRealtimeMonitoring $true
+          Stop-Service -Name "wsearch" -Force -ErrorAction SilentlyContinue
+          Set-Service -Name "wsearch" -StartupType Disabled
+          Stop-Service -Name "SysMain" -Force -ErrorAction SilentlyContinue
+          Set-Service -Name "SysMain" -StartupType Disabled
+        shell: 'powershell'
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@v4'
+        with:
+          node-version-file: '.nvmrc'
+          architecture: '${{ matrix.arch }}'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Check Secrets'
+        id: 'check_secrets'
+        run: |
+          echo "has_win_cert=${{ secrets.WINDOWS_PFX_BASE64 != '' }}" >> "$GITHUB_OUTPUT"
+          echo "has_mac_cert=${{ secrets.MACOS_CERT_P12_BASE64 != '' }}" >> "$GITHUB_OUTPUT"
+
+      - name: 'Setup Windows SDK (Windows)'
+        if: "matrix.os == 'windows-latest'"
+        uses: 'microsoft/setup-msbuild@v2'
+
+      - name: 'Add Signtool to Path (Windows)'
+        if: "matrix.os == 'windows-latest'"
+        run: |
+          $signtoolPath = Get-ChildItem -Path "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Filter "signtool.exe" | Sort-Object FullName -Descending | Select-Object -First 1 -ExpandProperty DirectoryName
+          echo "Found signtool at: $signtoolPath"
+          echo "$signtoolPath" >> $env:GITHUB_PATH
+        shell: 'pwsh'
+
+      - name: 'Setup macOS Keychain'
+        if: "startsWith(matrix.os, 'macos') && steps.check_secrets.outputs.has_mac_cert == 'true' && github.event_name != 'pull_request'"
+        env:
+          BUILD_CERTIFICATE_BASE64: '${{ secrets.MACOS_CERT_P12_BASE64 }}'
+          P12_PASSWORD: '${{ secrets.MACOS_CERT_PASSWORD }}'
+          KEYCHAIN_PASSWORD: 'temp-password'
+        run: |
+          # Create the P12 file
+          echo "$BUILD_CERTIFICATE_BASE64" | base64 --decode > certificate.p12
+
+          # Create a temporary keychain
+          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+
+          # Import the certificate
+          security import certificate.p12 -k build.keychain -P "$P12_PASSWORD" -T /usr/bin/codesign
+
+          # Allow codesign to access it
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" build.keychain
+
+          # Set Identity for build script
+          echo "APPLE_IDENTITY=${{ secrets.MACOS_CERT_IDENTITY }}" >> "$GITHUB_ENV"
+
+      - name: 'Setup Windows Certificate'
+        if: "matrix.os == 'windows-latest' && steps.check_secrets.outputs.has_win_cert == 'true' && github.event_name != 'pull_request'"
+        env:
+          PFX_BASE64: '${{ secrets.WINDOWS_PFX_BASE64 }}'
+          PFX_PASSWORD: '${{ secrets.WINDOWS_PFX_PASSWORD }}'
+        run: |
+          $pfx_cert_byte = [System.Convert]::FromBase64String("$env:PFX_BASE64")
+          $certPath = Join-Path (Get-Location) "cert.pfx"
+          [IO.File]::WriteAllBytes($certPath, $pfx_cert_byte)
+          echo "WINDOWS_PFX_FILE=$certPath" >> $env:GITHUB_ENV
+          echo "WINDOWS_PFX_PASSWORD=$env:PFX_PASSWORD" >> $env:GITHUB_ENV
+        shell: 'pwsh'
+
+      - name: 'Build Binary'
+        run: 'npm run build:binary'
+
+      - name: 'Build Core Package'
+        run: 'npm run build -w @google/gemini-cli-core'
+
+      - name: 'Verify Output Exists'
+        run: |
+          if [ -f "dist/${{ matrix.platform_name }}/gemini" ]; then
+            echo "Binary found at dist/${{ matrix.platform_name }}/gemini"
+          elif [ -f "dist/${{ matrix.platform_name }}/gemini.exe" ]; then
+            echo "Binary found at dist/${{ matrix.platform_name }}/gemini.exe"
+          else
+            echo "Error: Binary not found in dist/${{ matrix.platform_name }}/"
+            ls -R dist/
+            exit 1
+          fi
+
+      - name: 'Smoke Test Binary'
+        run: |
+          echo "Running binary smoke test..."
+          if [ -f "dist/${{ matrix.platform_name }}/gemini.exe" ]; then
+            "./dist/${{ matrix.platform_name }}/gemini.exe" --version
+          else
+            "./dist/${{ matrix.platform_name }}/gemini" --version
+          fi
+
+      - name: 'Run Integration Tests'
+        if: "github.event_name != 'pull_request'"
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+        run: |
+          echo "Running integration tests with binary..."
+          if [[ "${{ matrix.os }}" == 'windows-latest' ]]; then
+            BINARY_PATH="$(cygpath -m "$(pwd)/dist/${{ matrix.platform_name }}/gemini.exe")"
+          else
+            BINARY_PATH="$(pwd)/dist/${{ matrix.platform_name }}/gemini"
+          fi
+          echo "Using binary at $BINARY_PATH"
+          export INTEGRATION_TEST_GEMINI_BINARY_PATH="$BINARY_PATH"
+          npm run test:integration:sandbox:none -- --testTimeout=600000
+
+      - name: 'Upload Artifact'
+        uses: 'actions/upload-artifact@v4'
+        with:
+          name: 'gemini-cli-${{ matrix.platform_name }}'
+          path: 'dist/${{ matrix.platform_name }}/'
+          retention-days: 5

.github/workflows/trigger_e2e.yml

@@ -0,0 +1,40 @@
+name: 'Trigger E2E'
+
+on:
+  workflow_dispatch:
+    inputs:
+      repo_name:
+        description: 'Repository name (e.g., owner/repo)'
+        required: false
+        type: 'string'
+      head_sha:
+        description: 'SHA of the commit to test'
+        required: false
+        type: 'string'
+  pull_request:
+
+jobs:
+  save_repo_name:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    steps:
+      - name: 'Save Repo name'
+        env:
+          REPO_NAME: '${{ github.event.inputs.repo_name || github.event.pull_request.head.repo.full_name }}'
+          HEAD_SHA: '${{ github.event.inputs.head_sha || github.event.pull_request.head.sha }}'
+        run: |
+          mkdir -p ./pr
+          echo "${REPO_NAME}" > ./pr/repo_name
+          echo "${HEAD_SHA}" > ./pr/head_sha
+      - uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'repo_name'
+          path: 'pr/'
+  trigger_e2e:
+    name: 'Trigger e2e'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    steps:
+      - id: 'trigger-e2e'
+        run: |
+          echo "Trigger e2e workflow"

.github/workflows/unassign-inactive-assignees.yml

@@ -0,0 +1,315 @@
+name: 'Unassign Inactive Issue Assignees'
+
+# This workflow runs daily and scans every open "help wanted" issue that has
+# one or more assignees.  For each assignee it checks whether they have a
+# non-draft pull request (open and ready for review, or already merged) that
+# is linked to the issue.  Draft PRs are intentionally excluded so that
+# contributors cannot reset the check by opening a no-op PR.  If no
+# qualifying PR is found within 7 days of assignment the assignee is
+# automatically removed and a friendly comment is posted so that other
+# contributors can pick up the work.
+# Maintainers, org members, and collaborators (anyone with write access or
+# above) are always exempted and will never be auto-unassigned.
+
+on:
+  schedule:
+    - cron: '0 9 * * *' # Every day at 09:00 UTC
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run in dry-run mode (no changes will be applied)'
+        required: false
+        default: false
+        type: 'boolean'
+
+concurrency:
+  group: '${{ github.workflow }}'
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: 'bash'
+
+jobs:
+  unassign-inactive-assignees:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      issues: 'write'
+
+    steps:
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        uses: 'actions/create-github-app-token@v2'
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+
+      - name: 'Unassign inactive assignees'
+        uses: 'actions/github-script@v7'
+        env:
+          DRY_RUN: '${{ inputs.dry_run }}'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |
+            const dryRun = process.env.DRY_RUN === 'true';
+            if (dryRun) {
+              core.info('DRY RUN MODE ENABLED: No changes will be applied.');
+            }
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const GRACE_PERIOD_DAYS = 7;
+            const now = new Date();
+
+            let maintainerLogins = new Set();
+            const teams = ['gemini-cli-maintainers', 'gemini-cli-askmode-approvers', 'gemini-cli-docs'];
+
+            for (const team_slug of teams) {
+              try {
+                const members = await github.paginate(github.rest.teams.listMembersInOrg, {
+                  org: owner,
+                  team_slug,
+                });
+                for (const m of members) maintainerLogins.add(m.login.toLowerCase());
+                core.info(`Fetched ${members.length} members from team ${team_slug}.`);
+              } catch (e) {
+                core.warning(`Could not fetch team ${team_slug}: ${e.message}`);
+              }
+            }
+
+            const isGooglerCache = new Map();
+            const isGoogler = async (login) => {
+              if (isGooglerCache.has(login)) return isGooglerCache.get(login);
+              try {
+                for (const org of ['googlers', 'google']) {
+                  try {
+                    await github.rest.orgs.checkMembershipForUser({ org, username: login });
+                    isGooglerCache.set(login, true);
+                    return true;
+                  } catch (e) {
+                    if (e.status !== 404) throw e;
+                  }
+                }
+              } catch (e) {
+                core.warning(`Could not check org membership for ${login}: ${e.message}`);
+              }
+              isGooglerCache.set(login, false);
+              return false;
+            };
+
+            const permissionCache = new Map();
+            const isPrivilegedUser = async (login) => {
+              if (maintainerLogins.has(login.toLowerCase())) return true;
+
+              if (permissionCache.has(login)) return permissionCache.get(login);
+
+              try {
+                const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner,
+                  repo,
+                  username: login,
+                });
+                const privileged = ['admin', 'maintain', 'write', 'triage'].includes(data.permission);
+                permissionCache.set(login, privileged);
+                if (privileged) {
+                  core.info(`  @${login} is a repo collaborator (${data.permission}) — exempt.`);
+                  return true;
+                }
+              } catch (e) {
+                if (e.status !== 404) {
+                  core.warning(`Could not check permission for ${login}: ${e.message}`);
+                }
+              }
+
+              const googler = await isGoogler(login);
+              permissionCache.set(login, googler);
+              return googler;
+            };
+
+            core.info('Fetching open "help wanted" issues with assignees...');
+
+            const issues = await github.paginate(github.rest.issues.listForRepo, {
+              owner,
+              repo,
+              state: 'open',
+              labels: 'help wanted',
+              per_page: 100,
+            });
+
+            const assignedIssues = issues.filter(
+              (issue) => !issue.pull_request && issue.assignees && issue.assignees.length > 0
+            );
+
+            core.info(`Found ${assignedIssues.length} assigned "help wanted" issues.`);
+
+            let totalUnassigned = 0;
+
+              let timelineEvents = [];
+              try {
+                timelineEvents = await github.paginate(github.rest.issues.listEventsForTimeline, {
+                  owner,
+                  repo,
+                  issue_number: issue.number,
+                  per_page: 100,
+                  mediaType: { previews: ['mockingbird'] },
+                });
+              } catch (err) {
+                core.warning(`Could not fetch timeline for issue #${issue.number}: ${err.message}`);
+                continue;
+              }
+
+              const assignedAtMap = new Map();
+
+              for (const event of timelineEvents) {
+                if (event.event === 'assigned' && event.assignee) {
+                  const login = event.assignee.login.toLowerCase();
+                  const at = new Date(event.created_at);
+                  assignedAtMap.set(login, at);
+                } else if (event.event === 'unassigned' && event.assignee) {
+                  assignedAtMap.delete(event.assignee.login.toLowerCase());
+                }
+              }
+
+              const linkedPRAuthorSet = new Set();
+              const seenPRKeys = new Set();
+
+              for (const event of timelineEvents) {
+                if (
+                  event.event !== 'cross-referenced' ||
+                  !event.source ||
+                  event.source.type !== 'pull_request' ||
+                  !event.source.issue ||
+                  !event.source.issue.user ||
+                  !event.source.issue.number ||
+                  !event.source.issue.repository
+                ) continue;
+
+                const prOwner  = event.source.issue.repository.owner.login;
+                const prRepo   = event.source.issue.repository.name;
+                const prNumber = event.source.issue.number;
+                const prAuthor = event.source.issue.user.login.toLowerCase();
+                const prKey    = `${prOwner}/${prRepo}#${prNumber}`;
+
+                if (seenPRKeys.has(prKey)) continue;
+                seenPRKeys.add(prKey);
+
+                try {
+                  const { data: pr } = await github.rest.pulls.get({
+                    owner: prOwner,
+                    repo: prRepo,
+                    pull_number: prNumber,
+                  });
+
+                  const isReady = (pr.state === 'open' && !pr.draft) ||
+                                  (pr.state === 'closed' && pr.merged_at !== null);
+
+                  core.info(
+                    `  PR ${prKey} by @${prAuthor}: ` +
+                    `state=${pr.state}, draft=${pr.draft}, merged=${!!pr.merged_at} → ` +
+                    (isReady ? 'qualifies' : 'does NOT qualify (draft or closed without merge)')
+                  );
+
+                  if (isReady) linkedPRAuthorSet.add(prAuthor);
+                } catch (err) {
+                  core.warning(`Could not fetch PR ${prKey}: ${err.message}`);
+                }
+              }
+
+              const assigneesToRemove = [];
+
+              for (const assignee of issue.assignees) {
+                const login = assignee.login.toLowerCase();
+
+                if (await isPrivilegedUser(assignee.login)) {
+                  core.info(`  @${assignee.login}: privileged user — skipping.`);
+                  continue;
+                }
+
+                const assignedAt = assignedAtMap.get(login);
+
+                if (!assignedAt) {
+                  core.warning(
+                    `No 'assigned' event found for @${login} on issue #${issue.number}; ` +
+                    `falling back to issue creation date (${issue.created_at}).`
+                  );
+                  assignedAtMap.set(login, new Date(issue.created_at));
+                }
+                const resolvedAssignedAt = assignedAtMap.get(login);
+
+                const daysSinceAssignment = (now - resolvedAssignedAt) / (1000 * 60 * 60 * 24);
+
+                core.info(
+                  `  @${login}: assigned ${daysSinceAssignment.toFixed(1)} day(s) ago, ` +
+                  `ready-for-review PR: ${linkedPRAuthorSet.has(login) ? 'yes' : 'no'}`
+                );
+
+                if (daysSinceAssignment < GRACE_PERIOD_DAYS) {
+                  core.info(`    → within grace period, skipping.`);
+                  continue;
+                }
+
+                if (linkedPRAuthorSet.has(login)) {
+                  core.info(`    → ready-for-review PR found, keeping assignment.`);
+                  continue;
+                }
+
+                core.info(`    → no ready-for-review PR after ${GRACE_PERIOD_DAYS} days, will unassign.`);
+                assigneesToRemove.push(assignee.login);
+              }
+
+              if (assigneesToRemove.length === 0) {
+                continue;
+              }
+
+              if (!dryRun) {
+                try {
+                  await github.rest.issues.removeAssignees({
+                    owner,
+                    repo,
+                    issue_number: issue.number,
+                    assignees: assigneesToRemove,
+                  });
+                } catch (err) {
+                  core.warning(
+                    `Failed to unassign ${assigneesToRemove.join(', ')} from issue #${issue.number}: ${err.message}`
+                  );
+                  continue;
+                }
+
+                const mentionList = assigneesToRemove.map((l) => `@${l}`).join(', ');
+                const commentBody =
+                  `👋 ${mentionList} — it has been more than ${GRACE_PERIOD_DAYS} days since ` +
+                  `you were assigned to this issue and we could not find a pull request ` +
+                  `ready for review.\n\n` +
+                  `To keep the backlog moving and ensure issues stay accessible to all ` +
+                  `contributors, we require a PR that is open and ready for review (not a ` +
+                  `draft) within ${GRACE_PERIOD_DAYS} days of assignment.\n\n` +
+                  `We are automatically unassigning you so that other contributors can pick ` +
+                  `this up. If you are still actively working on this, please:\n` +
+                  `1. Re-assign yourself by commenting \`/assign\`.\n` +
+                  `2. Open a PR (not a draft) linked to this issue (e.g. \`Fixes #${issue.number}\`) ` +
+                  `within ${GRACE_PERIOD_DAYS} days so the automation knows real progress is being made.\n\n` +
+                  `Thank you for your contribution — we hope to see a PR from you soon! 🙏`;
+
+                try {
+                  await github.rest.issues.createComment({
+                    owner,
+                    repo,
+                    issue_number: issue.number,
+                    body: commentBody,
+                  });
+                } catch (err) {
+                  core.warning(
+                    `Failed to post comment on issue #${issue.number}: ${err.message}`
+                  );
+                }
+              }
+
+              totalUnassigned += assigneesToRemove.length;
+              core.info(
+                `  ${dryRun ? '[DRY RUN] Would have unassigned' : 'Unassigned'}: ${assigneesToRemove.join(', ')}`
+              );
+            }
+
+            core.info(`\nDone. Total assignees ${dryRun ? 'that would be' : ''} unassigned: ${totalUnassigned}`);

.github/workflows/verify-release.yml

@@ -0,0 +1,56 @@
+name: 'Verify NPM release tag'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The expected Gemini binary version that should be released (e.g., 0.5.0-preview-2).'
+        required: true
+        type: 'string'
+      npm-tag:
+        description: 'NPM tag to verify'
+        required: true
+        type: 'choice'
+        options:
+          - 'dev'
+          - 'latest'
+          - 'preview'
+          - 'nightly'
+        default: 'latest'
+      environment:
+        description: 'Environment'
+        required: false
+        type: 'choice'
+        options:
+          - 'prod'
+          - 'dev'
+        default: 'prod'
+
+jobs:
+  verify-release:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    environment: "${{ github.event.inputs.environment || 'prod' }}"
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ['ubuntu-latest', 'macos-latest', 'windows-latest']
+    runs-on: '${{ matrix.os }}'
+    permissions:
+      contents: 'read'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: '📝 Print vars'
+        shell: 'bash'
+        run: 'echo "${{ toJSON(vars) }}"'
+      - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+      - name: 'Verify release'
+        uses: './.github/actions/verify-release'
+        with:
+          npm-package: '${{vars.CLI_PACKAGE_NAME}}@${{github.event.inputs.npm-tag}}'
+          expected-version: '${{github.event.inputs.version}}'
+          working-directory: '.'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          npm-registry-url: '${{ vars.NPM_REGISTRY_URL }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          npm-registry-scope: '${{ vars.NPM_REGISTRY_SCOPE }}'

.gitignore

@@ -3,8 +3,16 @@
 .env~
 
 # gemini-cli settings
-.gemini/
-!gemini/config.yaml
+# We want to keep the .gemini in the root of the repo and ignore any .gemini
+# in subdirectories. In our root .gemini we want to allow for version control
+# for subcommands.
+**/.gemini/
+!/.gemini/
+.gemini/*
+!.gemini/config.yaml
+!.gemini/commands/
+!.gemini/skills/
+!.gemini/settings.json
 
 # Note: .gemini-clipboard/ is NOT in gitignore so Gemini can access pasted images
 
@@ -38,8 +46,21 @@ packages/*/coverage/
 # Generated files
 packages/cli/src/generated/
 packages/core/src/generated/
+packages/devtools/src/_client-assets.ts
 .integration-tests/
 packages/vscode-ide-companion/*.vsix
+packages/cli/download-ripgrep*/
 
 # GHA credentials
 gha-creds-*.json
+
+# Log files
+patch_output.log
+gemini-debug.log
+
+.genkit
+.gemini-clipboard/
+.eslintcache
+evals/logs/
+
+temp_agents/

.husky/pre-commit

@@ -0,0 +1,9 @@
+npm run pre-commit || {
+  echo ''
+  echo '===================================================='
+  echo 'pre-commit checks failed. in case of emergency, run:'
+  echo ''
+  echo 'git commit --no-verify'
+  echo '===================================================='
+  exit 1
+}

.lycheeignore

@@ -0,0 +1,6 @@
+http://localhost:16686/
+https://github.com/google-gemini/gemini-cli/issues/new/choose
+https://github.com/google-gemini/maintainers-gemini-cli/blob/main/npm.md
+https://github.com/settings/personal-access-tokens/new
+https://github.com/settings/tokens/new
+https://www.npmjs.com/package/@google/gemini-cli

.prettierignore

@@ -17,4 +17,8 @@ eslint.config.js
 **/generated
 gha-creds-*.json
 junit.xml
+.gemini-linters/
 Thumbs.db
+.pytest_cache
+**/SKILL.md
+packages/sdk/test-data/*.json

.prettierrc.json

@@ -3,5 +3,15 @@
   "trailingComma": "all",
   "singleQuote": true,
   "printWidth": 80,
-  "tabWidth": 2
+  "tabWidth": 2,
+  "overrides": [
+    {
+      "files": ["**/*.md"],
+      "options": {
+        "tabWidth": 2,
+        "printWidth": 80,
+        "proseWrap": "always"
+      }
+    }
+  ]
 }

.vscode/settings.json

@@ -7,10 +7,17 @@
   "[typescript]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
   },
+  "[typescriptreact]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode"
+  },
   "[json]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
   },
   "[javascript]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
-  }
+  },
+  "[markdown]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode"
+  },
+  "vitest.disableWorkspaceWarning": true
 }

.yamllint.yml

@@ -86,3 +86,4 @@ ignore:
   - 'thirdparty/'
   - 'third_party/'
   - 'vendor/'
+  - 'node_modules/'

CONTRIBUTING.md

@@ -1,6 +1,18 @@
-# How to Contribute
+# How to contribute
 
-We would love to accept your patches and contributions to this project.
+We would love to accept your patches and contributions to this project. This
+document includes:
+
+- **[Before you begin](#before-you-begin):** Essential steps to take before
+  becoming a Gemini CLI contributor.
+- **[Code contribution process](#code-contribution-process):** How to contribute
+  code to Gemini CLI.
+- **[Development setup and workflow](#development-setup-and-workflow):** How to
+  set up your development environment and workflow.
+- **[Documentation contribution process](#documentation-contribution-process):**
+  How to contribute documentation to Gemini CLI.
+
+We're looking forward to seeing your contributions!
 
 ## Before you begin
 
@@ -20,88 +32,184 @@ sign a new one.
 
 ### Review our Community Guidelines
 
-This project follows [Google's Open Source Community
-Guidelines](https://opensource.google/conduct/).
+This project follows
+[Google's Open Source Community Guidelines](https://opensource.google/conduct/).
 
-## Contribution Process
+## Code contribution process
 
-### Code Reviews
+### Get started
+
+The process for contributing code is as follows:
+
+1.  **Find an issue** that you want to work on. If an issue is tagged as
+    `🔒Maintainers only`, this means it is reserved for project maintainers. We
+    will not accept pull requests related to these issues. In the near future,
+    we will explicitly mark issues looking for contributions using the
+    `help-wanted` label. If you believe an issue is a good candidate for
+    community contribution, please leave a comment on the issue. A maintainer
+    will review it and apply the `help-wanted` label if appropriate. Only
+    maintainers should attempt to add the `help-wanted` label to an issue.
+2.  **Fork the repository** and create a new branch.
+3.  **Make your changes** in the `packages/` directory.
+4.  **Ensure all checks pass** by running `npm run preflight`.
+5.  **Open a pull request** with your changes.
+
+### Code reviews
 
 All submissions, including submissions by project members, require review. We
 use [GitHub pull requests](https://docs.github.com/articles/about-pull-requests)
 for this purpose.
 
-### Self Assigning Issues
+To assist with the review process, we provide an automated review tool that
+helps detect common anti-patterns, testing issues, and other best practices that
+are easy to miss.
 
-If you're looking for an issue to work on, check out our list of issues that are labeled ["help wanted"](https://github.com/google-gemini/gemini-cli/issues?q=is%3Aissue+state%3Aopen+label%3A%22help+wanted%22).
+#### Using the automated review tool
 
-To assign an issue to yourself, simply add a comment with the text `/assign`. The comment must contain only that text and nothing else. This command will assign the issue to you, provided it is not already assigned.
+You can run the review tool in two ways:
 
-Please note that you can have a maximum of 3 issues assigned to you at any given time.
+1.  **Using the helper script (Recommended):** We provide a script that
+    automatically handles checking out the PR into a separate worktree,
+    installing dependencies, building the project, and launching the review
+    tool.
 
-### Pull Request Guidelines
+    ```bash
+    ./scripts/review.sh <PR_NUMBER> [model]
+    ```
 
-To help us review and merge your PRs quickly, please follow these guidelines. PRs that do not meet these standards may be closed.
+    **Warning:** If you run `scripts/review.sh`, you must have first verified
+    that the code for the PR being reviewed is safe to run and does not contain
+    data exfiltration attacks.
 
-#### 1. Link to an Existing Issue
+    **Authors are strongly encouraged to run this script on their own PRs**
+    immediately after creation. This allows you to catch and fix simple issues
+    locally before a maintainer performs a full review.
 
-All PRs should be linked to an existing issue in our tracker. This ensures that every change has been discussed and is aligned with the project's goals before any code is written.
+    **Note on Models:** By default, the script uses the latest Pro model
+    (`gemini-3.1-pro-preview`). If you do not have enough Pro quota, you can run
+    it with the latest Flash model instead:
+    `./scripts/review.sh <PR_NUMBER> gemini-3-flash-preview`.
+
+2.  **Manually from within Gemini CLI:** If you already have the PR checked out
+    and built, you can run the tool directly from the CLI prompt:
+
+    ```text
+    /review-frontend <PR_NUMBER>
+    ```
+
+Replace `<PR_NUMBER>` with your pull request number. Reviewers should use this
+tool to augment, not replace, their manual review process.
+
+### Self-assigning and unassigning issues
+
+To assign an issue to yourself, simply add a comment with the text `/assign`. To
+unassign yourself from an issue, add a comment with the text `/unassign`.
+
+The comment must contain only that text and nothing else. These commands will
+assign or unassign the issue as requested, provided the conditions are met
+(e.g., an issue must be unassigned to be assigned).
+
+Please note that you can have a maximum of 3 issues assigned to you at any given
+time.
+
+### Pull request guidelines
+
+To help us review and merge your PRs quickly, please follow these guidelines.
+PRs that do not meet these standards may be closed.
+
+#### 1. Link to an existing issue
+
+All PRs should be linked to an existing issue in our tracker. This ensures that
+every change has been discussed and is aligned with the project's goals before
+any code is written.
 
 - **For bug fixes:** The PR should be linked to the bug report issue.
-- **For features:** The PR should be linked to the feature request or proposal issue that has been approved by a maintainer.
+- **For features:** The PR should be linked to the feature request or proposal
+  issue that has been approved by a maintainer.
 
-If an issue for your change doesn't exist, please **open one first** and wait for feedback before you start coding.
+If an issue for your change doesn't exist, we will automatically close your PR
+along with a comment reminding you to associate the PR with an issue. The ideal
+workflow starts with an issue that has been reviewed and approved by a
+maintainer. Please **open the issue first** and wait for feedback before you
+start coding.
 
-#### 2. Keep It Small and Focused
+#### 2. Keep it small and focused
 
-We favor small, atomic PRs that address a single issue or add a single, self-contained feature.
+We favor small, atomic PRs that address a single issue or add a single,
+self-contained feature.
 
 - **Do:** Create a PR that fixes one specific bug or adds one specific feature.
-- **Don't:** Bundle multiple unrelated changes (e.g., a bug fix, a new feature, and a refactor) into a single PR.
+- **Don't:** Bundle multiple unrelated changes (e.g., a bug fix, a new feature,
+  and a refactor) into a single PR.
 
-Large changes should be broken down into a series of smaller, logical PRs that can be reviewed and merged independently.
+Large changes should be broken down into a series of smaller, logical PRs that
+can be reviewed and merged independently.
 
-#### 3. Use Draft PRs for Work in Progress
+#### 3. Use draft PRs for work in progress
 
-If you'd like to get early feedback on your work, please use GitHub's **Draft Pull Request** feature. This signals to the maintainers that the PR is not yet ready for a formal review but is open for discussion and initial feedback.
+If you'd like to get early feedback on your work, please use GitHub's **Draft
+Pull Request** feature. This signals to the maintainers that the PR is not yet
+ready for a formal review but is open for discussion and initial feedback.
 
-#### 4. Ensure All Checks Pass
+#### 4. Ensure all checks pass
 
-Before submitting your PR, ensure that all automated checks are passing by running `npm run preflight`. This command runs all tests, linting, and other style checks.
+Before submitting your PR, ensure that all automated checks are passing by
+running `npm run preflight`. This command runs all tests, linting, and other
+style checks.
 
-#### 5. Update Documentation
+#### 5. Update documentation
 
-If your PR introduces a user-facing change (e.g., a new command, a modified flag, or a change in behavior), you must also update the relevant documentation in the `/docs` directory.
+If your PR introduces a user-facing change (e.g., a new command, a modified
+flag, or a change in behavior), you must also update the relevant documentation
+in the `/docs` directory.
 
-#### 6. Write Clear Commit Messages and a Good PR Description
+See more about writing documentation:
+[Documentation contribution process](#documentation-contribution-process).
 
-Your PR should have a clear, descriptive title and a detailed description of the changes. Follow the [Conventional Commits](https://www.conventionalcommits.org/) standard for your commit messages.
+#### 6. Write clear commit messages and a good PR description
 
-- **Good PR Title:** `feat(cli): Add --json flag to 'config get' command`
-- **Bad PR Title:** `Made some changes`
+Your PR should have a clear, descriptive title and a detailed description of the
+changes. Follow the [Conventional Commits](https://www.conventionalcommits.org/)
+standard for your commit messages.
 
-In the PR description, explain the "why" behind your changes and link to the relevant issue (e.g., `Fixes #123`).
+- **Good PR title:** `feat(cli): Add --json flag to 'config get' command`
+- **Bad PR title:** `Made some changes`
 
-## Forking
+In the PR description, explain the "why" behind your changes and link to the
+relevant issue (e.g., `Fixes #123`).
 
-If you are forking the repository you will be able to run the Build, Test and Integration test workflows. However in order to make the integration tests run you'll need to add a [GitHub Repository Secret](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository) with a value of `GEMINI_API_KEY` and set that to a valid API key that you have available. Your key and secret are private to your repo; no one without access can see your key and you cannot see any secrets related to this repo.
+### Forking
 
-Additionally you will need to click on the `Actions` tab and enable workflows for your repository, you'll find it's the large blue button in the center of the screen.
+If you are forking the repository you will be able to run the Build, Test and
+Integration test workflows. However in order to make the integration tests run
+you'll need to add a
+[GitHub Repository Secret](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository)
+with a value of `GEMINI_API_KEY` and set that to a valid API key that you have
+available. Your key and secret are private to your repo; no one without access
+can see your key and you cannot see any secrets related to this repo.
 
-## Development Setup and Workflow
+Additionally you will need to click on the `Actions` tab and enable workflows
+for your repository, you'll find it's the large blue button in the center of the
+screen.
 
-This section guides contributors on how to build, modify, and understand the development setup of this project.
+### Development setup and workflow
 
-### Setting Up the Development Environment
+This section guides contributors on how to build, modify, and understand the
+development setup of this project.
+
+### Setting up the development environment
 
 **Prerequisites:**
 
 1.  **Node.js**:
-    - **Development:** Please use Node.js `~20.19.0`. This specific version is required due to an upstream development dependency issue. You can use a tool like [nvm](https://github.com/nvm-sh/nvm) to manage Node.js versions.
-    - **Production:** For running the CLI in a production environment, any version of Node.js `>=20` is acceptable.
+    - **Development:** Please use Node.js `~20.19.0`. This specific version is
+      required due to an upstream development dependency issue. You can use a
+      tool like [nvm](https://github.com/nvm-sh/nvm) to manage Node.js versions.
+    - **Production:** For running the CLI in a production environment, any
+      version of Node.js `>=20` is acceptable.
 2.  **Git**
 
-### Build Process
+### Build process
 
 To clone the repository:
 
@@ -122,13 +230,19 @@ To build the entire project (all packages):
 npm run build
 ```
 
-This command typically compiles TypeScript to JavaScript, bundles assets, and prepares the packages for execution. Refer to `scripts/build.js` and `package.json` scripts for more details on what happens during the build.
+This command typically compiles TypeScript to JavaScript, bundles assets, and
+prepares the packages for execution. Refer to `scripts/build.js` and
+`package.json` scripts for more details on what happens during the build.
 
-### Enabling Sandboxing
+### Enabling sandboxing
 
-[Sandboxing](#sandboxing) is highly recommended and requires, at a minimum, setting `GEMINI_SANDBOX=true` in your `~/.env` and ensuring a sandboxing provider (e.g. `macOS Seatbelt`, `docker`, or `podman`) is available. See [Sandboxing](#sandboxing) for details.
+[Sandboxing](#sandboxing) is highly recommended and requires, at a minimum,
+setting `GEMINI_SANDBOX=true` in your `~/.env` and ensuring a sandboxing
+provider (e.g. `macOS Seatbelt`, `docker`, or `podman`) is available. See
+[Sandboxing](#sandboxing) for details.
 
-To build both the `gemini` CLI utility and the sandbox container, run `build:all` from the root directory:
+To build both the `gemini` CLI utility and the sandbox container, run
+`build:all` from the root directory:
 
 ```bash
 npm run build:all
@@ -136,21 +250,25 @@ npm run build:all
 
 To skip building the sandbox container, you can use `npm run build` instead.
 
-### Running
+### Running the CLI
 
-To start the Gemini CLI from the source code (after building), run the following command from the root directory:
+To start the Gemini CLI from the source code (after building), run the following
+command from the root directory:
 
 ```bash
 npm start
 ```
 
-If you'd like to run the source build outside of the gemini-cli folder you can utilize `npm link path/to/gemini-cli/packages/cli` (see: [docs](https://docs.npmjs.com/cli/v9/commands/npm-link)) or `alias gemini="node path/to/gemini-cli/packages/cli"` to run with `gemini`
+If you'd like to run the source build outside of the gemini-cli folder, you can
+utilize `npm link path/to/gemini-cli/packages/cli` (see:
+[docs](https://docs.npmjs.com/cli/v9/commands/npm-link)) or
+`alias gemini="node path/to/gemini-cli/packages/cli"` to run with `gemini`
 
-### Running Tests
+### Running tests
 
 This project contains two types of tests: unit tests and integration tests.
 
-#### Unit Tests
+#### Unit tests
 
 To execute the unit test suite for the project:
 
@@ -158,11 +276,14 @@ To execute the unit test suite for the project:
 npm run test
 ```
 
-This will run tests located in the `packages/core` and `packages/cli` directories. Ensure tests pass before submitting any changes. For a more comprehensive check, it is recommended to run `npm run preflight`.
+This will run tests located in the `packages/core` and `packages/cli`
+directories. Ensure tests pass before submitting any changes. For a more
+comprehensive check, it is recommended to run `npm run preflight`.
 
-#### Integration Tests
+#### Integration tests
 
-The integration tests are designed to validate the end-to-end functionality of the Gemini CLI. They are not run as part of the default `npm run test` command.
+The integration tests are designed to validate the end-to-end functionality of
+the Gemini CLI. They are not run as part of the default `npm run test` command.
 
 To run the integration tests, use the following command:
 
@@ -170,9 +291,11 @@ To run the integration tests, use the following command:
 npm run test:e2e
 ```
 
-For more detailed information on the integration testing framework, please see the [Integration Tests documentation](./docs/integration-tests.md).
+For more detailed information on the integration testing framework, please see
+the
+[Integration Tests documentation](https://geminicli.com/docs/integration-tests).
 
-### Linting and Preflight Checks
+### Linting and preflight checks
 
 To ensure code quality and formatting consistency, run the preflight check:
 
@@ -180,11 +303,13 @@ To ensure code quality and formatting consistency, run the preflight check:
 npm run preflight
 ```
 
-This command will run ESLint, Prettier, all tests, and other checks as defined in the project's `package.json`.
+This command will run ESLint, Prettier, all tests, and other checks as defined
+in the project's `package.json`.
 
 _ProTip_
 
-after cloning create a git precommit hook file to ensure your commits are always clean.
+after cloning create a git precommit hook file to ensure your commits are always
+clean.
 
 ```bash
 echo "
@@ -198,51 +323,69 @@ fi
 
 #### Formatting
 
-To separately format the code in this project by running the following command from the root directory:
+To separately format the code in this project by running the following command
+from the root directory:
 
 ```bash
 npm run format
 ```
 
-This command uses Prettier to format the code according to the project's style guidelines.
+This command uses Prettier to format the code according to the project's style
+guidelines.
 
 #### Linting
 
-To separately lint the code in this project, run the following command from the root directory:
+To separately lint the code in this project, run the following command from the
+root directory:
 
 ```bash
 npm run lint
 ```
 
-### Coding Conventions
+### Coding conventions
 
-- Please adhere to the coding style, patterns, and conventions used throughout the existing codebase.
-- Consult [GEMINI.md](https://github.com/google-gemini/gemini-cli/blob/main/GEMINI.md) (typically found in the project root) for specific instructions related to AI-assisted development, including conventions for React, comments, and Git usage.
-- **Imports:** Pay special attention to import paths. The project uses ESLint to enforce restrictions on relative imports between packages.
+- Please adhere to the coding style, patterns, and conventions used throughout
+  the existing codebase.
+- Consult [GEMINI.md](../GEMINI.md) (typically found in the project root) for
+  specific instructions related to AI-assisted development, including
+  conventions for React, comments, and Git usage.
+- **Imports:** Pay special attention to import paths. The project uses ESLint to
+  enforce restrictions on relative imports between packages.
 
-### Project Structure
+### Project structure
 
 - `packages/`: Contains the individual sub-packages of the project.
+  - `a2a-server`: A2A server implementation for the Gemini CLI. (Experimental)
   - `cli/`: The command-line interface.
   - `core/`: The core backend logic for the Gemini CLI.
+  - `test-utils` Utilities for creating and cleaning temporary file systems for
+    testing.
+  - `vscode-ide-companion/`: The Gemini CLI Companion extension pairs with
+    Gemini CLI.
 - `docs/`: Contains all project documentation.
 - `scripts/`: Utility scripts for building, testing, and development tasks.
 
 For more detailed architecture, see `docs/architecture.md`.
 
-## Debugging
+### Debugging
 
-### VS Code:
+#### VS Code
 
 0.  Run the CLI to interactively debug in VS Code with `F5`
 1.  Start the CLI in debug mode from the root directory:
     ```bash
     npm run debug
     ```
-    This command runs `node --inspect-brk dist/gemini.js` within the `packages/cli` directory, pausing execution until a debugger attaches. You can then open `chrome://inspect` in your Chrome browser to connect to the debugger.
-2.  In VS Code, use the "Attach" launch configuration (found in `.vscode/launch.json`).
+    This command runs `node --inspect-brk dist/gemini.js` within the
+    `packages/cli` directory, pausing execution until a debugger attaches. You
+    can then open `chrome://inspect` in your Chrome browser to connect to the
+    debugger.
+2.  In VS Code, use the "Attach" launch configuration (found in
+    `.vscode/launch.json`).
 
-Alternatively, you can use the "Launch Program" configuration in VS Code if you prefer to launch the currently open file directly, but 'F5' is generally recommended.
+Alternatively, you can use the "Launch Program" configuration in VS Code if you
+prefer to launch the currently open file directly, but 'F5' is generally
+recommended.
 
 To hit a breakpoint inside the sandbox container run:
 
@@ -250,11 +393,13 @@ To hit a breakpoint inside the sandbox container run:
 DEBUG=1 gemini
 ```
 
-**Note:** If you have `DEBUG=true` in a project's `.env` file, it won't affect gemini-cli due to automatic exclusion. Use `.gemini/.env` files for gemini-cli specific debug settings.
+**Note:** If you have `DEBUG=true` in a project's `.env` file, it won't affect
+gemini-cli due to automatic exclusion. Use `.gemini/.env` files for gemini-cli
+specific debug settings.
 
 ### React DevTools
 
-To debug the CLI's React-based UI, you can use React DevTools. Ink, the library used for the CLI's interface, is compatible with React DevTools version 4.x.
+To debug the CLI's React-based UI, you can use React DevTools.
 
 1.  **Start the Gemini CLI in development mode:**
 
@@ -262,43 +407,82 @@ To debug the CLI's React-based UI, you can use React DevTools. Ink, the library
     DEV=true npm start
     ```
 
-2.  **Install and run React DevTools version 4.28.5 (or the latest compatible 4.x version):**
+2.  **Install and run React DevTools version 6 (which matches the CLI's
+    `react-devtools-core`):**
 
     You can either install it globally:
 
     ```bash
-    npm install -g react-devtools@4.28.5
+    npm install -g react-devtools@6
     react-devtools
     ```
 
     Or run it directly using npx:
 
     ```bash
-    npx react-devtools@4.28.5
+    npx react-devtools@6
     ```
 
     Your running CLI application should then connect to React DevTools.
     ![](/docs/assets/connected_devtools.png)
 
-## Sandboxing
+### Sandboxing
 
-### macOS Seatbelt
+#### macOS Seatbelt
 
-On macOS, `gemini` uses Seatbelt (`sandbox-exec`) under a `permissive-open` profile (see `packages/cli/src/utils/sandbox-macos-permissive-open.sb`) that restricts writes to the project folder but otherwise allows all other operations and outbound network traffic ("open") by default. You can switch to a `restrictive-closed` profile (see `packages/cli/src/utils/sandbox-macos-restrictive-closed.sb`) that declines all operations and outbound network traffic ("closed") by default by setting `SEATBELT_PROFILE=restrictive-closed` in your environment or `.env` file. Available built-in profiles are `{permissive,restrictive}-{open,closed,proxied}` (see below for proxied networking). You can also switch to a custom profile `SEATBELT_PROFILE=<profile>` if you also create a file `.gemini/sandbox-macos-<profile>.sb` under your project settings directory `.gemini`.
+On macOS, `gemini` uses Seatbelt (`sandbox-exec`) under a `permissive-open`
+profile (see `packages/cli/src/utils/sandbox-macos-permissive-open.sb`) that
+restricts writes to the project folder but otherwise allows all other operations
+and outbound network traffic ("open") by default. You can switch to a
+`strict-open` profile (see
+`packages/cli/src/utils/sandbox-macos-strict-open.sb`) that restricts both reads
+and writes to the working directory while allowing outbound network traffic by
+setting `SEATBELT_PROFILE=strict-open` in your environment or `.env` file.
+Available built-in profiles are `permissive-{open,proxied}`,
+`restrictive-{open,proxied}`, and `strict-{open,proxied}` (see below for proxied
+networking). You can also switch to a custom profile
+`SEATBELT_PROFILE=<profile>` if you also create a file
+`.gemini/sandbox-macos-<profile>.sb` under your project settings directory
+`.gemini`.
 
-### Container-based Sandboxing (All Platforms)
+#### Container-based sandboxing (all platforms)
 
-For stronger container-based sandboxing on macOS or other platforms, you can set `GEMINI_SANDBOX=true|docker|podman|<command>` in your environment or `.env` file. The specified command (or if `true` then either `docker` or `podman`) must be installed on the host machine. Once enabled, `npm run build:all` will build a minimal container ("sandbox") image and `npm start` will launch inside a fresh instance of that container. The first build can take 20-30s (mostly due to downloading of the base image) but after that both build and start overhead should be minimal. Default builds (`npm run build`) will not rebuild the sandbox.
+For stronger container-based sandboxing on macOS or other platforms, you can set
+`GEMINI_SANDBOX=true|docker|podman|<command>` in your environment or `.env`
+file. The specified command (or if `true` then either `docker` or `podman`) must
+be installed on the host machine. Once enabled, `npm run build:all` will build a
+minimal container ("sandbox") image and `npm start` will launch inside a fresh
+instance of that container. The first build can take 20-30s (mostly due to
+downloading of the base image) but after that both build and start overhead
+should be minimal. Default builds (`npm run build`) will not rebuild the
+sandbox.
 
-Container-based sandboxing mounts the project directory (and system temp directory) with read-write access and is started/stopped/removed automatically as you start/stop Gemini CLI. Files created within the sandbox should be automatically mapped to your user/group on host machine. You can easily specify additional mounts, ports, or environment variables by setting `SANDBOX_{MOUNTS,PORTS,ENV}` as needed. You can also fully customize the sandbox for your projects by creating the files `.gemini/sandbox.Dockerfile` and/or `.gemini/sandbox.bashrc` under your project settings directory (`.gemini`) and running `gemini` with `BUILD_SANDBOX=1` to trigger building of your custom sandbox.
+Container-based sandboxing mounts the project directory (and system temp
+directory) with read-write access and is started/stopped/removed automatically
+as you start/stop Gemini CLI. Files created within the sandbox should be
+automatically mapped to your user/group on host machine. You can easily specify
+additional mounts, ports, or environment variables by setting
+`SANDBOX_{MOUNTS,PORTS,ENV}` as needed. You can also fully customize the sandbox
+for your projects by creating the files `.gemini/sandbox.Dockerfile` and/or
+`.gemini/sandbox.bashrc` under your project settings directory (`.gemini`) and
+running `gemini` with `BUILD_SANDBOX=1` to trigger building of your custom
+sandbox.
 
-#### Proxied Networking
+#### Proxied networking
 
-All sandboxing methods, including macOS Seatbelt using `*-proxied` profiles, support restricting outbound network traffic through a custom proxy server that can be specified as `GEMINI_SANDBOX_PROXY_COMMAND=<command>`, where `<command>` must start a proxy server that listens on `:::8877` for relevant requests. See `docs/examples/proxy-script.md` for a minimal proxy that only allows `HTTPS` connections to `example.com:443` (e.g. `curl https://example.com`) and declines all other requests. The proxy is started and stopped automatically alongside the sandbox.
+All sandboxing methods, including macOS Seatbelt using `*-proxied` profiles,
+support restricting outbound network traffic through a custom proxy server that
+can be specified as `GEMINI_SANDBOX_PROXY_COMMAND=<command>`, where `<command>`
+must start a proxy server that listens on `:::8877` for relevant requests. See
+`docs/examples/proxy-script.md` for a minimal proxy that only allows `HTTPS`
+connections to `example.com:443` (e.g. `curl https://example.com`) and declines
+all other requests. The proxy is started and stopped automatically alongside the
+sandbox.
 
-## Manual Publish
+### Manual publish
 
-We publish an artifact for each commit to our internal registry. But if you need to manually cut a local build, then run the following commands:
+We publish an artifact for each commit to our internal registry. But if you need
+to manually cut a local build, then run the following commands:
 
 ```
 npm run clean
@@ -307,3 +491,91 @@ npm run auth
 npm run prerelease:dev
 npm publish --workspaces
 ```
+
+## Documentation contribution process
+
+Our documentation must be kept up-to-date with our code contributions. We want
+our documentation to be clear, concise, and helpful to our users. We value:
+
+- **Clarity:** Use simple and direct language. Avoid jargon where possible.
+- **Accuracy:** Ensure all information is correct and up-to-date.
+- **Completeness:** Cover all aspects of a feature or topic.
+- **Examples:** Provide practical examples to help users understand how to use
+  Gemini CLI.
+
+### Getting started
+
+The process for contributing to the documentation is similar to contributing
+code.
+
+1. **Fork the repository** and create a new branch.
+2. **Make your changes** in the `/docs` directory.
+3. **Preview your changes locally** in Markdown rendering.
+4. **Lint and format your changes.** Our preflight check includes linting and
+   formatting for documentation files.
+   ```bash
+   npm run preflight
+   ```
+5. **Open a pull request** with your changes.
+
+### Documentation structure
+
+Our documentation is organized using [sidebar.json](/docs/sidebar.json) as the
+table of contents. When adding new documentation:
+
+1. Create your markdown file **in the appropriate directory** under `/docs`.
+2. Add an entry to `sidebar.json` in the relevant section.
+3. Ensure all internal links use relative paths and point to existing files.
+
+### Style guide
+
+We follow the
+[Google Developer Documentation Style Guide](https://developers.google.com/style).
+Please refer to it for guidance on writing style, tone, and formatting.
+
+#### Key style points
+
+- Use sentence case for headings.
+- Write in second person ("you") when addressing the reader.
+- Use present tense.
+- Keep paragraphs short and focused.
+- Use code blocks with appropriate language tags for syntax highlighting.
+- Include practical examples whenever possible.
+
+### Linting and formatting
+
+We use `prettier` to enforce a consistent style across our documentation. The
+`npm run preflight` command will check for any linting issues.
+
+You can also run the linter and formatter separately:
+
+- `npm run lint` - Check for linting issues
+- `npm run format` - Auto-format markdown files
+- `npm run lint:fix` - Auto-fix linting issues where possible
+
+Please make sure your contributions are free of linting errors before submitting
+a pull request.
+
+### Before you submit
+
+Before submitting your documentation pull request, please:
+
+1. Run `npm run preflight` to ensure all checks pass.
+2. Review your changes for clarity and accuracy.
+3. Check that all links work correctly.
+4. Ensure any code examples are tested and functional.
+5. Sign the
+   [Contributor License Agreement (CLA)](https://cla.developers.google.com/) if
+   you haven't already.
+
+### Need help?
+
+If you have questions about contributing documentation:
+
+- Check our [FAQ](https://geminicli.com/docs/resources/faq).
+- Review existing documentation for examples.
+- Open [an issue](https://github.com/google-gemini/gemini-cli/issues) to discuss
+  your proposed changes.
+- Reach out to the maintainers.
+
+We appreciate your contributions to making Gemini CLI documentation better!