chore(release): v0.7.0-preview.1

(cherry picked from commit ee36307495)

.gemini/commands/find-docs.toml

@@ -0,0 +1,30 @@
+description = "Find relevant documentation and output GitHub URLs."
+
+prompt = """
+## Mission: Find Relevant Documentation
+
+Your task is to find documentation files relevant to the user's question within the current git repository and provide a list of GitHub URLs to view them.
+
+### Workflow:
+
+1.  **Identify Repository Details**:
+    *   You may use shell commands like `git` or `gh` to get the remote URL of the repository.
+    *   From the remote URL, parse and construct the base GitHub URL (e.g., `https://github.com/user/repo`). You must handle both HTTPS (`https://github.com/user/repo.git`) and SSH (`git@github.com:user/repo.git`) formats.
+    *   Determine the default branch name. You can assume `main` for this purpose, as it is the most common.
+
+2.  **Search for Documentation**:
+    *   First, perform a targeted search across the repository for documentation files (e.g., `.md`, `.mdx`) that seem directly related to the user's question.
+    *   If this initial search yields no relevant results, and a `docs/` directory exists, read the content of all files within the `docs/` directory to find relevant information.
+    *   If you still can't find a direct match, broaden your search to include related concepts and synonyms of the keywords in the user's question.
+    *   For each file you identify as potentially relevant, read its content to confirm it addresses the user's query.
+
+3.  **Construct and Output URLs**:
+    *   For each file you identify as relevant, construct the full GitHub URL by combining the base URL, branch, and file path. **Do not use shell commands for this step.**
+    *   The URL format should be: `{BASE_GITHUB_URL}/blob/{BRANCH_NAME}/{PATH_TO_FILE_FROM_REPO_ROOT}`.
+    *   Present the final list to the user as a markdown list. Each item in the list should be the URL to the document, followed by a short summary of its content.
+    *   If, after all search attempts, you cannot find any relevant documentation, ask the user clarifying questions to better understand their needs. Do not return any URLs in this case.
+
+### QUESTION:
+
+{{args}}
+"""

.gemini/commands/github/cleanup-back-to-main.toml

@@ -0,0 +1,13 @@
+description = "Go back to main and clean up the branch."
+
+prompt = """
+I'm done with the work on this branch, and I'm ready to go back to main and clean up.
+
+Here is the workflow I'd like you to follow:
+
+1.  **Get Current Branch:** First, I need you to get the name of the current branch and save it.
+2.  **Branch Check:** Check if the current branch is `main`. If it is, I need you to stop and let me know.
+3.  **Go to Main:** Next, I need you to checkout the main branch.
+4.  **Pull Latest:** Once you are on the main branch, I need you to pull down the latest changes to make sure I'm up to date.
+5.  **Branch Cleanup:** Finally, I need you to delete the branch that you noted in the first step.
+"""

.gemini/commands/oncall/pr-review.toml

@@ -0,0 +1,47 @@
+description = "Review a specific pull request"
+
+prompt = """
+## Mission: Comprehensive Pull Request Review
+
+Today, our mission is to meticulously review community pull requests (PRs) for this project. We will proceed systematically, evaluating each candidate PR for its quality, adherence to standards, and readiness for merging.
+
+### Workflow:
+
+1.  **PR Preparation & Initial Assessment**:
+    * **You will check out the designated PR {{args}}** into a temporary branch.
+    * **Execute the preflight checks (`npm run preflight`)**. This includes building, linting, and running all unit tests.
+    * Analyze the output of these preflight checks, noting any failures, warnings, or linting issues.
+
+2.  **In-Depth Code Review**:
+    * **Your primary role is to conduct a thorough and in-depth code review** of the changes introduced in the PR. Focus your analysis on the following criteria:
+        * **Correctness**: Does the code achieve its stated purpose without bugs or logical errors?
+        * **Maintainability**: Is the code clean, well-structured, and easy to understand and modify in the future? Consider factors like code clarity, modularity, and adherence to established design patterns.
+        * **Readability**: Is the code well-commented (where necessary) and consistently formatted according to our project's coding style guidelines?
+        * **Efficiency**: Are there any obvious performance bottlenecks or resource inefficiencies introduced by the changes?
+        * **Security**: Are there any potential security vulnerabilities or insecure coding practices?
+        * **Edge Cases and Error Handling**: Does the code appropriately handle edge cases and potential errors?
+        * **Testability**: Is the new or modified code adequately covered by tests (even if preflight checks pass)? Suggest additional test cases that would improve coverage or robustness.
+    * Based on your analysis, you will determine if the PR is **safe to merge**.
+
+3.  **Reviewing Previous Feedback**:
+    * **Access and examine the PR's history** to identify any **outstanding requests or unresolved comments from previous reviews**. Incorporate these into your current review and explicitly highlight if they have been adequately addressed in the current state of the PR.
+
+4.  **Decision and Output Generation**:
+    * **If the PR is deemed safe to merge** (after your comprehensive review and considering previous feedback):
+        * Draft a **friendly, concise, and professional approval message**.
+        * **The approval message should:**
+            * Clearly state that the PR is approved.
+            * Briefly acknowledge the quality or value of the contribution (e.g., "Great work on X feature!" or "Appreciate the fix for Y issue!").
+            * **Do NOT mention the preflight checks or unit testing**, as these are internal processes.
+            * Be suitable for public display on GitHub.
+    * **If the PR is NOT safe to merge**:
+        * Provide a **clear, constructive, and detailed summary of the issues found**.
+        * Suggest **specific actionable changes** required for the PR to become merge-ready.
+        * Ensure the feedback is professional and encourages the contributor.
+
+### Post-PR Action:
+
+* After providing your review and decision for the current PR, I will wait for you to perform any manual testing you wish to do. Please let me know when you are finished.
+* Once you have confirmed that you are done, I will switch to the `main` branch, clean up the local branch, and perform a pull to ensure we are synchronized with the latest upstream changes for the next review.
+
+"""

.github/CODEOWNERS

@@ -1,7 +1,13 @@
-# By default, require reviews from the release approvers for all files.
-* @google-gemini/gemini-cli-askmode-approvers
+# By default, require reviews from the maintainers for all files.
+* @google-gemini/gemini-cli-maintainers
 
-# The following files don't need reviews from the release approvers.
+# Require reviews from the release approvers for critical files.
 # These patterns override the rule above.
-**/*.md
-/docs/
+/package.json @google-gemini/gemini-cli-askmode-approvers
+/package-lock.json @google-gemini/gemini-cli-askmode-approvers
+/GEMINI.md @google-gemini/gemini-cli-askmode-approvers
+/SECURITY.md @google-gemini/gemini-cli-askmode-approvers
+/LICENSE @google-gemini/gemini-cli-askmode-approvers
+/.github/workflows/ @google-gemini/gemini-cli-askmode-approvers
+/packages/cli/package.json @google-gemini/gemini-cli-askmode-approvers
+/packages/core/package.json @google-gemini/gemini-cli-askmode-approvers

.github/actions/create-pull-request/action.yml

@@ -0,0 +1,55 @@
+name: 'Create and Merge Pull Request'
+description: 'Creates a pull request and merges it automatically.'
+
+inputs:
+  branch-name:
+    description: 'The name of the branch to create the PR from.'
+    required: true
+  pr-title:
+    description: 'The title of the pull request.'
+    required: true
+  pr-body:
+    description: 'The body of the pull request.'
+    required: true
+  base-branch:
+    description: 'The branch to merge into.'
+    required: true
+    default: 'main'
+  app-id:
+    description: 'The ID of the GitHub App.'
+    required: true
+  private-key:
+    description: 'The private key of the GitHub App.'
+    required: true
+  dry-run:
+    description: 'Whether to run in dry-run mode.'
+    required: false
+    default: 'false'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Generate GitHub App Token'
+      id: 'generate_token'
+      if: "inputs.dry-run == 'false'"
+      uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b'
+      with:
+        app-id: '${{ inputs.app-id }}'
+        private-key: '${{ inputs.private-key }}'
+        permission-pull-requests: 'write'
+        permission-contents: 'write'
+
+    - name: 'Create and Approve Pull Request'
+      if: "inputs.dry-run == 'false'"
+      env:
+        GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
+      shell: 'bash'
+      run: |
+        set -e
+        PR_URL=$(gh pr create \
+          --title "${{ inputs.pr-title }}" \
+          --body "${{ inputs.pr-body }}" \
+          --base "${{ inputs.base-branch }}" \
+          --head "${{ inputs.branch-name }}" \
+          --fill)
+        gh pr merge "$PR_URL" --auto --squash

.github/actions/publish-release/action.yml

@@ -0,0 +1,181 @@
+name: 'Publish Release'
+description: 'Builds, prepares, and publishes the gemini-cli packages to npm and creates a GitHub release.'
+
+inputs:
+  release-version:
+    description: 'The version to release (e.g., 0.1.11).'
+    required: true
+  npm-tag:
+    description: 'The npm tag to publish with (e.g., latest, preview, nightly).'
+    required: true
+  wombat-token-core:
+    description: 'The npm token for the @google/gemini-cli-core package.'
+    required: true
+  wombat-token-cli:
+    description: 'The npm token for the @google/gemini-cli package.'
+    required: true
+  github-token:
+    description: 'The GitHub token for creating the release.'
+    required: true
+  dry-run:
+    description: 'Whether to run in dry-run mode.'
+    type: 'string'
+    required: true
+  release-tag:
+    description: 'The release tag for the release (e.g., v0.1.11).'
+    required: true
+  previous-tag:
+    description: 'The previous tag to use for generating release notes.'
+    required: true
+  skip-github-release:
+    description: 'Whether to skip creating a GitHub release.'
+    type: 'boolean'
+    required: false
+    default: false
+  working-directory:
+    description: 'The working directory to run the steps in.'
+    required: false
+    default: '.'
+  force-skip-tests:
+    description: 'Skip tests and validation'
+    required: false
+    default: false
+
+runs:
+  using: 'composite'
+  steps:
+    - name: '📝 Print Inputs'
+      shell: 'bash'
+      run: |
+        echo "${{ toJSON(inputs) }}"
+
+    - name: '👤 Configure Git User'
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      run: |
+        git config user.name "gemini-cli-robot"
+        git config user.email "gemini-cli-robot@google.com"
+
+    - name: '🌿 Create and switch to a release branch'
+      working-directory: '${{ inputs.working-directory }}'
+      id: 'release_branch'
+      shell: 'bash'
+      run: |
+        BRANCH_NAME="release/${{ inputs.release-tag }}"
+        git switch -c "${BRANCH_NAME}"
+        echo "BRANCH_NAME=${BRANCH_NAME}" >> "${GITHUB_OUTPUT}"
+
+    - name: '⬆️ Update package versions'
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      run: |
+        npm run release:version "${{ inputs.release-version }}"
+
+    - name: '💾 Commit and Conditionally Push package versions'
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      env:
+        BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
+        DRY_RUN: '${{ inputs.dry-run }}'
+        RELEASE_TAG: '${{ inputs.release-tag }}'
+      run: |-
+        git add package.json package-lock.json packages/*/package.json
+        git commit -m "chore(release): ${RELEASE_TAG}"
+        if [[ "${DRY_RUN}" == "false" ]]; then
+          echo "Pushing release branch to remote..."
+          git push --set-upstream origin "${BRANCH_NAME}" --follow-tags
+        else
+          echo "Dry run enabled. Skipping push."
+        fi
+
+    - name: '🛠️ Build and Prepare Packages'
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      run: |
+        npm run build:packages
+        npm run prepare:package
+
+    - name: 'Configure npm for publishing'
+      uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+      with:
+        node-version-file: '${{ inputs.working-directory }}/.nvmrc'
+        registry-url: 'https://wombat-dressing-room.appspot.com'
+        scope: '@google'
+
+    - name: '📦 Publish @google/gemini-cli-core'
+      working-directory: '${{ inputs.working-directory }}'
+      env:
+        NODE_AUTH_TOKEN: '${{ inputs.wombat-token-core }}'
+      shell: 'bash'
+      run: |
+        npm publish \
+          --dry-run="${{ inputs.dry-run }}" \
+          --workspace="@google/gemini-cli-core" \
+          --no-tag
+
+    - name: '🔗 Install latest core package'
+      working-directory: '${{ inputs.working-directory }}'
+      if: "${{ inputs.dry-run == 'false' }}"
+      shell: 'bash'
+      run: |
+        npm install "@google/gemini-cli-core@${{ inputs.release-version }}" \
+        --workspace="@google/gemini-cli" \
+        --save-exact
+
+    - name: '📦 Publish @google/gemini-cli'
+      working-directory: '${{ inputs.working-directory }}'
+      env:
+        NODE_AUTH_TOKEN: '${{ inputs.wombat-token-cli }}'
+      shell: 'bash'
+      run: |
+        npm publish \
+          --dry-run="${{ inputs.dry-run }}" \
+          --workspace="@google/gemini-cli" \
+          --no-tag
+
+    - name: '🔬 Verify NPM release by version'
+      uses: './.github/actions/verify-release'
+      if: "${{ inputs.dry-run == 'false' && inputs.force-skip-tests == 'false' }}"
+      with:
+        npm-package: '@google/gemini-cli@${{ inputs.release-version }}'
+        expected-version: '${{ inputs.release-version }}'
+        ref: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
+
+    - name: '🏷️ Tag release'
+      uses: './.github/actions/tag-npm-release'
+      if: "${{ inputs.dry-run == 'false' }}"
+      with:
+        channel: '${{ inputs.npm-tag }}'
+        version: '${{ inputs.release-version }}'
+        dry-run: '${{ inputs.dry-run }}'
+        wombat-token-core: '${{ inputs.wombat-token-core }}'
+        wombat-token-cli: '${{ inputs.wombat-token-cli }}'
+
+    - name: '🎁 Bundle'
+      working-directory: '${{ inputs.working-directory }}'
+      shell: 'bash'
+      run: |
+        npm run bundle
+
+    - name: '🎉 Create GitHub Release'
+      working-directory: '${{ inputs.working-directory }}'
+      if: "${{ inputs.dry-run == 'false' && inputs.skip-github-release == 'false' && inputs.npm-tag != 'dev' }}"
+      env:
+        GITHUB_TOKEN: '${{ inputs.github-token }}'
+      shell: 'bash'
+      run: |
+        gh release create "${{ inputs.release-tag }}" \
+          bundle/gemini.js \
+          --target "${{ steps.release_branch.outputs.BRANCH_NAME }}" \
+          --title "Release ${{ inputs.release-tag }}" \
+          --notes-start-tag "${{ inputs.previous-tag }}" \
+          --generate-notes
+
+    - name: '🧹 Clean up release branch'
+      working-directory: '${{ inputs.working-directory }}'
+      if: "${{ inputs.dry-run == 'false' }}"
+      continue-on-error: true
+      shell: 'bash'
+      run: |
+        echo "Cleaning up release branch ${{ steps.release_branch.outputs.BRANCH_NAME }}..."
+        git push origin --delete "${{ steps.release_branch.outputs.BRANCH_NAME }}"

.github/actions/push-docker/action.yml

@@ -0,0 +1,73 @@
+name: 'Push to docker'
+description: 'Builds packages and pushes a docker image to GHCR'
+
+inputs:
+  github-actor:
+    description: 'Github actor'
+    required: true
+  github-secret:
+    description: 'Github secret'
+    required: true
+  ref-name:
+    description: 'Github ref name'
+    required: true
+  github-sha:
+    description: 'Github Commit SHA Hash'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Checkout'
+      uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
+      with:
+        ref: '${{ inputs.github-sha }}'
+        fetch-depth: 0
+    - name: 'Install Dependencies'
+      shell: 'bash'
+      run: 'npm install'
+    - name: 'Set up Docker Buildx'
+      uses: 'docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435' # ratchet:docker/setup-buildx-action@v3
+    - name: 'build'
+      shell: 'bash'
+      run: 'npm run build'
+    - name: 'pack @google/gemini-cli'
+      shell: 'bash'
+      run: 'npm pack -w @google/gemini-cli --pack-destination ./packages/cli/dist'
+    - name: 'pack @google/gemini-cli-core'
+      shell: 'bash'
+      run: 'npm pack -w @google/gemini-cli-core --pack-destination ./packages/core/dist'
+    - name: 'Log in to GitHub Container Registry'
+      uses: 'docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1' # ratchet:docker/login-action@v3
+      with:
+        registry: 'ghcr.io'
+        username: '${{ inputs.github-actor }}'
+        password: '${{ inputs.github-secret }}'
+    - name: 'Get branch name'
+      id: 'branch_name'
+      shell: 'bash'
+      run: |
+        REF_NAME="${{ inputs.ref-name }}"
+        echo "name=${REF_NAME%/merge}" >> $GITHUB_OUTPUT
+    - name: 'Build and Push the Docker Image'
+      uses: 'docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83' # ratchet:docker/build-push-action@v6
+      with:
+        context: '.'
+        file: './Dockerfile'
+        push: true
+        provenance: false # avoid pushing 3 images to Aritfact Registry
+        tags: |
+          ghcr.io/${{ github.repository }}/cli:${{ steps.branch_name.outputs.name }}
+          ghcr.io/${{ github.repository }}/cli:${{ inputs.github-sha }}
+    - name: 'Create issue on failure'
+      if: |-
+        ${{ failure() }}
+      shell: 'bash'
+      env:
+        GITHUB_TOKEN: '${{ inputs.github-secret }}'
+        DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+      run: |-
+        gh issue create \
+          --title "Docker build failed" \
+          --body "The docker build failed. See the full run for details: ${DETAILS_URL}" \
+          --label "kind/bug,release-failure"

.github/actions/push-sandbox/action.yaml

@@ -0,0 +1,85 @@
+name: 'Build and push sandbox docker'
+description: 'Pushes sandbox docker image to container registry'
+
+inputs:
+  github-actor:
+    description: 'Github actor'
+    required: true
+  github-secret:
+    description: 'Github secret'
+    required: true
+  github-sha:
+    description: 'Github Commit SHA Hash'
+    required: true
+  github-ref-name:
+    description: 'Github ref name'
+    required: true
+  dry-run:
+    description: 'Whether this is a dry run.'
+    required: true
+    type: 'boolean'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Checkout'
+      uses: 'actions/checkout@v4'
+      with:
+        ref: '${{ inputs.github-sha }}'
+        fetch-depth: 0
+    - name: 'Install Dependencies'
+      shell: 'bash'
+      run: 'npm install'
+    - name: 'npm build'
+      shell: 'bash'
+      run: 'npm run build'
+    - name: 'Set up Docker Buildx'
+      uses: 'docker/setup-buildx-action@v3'
+    - name: 'Log in to GitHub Container Registry'
+      uses: 'docker/login-action@v3'
+      with:
+        registry: 'ghcr.io'
+        username: '${{ inputs.github-actor }}'
+        password: '${{ inputs.github-secret }}'
+    - name: 'determine image tag'
+      id: 'image_tag'
+      shell: 'bash'
+      run: |-
+        SHELL_TAG_NAME="${{ inputs.github-ref-name }}"
+        FINAL_TAG="${{ inputs.github-sha }}"
+        if [[ "$SHELL_TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
+          echo "Release detected."
+          FINAL_TAG="${SHELL_TAG_NAME#v}"
+        else
+          echo "Development release detected. Using commit SHA as tag."
+        fi
+        echo "Determined image tag: $FINAL_TAG"
+        echo "FINAL_TAG=$FINAL_TAG" >> $GITHUB_OUTPUT
+    - name: 'build'
+      id: 'docker_build'
+      shell: 'bash'
+      env:
+        GEMINI_SANDBOX_IMAGE_TAG: '${{ steps.image_tag.outputs.FINAL_TAG }}'
+        GEMINI_SANDBOX: 'docker'
+      run: |-
+        npm run build:sandbox -- \
+          --image ghcr.io/${{ github.repository}}/sandbox:${{ steps.image_tag.outputs.FINAL_TAG }} \
+          --output-file final_image_uri.txt
+        echo "uri=$(cat final_image_uri.txt)" >> $GITHUB_OUTPUT
+    - name: 'publish'
+      shell: 'bash'
+      if: "${{ inputs.dry-run == 'false' }}"
+      run: |-
+        docker push "${{ steps.docker_build.outputs.uri }}"
+    - name: 'Create issue on failure'
+      if: |-
+        ${{ failure() }}
+      shell: 'bash'
+      env:
+        GITHUB_TOKEN: '${{ inputs.github-secret }}'
+        DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+      run: |-
+        gh issue create \
+          --title "Docker build failed" \
+          --body "The docker build failed. See the full run for details: ${DETAILS_URL}" \
+          --label "kind/bug,release-failure"

.github/actions/run-tests/action.yml

@@ -0,0 +1,31 @@
+name: 'Run Tests'
+description: 'Runs the preflight checks and integration tests.'
+
+inputs:
+  force_skip_tests:
+    description: 'Whether to force skip the tests.'
+    required: false
+    type: 'boolean'
+    default: false
+  gemini_api_key:
+    description: 'The API key for running integration tests.'
+    required: true
+  working-directory:
+    description: 'The working directory to run the tests in.'
+    required: false
+    default: '.'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Run Tests'
+      if: "${{ inputs.force_skip_tests != 'true' }}"
+      env:
+        GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'
+      working-directory: '${{ inputs.working-directory }}'
+      run: |-
+        npm run build
+        npm run test:ci
+        npm run test:integration:sandbox:none
+        npm run test:integration:sandbox:docker
+      shell: 'bash'

.github/actions/tag-npm-release/action.yml

@@ -0,0 +1,53 @@
+name: 'Tag an NPM release'
+description: 'Tags a specific npm version to a specific channel.'
+
+inputs:
+  channel:
+    description: 'NPM Channel tag'
+    required: true
+  version:
+    description: 'version'
+    required: true
+  dry-run:
+    description: 'Whether to run in dry-run mode.'
+    required: true
+  wombat-token-core:
+    description: 'The npm token for the wombat @google/gemini-cli-core'
+    required: true
+  wombat-token-cli:
+    description: 'The npm token for wombat @google/gemini-cli'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Setup Node.js'
+      uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+      with:
+        node-version-file: '.nvmrc'
+        registry-url: 'https://wombat-dressing-room.appspot.com'
+        scope: '@google'
+
+    - name: 'Change tag for @google/gemini-cli-core'
+      if: |-
+        ${{ inputs.dry-run == 'false' }}
+      env:
+        NODE_AUTH_TOKEN: '${{ inputs.wombat-token-core }}'
+      shell: 'bash'
+      run: |
+        npm dist-tag add @google/gemini-cli-core@${{ inputs.version }} ${{ inputs.channel }}
+
+    - name: 'Change tag for @google/gemini-cli'
+      if: |-
+        ${{ inputs.dry-run == 'false' }}
+      env:
+        NODE_AUTH_TOKEN: '${{ inputs.wombat-token-cli }}'
+      shell: 'bash'
+      run: |
+        npm dist-tag add @google/gemini-cli@${{ inputs.version }} ${{ inputs.channel }}
+
+    - name: 'Log dry run'
+      if: |-
+        ${{ inputs.dry-run == 'true' }}
+      shell: 'bash'
+      run: |
+        echo "Dry run: Would have added tag '${{ inputs.channel }}' to version '${{ inputs.version }}' for @google/gemini-cli and @google/gemini-cli-core."

.github/actions/verify-release/action.yml

@@ -0,0 +1,57 @@
+name: 'Verify an NPM release'
+description: 'Fetches a package from NPM and does some basic smoke tests'
+
+inputs:
+  npm-package:
+    description: 'NPM Package'
+    required: true
+    default: '@google/gemini-cli@latest'
+  expected-version:
+    description: 'Expected version'
+    required: true
+  ref:
+    description: 'The branch, tag, or SHA to release from.'
+    required: false
+    type: 'string'
+    default: 'main'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: '📝 Print Inputs'
+      shell: 'bash'
+      run: |
+        echo "${{ toJSON(inputs) }}"
+    - name: 'Checkout'
+      uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
+      with:
+        path: 'verify'
+        ref: '${{ github.event.inputs.ref }}'
+        fetch-depth: 0
+
+    - name: 'Install from NPM'
+      uses: 'nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08' # ratchet:nick-fields/retry@v3
+      with:
+        timeout_seconds: 900
+        retry_wait_seconds: 30
+        max_attempts: 10
+        command: 'cd ./verify && pkg="${{ inputs.npm-package }}" && npm install --prefer-online --no-cache -g "$pkg"'
+
+    # This provides a very basic smoke test for Gemini CLI
+    - name: 'Run Gemini CLI'
+      id: 'gemini_cli'
+      shell: 'bash'
+      working-directory: './verify'
+      run: |-
+        echo "gemini_version=$(gemini --version)" >> $GITHUB_OUTPUT
+
+    # Force a failure if it doesn't match
+    - name: 'Fail workflow if version does not match'
+      if: '${{ steps.gemini_cli.outputs.gemini_version != inputs.expected-version }}'
+      shell: 'bash'
+      working-directory: './verify'
+      run: |-
+        echo '❌ Got ${{ steps.gemini_cli.outputs.gemini_version }} from ${{ inputs.npm-package }}'
+        echo '❌ Expected Version ${{ inputs.expected-version }}'
+
+        exit 1

.github/scripts/pr-triage.sh

@@ -19,24 +19,10 @@ process_pr() {
     local PR_NUMBER=$1
     echo "🔄 Processing PR #${PR_NUMBER}"
 
-    # Get PR body with error handling
-    local PR_BODY
-    if ! PR_BODY=$(gh pr view "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json body -q .body 2>/dev/null); then
-        echo "   ⚠️ Could not fetch PR #${PR_NUMBER} details"
-        return 1
-    fi
-
-    # Look for issue references using multiple patterns
-    local ISSUE_NUMBER=""
-
-    # Pattern 1: Direct reference like #123
-    if [[ -z "${ISSUE_NUMBER}" ]]; then
-        ISSUE_NUMBER=$(echo "${PR_BODY}" | grep -oE '#[0-9]+' | head -1 | sed 's/#//' 2>/dev/null || echo "")
-    fi
-
-    # Pattern 2: Closes/Fixes/Resolves patterns (case-insensitive)
-    if [[ -z "${ISSUE_NUMBER}" ]]; then
-        ISSUE_NUMBER=$(echo "${PR_BODY}" | grep -iE '(closes?|fixes?|resolves?) #[0-9]+' | grep -oE '#[0-9]+' | head -1 | sed 's/#//' 2>/dev/null || echo "")
+    # Get closing issue number with error handling
+    local ISSUE_NUMBER
+    if ! ISSUE_NUMBER=$(gh pr view "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json closingIssuesReferences -q '.closingIssuesReferences.nodes[0].number' 2>/dev/null); then
+        echo "   ⚠️ Could not fetch closing issue for PR #${PR_NUMBER}"
     fi
 
     if [[ -z "${ISSUE_NUMBER}" ]]; then
@@ -95,21 +81,6 @@ process_pr() {
             fi
         done
 
-        # Find labels to remove (on PR but not on issue)
-        local LABELS_TO_REMOVE=""
-        for label in "${PR_LABEL_ARRAY[@]}"; do
-            if [[ -n "${label}" ]] && [[ " ${ISSUE_LABEL_ARRAY[*]} " != *" ${label} "* ]]; then
-                # Don't remove status/need-issue since we already handled it
-                if [[ "${label}" != "status/need-issue" ]]; then
-                    if [[ -z "${LABELS_TO_REMOVE}" ]]; then
-                        LABELS_TO_REMOVE="${label}"
-                    else
-                        LABELS_TO_REMOVE="${LABELS_TO_REMOVE},${label}"
-                    fi
-                fi
-            fi
-        done
-
         # Apply label changes
         if [[ -n "${LABELS_TO_ADD}" ]]; then
             echo "➕ Adding labels: ${LABELS_TO_ADD}"
@@ -118,14 +89,7 @@ process_pr() {
             fi
         fi
 
-        if [[ -n "${LABELS_TO_REMOVE}" ]]; then
-            echo "➖ Removing labels: ${LABELS_TO_REMOVE}"
-            if ! gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --remove-label "${LABELS_TO_REMOVE}" 2>/dev/null; then
-                echo "   ⚠️ Failed to remove some labels"
-            fi
-        fi
-
-        if [[ -z "${LABELS_TO_ADD}" ]] && [[ -z "${LABELS_TO_REMOVE}" ]]; then
+        if [[ -z "${LABELS_TO_ADD}" ]]; then
             echo "✅ Labels already synchronized"
         fi
         echo "needs_comment=false" >> "${GITHUB_OUTPUT}"

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: 'Gemini CLI CI'
+name: 'Testing: CI'
 
 on:
   push:
@@ -10,6 +10,7 @@ on:
       - 'main'
       - 'release/**'
   merge_group:
+  workflow_dispatch:
 
 concurrency:
   group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
@@ -25,63 +26,10 @@ defaults:
   run:
     shell: 'bash'
 
-env:
-  ACTIONLINT_VERSION: '1.7.7'
-  SHELLCHECK_VERSION: '0.11.0'
-  YAMLLINT_VERSION: '1.35.1'
-
 jobs:
-  #
-  # Lint: GitHub Actions
-  #
-  lint_github_actions:
-    name: 'Lint (GitHub Actions)'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          fetch-depth: 1
-
-      - name: 'Install shellcheck' # Actionlint uses shellcheck
-        run: |-
-          mkdir -p "${RUNNER_TEMP}/shellcheck"
-          curl -sSLo "${RUNNER_TEMP}/.shellcheck.txz" "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
-          tar -xf "${RUNNER_TEMP}/.shellcheck.txz" -C "${RUNNER_TEMP}/shellcheck" --strip-components=1
-          echo "${RUNNER_TEMP}/shellcheck" >> "${GITHUB_PATH}"
-
-      - name: 'Install actionlint'
-        run: |-
-          mkdir -p "${RUNNER_TEMP}/actionlint"
-          curl -sSLo "${RUNNER_TEMP}/.actionlint.tgz" "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
-          tar -xzf "${RUNNER_TEMP}/.actionlint.tgz" -C "${RUNNER_TEMP}/actionlint"
-          echo "${RUNNER_TEMP}/actionlint" >> "${GITHUB_PATH}"
-
-      # For actionlint, we specifically ignore shellcheck rules that are
-      # annoying or unhelpful. See the shellcheck action for a description.
-      - name: 'Run actionlint'
-        run: |-
-          actionlint \
-            -color \
-            -format '{{range $err := .}}::error file={{$err.Filepath}},line={{$err.Line}},col={{$err.Column}}::{{$err.Filepath}}@{{$err.Line}} {{$err.Message}}%0A```%0A{{replace $err.Snippet "\\n" "%0A"}}%0A```\n{{end}}' \
-            -ignore 'SC2002:' \
-            -ignore 'SC2016:' \
-            -ignore 'SC2129:' \
-            -ignore 'label ".+" is unknown'
-
-      - name: 'Run ratchet'
-        uses: 'sethvargo/ratchet@8b4ca256dbed184350608a3023620f267f0a5253' # ratchet:sethvargo/ratchet@v0.11.4
-        with:
-          files: |-
-            .github/workflows/*.yml
-            .github/actions/**/*.yml
-
-  #
-  # Lint: Javascript
-  #
-  lint_javascript:
-    name: 'Lint (Javascript)'
-    runs-on: 'ubuntu-latest'
+  lint:
+    name: 'Lint'
+    runs-on: 'gemini-cli-ubuntu-16-core'
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
@@ -94,161 +42,33 @@ jobs:
           node-version-file: '.nvmrc'
           cache: 'npm'
 
-      - name: 'Run lockfile check'
-        run: |-
-          npm run check:lockfile
-
       - name: 'Install dependencies'
-        run: |-
-          npm ci
+        run: 'npm ci'
 
-      - name: 'Run formatter check'
-        run: |-
-          npm run format
-          git diff --exit-code
+      - name: 'Check lockfile'
+        run: 'npm run check:lockfile'
 
-      - name: 'Run linter'
-        run: |-
-          npm run lint:ci
+      - name: 'Install linters'
+        run: 'node scripts/lint.js --setup'
 
-      - name: 'Run linter on integration tests'
-        run: |-
-          npx eslint integration-tests --max-warnings 0
+      - name: 'Run ESLint'
+        run: 'node scripts/lint.js --eslint'
 
-      - name: 'Run formatter on integration tests'
-        run: |-
-          npx prettier --check integration-tests
-          git diff --exit-code
+      - name: 'Run actionlint'
+        run: 'node scripts/lint.js --actionlint'
 
-      - name: 'Build project'
-        run: |-
-          npm run build
-
-      - name: 'Run type check'
-        run: |-
-          npm run typecheck
-
-  #
-  # Lint: Shell
-  #
-  lint_shell:
-    name: 'Lint (Shell)'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          fetch-depth: 1
-
-      - name: 'Install shellcheck'
-        run: |-
-          mkdir -p "${RUNNER_TEMP}/shellcheck"
-          curl -sSLo "${RUNNER_TEMP}/.shellcheck.txz" "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
-          tar -xf "${RUNNER_TEMP}/.shellcheck.txz" -C "${RUNNER_TEMP}/shellcheck" --strip-components=1
-          echo "${RUNNER_TEMP}/shellcheck" >> "${GITHUB_PATH}"
-
-      - name: 'Install shellcheck problem matcher'
-        run: |-
-          cat > "${RUNNER_TEMP}/shellcheck/problem-matcher-lint-shell.json" <<"EOF"
-          {
-            "problemMatcher": [
-              {
-                "owner": "lint_shell",
-                "pattern": [
-                  {
-                    "regexp": "^(.*):(\\\\d+):(\\\\d+):\\\\s+(?:fatal\\\\s+)?(warning|error):\\\\s+(.*)$",
-                    "file": 1,
-                    "line": 2,
-                    "column": 3,
-                    "severity": 4,
-                    "message": 5
-                  }
-                ]
-              }
-            ]
-          }
-          EOF
-          echo "::add-matcher::${RUNNER_TEMP}/shellcheck/problem-matcher-lint-shell.json"
-
-      # Note that only warning and error severity show up in the github files
-      # page. So we replace 'style' and 'note' with 'warning' to make it show
-      # up.
-      #
-      # We also try and find all bash scripts even if they don't have an
-      # explicit extension.
-      #
-      # We explicitly ignore the following rules:
-      #
-      # - SC2002: This rule suggests using "cmd < file" instead of "cat | cmd".
-      #   While < is more efficient, pipes are much more readable and expected.
-      #
-      # - SC2129: This rule suggests grouping multiple writes to a file in
-      #   braces like "{ cmd1; cmd2; } >> file". This is unexpected and less
-      #   readable.
-      #
-      # - SC2310: This is an optional warning that only appears with "set -e"
-      #   and when a command is used as a conditional.
       - name: 'Run shellcheck'
-        run: |-
-          git ls-files | grep -E '^([^.]+|.*\.(sh|zsh|bash))$' | xargs file --mime-type \
-            | grep "text/x-shellscript" | awk '{ print substr($1, 1, length($1)-1) }' \
-            | xargs shellcheck \
-              --check-sourced \
-              --enable=all \
-              --exclude=SC2002,SC2129,SC2310 \
-              --severity=style \
-              --format=gcc \
-              --color=never | sed -e 's/note:/warning:/g' -e 's/style:/warning:/g'
-
-  #
-  # Lint: YAML
-  #
-  lint_yaml:
-    name: 'Lint (YAML)'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          fetch-depth: 1
-
-      - name: 'Setup Python'
-        uses: 'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065' # ratchet:actions/setup-python@v5
-        with:
-          python-version: '3'
-
-      - name: 'Install yamllint'
-        run: |-
-          pip install --user "yamllint==${YAMLLINT_VERSION}"
+        run: 'node scripts/lint.js --shellcheck'
 
       - name: 'Run yamllint'
-        run: |-
-          git ls-files | grep -E '\.(yaml|yml)' | xargs yamllint --format github
+        run: 'node scripts/lint.js --yamllint'
 
-  #
-  # Lint: All
-  #
-  # This is a virtual job that other jobs depend on to wait for all linters to
-  # finish. It's also used to ensure linting happens on CI via required
-  # workflows.
-  lint:
-    name: 'Lint'
-    needs:
-      - 'lint_github_actions'
-      - 'lint_javascript'
-      - 'lint_shell'
-      - 'lint_yaml'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - run: |-
-          echo 'All linters finished!'
+      - name: 'Run Prettier'
+        run: 'node scripts/lint.js --prettier'
 
-  #
-  # Test: Node
-  #
-  test:
-    name: 'Test'
-    runs-on: '${{ matrix.os }}'
+  test_linux:
+    name: 'Test (Linux)'
+    runs-on: 'gemini-cli-ubuntu-16-core'
     needs:
       - 'lint'
     permissions:
@@ -256,12 +76,7 @@ jobs:
       checks: 'write'
       pull-requests: 'write'
     strategy:
-      fail-fast: false # So we can see all test failures
       matrix:
-        os:
-          - 'macos-latest'
-          - 'ubuntu-latest'
-          - 'windows-latest'
         node-version:
           - '20.x'
           - '22.x'
@@ -277,18 +92,19 @@ jobs:
           cache: 'npm'
 
       - name: 'Build project'
-        run: |-
-          npm run build
+        run: 'npm run build'
 
       - name: 'Install dependencies for testing'
-        run: |-
-          npm ci
+        run: 'npm ci'
 
       - name: 'Run tests and generate reports'
         env:
           NO_COLOR: true
         run: 'npm run test:ci'
 
+      - name: 'Wait for file system sync'
+        run: 'sleep 2'
+
       - name: 'Publish Test Report (for non-forks)'
         if: |-
           ${{ always() && (github.event.pull_request.head.repo.full_name == github.repository) }}
@@ -304,7 +120,67 @@ jobs:
           ${{ always() && (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
         uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
         with:
-          name: 'test-results-fork-${{ matrix.node-version }}-${{ matrix.os }}'
+          name: 'test-results-fork-${{ matrix.node-version }}-${{ runner.os }}'
+          path: 'packages/*/junit.xml'
+
+  test_slow_platforms:
+    name: 'Slow Test - Mac'
+    runs-on: '${{ matrix.os }}'
+    needs:
+      - 'lint'
+    permissions:
+      contents: 'read'
+      checks: 'write'
+      pull-requests: 'write'
+    continue-on-error: true
+    strategy:
+      matrix:
+        os:
+          - 'macos-latest'
+        node-version:
+          - '20.x'
+          - '22.x'
+          - '24.x'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+
+      - name: 'Set up Node.js ${{ matrix.node-version }}'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '${{ matrix.node-version }}'
+          cache: 'npm'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Install dependencies for testing'
+        run: 'npm ci'
+
+      - name: 'Run tests and generate reports'
+        env:
+          NO_COLOR: true
+        run: 'npm run test:ci -- --coverage.enabled=false'
+
+      - name: 'Wait for file system sync'
+        run: 'sleep 2'
+
+      - name: 'Publish Test Report (for non-forks)'
+        if: |-
+          ${{ always() && (github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: 'dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3' # ratchet:dorny/test-reporter@v2
+        with:
+          name: 'Test Results (Node ${{ matrix.node-version }})'
+          path: 'packages/*/junit.xml'
+          reporter: 'java-junit'
+          fail-on-error: 'false'
+
+      - name: 'Upload Test Results Artifact (for forks)'
+        if: |-
+          ${{ always() && (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'test-results-fork-${{ matrix.node-version }}-${{ runner.os }}'
           path: 'packages/*/junit.xml'
 
       - name: 'Upload coverage reports'
@@ -315,47 +191,9 @@ jobs:
           name: 'coverage-reports-${{ matrix.node-version }}-${{ matrix.os }}'
           path: 'packages/*/coverage'
 
-  post_coverage_comment:
-    name: 'Post Coverage Comment'
-    runs-on: 'ubuntu-latest'
-    needs: 'test'
-    if: |-
-      ${{ always() && github.event_name == 'pull_request' && (github.event.pull_request.head.repo.full_name == github.repository) }}
-    continue-on-error: true
-    permissions:
-      contents: 'read' # For checkout
-      pull-requests: 'write' # For commenting
-    strategy:
-      matrix:
-        # Reduce noise by only posting the comment once
-        os:
-          - 'ubuntu-latest'
-        node-version:
-          - '22.x'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-
-      - name: 'Download coverage reports artifact'
-        uses: 'actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0' # ratchet:actions/download-artifact@v5
-        with:
-          name: 'coverage-reports-${{ matrix.node-version }}-${{ matrix.os }}'
-          path: 'coverage_artifact' # Download to a specific directory
-
-      - name: 'Post Coverage Comment using Composite Action'
-        uses: './.github/actions/post-coverage-comment' # Path to the composite action directory
-        with:
-          cli_json_file: 'coverage_artifact/cli/coverage/coverage-summary.json'
-          core_json_file: 'coverage_artifact/core/coverage/coverage-summary.json'
-          cli_full_text_summary_file: 'coverage_artifact/cli/coverage/full-text-summary.txt'
-          core_full_text_summary_file: 'coverage_artifact/core/coverage/full-text-summary.txt'
-          node_version: '${{ matrix.node-version }}'
-          os: '${{ matrix.os }}'
-          github_token: '${{ secrets.GITHUB_TOKEN }}'
-
   codeql:
     name: 'CodeQL'
-    runs-on: 'ubuntu-latest'
+    runs-on: 'gemini-cli-ubuntu-16-core'
     permissions:
       actions: 'read'
       contents: 'read'
@@ -375,7 +213,8 @@ jobs:
   # Check for changes in bundle size.
   bundle_size:
     name: 'Check Bundle Size'
-    runs-on: 'ubuntu-latest'
+    if: "github.event_name == 'pull_request'"
+    runs-on: 'gemini-cli-ubuntu-16-core'
     permissions:
       contents: 'read' # For checkout
       pull-requests: 'write' # For commenting
@@ -392,3 +231,80 @@ jobs:
           pattern: './bundle/**/*.{js,sb}'
           minimum-change-threshold: '1000'
           compression: 'none'
+          clean-script: 'clean'
+
+  test_windows:
+    name: 'Slow Test - Win'
+    runs-on: 'gemini-cli-windows-16-core'
+    continue-on-error: true
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+
+      - name: 'Set up Node.js 20.x'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+
+      - name: 'Configure Windows Defender exclusions'
+        run: |
+          Add-MpPreference -ExclusionPath $env:GITHUB_WORKSPACE -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\node_modules" -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\packages" -Force
+          Add-MpPreference -ExclusionPath "$env:TEMP" -Force
+        shell: 'pwsh'
+
+      - name: 'Configure npm for Windows performance'
+        run: |
+          npm config set progress false
+          npm config set audit false
+          npm config set fund false
+          npm config set loglevel error
+          npm config set maxsockets 32
+          npm config set registry https://registry.npmjs.org/
+        shell: 'pwsh'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+        shell: 'pwsh'
+
+      - name: 'Build project'
+        run: 'npm run build'
+        shell: 'pwsh'
+        env:
+          NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
+          UV_THREADPOOL_SIZE: '32'
+          NODE_ENV: 'production'
+
+      - name: 'Run tests and generate reports'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          NO_COLOR: true
+          NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
+          UV_THREADPOOL_SIZE: '32'
+          NODE_ENV: 'test'
+        run: 'npm run test:ci -- --coverage.enabled=false'
+        shell: 'pwsh'
+
+  ci:
+    name: 'CI'
+    if: 'always()'
+    needs:
+      - 'lint'
+      - 'test_linux'
+      - 'codeql'
+      - 'bundle_size'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    steps:
+      - name: 'Check all job results'
+        run: |
+          if [[ (${{ needs.lint.result }} != 'success' && ${{ needs.lint.result }} != 'skipped') || \
+               (${{ needs.test_linux.result }} != 'success' && ${{ needs.test_linux.result }} != 'skipped') || \
+               (${{ needs.codeql.result }} != 'success' && ${{ needs.codeql.result }} != 'skipped') || \
+               (${{ needs.bundle_size.result }} != 'success' && ${{ needs.bundle_size.result }} != 'skipped') ]]; then
+            echo "One or more CI jobs failed."
+            exit 1
+          fi
+          echo "All CI jobs passed!"

.github/workflows/e2e.yml

@@ -1,4 +1,4 @@
-name: 'E2E Tests'
+name: 'Testing: E2E'
 
 on:
   push:
@@ -14,32 +14,63 @@ on:
     types: ['labeled']
   merge_group:
 
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: |-
+    ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/heads/release/') }}
+
 jobs:
-  e2e-test:
-    name: 'E2E Test (${{ matrix.os }}) - ${{ matrix.sandbox }}'
-    # This condition ensures the job runs for pushes to main, merge groups,
-    # PRs from the base repo, OR PRs from forks with the correct label.
+  build:
+    name: 'Build Project'
+    runs-on: 'gemini-cli-ubuntu-16-core'
     if: |
       github.event_name == 'push' ||
       github.event_name == 'merge_group' ||
       (github.event.pull_request.head.repo.full_name == github.repository) ||
       (github.event.label.name == 'maintainer:e2e:ok')
-    runs-on: '${{ matrix.os }}'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Archive build artifacts'
+        run: 'tar -cvf build-artifacts.tar bundle/ node_modules/ packages/ package.json'
+
+      - name: 'Upload build artifacts'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
+        with:
+          name: 'build-artifacts-${{ github.run_id }}'
+          path: 'build-artifacts.tar'
+
+  e2e_linux:
+    name: 'E2E Test (Linux) - ${{ matrix.sandbox }}'
+    needs:
+      - 'build'
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'merge_group' ||
+      (github.event.pull_request.head.repo.full_name == github.repository) ||
+      (github.event.label.name == 'maintainer:e2e:ok')
+    runs-on: 'gemini-cli-ubuntu-16-core'
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - 'ubuntu-latest'
-          - 'macos-latest'
         sandbox:
           - 'sandbox:none'
           - 'sandbox:docker'
         node-version:
           - '20.x'
-        exclude:
-          # Docker tests are not supported on macOS or Windows
-          - os: 'macos-latest'
-            sandbox: 'sandbox:docker'
 
     steps:
       - name: 'Checkout (fork)'
@@ -53,23 +84,22 @@ jobs:
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         if: "github.event_name != 'pull_request_target'"
 
+      - name: 'Download build artifacts'
+        uses: 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        with:
+          name: 'build-artifacts-${{ github.run_id }}'
+          path: '.'
+
+      - name: 'Extract build artifacts'
+        run: 'tar -xvf build-artifacts.tar'
+
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
         with:
           node-version: '${{ matrix.node-version }}'
-          cache: 'npm'
-
-      - name: 'Install dependencies'
-        run: |-
-          npm ci
-
-      - name: 'Build project'
-        run: |-
-          npm run build
 
       - name: 'Set up Docker'
-        if: |-
-          matrix.os == 'ubuntu-latest' && matrix.sandbox == 'sandbox:docker'
+        if: "matrix.sandbox == 'sandbox:docker'"
         uses: 'docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435' # ratchet:docker/setup-buildx-action@v3
 
       - name: 'Run E2E tests'
@@ -78,5 +108,153 @@ jobs:
           KEEP_OUTPUT: 'true'
           SANDBOX: '${{ matrix.sandbox }}'
           VERBOSE: 'true'
-        run: |-
-          npm run "test:integration:${SANDBOX}"
+          GEMINI_SANDBOX: 'docker'
+        shell: 'bash'
+        run: |
+          if [[ "${{ matrix.sandbox }}" == "sandbox:docker" ]]; then
+            npm run build:sandbox
+          fi
+          npx vitest run --root ./integration-tests
+
+  e2e_slow_platforms:
+    name: 'Slow E2E - Mac'
+    needs:
+      - 'build'
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'merge_group' ||
+      (github.event.pull_request.head.repo.full_name == github.repository) ||
+      (github.event.label.name == 'maintainer:e2e:ok')
+    runs-on: '${{ matrix.os }}'
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - 'macos-latest'
+        node-version:
+          - '20.x'
+
+    steps:
+      - name: 'Checkout (fork)'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        if: "github.event_name == 'pull_request_target'"
+        with:
+          ref: '${{ github.event.pull_request.head.sha }}'
+          repository: '${{ github.event.pull_request.head.repo.full_name }}'
+
+      - name: 'Checkout (internal)'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        if: "github.event_name != 'pull_request_target'"
+
+      - name: 'Download build artifacts'
+        uses: 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        with:
+          name: 'build-artifacts-${{ github.run_id }}'
+          path: '.'
+
+      - name: 'Extract build artifacts'
+        run: 'tar -xvf build-artifacts.tar'
+
+      - name: 'Set up Node.js ${{ matrix.node-version }}'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version: '${{ matrix.node-version }}'
+
+      - name: 'Fix rollup optional dependencies on macOS'
+        if: "runner.os == 'macOS'"
+        run: |
+          npm cache clean --force
+          npm install --no-save @rollup/rollup-darwin-arm64 || true
+
+      - name: 'Run E2E tests (non-Windows)'
+        if: "runner.os != 'Windows'"
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          KEEP_OUTPUT: 'true'
+          SANDBOX: 'sandbox:none'
+          VERBOSE: 'true'
+        run: 'npx vitest run --root ./integration-tests'
+
+  e2e_windows:
+    name: 'Slow E2E - Win'
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'merge_group' ||
+      (github.event.pull_request.head.repo.full_name == github.repository) ||
+      (github.event.label.name == 'maintainer:e2e:ok')
+    runs-on: 'gemini-cli-windows-16-core'
+    continue-on-error: true
+
+    steps:
+      - name: 'Checkout (fork)'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        if: "github.event_name == 'pull_request_target'"
+        with:
+          ref: '${{ github.event.pull_request.head.sha }}'
+          repository: '${{ github.event.pull_request.head.repo.full_name }}'
+
+      - name: 'Checkout (internal)'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        if: "github.event_name != 'pull_request_target'"
+
+      - name: 'Set up Node.js 20.x'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+
+      - name: 'Configure Windows Defender exclusions'
+        run: |
+          Add-MpPreference -ExclusionPath $env:GITHUB_WORKSPACE -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\node_modules" -Force
+          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\packages" -Force
+          Add-MpPreference -ExclusionPath "$env:TEMP" -Force
+        shell: 'pwsh'
+
+      - name: 'Configure npm for Windows performance'
+        run: |
+          npm config set progress false
+          npm config set audit false
+          npm config set fund false
+          npm config set loglevel error
+          npm config set maxsockets 32
+          npm config set registry https://registry.npmjs.org/
+        shell: 'pwsh'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+        shell: 'pwsh'
+
+      - name: 'Run E2E tests'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          KEEP_OUTPUT: 'true'
+          SANDBOX: 'sandbox:none'
+          VERBOSE: 'true'
+          NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
+          UV_THREADPOOL_SIZE: '32'
+          NODE_ENV: 'test'
+        shell: 'pwsh'
+        run: 'npx vitest run --root ./integration-tests'
+
+  e2e:
+    name: 'E2E'
+    if: |
+      always() && (
+        github.event_name == 'push' ||
+        github.event_name == 'merge_group' ||
+        (github.event.pull_request.head.repo.full_name == github.repository) ||
+        (github.event.label.name == 'maintainer:e2e:ok')
+      )
+    needs:
+      - 'e2e_linux'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    steps:
+      - name: 'Check E2E test results'
+        run: |
+          if [[ ${{ needs.e2e_linux.result }} != 'success' ]]; then
+            echo "The required E2E test job failed."
+            exit 1
+          fi
+          echo "All required E2E test jobs passed!"

.github/workflows/eval.yml

@@ -3,27 +3,46 @@ name: 'Eval'
 on:
   workflow_dispatch:
 
+defaults:
+  run:
+    shell: 'bash'
+
+permissions:
+  contents: 'read'
+  id-token: 'write'
+  packages: 'read'
+
 jobs:
   eval:
     name: 'Eval'
+    if: >-
+      github.repository == 'google-gemini/gemini-cli'
     runs-on: 'ubuntu-latest'
-    strategy:
-      matrix:
-        node-version:
-          - '20.x'
-          - '22.x'
-          - '24.x'
+    container:
+      image: 'ghcr.io/google-gemini/gemini-cli-swe-agent-eval@sha256:cd5edc4afd2245c1f575e791c0859b3c084a86bb3bd9a6762296da5162b35a8f'
+      credentials:
+        username: '${{ github.actor }}'
+        password: '${{ secrets.GITHUB_TOKEN }}'
+      env:
+        GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        DEFAULT_VERTEXAI_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
+        GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
+        GEMINI_API_KEY: '${{ secrets.EVAL_GEMINI_API_KEY }}'
+        GCLI_LOCAL_FILE_TELEMETRY: 'True'
+        EVAL_GCS_BUCKET: '${{ vars.EVAL_GCS_ARTIFACTS_BUCKET }}'
     steps:
-      - name: 'Set up Node.js ${{ matrix.node-version }}'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+      - name: 'Authenticate to Google Cloud'
+        id: 'auth'
+        uses: 'google-github-actions/auth@v2' # ratchet:exclude
         with:
-          node-version: '${{ matrix.node-version }}'
-          cache: 'npm'
+          project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
+          workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
+          service_account: '${{ vars.SERVICE_ACCOUNT_EMAIL }}'
+          token_format: 'access_token'
+          access_token_scopes: 'https://www.googleapis.com/auth/cloud-platform'
 
-      - name: 'Set up Python'
-        uses: 'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065' # ratchet:actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: 'Install and configure Poetry'
-        uses: 'snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a' # ratchet:snok/install-poetry@v1
+      - name: 'Run evaluation'
+        working-directory: '/app'
+        run: |
+          poetry run exp_run --experiment-mode=on-demand --branch-or-commit=${{ github.ref_name }} --model-name=gemini-2.5-pro --dataset=swebench_verified --concurrency=15
+          poetry run python agent_prototypes/scripts/parse_gcli_logs_experiment.py --experiment_dir=experiments/adhoc/gcli_temp_exp --gcs-bucket="${EVAL_GCS_BUCKET}" --gcs-path=gh_action_artifacts

.github/workflows/gemini-automated-issue-triage.yml

@@ -288,17 +288,19 @@ jobs:
 
             const issueNumber = parseInt(process.env.ISSUE_NUMBER);
             const explanation = parsedLabels.explanation || '';
+            const labelsToSet = parsedLabels.labels_to_set || [];
+            labelsToSet.push('status/bot-triaged');
 
             // Set labels based on triage result
-            if (parsedLabels.labels_to_set && parsedLabels.labels_to_set.length > 0) {
+            if (labelsToSet.length > 0) {
               await github.rest.issues.setLabels({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 issue_number: issueNumber,
-                labels: parsedLabels.labels_to_set
+                labels: labelsToSet
               });
               const explanationInfo = explanation ? ` - ${explanation}` : '';
-              core.info(`Successfully set labels for #${issueNumber}: ${parsedLabels.labels_to_set.join(', ')}${explanationInfo}`);
+              core.info(`Successfully set labels for #${issueNumber}: ${labelsToSet.join(', ')}${explanationInfo}`);
             } else {
               // If no labels to set, leave the issue as is
               const explanationInfo = explanation ? ` - ${explanation}` : '';

.github/workflows/gemini-scheduled-issue-triage.yml

@@ -286,15 +286,18 @@ jobs:
                 continue;
               }
 
-              if (entry.labels_to_add && entry.labels_to_add.length > 0) {
+              const labelsToAdd = entry.labels_to_add || [];
+              labelsToAdd.push('status/bot-triaged');
+
+              if (labelsToAdd.length > 0) {
                 await github.rest.issues.addLabels({
                   owner: context.repo.owner,
                   repo: context.repo.repo,
                   issue_number: issueNumber,
-                  labels: entry.labels_to_add
+                  labels: labelsToAdd
                 });
                 const explanation = entry.explanation ? ` - ${entry.explanation}` : '';
-                core.info(`Successfully added labels for #${issueNumber}: ${entry.labels_to_add.join(', ')}${explanation}`);
+                core.info(`Successfully added labels for #${issueNumber}: ${labelsToAdd.join(', ')}${explanation}`);
               }
 
               if (entry.labels_to_remove && entry.labels_to_remove.length > 0) {

.github/workflows/release-change-tags.yml

@@ -0,0 +1,56 @@
+name: 'Release: Change Tags'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The package version to tag (e.g., 0.5.0-preview-2). This version must already exist on the npm registry.'
+        required: true
+        type: 'string'
+      channel:
+        description: 'The npm dist-tag to apply (e.g., latest, preview, nightly).'
+        required: true
+        type: 'choice'
+        options:
+          - 'latest'
+          - 'preview'
+          - 'nightly'
+      ref:
+        description: 'The branch, tag, or SHA to run from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      dry-run:
+        description: 'Whether to run in dry-run mode.'
+        required: false
+        type: 'boolean'
+        default: true
+
+jobs:
+  change-tags:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@v4'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          registry-url: 'https://wombat-dressing-room.appspot.com'
+          scope: '@google'
+
+      - name: 'Change tag'
+        uses: './.github/actions/tag-npm-release'
+        with:
+          channel: '${{ github.event.inputs.channel }}'
+          version: '${{ github.event.inputs.version }}'
+          dry-run: '${{ github.event.inputs.dry-run }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'

.github/workflows/release-manual.yml

@@ -0,0 +1,89 @@
+name: 'Release: Manual'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The version to release (e.g., v0.1.11). Must be a valid semver string with a "v" prefix.'
+        required: true
+        type: 'string'
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: true
+        type: 'string'
+      npm_channel:
+        description: 'The npm channel to publish to.'
+        required: true
+        type: 'choice'
+        options:
+          - 'preview'
+          - 'nightly'
+          - 'latest'
+          - 'dev'
+        default: 'dev'
+      dry_run:
+        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
+        required: true
+        type: 'boolean'
+        default: true
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+      skip_github_release:
+        description: 'Select to skip creating a GitHub release and create a npm release only.'
+        required: false
+        type: 'boolean'
+        default: false
+
+jobs:
+  release:
+    runs-on: 'self-hosted'
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Prepare Release Info'
+        id: 'release_info'
+        run: |
+          RELEASE_VERSION="${{ github.event.inputs.version }}"
+          echo "RELEASE_VERSION=${RELEASE_VERSION#v}" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_TAG=$(git describe --tags --abbrev=0)" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Run Tests'
+        if: |-
+          ${{ github.event.inputs.force_skip_tests != true }}
+        uses: './.github/actions/run-tests'
+        with:
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          force-skip-tests: '${{ github.event.inputs.force_skip_tests }}'
+          release-version: '${{ steps.release_info.outputs.RELEASE_VERSION }}'
+          release-tag: '${{ github.event.inputs.version }}'
+          npm-tag: '${{ github.event.inputs.npm_channel }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ steps.release_info.outputs.PREVIOUS_TAG }}'
+          skip-github-release: '${{ github.event.inputs.skip_github_release }}'

.github/workflows/release-nightly.yml

@@ -0,0 +1,97 @@
+name: 'Release: Nightly'
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
+        required: true
+        type: 'boolean'
+        default: true
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: false
+        type: 'string'
+        default: 'main'
+
+jobs:
+  release:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+      pull-requests: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Run Tests'
+        uses: './.github/actions/run-tests'
+        with:
+          force_skip_tests: '${{ github.event.inputs.force_skip_tests }}'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+
+      - name: 'Get Nightly Version'
+        id: 'nightly_version'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          VERSION_JSON=$(node scripts/get-release-version.js --type=nightly)
+          echo "RELEASE_TAG=$(echo "${VERSION_JSON}" | jq -r .releaseTag)" >> "${GITHUB_OUTPUT}"
+          echo "RELEASE_VERSION=$(echo "${VERSION_JSON}" | jq -r .releaseVersion)" >> "${GITHUB_OUTPUT}"
+          echo "NPM_TAG=$(echo "${VERSION_JSON}" | jq -r .npmTag)" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_TAG=$(echo "${VERSION_JSON}" | jq -r .previousReleaseTag)" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          release-version: '${{ steps.nightly_version.outputs.RELEASE_VERSION }}'
+          release-tag: '${{ steps.nightly_version.outputs.RELEASE_TAG }}'
+          npm-tag: '${{ steps.nightly_version.outputs.NPM_TAG }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ steps.nightly_version.outputs.PREVIOUS_TAG }}'
+
+      - name: 'Create and Merge Pull Request'
+        uses: './.github/actions/create-pull-request'
+        with:
+          branch-name: 'release/${{ steps.nightly_version.outputs.RELEASE_TAG }}'
+          pr-title: 'chore(release): bump version to ${{ steps.nightly_version.outputs.RELEASE_VERSION }}'
+          pr-body: 'Automated version bump for nightly release.'
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry_run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: '${{ steps.nightly_version.outputs.RELEASE_TAG }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Nightly Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')' \
+            --body 'The nightly-release workflow failed. See the full run for details: ${DETAILS_URL}' \
+            --label 'kind/bug,release-failure,priority/p0'

.github/workflows/release-patch-1-create-pr.yml

@@ -0,0 +1,109 @@
+name: 'Release: Patch (1) Create PR'
+
+on:
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: 'The commit SHA to cherry-pick for the patch.'
+        required: true
+        type: 'string'
+      channel:
+        description: 'The release channel to patch.'
+        required: true
+        type: 'choice'
+        options:
+          - 'stable'
+          - 'preview'
+      dry_run:
+        description: 'Whether to run in dry-run mode.'
+        required: false
+        type: 'boolean'
+        default: false
+      ref:
+        description: 'The branch, tag, or SHA to test from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      original_pr:
+        description: 'The original PR number to comment back on.'
+        required: false
+        type: 'string'
+
+jobs:
+  create-patch:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+      actions: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Script Dependencies'
+        run: 'npm install yargs'
+
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b'
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+          permission-pull-requests: 'write'
+          permission-contents: 'write'
+
+      - name: 'Configure Git User'
+        run: |-
+          git config user.name "gemini-cli-robot"
+          git config user.email "gemini-cli-robot@google.com"
+          # Configure git to use GITHUB_TOKEN for remote operations (has actions:write for workflow files)
+          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git"
+
+      - name: 'Create Patch'
+        id: 'create_patch'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
+        continue-on-error: true
+        run: |
+          # Capture output and display it in logs using tee
+          {
+            node scripts/releasing/create-patch-pr.js --commit=${{ github.event.inputs.commit }} --channel=${{ github.event.inputs.channel }} --dry-run=${{ github.event.inputs.dry_run }}
+            echo "EXIT_CODE=$?" >> "$GITHUB_OUTPUT"
+          } 2>&1 | tee >(
+            echo "LOG_CONTENT<<EOF" >> "$GITHUB_ENV"
+            cat >> "$GITHUB_ENV"
+            echo "EOF" >> "$GITHUB_ENV"
+          )
+
+      - name: 'Comment on Original PR'
+        if: 'always() && inputs.original_pr'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ORIGINAL_PR: '${{ github.event.inputs.original_pr }}'
+          EXIT_CODE: '${{ steps.create_patch.outputs.EXIT_CODE }}'
+          COMMIT: '${{ github.event.inputs.commit }}'
+          CHANNEL: '${{ github.event.inputs.channel }}'
+          REPOSITORY: '${{ github.repository }}'
+          GITHUB_RUN_ID: '${{ github.run_id }}'
+          LOG_CONTENT: '${{ env.LOG_CONTENT }}'
+        continue-on-error: true
+        run: |
+          git checkout '${{ github.event.inputs.ref }}'
+          node scripts/releasing/patch-create-comment.js
+
+      - name: 'Fail Workflow if Main Task Failed'
+        if: 'always() && steps.create_patch.outputs.EXIT_CODE != 0'
+        run: |
+          echo "Patch creation failed with exit code: ${{ steps.create_patch.outputs.EXIT_CODE }}"
+          echo "Check the logs above and the comment posted to the original PR for details."
+          exit 1

.github/workflows/release-patch-2-trigger.yml

@@ -0,0 +1,72 @@
+name: 'Release: Patch (2) Trigger'
+
+on:
+  pull_request:
+    types:
+      - 'closed'
+    branches:
+      - 'release/**'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'The head ref of the merged hotfix PR to trigger the release for (e.g. hotfix/v1.2.3/cherry-pick-abc).'
+        required: true
+        type: 'string'
+      workflow_ref:
+        description: 'The ref to checkout the workflow code from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      workflow_id:
+        description: 'The workflow to trigger. Defaults to patch-release.yml'
+        required: false
+        type: 'string'
+        default: 'release-patch-3-release.yml'
+      dry_run:
+        description: 'Whether this is a dry run.'
+        required: false
+        type: 'boolean'
+        default: false
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+
+jobs:
+  trigger-patch-release:
+    if: "(github.event_name == 'pull_request' && github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'hotfix/')) || github.event_name == 'workflow_dispatch'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      actions: 'write'
+      contents: 'write'
+      pull-requests: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: "${{ github.event.inputs.workflow_ref || 'main' }}"
+          fetch-depth: 1
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Trigger Patch Release'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          HEAD_REF: "${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.event.inputs.ref }}"
+          PR_BODY: "${{ github.event_name == 'pull_request' && github.event.pull_request.body || '' }}"
+          WORKFLOW_ID: '${{ github.event.inputs.workflow_id }}'
+          GITHUB_REPOSITORY_OWNER: '${{ github.repository_owner }}'
+          GITHUB_REPOSITORY_NAME: '${{ github.event.repository.name }}'
+          GITHUB_EVENT_NAME: '${{ github.event_name }}'
+          GITHUB_EVENT_PAYLOAD: '${{ toJSON(github.event) }}'
+          FORCE_SKIP_TESTS: '${{ github.event.inputs.force_skip_tests }}'
+        run: |
+          node scripts/releasing/patch-trigger.js

.github/workflows/release-patch-3-release.yml

@@ -0,0 +1,219 @@
+name: 'Release: Patch (3) Release'
+
+on:
+  workflow_dispatch:
+    inputs:
+      type:
+        description: 'The type of release to perform.'
+        required: true
+        type: 'choice'
+        options:
+          - 'stable'
+          - 'preview'
+      dry_run:
+        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
+        required: true
+        type: 'boolean'
+        default: true
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+      release_ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: true
+        type: 'string'
+      original_pr:
+        description: 'The original PR number to comment back on.'
+        required: false
+        type: 'string'
+
+jobs:
+  release:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: 'Checkout Release Code'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.release_ref }}'
+          path: 'release'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        working-directory: './release'
+        run: |-
+          npm ci
+
+      - name: 'Print Inputs'
+        shell: 'bash'
+        run: |-
+          echo "${{ toJSON(inputs) }}"
+
+      - name: 'Get Patch Version'
+        id: 'patch_version'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          # Use the existing get-release-version.js script to calculate patch version
+          # Run from main checkout which has full git history and access to npm
+          PATCH_JSON=$(node scripts/get-release-version.js --type=patch --patch-from=${{ github.event.inputs.type }})
+          echo "Patch version calculation result: ${PATCH_JSON}"
+
+          RELEASE_VERSION=$(echo "${PATCH_JSON}" | jq -r .releaseVersion)
+          RELEASE_TAG=$(echo "${PATCH_JSON}" | jq -r .releaseTag)
+          NPM_TAG=$(echo "${PATCH_JSON}" | jq -r .npmTag)
+          PREVIOUS_TAG=$(echo "${PATCH_JSON}" | jq -r .previousReleaseTag)
+
+          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> "${GITHUB_OUTPUT}"
+          echo "RELEASE_TAG=${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "NPM_TAG=${NPM_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_TAG=${PREVIOUS_TAG}" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Verify Version Consistency'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          CHANNEL: '${{ github.event.inputs.type }}'
+        run: |
+          echo "🔍 Verifying no concurrent patch releases have occurred..."
+
+          # Store original calculation for comparison
+          ORIGINAL_RELEASE_VERSION="${{ steps.patch_version.outputs.RELEASE_VERSION }}"
+          ORIGINAL_RELEASE_TAG="${{ steps.patch_version.outputs.RELEASE_TAG }}"
+          ORIGINAL_PREVIOUS_TAG="${{ steps.patch_version.outputs.PREVIOUS_TAG }}"
+
+          echo "Original calculation:"
+          echo "  Release version: ${ORIGINAL_RELEASE_VERSION}"
+          echo "  Release tag: ${ORIGINAL_RELEASE_TAG}"
+          echo "  Previous tag: ${ORIGINAL_PREVIOUS_TAG}"
+
+          # Re-run the same version calculation script
+          echo "Re-calculating version to check for changes..."
+          CURRENT_PATCH_JSON=$(node scripts/get-release-version.js --type=patch --patch-from="${CHANNEL}")
+          CURRENT_RELEASE_VERSION=$(echo "${CURRENT_PATCH_JSON}" | jq -r .releaseVersion)
+          CURRENT_RELEASE_TAG=$(echo "${CURRENT_PATCH_JSON}" | jq -r .releaseTag)
+          CURRENT_PREVIOUS_TAG=$(echo "${CURRENT_PATCH_JSON}" | jq -r .previousReleaseTag)
+
+          echo "Current calculation:"
+          echo "  Release version: ${CURRENT_RELEASE_VERSION}"
+          echo "  Release tag: ${CURRENT_RELEASE_TAG}"
+          echo "  Previous tag: ${CURRENT_PREVIOUS_TAG}"
+
+          # Compare calculations
+          if [[ "${ORIGINAL_RELEASE_VERSION}" != "${CURRENT_RELEASE_VERSION}" ]] || \
+             [[ "${ORIGINAL_RELEASE_TAG}" != "${CURRENT_RELEASE_TAG}" ]] || \
+             [[ "${ORIGINAL_PREVIOUS_TAG}" != "${CURRENT_PREVIOUS_TAG}" ]]; then
+            echo "❌ RACE CONDITION DETECTED: Version calculations have changed!"
+            echo "This indicates another patch release completed while this one was in progress."
+            echo ""
+            echo "Originally planned:  ${ORIGINAL_RELEASE_VERSION} (from ${ORIGINAL_PREVIOUS_TAG})"
+            echo "Should now build:    ${CURRENT_RELEASE_VERSION} (from ${CURRENT_PREVIOUS_TAG})"
+            echo ""
+            echo "# Setting outputs for failure comment"
+            echo "CURRENT_RELEASE_VERSION=${CURRENT_RELEASE_VERSION}" >> "${GITHUB_ENV}"
+            echo "CURRENT_RELEASE_TAG=${CURRENT_RELEASE_TAG}" >> "${GITHUB_ENV}"
+            echo "CURRENT_PREVIOUS_TAG=${CURRENT_PREVIOUS_TAG}" >> "${GITHUB_ENV}"
+            echo "The patch release must be restarted to use the correct version numbers."
+            exit 1
+          fi
+
+          echo "✅ Version calculations unchanged - proceeding with release"
+
+      - name: 'Print Calculated Version'
+        run: |-
+          echo "Patch Release Summary:"
+          echo "  Release Version: ${{ steps.patch_version.outputs.RELEASE_VERSION }}"
+          echo "  Release Tag: ${{ steps.patch_version.outputs.RELEASE_TAG }}"
+          echo "  NPM Tag: ${{ steps.patch_version.outputs.NPM_TAG }}"
+          echo "  Previous Tag: ${{ steps.patch_version.outputs.PREVIOUS_TAG }}"
+
+      - name: 'Run Tests'
+        uses: './.github/actions/run-tests'
+        with:
+          force_skip_tests: '${{ github.event.inputs.force_skip_tests }}'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          working-directory: './release'
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          release-version: '${{ steps.patch_version.outputs.RELEASE_VERSION }}'
+          release-tag: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          npm-tag: '${{ steps.patch_version.outputs.NPM_TAG }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ steps.patch_version.outputs.PREVIOUS_TAG }}'
+          working-directory: './release'
+
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry_run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Patch Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')' \
+            --body 'The patch-release workflow failed. See the full run for details: ${DETAILS_URL}' \
+            --label 'kind/bug,release-failure,priority/p0'
+
+      - name: 'Comment Success on Original PR'
+        if: '${{ success() && github.event.inputs.original_pr }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ORIGINAL_PR: '${{ github.event.inputs.original_pr }}'
+          SUCCESS: 'true'
+          RELEASE_VERSION: '${{ steps.patch_version.outputs.RELEASE_VERSION }}'
+          RELEASE_TAG: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          NPM_TAG: '${{ steps.patch_version.outputs.NPM_TAG }}'
+          CHANNEL: '${{ github.event.inputs.type }}'
+          DRY_RUN: '${{ github.event.inputs.dry_run }}'
+          GITHUB_RUN_ID: '${{ github.run_id }}'
+          GITHUB_REPOSITORY_OWNER: '${{ github.repository_owner }}'
+          GITHUB_REPOSITORY_NAME: '${{ github.event.repository.name }}'
+        run: |
+          node scripts/releasing/patch-comment.js
+
+      - name: 'Comment Failure on Original PR'
+        if: '${{ failure() && github.event.inputs.original_pr }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ORIGINAL_PR: '${{ github.event.inputs.original_pr }}'
+          SUCCESS: 'false'
+          RELEASE_VERSION: '${{ steps.patch_version.outputs.RELEASE_VERSION }}'
+          RELEASE_TAG: '${{ steps.patch_version.outputs.RELEASE_TAG }}'
+          NPM_TAG: '${{ steps.patch_version.outputs.NPM_TAG }}'
+          CHANNEL: '${{ github.event.inputs.type }}'
+          DRY_RUN: '${{ github.event.inputs.dry_run }}'
+          GITHUB_RUN_ID: '${{ github.run_id }}'
+          GITHUB_REPOSITORY_OWNER: '${{ github.repository_owner }}'
+          GITHUB_REPOSITORY_NAME: '${{ github.event.repository.name }}'
+          # Pass current version info for race condition failures
+          CURRENT_RELEASE_VERSION: '${{ env.CURRENT_RELEASE_VERSION }}'
+          CURRENT_RELEASE_TAG: '${{ env.CURRENT_RELEASE_TAG }}'
+          CURRENT_PREVIOUS_TAG: '${{ env.CURRENT_PREVIOUS_TAG }}'
+        run: |
+          # Check if this was a version consistency failure
+          if [[ -n "${CURRENT_RELEASE_VERSION}" ]]; then
+            echo "Detected version race condition failure - posting specific comment with current version info"
+            export RACE_CONDITION_FAILURE=true
+          fi
+          node scripts/releasing/patch-comment.js

.github/workflows/release-patch-from-comment.yml

@@ -0,0 +1,187 @@
+name: 'Release: Patch from Comment'
+
+on:
+  issue_comment:
+    types: ['created']
+
+jobs:
+  slash-command:
+    runs-on: 'ubuntu-latest'
+    # Only run if the comment is from a human user (not automated)
+    if: "github.event.comment.user.type == 'User' && github.event.comment.user.login != 'github-actions[bot]'"
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+      actions: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          fetch-depth: 1
+
+      - name: 'Slash Command Dispatch'
+        id: 'slash_command'
+        uses: 'peter-evans/slash-command-dispatch@40877f718dce0101edfc7aea2b3800cc192f9ed5'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          commands: 'patch'
+          permission: 'write'
+          issue-type: 'pull-request'
+
+      - name: 'Get PR Status'
+        id: 'pr_status'
+        if: "startsWith(github.event.comment.body, '/patch')"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          gh pr view "${{ github.event.issue.number }}" --json mergeCommit,state > pr_status.json
+          echo "MERGE_COMMIT_SHA=$(jq -r .mergeCommit.oid pr_status.json)" >> "$GITHUB_OUTPUT"
+          echo "STATE=$(jq -r .state pr_status.json)" >> "$GITHUB_OUTPUT"
+
+      - name: 'Dispatch if Merged'
+        if: "steps.pr_status.outputs.STATE == 'MERGED'"
+        id: 'dispatch_patch'
+        uses: 'actions/github-script@00f12e3e20659f42342b1c0226afda7f7c042325'
+        env:
+          COMMENT_BODY: '${{ github.event.comment.body }}'
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          script: |
+            // Parse the comment body directly to extract channel(s)
+            const commentBody = process.env.COMMENT_BODY;
+            console.log('Comment body:', commentBody);
+
+            let channels = ['stable', 'preview'];  // default to both
+
+            // Parse different formats:
+            // /patch (defaults to both)
+            // /patch both
+            // /patch stable
+            // /patch preview
+            if (commentBody.trim() === '/patch' || commentBody.trim() === '/patch both') {
+              channels = ['stable', 'preview'];
+            } else if (commentBody.trim() === '/patch stable') {
+              channels = ['stable'];
+            } else if (commentBody.trim() === '/patch preview') {
+              channels = ['preview'];
+            } else {
+              // Fallback parsing for legacy formats
+              if (commentBody.includes('channel=preview')) {
+                channels = ['preview'];
+              } else if (commentBody.includes('--channel preview')) {
+                channels = ['preview'];
+              }
+            }
+
+            console.log('Detected channels:', channels);
+
+            const dispatchedRuns = [];
+
+            // Dispatch workflow for each channel
+            for (const channel of channels) {
+              console.log(`Dispatching workflow for channel: ${channel}`);
+
+              const response = await github.rest.actions.createWorkflowDispatch({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'release-patch-1-create-pr.yml',
+                ref: 'main',
+                inputs: {
+                  commit: '${{ steps.pr_status.outputs.MERGE_COMMIT_SHA }}',
+                  channel: channel,
+                  original_pr: '${{ github.event.issue.number }}'
+                }
+              });
+
+              dispatchedRuns.push({ channel, response });
+            }
+
+            // Wait a moment for the workflows to be created
+            await new Promise(resolve => setTimeout(resolve, 3000));
+
+            const runs = await github.rest.actions.listWorkflowRuns({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release-patch-1-create-pr.yml',
+              per_page: 20  // Increased to handle multiple runs
+            });
+
+            // Find the recent runs that match our trigger
+            const recentRuns = runs.data.workflow_runs.filter(run =>
+              run.event === 'workflow_dispatch' &&
+              new Date(run.created_at) > new Date(Date.now() - 15000) // Within last 15 seconds
+            ).slice(0, channels.length); // Limit to the number of channels we dispatched
+
+            // Set outputs
+            core.setOutput('dispatched_channels', channels.join(','));
+            core.setOutput('dispatched_run_count', channels.length.toString());
+
+            if (recentRuns.length > 0) {
+              core.setOutput('dispatched_run_urls', recentRuns.map(r => r.html_url).join(','));
+              core.setOutput('dispatched_run_ids', recentRuns.map(r => r.id).join(','));
+            }
+
+      - name: 'Comment on Failure'
+        if: "startsWith(github.event.comment.body, '/patch') && steps.pr_status.outputs.STATE != 'MERGED'"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            :x: The `/patch` command failed. This pull request must be merged before a patch can be created.
+
+      - name: 'Final Status Comment - Success'
+        if: "always() && startsWith(github.event.comment.body, '/patch') && steps.dispatch_patch.outcome == 'success' && steps.dispatch_patch.outputs.dispatched_run_urls"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            ✅ **Patch workflow(s) dispatched successfully!**
+
+            **📋 Details:**
+            - **Channels**: `${{ steps.dispatch_patch.outputs.dispatched_channels }}`
+            - **Commit**: `${{ steps.pr_status.outputs.MERGE_COMMIT_SHA }}`
+            - **Workflows Created**: ${{ steps.dispatch_patch.outputs.dispatched_run_count }}
+
+            **🔗 Track Progress:**
+            - [View patch workflows](https://github.com/${{ github.repository }}/actions/workflows/release-patch-1-create-pr.yml)
+            - [This workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+
+      - name: 'Final Status Comment - Dispatch Success (No URL)'
+        if: "always() && startsWith(github.event.comment.body, '/patch') && steps.dispatch_patch.outcome == 'success' && !steps.dispatch_patch.outputs.dispatched_run_urls"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            ✅ **Patch workflow(s) dispatched successfully!**
+
+            **📋 Details:**
+            - **Channels**: `${{ steps.dispatch_patch.outputs.dispatched_channels }}`
+            - **Commit**: `${{ steps.pr_status.outputs.MERGE_COMMIT_SHA }}`
+            - **Workflows Created**: ${{ steps.dispatch_patch.outputs.dispatched_run_count }}
+
+            **🔗 Track Progress:**
+            - [View patch workflows](https://github.com/${{ github.repository }}/actions/workflows/release-patch-1-create-pr.yml)
+            - [This workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+
+      - name: 'Final Status Comment - Failure'
+        if: "always() && startsWith(github.event.comment.body, '/patch') && (steps.dispatch_patch.outcome == 'failure' || steps.dispatch_patch.outcome == 'cancelled')"
+        uses: 'peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d'
+        with:
+          token: '${{ secrets.GITHUB_TOKEN }}'
+          issue-number: '${{ github.event.issue.number }}'
+          body: |
+            ❌ **Patch workflow dispatch failed!**
+
+            There was an error dispatching the patch creation workflow.
+
+            **🔍 Troubleshooting:**
+            - Check that the PR is properly merged
+            - Verify workflow permissions
+            - Review error logs in the workflow run
+
+            **🔗 Debug Links:**
+            - [This workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+            - [Patch workflow history](https://github.com/${{ github.repository }}/actions/workflows/release-patch-1-create-pr.yml)

.github/workflows/release-promote.yml

@@ -0,0 +1,337 @@
+name: 'Release: Promote'
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
+        required: true
+        type: 'boolean'
+        default: true
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      stable_version_override:
+        description: 'Manually override the stable version number.'
+        required: false
+        type: 'string'
+      preview_version_override:
+        description: 'Manually override the preview version number.'
+        required: false
+        type: 'string'
+
+jobs:
+  calculate-versions:
+    name: 'Calculate Versions and Plan'
+    runs-on: 'ubuntu-latest'
+    outputs:
+      STABLE_VERSION: '${{ steps.versions.outputs.STABLE_VERSION }}'
+      STABLE_SHA: '${{ steps.versions.outputs.STABLE_SHA }}'
+      PREVIOUS_STABLE_TAG: '${{ steps.versions.outputs.PREVIOUS_STABLE_TAG }}'
+      PREVIEW_VERSION: '${{ steps.versions.outputs.PREVIEW_VERSION }}'
+      PREVIEW_SHA: '${{ steps.versions.outputs.PREVIEW_SHA }}'
+      PREVIOUS_PREVIEW_TAG: '${{ steps.versions.outputs.PREVIOUS_PREVIEW_TAG }}'
+      NEXT_NIGHTLY_VERSION: '${{ steps.versions.outputs.NEXT_NIGHTLY_VERSION }}'
+      PREVIOUS_NIGHTLY_TAG: '${{ steps.versions.outputs.PREVIOUS_NIGHTLY_TAG }}'
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Print Inputs'
+        shell: 'bash'
+        run: |-
+          echo "${{ toJSON(inputs) }}"
+
+      - name: 'Calculate Versions and SHAs'
+        id: 'versions'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          set -e
+          STABLE_JSON=$(node scripts/get-release-version.js --type=stable ${{ github.event.inputs.stable_version_override && format('--stable_version_override={0}', github.event.inputs.stable_version_override) || '' }})
+          PREVIEW_JSON=$(node scripts/get-release-version.js --type=preview ${{ github.event.inputs.preview_version_override && format('--preview_version_override={0}', github.event.inputs.preview_version_override) || '' }})
+          NIGHTLY_JSON=$(node scripts/get-release-version.js --type=nightly)
+          echo "STABLE_JSON_COMMAND=node scripts/get-release-version.js --type=stable ${{ github.event.inputs.stable_version_override && format('--stable_version_override={0}', github.event.inputs.stable_version_override) || '' }}"
+          echo "PREVIEW_JSON_COMMAND=node scripts/get-release-version.js --type=preview ${{ github.event.inputs.preview_version_override && format('--preview_version_override={0}', github.event.inputs.preview_version_override) || '' }}"
+          echo "NIGHTLY_JSON_COMMAND=node scripts/get-release-version.js --type=nightly"
+          echo "STABLE_JSON: ${STABLE_JSON}"
+          echo "PREVIEW_JSON: ${PREVIEW_JSON}"
+          echo "NIGHTLY_JSON: ${NIGHTLY_JSON}"
+          echo "STABLE_VERSION=$(echo "${STABLE_JSON}" | jq -r .releaseVersion)" >> "${GITHUB_OUTPUT}"
+          # shellcheck disable=SC1083
+          echo "STABLE_SHA=$(git rev-parse "$(echo "${PREVIEW_JSON}" | jq -r .previousReleaseTag)"^{commit})" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_STABLE_TAG=$(echo "${STABLE_JSON}" | jq -r .previousReleaseTag)" >> "${GITHUB_OUTPUT}"
+          echo "PREVIEW_VERSION=$(echo "${PREVIEW_JSON}" | jq -r .releaseVersion)" >> "${GITHUB_OUTPUT}"
+          # shellcheck disable=SC1083
+          echo "PREVIEW_SHA=$(git rev-parse '${{ github.event.inputs.ref }}'^{commit})" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_PREVIEW_TAG=$(echo "${PREVIEW_JSON}" | jq -r .previousReleaseTag)" >> "${GITHUB_OUTPUT}"
+          echo "NEXT_NIGHTLY_VERSION=$(echo "${NIGHTLY_JSON}" | jq -r .releaseVersion)" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_NIGHTLY_TAG=$(echo "${NIGHTLY_JSON}" | jq -r .previousReleaseTag)" >> "${GITHUB_OUTPUT}"
+          CURRENT_NIGHTLY_TAG=$(git describe --tags --abbrev=0 --match="*nightly*")
+          echo "CURRENT_NIGHTLY_TAG=${CURRENT_NIGHTLY_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "NEXT_SHA=$(git rev-parse HEAD)" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Display Pending Updates'
+        run: |
+          echo "Pending Changes, Next Versions:"
+          echo "  Nightly: ${{ steps.versions.outputs.NEXT_NIGHTLY_VERSION }}"
+          echo "  Preview: ${{ steps.versions.outputs.PREVIEW_VERSION }}"
+          echo "  Stable: ${{ steps.versions.outputs.STABLE_VERSION }}"
+          echo ""
+          echo "Relevant SHAs:"
+          echo "  Stable: Will be cut from:  : ${{ steps.versions.outputs.STABLE_SHA }} / ${{ steps.versions.outputs.PREVIOUS_STABLE_TAG }}"
+          echo "  Preview will be cut from:  : ${{ steps.versions.outputs.PREVIEW_SHA }} (${{ github.event.inputs.ref }})". Users last saw preview as: ${{ steps.versions.outputs.PREVIOUS_PREVIEW_TAG }}
+          echo "  Nightly will be udpated in : ${{ steps.versions.outputs.NEXT_SHA }} (${{ github.event.inputs.ref }}). Previous nightly tag: ${{ steps.versions.outputs.PREVIOUS_NIGHTLY_TAG }}"
+
+  test:
+    name: 'Test ${{ matrix.channel }}'
+    needs: 'calculate-versions'
+    runs-on: 'ubuntu-latest'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - channel: 'stable'
+            sha: '${{ needs.calculate-versions.outputs.STABLE_SHA }}'
+          - channel: 'preview'
+            sha: '${{ needs.calculate-versions.outputs.PREVIEW_SHA }}'
+          - channel: 'nightly'
+            sha: '${{ github.event.inputs.ref }}'
+    steps:
+      - name: 'Checkout Ref'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+
+      - name: 'Checkout correct SHA'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ matrix.sha }}'
+          path: 'release'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        working-directory: './release'
+        run: 'npm ci'
+
+      - name: 'Run Tests'
+        uses: './.github/actions/run-tests'
+        with:
+          force_skip_tests: '${{ github.event.inputs.force_skip_tests }}'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          working-directory: './release'
+
+  publish-preview:
+    name: 'Publish preview'
+    needs: ['calculate-versions', 'test']
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout Ref'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+
+      - name: 'Checkout correct SHA'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ needs.calculate-versions.outputs.PREVIEW_SHA }}'
+          path: 'release'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        working-directory: './release'
+        run: 'npm ci'
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          release-version: '${{ needs.calculate-versions.outputs.PREVIEW_VERSION }}'
+          release-tag: 'v${{ needs.calculate-versions.outputs.PREVIEW_VERSION }}'
+          npm-tag: 'preview'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ needs.calculate-versions.outputs.PREVIOUS_PREVIEW_TAG }}'
+          working-directory: './release'
+
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry_run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: 'v${{ needs.calculate-versions.outputs.PREVIEW_VERSION }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Promote Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')' \
+            --body 'The promote-release workflow failed during preview publish. See the full run for details: ${DETAILS_URL}' \
+            --label 'kind/bug,release-failure,priority/p0'
+
+  publish-stable:
+    name: 'Publish stable'
+    needs: ['calculate-versions', 'test', 'publish-preview']
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout Ref'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+
+      - name: 'Checkout correct SHA'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ needs.calculate-versions.outputs.STABLE_SHA }}'
+          path: 'release'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        working-directory: './release'
+        run: 'npm ci'
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          release-version: '${{ needs.calculate-versions.outputs.STABLE_VERSION }}'
+          release-tag: 'v${{ needs.calculate-versions.outputs.STABLE_VERSION }}'
+          npm-tag: 'latest'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ needs.calculate-versions.outputs.PREVIOUS_STABLE_TAG }}'
+          working-directory: './release'
+
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry_run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: 'v${{ needs.calculate-versions.outputs.STABLE_VERSION }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Promote Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')' \
+            --body 'The promote-release workflow failed during stable publish. See the full run for details: ${DETAILS_URL}' \
+            --label 'kind/bug,release-failure,priority/p0'
+
+  nightly-pr:
+    name: 'Create Nightly PR'
+    needs: ['publish-stable', 'calculate-versions']
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout Ref'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Configure Git User'
+        run: |-
+          git config user.name "gemini-cli-robot"
+          git config user.email "gemini-cli-robot@google.com"
+
+      - name: 'Create and switch to a new branch'
+        id: 'release_branch'
+        run: |
+          BRANCH_NAME="chore/nightly-version-bump-${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}"
+          git switch -c "${BRANCH_NAME}"
+          echo "BRANCH_NAME=${BRANCH_NAME}" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Update package versions'
+        run: 'npm run release:version "${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}"'
+
+      - name: 'Commit and Push package versions'
+        env:
+          BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
+          DRY_RUN: '${{ github.event.inputs.dry_run }}'
+        run: |-
+          git add package.json packages/*/package.json
+          if [ -f package-lock.json ]; then
+            git add package-lock.json
+          fi
+          git commit -m "chore(release): bump version to ${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}"
+          if [[ "${DRY_RUN}" == "false" ]]; then
+            echo "Pushing release branch to remote..."
+            git push --set-upstream origin "${BRANCH_NAME}"
+          else
+            echo "Dry run enabled. Skipping push."
+          fi
+
+      - name: 'Create and Merge Pull Request'
+        uses: './.github/actions/create-pull-request'
+        with:
+          branch-name: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
+          pr-title: 'chore(release): bump version to ${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
+          pr-body: 'Automated version bump to prepare for the next nightly release.'
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+
+      - name: 'Create Issue on Failure'
+        if: '${{ failure() && github.event.inputs.dry_run == false }}'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          RELEASE_TAG: 'v${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
+          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        run: |
+          gh issue create \
+            --title 'Promote Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')' \
+            --body 'The promote-release workflow failed during nightly PR creation. See the full run for details: ${DETAILS_URL}' \
+            --label 'kind/bug,release-failure,priority/p0'

.github/workflows/release-rollback.yml

@@ -0,0 +1,49 @@
+name: 'Release: Rollback change'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The package version to tag (e.g., 0.5.0-preview-2). This version must already exist on the npm registry.'
+        required: true
+        type: 'string'
+      channel:
+        description: 'The npm dist-tag to apply (e.g., latest, preview, nightly).'
+        required: true
+        type: 'choice'
+        options:
+          - 'latest'
+          - 'preview'
+          - 'nightly'
+          - 'dev'
+        default: 'dev'
+      ref:
+        description: 'The branch, tag, or SHA to run from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      dry-run:
+        description: 'Whether to run in dry-run mode.'
+        required: false
+        type: 'boolean'
+        default: true
+
+jobs:
+  change-tags:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          registry-url: 'https://wombat-dressing-room.appspot.com'
+          scope: '@google'

.github/workflows/release-sandbox.yml

@@ -0,0 +1,33 @@
+name: 'Release Sandbox'
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: false
+        type: 'string'
+        default: 'main'
+      dry-run:
+        description: 'Whether this is a dry run.'
+        required: false
+        type: 'boolean'
+        default: true
+
+jobs:
+  build:
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref || github.sha }}'
+          fetch-depth: 0
+      - name: 'Push'
+        uses: './.github/actions/push-sandbox'
+        with:
+          github-actor: '${{ github.actor }}'
+          github-secret: '${{ secrets.GITHUB_TOKEN }}'
+          github-sha: '${{ github.event.inputs.ref || github.sha }}'
+          github-ref-name: '${{github.event.inputs.ref}}'
+          dry-run: '${{ github.event.inputs.dry-run }}'

.github/workflows/release.yml

@@ -1,231 +0,0 @@
-name: 'Release'
-
-on:
-  schedule:
-    # Runs every day at midnight UTC for the nightly release.
-    - cron: '0 0 * * *'
-    # Runs every Tuesday at 23:59 UTC for the preview release.
-    - cron: '59 23 * * 2'
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'The version to release (e.g., v0.1.11). Required for manual patch releases.'
-        required: false # Not required for scheduled runs
-        type: 'string'
-      ref:
-        description: 'The branch or ref (full git sha) to release from.'
-        required: true
-        type: 'string'
-        default: 'main'
-      dry_run:
-        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
-        required: true
-        type: 'boolean'
-        default: true
-      create_nightly_release:
-        description: 'Auto apply the nightly release tag, input version is ignored.'
-        required: false
-        type: 'boolean'
-        default: false
-      create_preview_release:
-        description: 'Auto apply the preview release tag, input version is ignored.'
-        required: false
-        type: 'boolean'
-        default: false
-      force_skip_tests:
-        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
-        required: false
-        type: 'boolean'
-        default: false
-
-jobs:
-  release:
-    runs-on: 'ubuntu-latest'
-    environment:
-      name: 'production-release'
-      url: '${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ steps.version.outputs.RELEASE_TAG }}'
-    if: |-
-      ${{ github.repository == 'google-gemini/gemini-cli' }}
-    permissions:
-      contents: 'write'
-      packages: 'write'
-      id-token: 'write'
-      issues: 'write' # For creating issues on failure
-    outputs:
-      RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          ref: '${{ github.event.inputs.ref || github.sha }}'
-          fetch-depth: 0
-
-      - name: 'Set booleans for simplified logic'
-        env:
-          CREATE_NIGHTLY_RELEASE: '${{ github.event.inputs.create_nightly_release }}'
-          CREATE_PREVIEW_RELEASE: '${{ github.event.inputs.create_preview_release }}'
-          EVENT_NAME: '${{ github.event_name }}'
-          CRON: '${{ github.event.schedule }}'
-          DRY_RUN_INPUT: '${{ github.event.inputs.dry_run }}'
-        id: 'vars'
-        run: |-
-          is_nightly="false"
-          if [[ "${CRON}" == "0 0 * * *" || "${CREATE_NIGHTLY_RELEASE}" == "true" ]]; then
-            is_nightly="true"
-          fi
-          echo "is_nightly=${is_nightly}" >> "${GITHUB_OUTPUT}"
-
-          is_preview="false"
-          if [[ "${CRON}" == "59 23 * * 2" || "${CREATE_PREVIEW_RELEASE}" == "true" ]]; then
-            is_preview="true"
-          fi
-          echo "is_preview=${is_preview}" >> "${GITHUB_OUTPUT}"
-
-          is_dry_run="false"
-          if [[ "${DRY_RUN_INPUT}" == "true" ]]; then
-            is_dry_run="true"
-          fi
-          echo "is_dry_run=${is_dry_run}" >> "${GITHUB_OUTPUT}"
-
-      - name: 'Setup Node.js'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
-        with:
-          node-version-file: '.nvmrc'
-          cache: 'npm'
-
-      - name: 'Install Dependencies'
-        run: |-
-          npm ci
-
-      - name: 'Get the version'
-        id: 'version'
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          IS_NIGHTLY: '${{ steps.vars.outputs.is_nightly }}'
-          IS_PREVIEW: '${{ steps.vars.outputs.is_preview }}'
-          MANUAL_VERSION: '${{ inputs.version }}'
-        run: |-
-          VERSION_JSON="$(node scripts/get-release-version.js)"
-          echo "RELEASE_TAG=$(echo "${VERSION_JSON}" | jq -r .releaseTag)" >> "${GITHUB_OUTPUT}"
-          echo "RELEASE_VERSION=$(echo "${VERSION_JSON}" | jq -r .releaseVersion)" >> "${GITHUB_OUTPUT}"
-          echo "NPM_TAG=$(echo "${VERSION_JSON}" | jq -r .npmTag)" >> "${GITHUB_OUTPUT}"
-          echo "PREVIOUS_TAG=$(echo "${VERSION_JSON}" | jq -r .previousReleaseTag)" >> "${GITHUB_OUTPUT}"
-
-      - name: 'Run Tests'
-        if: |-
-          ${{ github.event.inputs.force_skip_tests != 'true' }}
-        env:
-          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-        run: |-
-          npm run preflight
-          npm run test:integration:sandbox:none
-          npm run test:integration:sandbox:docker
-
-      - name: 'Configure Git User'
-        run: |-
-          git config user.name "gemini-cli-robot"
-          git config user.email "gemini-cli-robot@google.com"
-
-      - name: 'Create and switch to a release branch'
-        id: 'release_branch'
-        env:
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-        run: |-
-          BRANCH_NAME="release/${RELEASE_TAG}"
-          git switch -c "${BRANCH_NAME}"
-          echo "BRANCH_NAME=${BRANCH_NAME}" >> "${GITHUB_OUTPUT}"
-
-      - name: 'Update package versions'
-        env:
-          RELEASE_VERSION: '${{ steps.version.outputs.RELEASE_VERSION }}'
-        run: |-
-          npm run release:version "${RELEASE_VERSION}"
-
-      - name: 'Commit and Conditionally Push package versions'
-        env:
-          BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
-          IS_DRY_RUN: '${{ steps.vars.outputs.is_dry_run }}'
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-        run: |-
-          git add package.json package-lock.json packages/*/package.json
-          git commit -m "chore(release): ${RELEASE_TAG}"
-          if [[ "${IS_DRY_RUN}" == "false" ]]; then
-            echo "Pushing release branch to remote..."
-            git push --set-upstream origin "${BRANCH_NAME}" --follow-tags
-          else
-            echo "Dry run enabled. Skipping push."
-          fi
-
-      - name: 'Build and Prepare Packages'
-        run: |-
-          npm run build:packages
-          npm run prepare:package
-
-      - name: 'Configure npm for publishing'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
-        with:
-          node-version-file: '.nvmrc'
-          registry-url: 'https://wombat-dressing-room.appspot.com'
-          scope: '@google'
-
-      - name: 'Publish @google/gemini-cli-core'
-        env:
-          IS_DRY_RUN: '${{ steps.vars.outputs.is_dry_run }}'
-          NODE_AUTH_TOKEN: '${{ secrets.WOMBAT_TOKEN_CORE }}'
-          NPM_TAG: '${{ steps.version.outputs.NPM_TAG }}'
-        run: |-
-          npm publish \
-            --dry-run="${IS_DRY_RUN}" \
-            --workspace="@google/gemini-cli-core" \
-            --tag="${NPM_TAG}"
-
-      - name: 'Install latest core package'
-        if: |-
-          ${{ steps.vars.outputs.is_dry_run == 'false' }}
-        env:
-          RELEASE_VERSION: '${{ steps.version.outputs.RELEASE_VERSION }}'
-        run: |-
-          npm install "@google/gemini-cli-core@${RELEASE_VERSION}" \
-          --workspace="@google/gemini-cli" \
-          --save-exact
-
-      - name: 'Publish @google/gemini-cli'
-        env:
-          IS_DRY_RUN: '${{ steps.vars.outputs.is_dry_run }}'
-          NODE_AUTH_TOKEN: '${{ secrets.WOMBAT_TOKEN_CLI }}'
-          NPM_TAG: '${{ steps.version.outputs.NPM_TAG }}'
-        run: |-
-          npm publish \
-            --dry-run="${IS_DRY_RUN}" \
-            --workspace="@google/gemini-cli" \
-            --tag="${NPM_TAG}"
-
-      - name: 'Create GitHub Release and Tag'
-        if: |-
-          ${{ steps.vars.outputs.is_dry_run == 'false' }}
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          RELEASE_BRANCH: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
-          PREVIOUS_TAG: '${{ steps.version.outputs.PREVIOUS_TAG }}'
-        run: |-
-          gh release create "${RELEASE_TAG}" \
-            bundle/gemini.js \
-            --target "$RELEASE_BRANCH" \
-            --title "Release ${RELEASE_TAG}" \
-            --notes-start-tag "$PREVIOUS_TAG" \
-            --generate-notes
-
-      - name: 'Create Issue on Failure'
-        if: |-
-          ${{ failure() }}
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }} || "N/A"'
-          DETAILS_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
-        run: |-
-          gh issue create \
-            --title "Release Failed for ${RELEASE_TAG} on $(date +'%Y-%m-%d')" \
-            --body "The release workflow failed. See the full run for details: ${DETAILS_URL}" \
-            --label "kind/bug,release-failure,priority/p0"

.github/workflows/stale.yml

@@ -8,7 +8,13 @@ on:
 
 jobs:
   stale:
-    runs-on: 'ubuntu-latest'
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - 'ubuntu-latest' # GitHub-hosted
+          - 'self-hosted' # GHA on GCP runners
+    runs-on: '${{ matrix.runner }}'
     if: |-
       ${{ github.repository == 'google-gemini/gemini-cli' }}
     permissions:

.github/workflows/verify-release.yml

@@ -0,0 +1,31 @@
+name: 'Verify NPM release tag'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The expected Gemini binary version that should be released (e.g., 0.5.0-preview-2).'
+        required: true
+        type: 'string'
+      npm-package:
+        description: 'NPM package to verify'
+        required: true
+        type: 'string'
+        default: '@google/gemini-cli@latest'
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: false
+        type: 'string'
+        default: 'main'
+
+jobs:
+  build:
+    runs-on: 'ubuntu-latest'
+    steps:
+      - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+      - name: 'Verify release'
+        uses: './.github/actions/verify-release'
+        with:
+          npm-package: '${{github.event.inputs.npm-package}}'
+          expected-version: '${{github.event.inputs.version}}'
+          ref: '${{github.event.inputs.ref}}'

.gitignore

@@ -3,14 +3,21 @@
 .env~
 
 # gemini-cli settings
-.gemini/
-!gemini/config.yaml
+# We want to keep the .gemini in the root of the repo and ignore any .gemini
+# in subdirectories. In our root .gemini we want to allow for version control
+# for subcommands.
+**/.gemini/
+!/.gemini/
+.gemini/*
+!.gemini/config.yaml
+!.gemini/commands/
 
 # Note: .gemini-clipboard/ is NOT in gitignore so Gemini can access pasted images
 
 # Dependency directory
 node_modules
 bower_components
+package-lock.json
 
 # Editors
 .idea
@@ -43,3 +50,6 @@ packages/vscode-ide-companion/*.vsix
 
 # GHA credentials
 gha-creds-*.json
+
+# Log files
+patch_output.log

.husky/pre-commit

@@ -0,0 +1,9 @@
+npm run pre-commit || {
+  echo ''
+  echo '===================================================='
+  echo 'pre-commit checks failed. in case of emergency, run:'
+  echo ''
+  echo 'git commit --no-verify'
+  echo '===================================================='
+  exit 1
+}

.vscode/settings.json

@@ -12,5 +12,6 @@
   },
   "[javascript]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
-  }
+  },
+  "vitest.disableWorkspaceWarning": true
 }

.yamllint.yml

@@ -86,3 +86,4 @@ ignore:
   - 'thirdparty/'
   - 'third_party/'
   - 'vendor/'
+  - 'node_modules/'

CONTRIBUTING.md

@@ -144,7 +144,7 @@ To start the Gemini CLI from the source code (after building), run the following
 npm start
 ```
 
-If you'd like to run the source build outside of the gemini-cli folder you can utilize `npm link path/to/gemini-cli/packages/cli` (see: [docs](https://docs.npmjs.com/cli/v9/commands/npm-link)) or `alias gemini="node path/to/gemini-cli/packages/cli"` to run with `gemini`
+If you'd like to run the source build outside of the gemini-cli folder, you can utilize `npm link path/to/gemini-cli/packages/cli` (see: [docs](https://docs.npmjs.com/cli/v9/commands/npm-link)) or `alias gemini="node path/to/gemini-cli/packages/cli"` to run with `gemini`
 
 ### Running Tests
 

LICENSE

@@ -187,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-  Copyright 2025 Google LLC
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
@@ -199,4 +199,4 @@
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
-   limitations under the License.
+   limitations under the License.

README.md

@@ -1,6 +1,7 @@
 # Gemini CLI
 
 [![Gemini CLI CI](https://github.com/google-gemini/gemini-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/google-gemini/gemini-cli/actions/workflows/ci.yml)
+[![Gemini CLI E2E](https://github.com/google-gemini/gemini-cli/actions/workflows/e2e.yml/badge.svg)](https://github.com/google-gemini/gemini-cli/actions/workflows/e2e.yml)
 [![Version](https://img.shields.io/npm/v/@google/gemini-cli)](https://www.npmjs.com/package/@google/gemini-cli)
 [![License](https://img.shields.io/github/license/google-gemini/gemini-cli)](https://github.com/google-gemini/gemini-cli/blob/main/LICENSE)
 
@@ -106,7 +107,7 @@ Integrate Gemini CLI directly into your GitHub workflows with [**Gemini CLI GitH
 
 Choose the authentication method that best fits your needs:
 
-### Option 1: OAuth login (Using your Google Account)
+### Option 1: Login with Google (OAuth login using your Google Account)
 
 **✨ Best for:** Individual developers as well as anyone who has a Gemini Code Assist License. (see [quota limits and terms of service](https://cloud.google.com/gemini/docs/quotas) for details)
 
@@ -117,7 +118,7 @@ Choose the authentication method that best fits your needs:
 - **No API key management** - just sign in with your Google account
 - **Automatic updates** to latest models
 
-#### Start Gemini CLI, then choose OAuth and follow the browser authentication flow when prompted
+#### Start Gemini CLI, then choose _Login with Google_ and follow the browser authentication flow when prompted
 
 ```bash
 gemini
@@ -190,10 +191,19 @@ gemini -m gemini-2.5-flash
 
 #### Non-interactive mode for scripts
 
+Get a simple text response:
+
 ```bash
 gemini -p "Explain the architecture of this codebase"
 ```
 
+For more advanced scripting, including how to parse JSON and handle errors, use
+the `--output-format json` flag to get structured output:
+
+```bash
+gemini -p "Explain the architecture of this codebase" --output-format json
+```
+
 ### Quick Examples
 
 #### Start a new project

docs/cli/authentication.md

@@ -171,3 +171,6 @@ following authentication methods if available:
       - Ensure the `GOOGLE_CLOUD_PROJECT` and `GOOGLE_CLOUD_LOCATION` environment variables are set.
 
 If none of these environment variables are set in a non-interactive session, the CLI will exit with an error.
+
+For comprehensive guidance on using Gemini CLI programmatically and in
+automation workflows, see the [Headless Mode Guide](../headless.md).

docs/cli/commands.md

@@ -30,6 +30,9 @@ Slash commands provide meta-level control over the CLI itself.
     - **`delete`**
       - **Description:** Deletes a saved conversation checkpoint.
       - **Usage:** `/chat delete <tag>`
+    - **`share`**
+      - **Description** Writes the current conversation to a provided Markdown or JSON file.
+      - **Usage** `/chat share file.md` or `/chat share file.json`. If no filename is provided, then the CLI will generate one.
 
 - **`/clear`**
   - **Description:** Clear the terminal screen, including the visible session history and scrollback within the CLI. The underlying session data (for history recall) might be preserved depending on the exact implementation, but the visual display is cleared.
@@ -380,6 +383,16 @@ That's it! You can now run your command in the CLI. First, you might add a file
 
 Gemini CLI will then execute the multi-line prompt defined in your TOML file.
 
+## Input Prompt Shortcuts
+
+These shortcuts apply directly to the input prompt for text manipulation.
+
+- **Undo:**
+  - **Keyboard shortcut:** Press **Ctrl+z** to undo the last action in the input prompt.
+
+- **Redo:**
+  - **Keyboard shortcut:** Press **Ctrl+Shift+Z** to redo the last undone action in the input prompt.
+
 ## At commands (`@`)
 
 At commands are used to include the content of files or directories as part of your prompt to Gemini. These commands include git-aware filtering.

docs/cli/configuration.md

@@ -76,6 +76,13 @@ Settings are organized into categories. All settings should be placed within the
   - **Description:** Enable session checkpointing for recovery.
   - **Default:** `false`
 
+#### `output`
+
+- **`output.format`** (string):
+  - **Description:** The format of the CLI output.
+  - **Default:** `"text"`
+  - **Values:** `"text"`, `"json"`
+
 #### `ui`
 
 - **`ui.theme`** (string):
@@ -112,7 +119,7 @@ Settings are organized into categories. All settings should be placed within the
 
 - **`ui.showCitations`** (boolean):
   - **Description:** Show citations for generated text in the chat.
-  - **Default:** `false`
+  - **Default:** `true`
 
 - **`ui.accessibility.disableLoadingPhrases`** (boolean):
   - **Description:** Disable loading phrases for accessibility.
@@ -196,9 +203,9 @@ Settings are organized into categories. All settings should be placed within the
   - **Description:** Sandbox execution environment (can be a boolean or a path string).
   - **Default:** `undefined`
 
-- **`tools.usePty`** (boolean):
-  - **Description:** Use node-pty for shell command execution. Fallback to child_process still applies.
-  - **Default:** `false`
+- **`tools.shell.enableInteractiveShell`** (boolean):
+
+  Use `node-pty` for an interactive shell experience. Fallback to `child_process` still applies. Defaults to `false`.
 
 - **`tools.core`** (array of strings):
   - **Description:** This can be used to restrict the set of built-in tools [with an allowlist](./enterprise.md#restricting-tool-access). See [Built-in Tools](../core/tools-api.md#built-in-tools) for a list of core tools. The match semantics are the same as `tools.allowed`.
@@ -302,6 +309,7 @@ Configures logging and metrics collection for Gemini CLI. For more information,
   - **`otlpProtocol`** (string): The protocol for the OTLP Exporter (`grpc` or `http`).
   - **`logPrompts`** (boolean): Whether or not to include the content of user prompts in the logs.
   - **`outfile`** (string): The file to write telemetry to when `target` is `local`.
+  - **`useCollector`** (boolean): Whether to use an external OTLP collector.
 
 ### Example `settings.json`
 
@@ -410,6 +418,27 @@ The CLI automatically loads environment variables from an `.env` file. The loadi
 - **`OTLP_GOOGLE_CLOUD_PROJECT`**:
   - Your Google Cloud Project ID for Telemetry in Google Cloud
   - Example: `export OTLP_GOOGLE_CLOUD_PROJECT="YOUR_PROJECT_ID"`.
+- **`GEMINI_TELEMETRY_ENABLED`**:
+  - Set to `true` or `1` to enable telemetry. Any other value is treated as disabling it.
+  - Overrides the `telemetry.enabled` setting.
+- **`GEMINI_TELEMETRY_TARGET`**:
+  - Sets the telemetry target (`local` or `gcp`).
+  - Overrides the `telemetry.target` setting.
+- **`GEMINI_TELEMETRY_OTLP_ENDPOINT`**:
+  - Sets the OTLP endpoint for telemetry.
+  - Overrides the `telemetry.otlpEndpoint` setting.
+- **`GEMINI_TELEMETRY_OTLP_PROTOCOL`**:
+  - Sets the OTLP protocol (`grpc` or `http`).
+  - Overrides the `telemetry.otlpProtocol` setting.
+- **`GEMINI_TELEMETRY_LOG_PROMPTS`**:
+  - Set to `true` or `1` to enable or disable logging of user prompts. Any other value is treated as disabling it.
+  - Overrides the `telemetry.logPrompts` setting.
+- **`GEMINI_TELEMETRY_OUTFILE`**:
+  - Sets the file path to write telemetry to when the target is `local`.
+  - Overrides the `telemetry.outfile` setting.
+- **`GEMINI_TELEMETRY_USE_COLLECTOR`**:
+  - Set to `true` or `1` to enable or disable using an external OTLP collector. Any other value is treated as disabling it.
+  - Overrides the `telemetry.useCollector` setting.
 - **`GOOGLE_CLOUD_LOCATION`**:
   - Your Google Cloud Project Location (e.g., us-central1).
   - Required for using Vertex AI in non express mode.
@@ -442,11 +471,18 @@ Arguments passed directly when running the CLI can override other configurations
   - Example: `npm start -- --model gemini-1.5-pro-latest`
 - **`--prompt <your_prompt>`** (**`-p <your_prompt>`**):
   - Used to pass a prompt directly to the command. This invokes Gemini CLI in a non-interactive mode.
+  - For scripting examples, use the `--output-format json` flag to get structured output.
 - **`--prompt-interactive <your_prompt>`** (**`-i <your_prompt>`**):
   - Starts an interactive session with the provided prompt as the initial input.
   - The prompt is processed within the interactive session, not before it.
   - Cannot be used when piping input from stdin.
   - Example: `gemini -i "explain this code"`
+- **`--output-format <format>`**:
+  - **Description:** Specifies the format of the CLI output for non-interactive mode.
+  - **Values:**
+    - `text`: (Default) The standard human-readable output.
+    - `json`: A machine-readable JSON output.
+  - **Note:** For structured output and scripting, use the `--output-format json` flag.
 - **`--sandbox`** (**`-s`**):
   - Enables sandbox mode for this session.
 - **`--sandbox-image`**:

docs/cli/index.md

@@ -8,6 +8,7 @@ Within Gemini CLI, `packages/cli` is the frontend for users to send and receive
 - **[Commands](./commands.md):** A reference for Gemini CLI commands (e.g., `/help`, `/tools`, `/theme`).
 - **[Configuration](./configuration.md):** A guide to tailoring Gemini CLI behavior using configuration files.
 - **[Enterprise](./enterprise.md):** A guide to enterprise configuration.
+- **[Headless Mode](../headless.md):** A comprehensive guide to using Gemini CLI programmatically for scripting and automation.
 - **[Token Caching](./token-caching.md):** Optimize API costs through token caching.
 - **[Themes](./themes.md)**: A guide to customizing the CLI's appearance with different themes.
 - **[Tutorials](tutorials.md)**: A tutorial showing how to use Gemini CLI to automate a development task.
@@ -22,8 +23,10 @@ The following example pipes a command to Gemini CLI from your terminal:
 echo "What is fine tuning?" | gemini
 ```
 
-Gemini CLI executes the command and prints the output to your terminal. Note that you can achieve the same behavior by using the `--prompt` or `-p` flag. For example:
+You can also use the `--prompt` or `-p` flag:
 
 ```bash
 gemini -p "What is fine tuning?"
 ```
+
+For comprehensive documentation on headless usage, scripting, automation, and advanced examples, see the **[Headless Mode](../headless.md)** guide.

docs/core/memport.md

@@ -147,7 +147,7 @@ Processes import statements in GEMINI.md content.
 - `debugMode` (boolean, optional): Whether to enable debug logging (default: false)
 - `importState` (ImportState, optional): State tracking for circular import prevention
 
-**Returns:** Promise<ProcessImportsResult> - Object containing processed content and import tree
+**Returns:** Promise&lt;ProcessImportsResult&gt; - Object containing processed content and import tree
 
 ### `ProcessImportsResult`
 
@@ -187,7 +187,7 @@ Finds the project root by searching for a `.git` directory upwards from the give
 
 - `startDir` (string): The directory to start searching from
 
-**Returns:** Promise<string> - The project root directory (or the start directory if no `.git` is found)
+**Returns:** Promise&lt;string&gt; - The project root directory (or the start directory if no `.git` is found)
 
 ## Best Practices
 

docs/extension-releasing.md

@@ -0,0 +1,121 @@
+# Extension Releasing
+
+There are two primary ways of releasing extensions to users:
+
+- [Git repository](#releasing-through-a-git-repository)
+- [Github Releases](#releasing-through-github-releases)
+
+Git repository releases tend to be the simplest and most flexible approach, while GitHub releases can be more efficient on initial install as they are shipped as single archives instead of requiring a git clone which downloads each file individually. Github releases may also contain platform specific archives if you need to ship platform specific binary files.
+
+## Releasing through a git repository
+
+This is the most flexible and simple option. All you need to do us create a publicly accessible git repo (such as a public github repository) and then users can install your extension using `gemini extensions install <your-repo-uri>`, or for a GitHub repository they can use the simplified `gemini extensions install <org>/<repo>` format. They can optionally depend on a specific ref (branch/tag/commit) using the `--ref=<some-ref>` argument, this defaults to the default branch.
+
+Whenever commits are pushed to the ref that a user depends on, they will be prompted to update the extension. Note that this also allows for easy rollbacks, the HEAD commit is always treated as the latest version regardless of the actual version in the `gemini-extension.json` file.
+
+### Managing release channels using a git repository
+
+Users can depend on any ref from your git repo, such as a branch or tag, which allows you to manage multiple release channels.
+
+For instance, you can maintain a `stable` branch, which users can install this way `gemini extensions install <your-repo-uri> --ref=stable`. Or, you could make this the default by treating your default branch as your stable release branch, and doing development in a different branch (for instance called `dev`). You can maintain as many branches or tags as you like, providing maximum flexibility for you and your users.
+
+Note that these `ref` arguments can be tags, branches, or even specific commits, which allows users to depend on a specific version of your extension. It is up to you how you want to manage your tags and branches.
+
+### Example releasing flow using a git repo
+
+While there are many options for how you want to manage releases using a git flow, we recommend treating your default branch as your "stable" release branch. This means that the default behavior for `gemini extensions install <your-repo-uri>` is to be on the stable release branch.
+
+Lets say you want to maintain three standard release channels, `stable`, `preview`, and `dev`. You would do all your standard development in the `dev` branch. When you are ready to do a preview release, you merge that branch into your `preview` branch. When you are ready to promote your preview branch to stable, you merge `preview` into your stable branch (which might be your default branch or a different branch).
+
+You can also cherry pick changes from one branch into another using `git cherry-pick`, but do note that this will result in your branches having a slightly divergent history from each other, unless you force push changes to your branches on each release to restore the history to a clean slate (which may not be possible for the default branch depending on your repository settings). If you plan on doing cherry picks, you may want to avoid having your default branch be the stable branch to avoid force-pushing to the default branch which should generally be avoided.
+
+## Releasing through Github releases
+
+Gemini CLI extensions can be distributed through [GitHub Releases](https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases). This provides a faster and more reliable initial installation experience for users, as it avoids the need to clone the repository.
+
+Each release includes at least one archive file, which contains the full contents of the repo at the tag that it was linked to. Releases may also include [pre-built archives](#custom-pre-built-archives) if your extension requires some build step or has platform specific binaries attached to it.
+
+When checking for updates, gemini will just look for the latest release on github (you must mark it as such when creating the release), unless the user installed a specific release by passing `--ref=<some-release-tag>`. We do not at this time support opting in to pre-release releases or semver.
+
+### Custom pre-built archives
+
+Custom archives must be attached directly to the github release as assets and must be fully self-contained. This means they should include the entire extension, see [archive structure](#archive-structure).
+
+If your extension is platform-independent, you can provide a single generic asset. In this case, there should be only one asset attached to the release.
+
+Custom archives may also be used if you want to develop your extension within a larger repository, you can build an archive which has a different layout from the repo itself (for instance it might just be an archive of a subdirectory containing the extension).
+
+#### Platform specific archives
+
+To ensure Gemini CLI can automatically find the correct release asset for each platform, you must follow this naming convention. The CLI will search for assets in the following order:
+
+1.  **Platform and Architecture-Specific:** `{platform}.{arch}.{name}.{extension}`
+2.  **Platform-Specific:** `{platform}.{name}.{extension}`
+3.  **Generic:** If only one asset is provided, it will be used as a generic fallback.
+
+- `{name}`: The name of your extension.
+- `{platform}`: The operating system. Supported values are:
+  - `darwin` (macOS)
+  - `linux`
+  - `win32` (Windows)
+- `{arch}`: The architecture. Supported values are:
+  - `x64`
+  - `arm64`
+- `{extension}`: The file extension of the archive (e.g., `.tar.gz` or `.zip`).
+
+**Examples:**
+
+- `darwin.arm64.my-tool.tar.gz` (specific to Apple Silicon Macs)
+- `darwin.my-tool.tar.gz` (for all Macs)
+- `linux.x64.my-tool.tar.gz`
+- `win32.my-tool.zip`
+
+#### Archive structure
+
+Archives must be fully contained extensions and have all the standard requirements - specifically the `gemini-extension.json` file must be at the root of the archive.
+
+The rest of the layout should look exactly the same as a typical extension, see [extensions.md](extension.md).
+
+#### Example GitHub Actions workflow
+
+Here is an example of a GitHub Actions workflow that builds and releases a Gemini CLI extension for multiple platforms:
+
+```yaml
+name: Release Extension
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build extension
+        run: npm run build
+
+      - name: Create release assets
+        run: |
+          npm run package -- --platform=darwin --arch=arm64
+          npm run package -- --platform=linux --arch=x64
+          npm run package -- --platform=win32 --arch=x64
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            release/darwin.arm64.my-tool.tar.gz
+            release/linux.arm64.my-tool.tar.gz
+            release/win32.arm64.my-tool.zip
+```

docs/extension.md

@@ -1,19 +1,90 @@
 # Gemini CLI Extensions
 
-Gemini CLI supports extensions that can be used to configure and extend its functionality.
+_This documentation is up-to-date with the v0.4.0 release._
+
+Gemini CLI extensions package prompts, MCP servers, and custom commands into a familiar and user-friendly format. With extensions, you can expand the capabilities of Gemini CLI and share those capabilities with others. They are designed to be easily installable and shareable.
+
+## Extension management
+
+We offer a suite of extension management tools using `gemini extensions` commands.
+
+Note that these commands are not supported from within the CLI, although you can list installed extensions using the `/extensions list` subcommand.
+
+Note that all of these commands will only be reflected in active CLI sessions on restart.
+
+### Installing an extension
+
+You can install an extension using `gemini extensions install` with either a GitHub URL source or `--path=some/local/path`.
+
+Note that we create a copy of the installed extension, so you will need to run `gemini extensions update` to pull in changes from both locally-defined extensions and those on GitHub.
+
+```
+gemini extensions install https://github.com/google-gemini/gemini-cli-security
+```
+
+This will install the Gemini CLI Security extension, which offers support for a `/security:analyze` command.
+
+### Uninstalling an extension
+
+To uninstall, run `gemini extensions uninstall extension-name`, so, in the case of the install example:
+
+```
+gemini extensions uninstall gemini-cli-security
+```
+
+### Disabling an extension
+
+Extensions are, by default, enabled across all workspaces. You can disable an extension entirely or for specific workspace.
+
+For example, `gemini extensions disable extension-name` will disable the extension at the user level, so it will be disabled everywhere. `gemini extensions disable extension-name --scope=workspace` will only disable the extension in the current workspace.
+
+### Enabling an extension
+
+You can enable extensions using `gemini extensions enable extension-name`. You can also enable an extension for a specific workspace using `gemini extensions enable extension-name --scope=workspace` from within that workspace.
+
+This is useful if you have an extension disabled at the top-level and only enabled in specific places.
+
+### Updating an extension
+
+For extensions installed from a local path or a git repository, you can explicitly update to the latest version (as reflected in the `gemini-extension.json` `version` field) with `gemini extensions update extension-name`.
+
+You can update all extensions with:
+
+```
+gemini extensions update --all
+```
+
+## Extension creation
+
+We offer commands to make extension development easier.
+
+### Create a boilerplate extension
+
+We offer several example extensions `context`, `custom-commands`, `exclude-tools` and `mcp-server`. You can view these examples [here](https://github.com/google-gemini/gemini-cli/tree/main/packages/cli/src/commands/extensions/examples).
+
+To copy one of these examples into a development directory using the type of your choosing, run:
+
+```
+gemini extensions new path/to/directory custom-commands
+```
+
+### Link a local extension
+
+The `gemini extensions link` command will create a symbolic link from the extension installation directory to the development path.
+
+This is useful so you don't have to run `gemini extensions update` every time you make changes you'd like to test.
+
+```
+gemini extensions link path/to/directory
+```
 
 ## How it works
 
-On startup, Gemini CLI looks for extensions in two locations:
+On startup, Gemini CLI looks for extensions in `<home>/.gemini/extensions`
 
-1.  `<workspace>/.gemini/extensions`
-2.  `<home>/.gemini/extensions`
+Extensions exist as a directory that contains a `gemini-extension.json` file. For example:
 
-Gemini CLI loads all extensions from both locations. If an extension with the same name exists in both locations, the extension in the workspace directory takes precedence.
-
-Within each location, individual extensions exist as a directory that contains a `gemini-extension.json` file. For example:
-
-`<workspace>/.gemini/extensions/my-extension/gemini-extension.json`
+`<home>/.gemini/extensions/my-extension/gemini-extension.json`
 
 ### `gemini-extension.json`
 
@@ -33,19 +104,20 @@ The `gemini-extension.json` file contains the configuration for the extension. T
 }
 ```
 
-- `name`: The name of the extension. This is used to uniquely identify the extension and for conflict resolution when extension commands have the same name as user or project commands.
+- `name`: The name of the extension. This is used to uniquely identify the extension and for conflict resolution when extension commands have the same name as user or project commands. The name should be lowercase and use dashes instead of underscores or spaces. This is how users will refer to your extension in the CLI. Note that we expect this name to match the extension directory name.
 - `version`: The version of the extension.
 - `mcpServers`: A map of MCP servers to configure. The key is the name of the server, and the value is the server configuration. These servers will be loaded on startup just like MCP servers configured in a [`settings.json` file](./cli/configuration.md). If both an extension and a `settings.json` file configure an MCP server with the same name, the server defined in the `settings.json` file takes precedence.
-- `contextFileName`: The name of the file that contains the context for the extension. This will be used to load the context from the workspace. If this property is not used but a `GEMINI.md` file is present in your extension directory, then that file will be loaded.
-- `excludeTools`: An array of tool names to exclude from the model. You can also specify command-specific restrictions for tools that support it, like the `run_shell_command` tool. For example, `"excludeTools": ["run_shell_command(rm -rf)"]` will block the `rm -rf` command.
+  - Note that all MCP server configuration options are supported except for `trust`.
+- `contextFileName`: The name of the file that contains the context for the extension. This will be used to load the context from the extension directory. If this property is not used but a `GEMINI.md` file is present in your extension directory, then that file will be loaded.
+- `excludeTools`: An array of tool names to exclude from the model. You can also specify command-specific restrictions for tools that support it, like the `run_shell_command` tool. For example, `"excludeTools": ["run_shell_command(rm -rf)"]` will block the `rm -rf` command. Note that this differs from the MCP server `excludeTools` functionality, which can be listed in the MCP server config.
 
 When Gemini CLI starts, it loads all the extensions and merges their configurations. If there are any conflicts, the workspace configuration takes precedence.
 
-## Extension Commands
+### Custom commands
 
 Extensions can provide [custom commands](./cli/commands.md#custom-commands) by placing TOML files in a `commands/` subdirectory within the extension directory. These commands follow the same format as user and project custom commands and use standard naming conventions.
 
-### Example
+**Example**
 
 An extension named `gcp` with the following structure:
 
@@ -63,7 +135,7 @@ Would provide these commands:
 - `/deploy` - Shows as `[gcp] Custom command from deploy.toml` in help
 - `/gcs:sync` - Shows as `[gcp] Custom command from sync.toml` in help
 
-### Conflict Resolution
+### Conflict resolution
 
 Extension commands have the lowest precedence. When a conflict occurs with user or project commands:
 
@@ -75,7 +147,7 @@ For example, if both a user and the `gcp` extension define a `deploy` command:
 - `/deploy` - Executes the user's deploy command
 - `/gcp.deploy` - Executes the extension's deploy command (marked with `[gcp]` tag)
 
-# Variables
+## Variables
 
 Gemini CLI extensions allow variable substitution in `gemini-extension.json`. This can be useful if e.g., you need the current directory to run an MCP server using `"cwd": "${extensionPath}${/}run.ts"`.
 
@@ -84,4 +156,5 @@ Gemini CLI extensions allow variable substitution in `gemini-extension.json`. Th
 | variable                   | description                                                                                                                                                     |
 | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `${extensionPath}`         | The fully-qualified path of the extension in the user's filesystem e.g., '/Users/username/.gemini/extensions/example-extension'. This will not unwrap symlinks. |
+| `${workspacePath}`         | The fully-qualified path of the current workspace.                                                                                                              |
 | `${/} or ${pathSeparator}` | The path separator (differs per OS).                                                                                                                            |

docs/headless.md

@@ -0,0 +1,323 @@
+# Headless Mode
+
+Headless mode allows you to run Gemini CLI programmatically from command line
+scripts and automation tools without any interactive UI. This is ideal for
+scripting, automation, CI/CD pipelines, and building AI-powered tools.
+
+- [Headless Mode](#headless-mode)
+  - [Overview](#overview)
+  - [Basic Usage](#basic-usage)
+    - [Direct Prompts](#direct-prompts)
+    - [Stdin Input](#stdin-input)
+    - [Combining with File Input](#combining-with-file-input)
+  - [Output Formats](#output-formats)
+    - [Text Output (Default)](#text-output-default)
+    - [JSON Output](#json-output)
+      - [Response Schema](#response-schema)
+      - [Example Usage](#example-usage)
+    - [File Redirection](#file-redirection)
+  - [Configuration Options](#configuration-options)
+  - [Examples](#examples)
+    - [Code review](#code-review)
+    - [Generate commit messages](#generate-commit-messages)
+    - [API documentation](#api-documentation)
+    - [Batch code analysis](#batch-code-analysis)
+    - [Code review](#code-review-1)
+    - [Log analysis](#log-analysis)
+    - [Release notes generation](#release-notes-generation)
+    - [Model and tool usage tracking](#model-and-tool-usage-tracking)
+  - [Resources](#resources)
+
+## Overview
+
+The headless mode provides a headless interface to Gemini CLI that:
+
+- Accepts prompts via command line arguments or stdin
+- Returns structured output (text or JSON)
+- Supports file redirection and piping
+- Enables automation and scripting workflows
+- Provides consistent exit codes for error handling
+
+## Basic Usage
+
+### Direct Prompts
+
+Use the `--prompt` (or `-p`) flag to run in headless mode:
+
+```bash
+gemini --prompt "What is machine learning?"
+```
+
+### Stdin Input
+
+Pipe input to Gemini CLI from your terminal:
+
+```bash
+echo "Explain this code" | gemini
+```
+
+### Combining with File Input
+
+Read from files and process with Gemini:
+
+```bash
+cat README.md | gemini --prompt "Summarize this documentation"
+```
+
+## Output Formats
+
+### Text Output (Default)
+
+Standard human-readable output:
+
+```bash
+gemini -p "What is the capital of France?"
+```
+
+Response format:
+
+```
+The capital of France is Paris.
+```
+
+### JSON Output
+
+Returns structured data including response, statistics, and metadata. This
+format is ideal for programmatic processing and automation scripts.
+
+#### Response Schema
+
+The JSON output follows this high-level structure:
+
+```json
+{
+  "response": "string", // The main AI-generated content answering your prompt
+  "stats": {
+    // Usage metrics and performance data
+    "models": {
+      // Per-model API and token usage statistics
+      "[model-name]": {
+        "api": {
+          /* request counts, errors, latency */
+        },
+        "tokens": {
+          /* prompt, response, cached, total counts */
+        }
+      }
+    },
+    "tools": {
+      // Tool execution statistics
+      "totalCalls": "number",
+      "totalSuccess": "number",
+      "totalFail": "number",
+      "totalDurationMs": "number",
+      "totalDecisions": {
+        /* accept, reject, modify, auto_accept counts */
+      },
+      "byName": {
+        /* per-tool detailed stats */
+      }
+    },
+    "files": {
+      // File modification statistics
+      "totalLinesAdded": "number",
+      "totalLinesRemoved": "number"
+    }
+  },
+  "error": {
+    // Present only when an error occurred
+    "type": "string", // Error type (e.g., "ApiError", "AuthError")
+    "message": "string", // Human-readable error description
+    "code": "number" // Optional error code
+  }
+}
+```
+
+#### Example Usage
+
+```bash
+gemini -p "What is the capital of France?" --output-format json
+```
+
+Response:
+
+```json
+{
+  "response": "The capital of France is Paris.",
+  "stats": {
+    "models": {
+      "gemini-2.5-pro": {
+        "api": {
+          "totalRequests": 2,
+          "totalErrors": 0,
+          "totalLatencyMs": 5053
+        },
+        "tokens": {
+          "prompt": 24939,
+          "candidates": 20,
+          "total": 25113,
+          "cached": 21263,
+          "thoughts": 154,
+          "tool": 0
+        }
+      },
+      "gemini-2.5-flash": {
+        "api": {
+          "totalRequests": 1,
+          "totalErrors": 0,
+          "totalLatencyMs": 1879
+        },
+        "tokens": {
+          "prompt": 8965,
+          "candidates": 10,
+          "total": 9033,
+          "cached": 0,
+          "thoughts": 30,
+          "tool": 28
+        }
+      }
+    },
+    "tools": {
+      "totalCalls": 1,
+      "totalSuccess": 1,
+      "totalFail": 0,
+      "totalDurationMs": 1881,
+      "totalDecisions": {
+        "accept": 0,
+        "reject": 0,
+        "modify": 0,
+        "auto_accept": 1
+      },
+      "byName": {
+        "google_web_search": {
+          "count": 1,
+          "success": 1,
+          "fail": 0,
+          "durationMs": 1881,
+          "decisions": {
+            "accept": 0,
+            "reject": 0,
+            "modify": 0,
+            "auto_accept": 1
+          }
+        }
+      }
+    },
+    "files": {
+      "totalLinesAdded": 0,
+      "totalLinesRemoved": 0
+    }
+  }
+}
+```
+
+### File Redirection
+
+Save output to files or pipe to other commands:
+
+```bash
+# Save to file
+gemini -p "Explain Docker" > docker-explanation.txt
+gemini -p "Explain Docker" --output-format json > docker-explanation.json
+
+# Append to file
+gemini -p "Add more details" >> docker-explanation.txt
+
+# Pipe to other tools
+gemini -p "What is Kubernetes?" --output-format json | jq '.response'
+gemini -p "Explain microservices" | wc -w
+gemini -p "List programming languages" | grep -i "python"
+```
+
+## Configuration Options
+
+Key command-line options for headless usage:
+
+| Option                  | Description                        | Example                                            |
+| ----------------------- | ---------------------------------- | -------------------------------------------------- |
+| `--prompt`, `-p`        | Run in headless mode               | `gemini -p "query"`                                |
+| `--output-format`       | Specify output format (text, json) | `gemini -p "query" --output-format json`           |
+| `--model`, `-m`         | Specify the Gemini model           | `gemini -p "query" -m gemini-2.5-flash`            |
+| `--debug`, `-d`         | Enable debug mode                  | `gemini -p "query" --debug`                        |
+| `--all-files`, `-a`     | Include all files in context       | `gemini -p "query" --all-files`                    |
+| `--include-directories` | Include additional directories     | `gemini -p "query" --include-directories src,docs` |
+| `--yolo`, `-y`          | Auto-approve all actions           | `gemini -p "query" --yolo`                         |
+| `--approval-mode`       | Set approval mode                  | `gemini -p "query" --approval-mode auto_edit`      |
+
+For complete details on all available configuration options, settings files, and environment variables, see the [Configuration Guide](./cli/configuration.md).
+
+## Examples
+
+#### Code review
+
+```bash
+cat src/auth.py | gemini -p "Review this authentication code for security issues" > security-review.txt
+```
+
+#### Generate commit messages
+
+```bash
+result=$(git diff --cached | gemini -p "Write a concise commit message for these changes" --output-format json)
+echo "$result" | jq -r '.response'
+```
+
+#### API documentation
+
+```bash
+result=$(cat api/routes.js | gemini -p "Generate OpenAPI spec for these routes" --output-format json)
+echo "$result" | jq -r '.response' > openapi.json
+```
+
+#### Batch code analysis
+
+```bash
+for file in src/*.py; do
+    echo "Analyzing $file..."
+    result=$(cat "$file" | gemini -p "Find potential bugs and suggest improvements" --output-format json)
+    echo "$result" | jq -r '.response' > "reports/$(basename "$file").analysis"
+    echo "Completed analysis for $(basename "$file")" >> reports/progress.log
+done
+```
+
+#### Code review
+
+```bash
+result=$(git diff origin/main...HEAD | gemini -p "Review these changes for bugs, security issues, and code quality" --output-format json)
+echo "$result" | jq -r '.response' > pr-review.json
+```
+
+#### Log analysis
+
+```bash
+grep "ERROR" /var/log/app.log | tail -20 | gemini -p "Analyze these errors and suggest root cause and fixes" > error-analysis.txt
+```
+
+#### Release notes generation
+
+```bash
+result=$(git log --oneline v1.0.0..HEAD | gemini -p "Generate release notes from these commits" --output-format json)
+response=$(echo "$result" | jq -r '.response')
+echo "$response"
+echo "$response" >> CHANGELOG.md
+```
+
+#### Model and tool usage tracking
+
+```bash
+result=$(gemini -p "Explain this database schema" --include-directories db --output-format json)
+total_tokens=$(echo "$result" | jq -r '.stats.models // {} | to_entries | map(.value.tokens.total) | add // 0')
+models_used=$(echo "$result" | jq -r '.stats.models // {} | keys | join(", ") | if . == "" then "none" else . end')
+tool_calls=$(echo "$result" | jq -r '.stats.tools.totalCalls // 0')
+tools_used=$(echo "$result" | jq -r '.stats.tools.byName // {} | keys | join(", ") | if . == "" then "none" else . end')
+echo "$(date): $total_tokens tokens, $tool_calls tool calls ($tools_used) used with models: $models_used" >> usage.log
+echo "$result" | jq -r '.response' > schema-docs.md
+echo "Recent usage trends:"
+tail -5 usage.log
+```
+
+## Resources
+
+- [CLI Configuration](./cli/configuration.md) - Complete configuration guide
+- [Authentication](./cli/authentication.md) - Setup authentication
+- [Commands](./cli/commands.md) - Interactive commands reference
+- [Tutorials](./cli/tutorials.md) - Step-by-step automation guides

docs/ide-companion-spec.md

@@ -0,0 +1,182 @@
+# Gemini CLI Companion Extension: Interface Specification
+
+> Last Updated: September 15, 2025
+
+This document defines the contract for building a companion extension to enable Gemini CLI's IDE mode. For VS Code, these features (native diffing, context awareness) are provided by the official extension ([marketplace](https://marketplace.visualstudio.com/items?itemName=Google.gemini-cli-vscode-ide-companion)). This specification is for contributors who wish to bring similar functionality to other editors like JetBrains IDEs, Sublime Text, etc.
+
+## I. The Communication Interface
+
+Gemini CLI and the IDE extension communicate through a local communication channel.
+
+### 1. Transport Layer: MCP over HTTP
+
+The extension **MUST** run a local HTTP server that implements the **Model Context Protocol (MCP)**.
+
+- **Protocol:** The server must be a valid MCP server. We recommend using an existing MCP SDK for your language of choice if available.
+- **Endpoint:** The server should expose a single endpoint (e.g., `/mcp`) for all MCP communication.
+- **Port:** The server **MUST** listen on a dynamically assigned port (i.e., listen on port `0`).
+
+### 2. Discovery Mechanism: The Port File
+
+For Gemini CLI to connect, it needs to discover which IDE instance it's running in and what port your server is using. The extension **MUST** facilitate this by creating a "discovery file."
+
+- **How the CLI Finds the File:** The CLI determines the Process ID (PID) of the IDE it's running in by traversing the process tree. It then looks for a discovery file that contains this PID in its name.
+- **File Location:** The file must be created in a specific directory: `os.tmpdir()/gemini/ide/`. Your extension must create this directory if it doesn't exist.
+- **File Naming Convention:** The filename is critical and **MUST** follow the pattern:
+  `gemini-ide-server-${PID}-${PORT}.json`
+  - `${PID}`: The process ID of the parent IDE process. Your extension must determine this PID and include it in the filename.
+  - `${PORT}`: The port your MCP server is listening on.
+- **File Content & Workspace Validation:** The file **MUST** contain a JSON object with the following structure:
+  ```json
+  {
+    "port": 12345,
+    "workspacePath": "/path/to/project1:/path/to/project2",
+    "authToken": "a-very-secret-token",
+    "ideInfo": {
+      "name": "vscode",
+      "displayName": "VS Code"
+    }
+  }
+  ```
+  - `port` (number, required): The port of the MCP server.
+  - `workspacePath` (string, required): A list of all open workspace root paths, delimited by the OS-specific path separator (`:` for Linux/macOS, `;` for Windows). The CLI uses this path to ensure it's running in the same project folder that's open in the IDE. If the CLI's current working directory is not a sub-directory of `workspacePath`, the connection will be rejected. Your extension **MUST** provide the correct, absolute path(s) to the root of the open workspace(s).
+  - `authToken` (string, required): A secret token for securing the connection. The CLI will include this token in an `Authorization: Bearer <token>` header on all requests.
+  - `ideInfo` (object, required): Information about the IDE.
+    - `name` (string, required): A short, lowercase identifier for the IDE (e.g., `vscode`, `jetbrains`).
+    - `displayName` (string, required): A user-friendly name for the IDE (e.g., `VS Code`, `JetBrains IDE`).
+- **Authentication:** To secure the connection, the extension **MUST** generate a unique, secret token and include it in the discovery file. The CLI will then include this token in the `Authorization` header for all requests to the MCP server (e.g., `Authorization: Bearer a-very-secret-token`). Your server **MUST** validate this token on every request and reject any that are unauthorized.
+- **Tie-Breaking with Environment Variables (Recommended):** For the most reliable experience, your extension **SHOULD** both create the discovery file and set the `GEMINI_CLI_IDE_SERVER_PORT` environment variable in the integrated terminal. The file serves as the primary discovery mechanism, but the environment variable is crucial for tie-breaking. If a user has multiple IDE windows open for the same workspace, the CLI uses the `GEMINI_CLI_IDE_SERVER_PORT` variable to identify and connect to the correct window's server.
+
+## II. The Context Interface
+
+To enable context awareness, the extension **MAY** provide the CLI with real-time information about the user's activity in the IDE.
+
+### `ide/contextUpdate` Notification
+
+The extension **MAY** send an `ide/contextUpdate` [notification](https://modelcontextprotocol.io/specification/2025-06-18/basic/index#notifications) to the CLI whenever the user's context changes.
+
+- **Triggering Events:** This notification should be sent (with a recommended debounce of 50ms) when:
+  - A file is opened, closed, or focused.
+  - The user's cursor position or text selection changes in the active file.
+- **Payload (`IdeContext`):** The notification parameters **MUST** be an `IdeContext` object:
+
+  ```typescript
+  interface IdeContext {
+    workspaceState?: {
+      openFiles?: File[];
+      isTrusted?: boolean;
+    };
+  }
+
+  interface File {
+    // Absolute path to the file
+    path: string;
+    // Last focused Unix timestamp (for ordering)
+    timestamp: number;
+    // True if this is the currently focused file
+    isActive?: boolean;
+    cursor?: {
+      // 1-based line number
+      line: number;
+      // 1-based character number
+      character: number;
+    };
+    // The text currently selected by the user
+    selectedText?: string;
+  }
+  ```
+
+  **Note:** The `openFiles` list should only include files that exist on disk. Virtual files (e.g., unsaved files without a path, editor settings pages) **MUST** be excluded.
+
+### How the CLI Uses This Context
+
+After receiving the `IdeContext` object, the CLI performs several normalization and truncation steps before sending the information to the model.
+
+- **File Ordering:** The CLI uses the `timestamp` field to determine the most recently used files. It sorts the `openFiles` list based on this value. Therefore, your extension **MUST** provide an accurate Unix timestamp for when a file was last focused.
+- **Active File:** The CLI considers only the most recent file (after sorting) to be the "active" file. It will ignore the `isActive` flag on all other files and clear their `cursor` and `selectedText` fields. Your extension should focus on setting `isActive: true` and providing cursor/selection details only for the currently focused file.
+- **Truncation:** To manage token limits, the CLI truncates both the file list (to 10 files) and the `selectedText` (to 16KB).
+
+While the CLI handles the final truncation, it is highly recommended that your extension also limits the amount of context it sends.
+
+## III. The Diffing Interface
+
+To enable interactive code modifications, the extension **MAY** expose a diffing interface. This allows the CLI to request that the IDE open a diff view, showing proposed changes to a file. The user can then review, edit, and ultimately accept or reject these changes directly within the IDE.
+
+### `openDiff` Tool
+
+The extension **MUST** register an `openDiff` tool on its MCP server.
+
+- **Description:** This tool instructs the IDE to open a modifiable diff view for a specific file.
+- **Request (`OpenDiffRequest`):** The tool is invoked via a `tools/call` request. The `arguments` field within the request's `params` **MUST** be an `OpenDiffRequest` object.
+
+  ```typescript
+  interface OpenDiffRequest {
+    // The absolute path to the file to be diffed.
+    filePath: string;
+    // The proposed new content for the file.
+    newContent: string;
+  }
+  ```
+
+- **Response (`CallToolResult`):** The tool **MUST** immediately return a `CallToolResult` to acknowledge the request and report whether the diff view was successfully opened.
+  - On Success: If the diff view was opened successfully, the response **MUST** contain empty content (i.e., `content: []`).
+  - On Failure: If an error prevented the diff view from opening, the response **MUST** have `isError: true` and include a `TextContent` block in the `content` array describing the error.
+
+  The actual outcome of the diff (acceptance or rejection) is communicated asynchronously via notifications.
+
+### `closeDiff` Tool
+
+The extension **MUST** register a `closeDiff` tool on its MCP server.
+
+- **Description:** This tool instructs the IDE to close an open diff view for a specific file.
+- **Request (`CloseDiffRequest`):** The tool is invoked via a `tools/call` request. The `arguments` field within the request's `params` **MUST** be an `CloseDiffRequest` object.
+
+  ```typescript
+  interface CloseDiffRequest {
+    // The absolute path to the file whose diff view should be closed.
+    filePath: string;
+  }
+  ```
+
+- **Response (`CallToolResult`):** The tool **MUST** return a `CallToolResult`.
+  - On Success: If the diff view was closed successfully, the response **MUST** include a single **TextContent** block in the content array containing the file's final content before closing.
+  - On Failure: If an error prevented the diff view from closing, the response **MUST** have `isError: true` and include a `TextContent` block in the `content` array describing the error.
+
+### `ide/diffAccepted` Notification
+
+When the user accepts the changes in a diff view (e.g., by clicking an "Apply" or "Save" button), the extension **MUST** send an `ide/diffAccepted` notification to the CLI.
+
+- **Payload:** The notification parameters **MUST** include the file path and the final content of the file. The content may differ from the original `newContent` if the user made manual edits in the diff view.
+
+  ```typescript
+  {
+    // The absolute path to the file that was diffed.
+    filePath: string;
+    // The full content of the file after acceptance.
+    content: string;
+  }
+  ```
+
+### `ide/diffRejected` Notification
+
+When the user rejects the changes (e.g., by closing the diff view without accepting), the extension **MUST** send an `ide/diffRejected` notification to the CLI.
+
+- **Payload:** The notification parameters **MUST** include the file path of the rejected diff.
+
+  ```typescript
+  {
+    // The absolute path to the file that was diffed.
+    filePath: string;
+  }
+  ```
+
+## IV. The Lifecycle Interface
+
+The extension **MUST** manage its resources and the discovery file correctly based on the IDE's lifecycle.
+
+- **On Activation (IDE startup/extension enabled):**
+  1.  Start the MCP server.
+  2.  Create the discovery file.
+- **On Deactivation (IDE shutdown/extension disabled):**
+  1.  Stop the MCP server.
+  2.  Delete the discovery file.

docs/ide-integration.md

@@ -2,7 +2,7 @@
 
 Gemini CLI can integrate with your IDE to provide a more seamless and context-aware experience. This integration allows the CLI to understand your workspace better and enables powerful features like native in-editor diffing.
 
-Currently, the only supported IDE is [Visual Studio Code](https://code.visualstudio.com/) and other editors that support VS Code extensions.
+Currently, the only supported IDE is [Visual Studio Code](https://code.visualstudio.com/) and other editors that support VS Code extensions. To build support for other editors, see the [IDE Companion Extension Spec](./ide-companion-spec.md).
 
 ## Features
 

docs/index.md

@@ -19,7 +19,9 @@ This documentation is organized into the following sections:
   - **[Checkpointing](./checkpointing.md):** Documentation for the checkpointing feature.
   - **[Extensions](./extension.md):** How to extend the CLI with new functionality.
   - **[IDE Integration](./ide-integration.md):** Connect the CLI to your editor.
+  - **[IDE Companion Extension Spec](./ide-companion-spec.md):** Spec for building IDE companion extensions.
   - **[Telemetry](./telemetry.md):** Overview of telemetry in the CLI.
+  - **[Trusted Folders](./trusted-folders.md):** An overview of the Trusted Folders security feature.
 - **Core Details:** Documentation for `packages/core`.
   - **[Core Introduction](./core/index.md):** Overview of the core component.
   - **[Tools API](./core/tools-api.md):** Information on how the core manages and exposes tools.

docs/integration-tests.md

@@ -20,7 +20,7 @@ npm run test:e2e
 
 ## Running a specific set of tests
 
-To run a subset of test files, you can use `npm run <integration test command> <file_name1> ....` where <integration test command> is either `test:e2e` or `test:integration*` and `<file_name>` is any of the `.test.js` files in the `integration-tests/` directory. For example, the following command runs `list_directory.test.js` and `write_file.test.js`:
+To run a subset of test files, you can use `npm run <integration test command> <file_name1> ....` where &lt;integration test command&gt; is either `test:e2e` or `test:integration*` and `<file_name>` is any of the `.test.js` files in the `integration-tests/` directory. For example, the following command runs `list_directory.test.js` and `write_file.test.js`:
 
 ```bash
 npm run test:e2e list_directory write_file

docs/issue-and-pr-automation.md

@@ -73,7 +73,7 @@ This is a fallback workflow to ensure that no issue gets missed by the triage pr
 
 This workflow handles the process of packaging and publishing new versions of the Gemini CLI.
 
-- **Workflow File**: `.github/workflows/release.yml`
+- **Workflow File**: `.github/workflows/release-manual.yml`
 - **When it runs**: On a daily schedule for "nightly" releases, and manually for official patch/minor releases.
 - **What it does**:
   - Automatically builds the project, bumps the version numbers, and publishes the packages to npm.

docs/mermaid/context.mmd

@@ -0,0 +1,103 @@
+graph LR
+    %% --- Style Definitions ---
+    classDef new fill:#98fb98,color:#000
+    classDef changed fill:#add8e6,color:#000
+    classDef unchanged fill:#f0f0f0,color:#000
+
+    %% --- Subgraphs ---
+    subgraph "Context Providers"
+        direction TB
+        A["gemini.tsx"]
+        B["AppContainer.tsx"]
+    end
+
+    subgraph "Contexts"
+        direction TB
+        CtxSession["SessionContext"]
+        CtxVim["VimModeContext"]
+        CtxSettings["SettingsContext"]
+        CtxApp["AppContext"]
+        CtxConfig["ConfigContext"]
+        CtxUIState["UIStateContext"]
+        CtxUIActions["UIActionsContext"]
+    end
+
+    subgraph "Component Consumers"
+        direction TB
+        ConsumerApp["App"]
+        ConsumerAppContainer["AppContainer"]
+        ConsumerAppHeader["AppHeader"]
+        ConsumerDialogManager["DialogManager"]
+        ConsumerHistoryItem["HistoryItemDisplay"]
+        ConsumerComposer["Composer"]
+        ConsumerMainContent["MainContent"]
+        ConsumerNotifications["Notifications"]
+    end
+
+    %% --- Provider -> Context Connections ---
+    A -.-> CtxSession
+    A -.-> CtxVim
+    A -.-> CtxSettings
+
+    B -.-> CtxApp
+    B -.-> CtxConfig
+    B -.-> CtxUIState
+    B -.-> CtxUIActions
+    B -.-> CtxSettings
+
+    %% --- Context -> Consumer Connections ---
+    CtxSession -.-> ConsumerAppContainer
+    CtxSession -.-> ConsumerApp
+
+    CtxVim -.-> ConsumerAppContainer
+    CtxVim -.-> ConsumerComposer
+    CtxVim -.-> ConsumerApp
+
+    CtxSettings -.-> ConsumerAppContainer
+    CtxSettings -.-> ConsumerAppHeader
+    CtxSettings -.-> ConsumerDialogManager
+    CtxSettings -.-> ConsumerApp
+
+    CtxApp -.-> ConsumerAppHeader
+    CtxApp -.-> ConsumerNotifications
+
+    CtxConfig -.-> ConsumerAppHeader
+    CtxConfig -.-> ConsumerHistoryItem
+    CtxConfig -.-> ConsumerComposer
+    CtxConfig -.-> ConsumerDialogManager
+
+
+
+    CtxUIState -.-> ConsumerApp
+    CtxUIState -.-> ConsumerMainContent
+    CtxUIState -.-> ConsumerComposer
+    CtxUIState -.-> ConsumerDialogManager
+
+    CtxUIActions -.-> ConsumerComposer
+    CtxUIActions -.-> ConsumerDialogManager
+
+    %% --- Apply Styles ---
+    %% New Elements (Green)
+    class B,CtxApp,CtxConfig,CtxUIState,CtxUIActions,ConsumerAppHeader,ConsumerDialogManager,ConsumerComposer,ConsumerMainContent,ConsumerNotifications new
+
+    %% Heavily Changed Elements (Blue)
+    class A,ConsumerApp,ConsumerAppContainer,ConsumerHistoryItem changed
+
+    %% Mostly Unchanged Elements (Gray)
+    class CtxSession,CtxVim,CtxSettings unchanged
+
+    %% --- Link Styles ---
+    %% CtxSession (Red)
+    linkStyle 0,8,9 stroke:#e57373,stroke-width:2px
+    %% CtxVim (Orange)
+    linkStyle 1,10,11,12 stroke:#ffb74d,stroke-width:2px
+    %% CtxSettings (Yellow)
+    linkStyle 2,7,13,14,15,16 stroke:#fff176,stroke-width:2px
+    %% CtxApp (Green)
+    linkStyle 3,17,18 stroke:#81c784,stroke-width:2px
+    %% CtxConfig (Blue)
+    linkStyle 4,19,20,21,22 stroke:#64b5f6,stroke-width:2px
+    %% CtxUIState (Indigo)
+    linkStyle 5,23,24,25,26 stroke:#7986cb,stroke-width:2px
+    %% CtxUIActions (Violet)
+    linkStyle 6,27,28 stroke:#ba68c8,stroke-width:2px

docs/mermaid/render-path.mmd

@@ -0,0 +1,64 @@
+graph TD
+    %% --- Style Definitions ---
+    classDef new fill:#98fb98,color:#000
+    classDef changed fill:#add8e6,color:#000
+    classDef unchanged fill:#f0f0f0,color:#000
+    classDef dispatcher fill:#f9e79f,color:#000,stroke:#333,stroke-width:1px
+    classDef container fill:#f5f5f5,color:#000,stroke:#ccc
+
+    %% --- Component Tree ---
+    subgraph "Entry Point"
+      A["gemini.tsx"]
+    end
+
+    subgraph "State & Logic Wrapper"
+      B["AppContainer.tsx"]
+    end
+
+    subgraph "Primary Layout"
+      C["App.tsx"]
+    end
+
+    A -.-> B
+    B -.-> C
+
+    subgraph "UI Containers"
+        direction LR
+        C -.-> D["MainContent"]
+        C -.-> G["Composer"]
+        C -.-> F["DialogManager"]
+        C -.-> E["Notifications"]
+    end
+
+    subgraph "MainContent"
+        direction TB
+        D -.-> H["AppHeader"]
+        D -.-> I["HistoryItemDisplay"]:::dispatcher
+        D -.-> L["ShowMoreLines"]
+    end
+
+    subgraph "Composer"
+        direction TB
+        G -.-> K_Prompt["InputPrompt"]
+        G -.-> K_Footer["Footer"]
+    end
+
+    subgraph "DialogManager"
+        F -.-> J["Various Dialogs<br>(Auth, Theme, Settings, etc.)"]
+    end
+
+    %% --- Apply Styles ---
+    class B,D,E,F,G,H,J,K_Prompt,L new
+    class A,C,I changed
+    class K_Footer unchanged
+
+    %% --- Link Styles ---
+    %% MainContent Branch (Blue)
+    linkStyle 2,6,7,8 stroke:#64b5f6,stroke-width:2px
+    %% Composer Branch (Green)
+    linkStyle 3,9,10 stroke:#81c784,stroke-width:2px
+    %% DialogManager Branch (Orange)
+    linkStyle 4,11 stroke:#ffb74d,stroke-width:2px
+    %% Notifications Branch (Violet)
+    linkStyle 5 stroke:#ba68c8,stroke-width:2px
+

docs/releases.md

@@ -2,11 +2,18 @@
 
 ## Release Cadence and Tags
 
-We will follow https://semver.org/ as closely as possible but will call out when or if we have to deviate from it. Our weekly releases will be minor version increments and any bug or hotfixes btween releases will go out as patch versions on the most recent release.
+We will follow https://semver.org/ as closely as possible but will call out when or if we have to deviate from it. Our weekly releases will be minor version increments and any bug or hotfixes between releases will go out as patch versions on the most recent release.
+
+Each Tuesaday ~2000 UTC new Stable and Preview releases will be cut. The promotion flow is:
+
+- Code is commited to main and pushed each night to nightly
+- After no more than 1 week on main, code is promoted to the `preview` channel
+- After 1 week the most recent `preview` channel is promoted to `stable` cannel
+- Patch fixes will be produced against both `preview` and `stable` as needed, with the final 'patch' version number incrementing each time.
 
 ### Preview
 
-New preview releases will be published each week at UTC 2359 on Tuesdays. These releases will not have been fully vetted and may contain regressions or other outstanding issues. Please help us test and install with `preview` tag.
+These releases will not have been fully vetted and may contain regressions or other outstanding issues. Please help us test and install with `preview` tag.
 
 ```bash
 npm install -g @google/gemini-cli@preview
@@ -14,7 +21,7 @@ npm install -g @google/gemini-cli@preview
 
 ### Stable
 
-- New stable releases will be published each week at UTC 2000 on Tuesdays, this will be the full promotion of last week's release + any bug fixes and validations. Use `latest` tag.
+This will be the full promotion of last week's release + any bug fixes and validations. Use `latest` tag.
 
 ```bash
 npm install -g @google/gemini-cli@latest
@@ -22,177 +29,227 @@ npm install -g @google/gemini-cli@latest
 
 ### Nightly
 
-- New releases will be published each week at UTC 0000 each day, This will be all changes from the main branch as represted at time of release. It should be assumed there are pending validations and issues. Use `nightly` tag.
+- New releases will be published each day at UTC 0000. This will be all changes from the main branch as represented at time of release. It should be assumed there are pending validations and issues. Use `nightly` tag.
 
 ```bash
 npm install -g @google/gemini-cli@nightly
 ```
 
-# Release Process.
+## Weekly Release Promotion
 
-Where `x.y.z` is the next version to be released. In most all cases for the weekly release this will be an increment on `y`, aka minor version update. Major version updates `x` will need broader coordination and communication. For patches `z` see below. When possible we will do our best to adher to https://semver.org/
+Each Tuesday, the on-call engineer will trigger the "Promote Release" workflow. This single action automates the entire weekly release process:
 
-Our release cadence is new releases are sent to a preview channel for a week and then promoted to stable after a week. Version numbers will follow SemVer with weekly releases incrementing the minor version. Patches and bug fixes to both preview and stable releases will increment the patch version.
+1.  **Promotes Preview to Stable:** The workflow identifies the latest `preview` release and promotes it to `stable`. This becomes the new `latest` version on npm.
+2.  **Promotes Nightly to Preview:** The latest `nightly` release is then promoted to become the new `preview` version.
+3.  **Prepares for next Nightly:** A pull request is automatically created and merged to bump the version in `main` in preparation for the next nightly release.
 
-## Nightly Release
+This process ensures a consistent and reliable release cadence with minimal manual intervention.
 
-Each night at UTC 0000 we will auto deploy a nightly release from `main`. This will be a version of the next production release, x.y.z, with the nightly tag.
+### Source of Truth for Versioning
 
-## Create Preview Release
+To ensure the highest reliability, the release promotion process uses the **NPM registry as the single source of truth** for determining the current version of each release channel (`stable`, `preview`, and `nightly`).
 
-Each Tuesday at UTC 2359 we will auto deploy a preview release of the next production release x.y.z.
+1.  **Fetch from NPM:** The workflow begins by querying NPM's `dist-tags` (`latest`, `preview`, `nightly`) to get the exact version strings for the packages currently available to users.
+2.  **Cross-Check for Integrity:** For each version retrieved from NPM, the workflow performs a critical integrity check:
+    - It verifies that a corresponding **git tag** exists in the repository.
+    - It verifies that a corresponding **GitHub Release** has been created.
+3.  **Halt on Discrepancy:** If either the git tag or the GitHub Release is missing for a version listed on NPM, the workflow will immediately fail. This strict check prevents promotions from a broken or incomplete previous release and alerts the on-call engineer to a release state inconsistency that must be manually resolved.
+4.  **Calculate Next Version:** Only after these checks pass does the workflow proceed to calculate the next semantic version based on the trusted version numbers retrieved from NPM.
 
-- This will happen as a scheduled instance of the ‘release’ action. It will be cut off of Main.
-- This will create a branch `release/vx.y.z-preview.n`
-- We will run evals and smoke testing against this branch and the npm package. For now this should be manual smoke testing, we don't have a dedicated matrix or specific detailed process. There is work coming soon to make this more formalized and automatic see https://github.com/google-gemini/gemini-cli/issues/3788
-- Users installing `@preview` will get this release as well
+This NPM-first approach, backed by integrity checks, makes the release process highly robust and prevents the kinds of versioning discrepancies that can arise from relying solely on git history or API outputs.
 
-## Promote Stable Release
+## Manual Releases
 
-After one week (On the following Tuesday) with all signals a go, we will manually release at 2000 UTC via the current on-call person.
+For situations requiring a release outside of the regular nightly and weekly promotion schedule, and NOT already covered by patching process, you can use the `Release: Manual` workflow. This workflow provides a direct way to publish a specific version from any branch, tag, or commit SHA.
 
-- The release action will be used with the source branch as `release/vx.y.z-preview.n`
-- The version will be x.y.z
-- The releaser will create and merge a pr into main with the version changes.
-- Smoke tests and manual validation will be run. For now this should be manual smoke testing, we don't have a dedicated matrix or specific detailed process. There is work coming soon to make this more formalized and automatic see https://github.com/google-gemini/gemini-cli/issues/3788
-
-## Patching Releases
-
-If a critical bug needs to be fixed before the next scheduled release, follow this process to create a patch.
-
-### 1. Create a Hotfix Branch
-
-First, create a new branch for your fix. The source for this branch depends on whether you are patching a stable or a preview release.
-
-- **For a stable release patch:**
-  Create a branch from the Git tag of the version you need to patch. Tag names are formatted as `vx.y.z`.
-
-  ```bash
-  # Example: Create a hotfix branch for v0.2.0
-  git checkout v0.2.0 -b hotfix/issue-123-fix-for-v0.2.0
-  ```
-
-- **For a preview release patch:**
-  Create a branch from the existing preview release branch, which is formatted as `release/vx.y.z-preview.n`.
-
-  ```bash
-  # Example: Create a hotfix branch for a preview release
-  git checkout release/v0.2.0-preview.0 && git checkout -b hotfix/issue-456-fix-for-preview
-  ```
-
-### 2. Implement the Fix
-
-In your new hotfix branch, either create a new commit with the fix or cherry-pick an existing commit from the `main` branch. Merge your changes into the source of the hotfix branch (ex. https://github.com/google-gemini/gemini-cli/pull/6850).
-
-### 3. Perform the Release
-
-Follow the manual release process using the "Release" GitHub Actions workflow.
-
-- **Version**: For stable patches, increment the patch version (e.g., `v0.2.0` -> `v0.2.1`). For preview patches, increment the preview number (e.g., `v0.2.0-preview.0` -> `v0.2.0-preview.1`).
-- **Ref**: Use your source branch as the reference (ex. `release/v0.2.0-preview.0`)
-
-![How to run a release](assets/release_patch.png)
-
-### 4. Update Versions
-
-After the hotfix is released, merge the changes back to the appropriate branch.
-
-- **For a stable release hotfix:**
-  Open a pull request to merge the release branch (e.g., `release/0.2.1`) back into `main`. This keeps the version number in `main` up to date.
-
-- **For a preview release hotfix:**
-  Open a pull request to merge the new preview release branch (e.g., `release/v0.2.0-preview.1`) back into the existing preview release branch (`release/v0.2.0-preview.0`) (ex. https://github.com/google-gemini/gemini-cli/pull/6868)
-
-## Release Schedule
-
-<table>
-  <tr>
-   <td>Date
-   </td>
-   <td>Stable UTC 2000
-   </td>
-   <td>Preview UTC 2359
-   </td>
-  </tr>
-  <tr>
-   <td>Aug 19th, 2025
-   </td>
-   <td>N/A
-   </td>
-   <td>0.2.0-preview.0
-   </td>
-  </tr>
-  <tr>
-   <td>Aug 26th, 2025
-   </td>
-   <td>0.2.0
-   </td>
-   <td>0.3.0-preview.0
-   </td>
-  </tr>
-  <tr>
-   <td>Sep 2nd, 2025
-   </td>
-   <td>0.3.0
-   </td>
-   <td>0.4.0-preview.0
-   </td>
-  </tr>
-  <tr>
-   <td>Sep 9th, 2025
-   </td>
-   <td>0.4.0
-   </td>
-   <td>0.5.0-preview.0
-   </td>
-  </tr>
-  <tr>
-   <td>Sep 16th, 2025
-   </td>
-   <td>0.5.0
-   </td>
-   <td>0.6.0-preview.0
-   </td>
-  </tr>
-  <tr>
-   <td>Sep 23rd, 2025
-   </td>
-   <td>0.6.0
-   </td>
-   <td>0.7.0-preview.0
-   </td>
-  </tr>
-</table>
-
-## How To Release
-
-Releases are managed through the [release.yml](https://github.com/google-gemini/gemini-cli/actions/workflows/release.yml) GitHub Actions workflow. To perform a manual release for a patch or hotfix:
+### How to Create a Manual Release
 
 1.  Navigate to the **Actions** tab of the repository.
-2.  Select the **Release** workflow from the list.
+2.  Select the **Release: Manual** workflow from the list.
 3.  Click the **Run workflow** dropdown button.
 4.  Fill in the required inputs:
-    - **Version**: The exact version to release (e.g., `v0.2.1`).
-    - **Ref**: The branch or commit SHA to release from (defaults to `main`).
-    - **Dry Run**: Leave as `true` to test the workflow without publishing, or set to `false` to perform a live release.
+    - **Version**: The exact version to release (e.g., `v0.6.1`). This must be a valid semantic version with a `v` prefix.
+    - **Ref**: The branch, tag, or full commit SHA to release from.
+    - **NPM Channel**: The npm channel to publish to. The options are `preview`, `nightly`, `latest` (for stable releases), and `dev`. The default is `dev`.
+    - **Dry Run**: Leave as `true` to run all steps without publishing, or set to `false` to perform a live release.
+    - **Force Skip Tests**: Set to `true` to skip the test suite. This is not recommended for production releases.
+    - **Skip GitHub Release**: Set to `true` to skip creating a GitHub release and create an npm release only.
 5.  Click **Run workflow**.
 
-### TLDR
+The workflow will then proceed to test (if not skipped), build, and publish the release. If the workflow fails during a non-dry run, it will automatically create a GitHub issue with the failure details.
 
-Each release, wether automated or manual performs the following steps:
+## Rollback/Rollforward
 
-1.  Checks out the latest code from the `main` branch.
-1.  Installs all dependencies.
-1.  Runs the full suite of `preflight` checks and integration tests.
-1.  If all tests succeed, it calculates the next version number based on the inputs.
-1.  It creates a branch name `release/${VERSION}`.
-1.  It creates a tag name `v${VERSION}`.
-1.  It then builds and publishes the packages to npm with the provided version number.
-1.  Finally, it creates a GitHub Release for the version.
+In the event that a release has a critical regression, you can quickly roll back to a previous stable version or roll forward to a new patch by changing the npm `dist-tag`. The `Release: Change Tags` workflow provides a safe and controlled way to do this.
 
-### Failure Handling
+This is the preferred method for both rollbacks and rollforwards, as it does not require a full release cycle.
 
-If any step in the workflow fails, it will automatically create a new issue in the repository with the labels `bug` and `release-failure`. The issue will contain a link to the failed workflow run for easy debugging.
+### How to Change a Release Tag
+
+1.  Navigate to the **Actions** tab of the repository.
+2.  Select the **Release: Change Tags** workflow from the list.
+3.  Click the **Run workflow** dropdown button.
+4.  Fill in the required inputs:
+    - **Version**: The existing package version that you want to point the tag to (e.g., `0.5.0-preview-2`). This version **must** already be published to the npm registry.
+    - **Channel**: The npm `dist-tag` to apply (e.g., `preview`, `stable`).
+    - **Dry Run**: Leave as `true` to log the action without making changes, or set to `false` to perform the live tag change.
+5.  Click **Run workflow**.
+
+The workflow will then run `npm dist-tag add` for both the `@google/gemini-cli` and `@google/gemini-cli-core` packages, pointing the specified channel to the specified version.
+
+## Patching
+
+If a critical bug that is already fixed on `main` needs to be patched on a `stable` or `preview` release, the process is now highly automated.
+
+### How to Patch
+
+#### 1. Create the Patch Pull Request
+
+There are two ways to create a patch pull request:
+
+**Option A: From a GitHub Comment (Recommended)**
+
+After a pull request containing the fix has been merged, a maintainer can add a comment on that same PR with the following format:
+
+`/patch [channel]`
+
+- **channel** (optional):
+  - _no channel_ - patches both stable and preview channels (default, recommended for most fixes)
+  - `both` - patches both stable and preview channels (same as default)
+  - `stable` - patches only the stable channel
+  - `preview` - patches only the preview channel
+
+Examples:
+
+- `/patch` (patches both stable and preview - default)
+- `/patch both` (patches both stable and preview - explicit)
+- `/patch stable` (patches only stable)
+- `/patch preview` (patches only preview)
+
+The `Release: Patch from Comment` workflow will automatically find the merge commit SHA and trigger the `Release: Patch (1) Create PR` workflow. If the PR is not yet merged, it will post a comment indicating the failure.
+
+**Option B: Manually Triggering the Workflow**
+
+Navigate to the **Actions** tab and run the **Release: Patch (1) Create PR** workflow.
+
+- **Commit**: The full SHA of the commit on `main` that you want to cherry-pick.
+- **Channel**: The channel you want to patch (`stable` or `preview`).
+
+This workflow will automatically:
+
+1.  Find the latest release tag for the channel.
+2.  Create a release branch from that tag if one doesn't exist (e.g., `release/v0.5.1`).
+3.  Create a new hotfix branch from the release branch.
+4.  Cherry-pick your specified commit into the hotfix branch.
+5.  Create a pull request from the hotfix branch back to the release branch.
+
+#### 2. Review and Merge
+
+Review the automatically created pull request(s) to ensure the cherry-pick was successful and the changes are correct. Once approved, merge the pull request.
+
+**Security Note:** The `release/*` branches are protected by branch protection rules. A pull request to one of these branches requires at least one review from a code owner before it can be merged. This ensures that no unauthorized code is released.
+
+#### 2.5. Adding Multiple Commits to a Hotfix (Advanced)
+
+If you need to include multiple fixes in a single patch release, you can add additional commits to the hotfix branch after the initial patch PR has been created:
+
+1. **Start with the primary fix**: Use `/patch` (or `/patch both`) on the most important PR to create the initial hotfix branch and PR.
+
+2. **Checkout the hotfix branch locally**:
+
+   ```bash
+   git fetch origin
+   git checkout hotfix/v0.5.1/stable/cherry-pick-abc1234  # Use the actual branch name from the PR
+   ```
+
+3. **Cherry-pick additional commits**:
+
+   ```bash
+   git cherry-pick <commit-sha-1>
+   git cherry-pick <commit-sha-2>
+   # Add as many commits as needed
+   ```
+
+4. **Push the updated branch**:
+
+   ```bash
+   git push origin hotfix/v0.5.1/stable/cherry-pick-abc1234
+   ```
+
+5. **Test and review**: The existing patch PR will automatically update with your additional commits. Test thoroughly since you're now releasing multiple changes together.
+
+6. **Update the PR description**: Consider updating the PR title and description to reflect that it includes multiple fixes.
+
+This approach allows you to group related fixes into a single patch release while maintaining full control over what gets included and how conflicts are resolved.
+
+#### 3. Automatic Release
+
+Upon merging the pull request, the `Release: Patch (2) Trigger` workflow is automatically triggered. It will then start the `Release: Patch (3) Release` workflow, which will:
+
+1.  Build and test the patched code.
+2.  Publish the new patch version to npm.
+3.  Create a new GitHub release with the patch notes.
+
+This fully automated process ensures that patches are created and released consistently and reliably.
+
+#### Troubleshooting: Older Branch Workflows
+
+**Issue**: If the patch trigger workflow fails with errors like "Resource not accessible by integration" or references to non-existent workflow files (e.g., `patch-release.yml`), this indicates the hotfix branch contains an outdated version of the workflow files.
+
+**Root Cause**: When a PR is merged, GitHub Actions runs the workflow definition from the **source branch** (the hotfix branch), not from the target branch (the release branch). If the hotfix branch was created from an older release branch that predates workflow improvements, it will use the old workflow logic.
+
+**Solutions**:
+
+**Option 1: Manual Trigger (Quick Fix)**
+Manually trigger the updated workflow from the branch with the latest workflow code:
+
+```bash
+# For a preview channel patch with tests skipped
+gh workflow run release-patch-2-trigger.yml --ref <branch-with-updated-workflow> \
+  --field ref="hotfix/v0.6.0-preview.2/preview/cherry-pick-abc1234" \
+  --field workflow_ref=<branch-with-updated-workflow> \
+  --field dry_run=false \
+  --field force_skip_tests=true
+
+# For a stable channel patch
+gh workflow run release-patch-2-trigger.yml --ref <branch-with-updated-workflow> \
+  --field ref="hotfix/v0.5.1/stable/cherry-pick-abc1234" \
+  --field workflow_ref=<branch-with-updated-workflow> \
+  --field dry_run=false \
+  --field force_skip_tests=false
+
+# Example using main branch (most common case)
+gh workflow run release-patch-2-trigger.yml --ref main \
+  --field ref="hotfix/v0.6.0-preview.2/preview/cherry-pick-abc1234" \
+  --field workflow_ref=main \
+  --field dry_run=false \
+  --field force_skip_tests=true
+```
+
+**Note**: Replace `<branch-with-updated-workflow>` with the branch containing the latest workflow improvements (usually `main`, but could be a feature branch if testing updates).
+
+**Option 2: Update the Hotfix Branch**
+Merge the latest main branch into your hotfix branch to get the updated workflows:
+
+```bash
+git checkout hotfix/v0.6.0-preview.2/preview/cherry-pick-abc1234
+git merge main
+git push
+```
+
+Then close and reopen the PR to retrigger the workflow with the updated version.
+
+**Option 3: Direct Release Trigger**
+Skip the trigger workflow entirely and directly run the release workflow:
+
+```bash
+# Replace channel and release_ref with appropriate values
+gh workflow run release-patch-3-release.yml --ref main \
+  --field type="preview" \
+  --field dry_run=false \
+  --field force_skip_tests=true \
+  --field release_ref="release/v0.6.0-preview.2"
+```
 
 ### Docker
 
@@ -211,7 +268,7 @@ After pushing a new release smoke testing should be performed to ensure that the
 
 If you need to test the release process without actually publishing to NPM or creating a public GitHub release, you can trigger the workflow manually from the GitHub UI.
 
-1.  Go to the [Actions tab](https://github.com/google-gemini/gemini-cli/actions/workflows/release.yml) of the repository.
+1.  Go to the [Actions tab](https://github.com/google-gemini/gemini-cli/actions/workflows/release-manual.yml) of the repository.
 2.  Click on the "Run workflow" dropdown.
 3.  Leave the `dry_run` option checked (`true`).
 4.  Click the "Run workflow" button.
@@ -239,105 +296,74 @@ By performing a dry run, you can be confident that your changes to the packaging
 
 ## Release Deep Dive
 
-The main goal of the release process is to take the source code from the packages/ directory, build it, and assemble a
-clean, self-contained package in a temporary `bundle` directory at the root of the project. This `bundle` directory is what
-actually gets published to NPM.
+The release process creates two distinct types of artifacts for different distribution channels: standard packages for the NPM registry and a single, self-contained executable for GitHub Releases.
 
 Here are the key stages:
 
-Stage 1: Pre-Release Sanity Checks and Versioning
+**Stage 1: Pre-Release Sanity Checks and Versioning**
 
-- What happens: Before any files are moved, the process ensures the project is in a good state. This involves running tests,
-  linting, and type-checking (npm run preflight). The version number in the root package.json and packages/cli/package.json
-  is updated to the new release version.
-- Why: This guarantees that only high-quality, working code is released. Versioning is the first step to signify a new
-  release.
+- **What happens:** Before any files are moved, the process ensures the project is in a good state. This involves running tests, linting, and type-checking (`npm run preflight`). The version number in the root `package.json` and `packages/cli/package.json` is updated to the new release version.
 
-Stage 2: Building the Source Code
+**Stage 2: Building the Source Code for NPM**
 
-- What happens: The TypeScript source code in packages/core/src and packages/cli/src is compiled into JavaScript.
-- File movement:
-  - packages/core/src/\*_/_.ts -> compiled to -> packages/core/dist/
-  - packages/cli/src/\*_/_.ts -> compiled to -> packages/cli/dist/
-- Why: The TypeScript code written during development needs to be converted into plain JavaScript that can be run by
-  Node.js. The core package is built first as the cli package depends on it.
+- **What happens:** The TypeScript source code in `packages/core/src` and `packages/cli/src` is compiled into standard JavaScript.
+- **File movement:**
+  - `packages/core/src/**/*.ts` -> compiled to -> `packages/core/dist/`
+  - `packages/cli/src/**/*.ts` -> compiled to -> `packages/cli/dist/`
+- **Why:** The TypeScript code written during development needs to be converted into plain JavaScript that can be run by Node.js. The `core` package is built first as the `cli` package depends on it.
 
-Stage 3: Assembling the Final Publishable Package
+**Stage 3: Publishing Standard Packages to NPM**
 
-This is the most critical stage where files are moved and transformed into their final state for publishing. A temporary
-`bundle` folder is created at the project root to house the final package contents.
+- **What happens:** The `npm publish` command is run for the `@google/gemini-cli-core` and `@google/gemini-cli` packages.
+- **Why:** This publishes them as standard Node.js packages. Users installing via `npm install -g @google/gemini-cli` will download these packages, and `npm` will handle installing the `@google/gemini-cli-core` dependency automatically. The code in these packages is not bundled into a single file.
 
-1.  The `package.json` is Transformed:
-    - What happens: The package.json from packages/cli/ is read, modified, and written into the root `bundle`/ directory.
-    - File movement: packages/cli/package.json -> (in-memory transformation) -> `bundle`/package.json
-    - Why: The final package.json must be different from the one used in development. Key changes include:
-      - Removing devDependencies.
-      - Removing workspace-specific "dependencies": { "@gemini-cli/core": "workspace:\*" } and ensuring the core code is
-        bundled directly into the final JavaScript file.
-      - Ensuring the bin, main, and files fields point to the correct locations within the final package structure.
+**Stage 4: Assembling and Creating the GitHub Release Asset**
 
-2.  The JavaScript Bundle is Created:
-    - What happens: The built JavaScript from both packages/core/dist and packages/cli/dist are bundled into a single,
-      executable JavaScript file.
-    - File movement: packages/cli/dist/index.js + packages/core/dist/index.js -> (bundled by esbuild) -> `bundle`/gemini.js (or a
-      similar name).
-    - Why: This creates a single, optimized file that contains all the necessary application code. It simplifies the package
-      by removing the need for the core package to be a separate dependency on NPM, as its code is now included directly.
+This stage happens _after_ the NPM publish and creates the single-file executable that enables `npx` usage directly from the GitHub repository.
 
-3.  Static and Supporting Files are Copied:
-    - What happens: Essential files that are not part of the source code but are required for the package to work correctly
-      or be well-described are copied into the `bundle` directory.
-    - File movement:
-      - README.md -> `bundle`/README.md
-      - LICENSE -> `bundle`/LICENSE
-      - packages/cli/src/utils/\*.sb (sandbox profiles) -> `bundle`/
-    - Why:
-      - The README.md and LICENSE are standard files that should be included in any NPM package.
-      - The sandbox profiles (.sb files) are critical runtime assets required for the CLI's sandboxing feature to
-        function. They must be located next to the final executable.
+1.  **The JavaScript Bundle is Created:**
+    - **What happens:** The built JavaScript from both `packages/core/dist` and `packages/cli/dist`, along with all third-party JavaScript dependencies, are bundled by `esbuild` into a single, executable JavaScript file (e.g., `gemini.js`). The `node-pty` library is excluded from this bundle as it contains native binaries.
+    - **Why:** This creates a single, optimized file that contains all the necessary application code. It simplifies execution for users who want to run the CLI without a full `npm install`, as all dependencies (including the `core` package) are included directly.
 
-Stage 4: Publishing to NPM
+2.  **The `bundle` Directory is Assembled:**
+    - **What happens:** A temporary `bundle` folder is created at the project root. The single `gemini.js` executable is placed inside it, along with other essential files.
+    - **File movement:**
+      - `gemini.js` (from esbuild) -> `bundle/gemini.js`
+      - `README.md` -> `bundle/README.md`
+      - `LICENSE` -> `bundle/LICENSE`
+      - `packages/cli/src/utils/*.sb` (sandbox profiles) -> `bundle/`
+    - **Why:** This creates a clean, self-contained directory with everything needed to run the CLI and understand its license and usage.
 
-- What happens: The npm publish command is run from inside the root `bundle` directory.
-- Why: By running npm publish from within the `bundle` directory, only the files we carefully assembled in Stage 3 are uploaded
-  to the NPM registry. This prevents any source code, test files, or development configurations from being accidentally
-  published, resulting in a clean and minimal package for users.
+3.  **The GitHub Release is Created:**
+    - **What happens:** The contents of the `bundle` directory, including the `gemini.js` executable, are attached as assets to a new GitHub Release.
+    - **Why:** This makes the single-file version of the CLI available for direct download and enables the `npx https://github.com/google-gemini/gemini-cli` command, which downloads and runs this specific bundled asset.
 
-Summary of File Flow
+**Summary of Artifacts**
 
-```mermaid
-graph TD
-    subgraph "Source Files"
-        A["packages/core/src/*.ts<br/>packages/cli/src/*.ts"]
-        B["packages/cli/package.json"]
-        C["README.md<br/>LICENSE<br/>packages/cli/src/utils/*.sb"]
-    end
+- **NPM:** Publishes standard, un-bundled Node.js packages. The primary artifact is the code in `packages/cli/dist`, which depends on `@google/gemini-cli-core`.
+- **GitHub Release:** Publishes a single, bundled `gemini.js` file that contains all dependencies, for easy execution via `npx`.
 
-    subgraph "Process"
-        D(Build)
-        E(Transform)
-        F(Assemble)
-        G(Publish)
-    end
+This dual-artifact process ensures that both traditional `npm` users and those who prefer the convenience of `npx` have an optimized experience.
 
-    subgraph "Artifacts"
-        H["Bundled JS"]
-        I["Final package.json"]
-        J["bundle/"]
-    end
+## Notifications
 
-    subgraph "Destination"
-        K["NPM Registry"]
-    end
+Failing release workflows will automatically create an issue with the label
+`release-failure`.
 
-    A --> D --> H
-    B --> E --> I
-    C --> F
-    H --> F
-    I --> F
-    F --> J
-    J --> G --> K
-```
+A notification will be posted to the maintainer's chat channel when issues with
+this type are created.
 
-This process ensures that the final published artifact is a purpose-built, clean, and efficient representation of the
-project, rather than a direct copy of the development workspace.
+### Modifying chat notifications
+
+Notifications use [GitHub for Google Chat](https://workspace.google.com/marketplace/app/github_for_google_chat/536184076190). To modify the notifications, use `/github-settings` within the chat space.
+
+> [!WARNING]
+> The following instructions describe a fragile workaround that depends on the internal structure of the chat application's UI. It is likely to break with future updates.
+
+The list of available labels is not currently populated correctly. If you want to add a label that does not appear alphabetically in the first 30 labels in the repo, you must use your browser's developer tools to manually modify the UI:
+
+1. Open your browser's developer tools (e.g., Chrome DevTools).
+2. In the `/github-settings` dialog, inspect the list of labels.
+3. Locate one of the `<li>` elements representing a label.
+4. In the HTML, modify the `data-option-value` attribute of that `<li>` element to the desired label name (e.g., `release-failure`).
+5. Click on your modified label in the UI to select it, then save your settings.

docs/telemetry.md

@@ -1,168 +1,216 @@
-# Gemini CLI Observability Guide
+# Observability with OpenTelemetry
 
-Telemetry provides data about Gemini CLI's performance, health, and usage. By enabling it, you can monitor operations, debug issues, and optimize tool usage through traces, metrics, and structured logs.
+Learn how to enable and setup OpenTelemetry for Gemini CLI.
 
-Gemini CLI's telemetry system is built on the **[OpenTelemetry] (OTEL)** standard, allowing you to send data to any compatible backend.
+- [Observability with OpenTelemetry](#observability-with-opentelemetry)
+  - [Key Benefits](#key-benefits)
+  - [OpenTelemetry Integration](#opentelemetry-integration)
+  - [Configuration](#configuration)
+  - [Google Cloud Telemetry](#google-cloud-telemetry)
+    - [Prerequisites](#prerequisites)
+    - [Direct Export (Recommended)](#direct-export-recommended)
+    - [Collector-Based Export (Advanced)](#collector-based-export-advanced)
+  - [Local Telemetry](#local-telemetry)
+    - [File-based Output (Recommended)](#file-based-output-recommended)
+    - [Collector-Based Export (Advanced)](#collector-based-export-advanced-1)
+  - [Logs and Metrics](#logs-and-metrics)
+    - [Logs](#logs)
+    - [Metrics](#metrics)
+
+## Key Benefits
+
+- **🔍 Usage Analytics**: Understand interaction patterns and feature adoption
+  across your team
+- **⚡ Performance Monitoring**: Track response times, token consumption, and
+  resource utilization
+- **🐛 Real-time Debugging**: Identify bottlenecks, failures, and error patterns
+  as they occur
+- **📊 Workflow Optimization**: Make informed decisions to improve
+  configurations and processes
+- **🏢 Enterprise Governance**: Monitor usage across teams, track costs, ensure
+  compliance, and integrate with existing monitoring infrastructure
+
+## OpenTelemetry Integration
+
+Built on **[OpenTelemetry]** — the vendor-neutral, industry-standard
+observability framework — Gemini CLI's observability system provides:
+
+- **Universal Compatibility**: Export to any OpenTelemetry backend (Google
+  Cloud, Jaeger, Prometheus, Datadog, etc.)
+- **Standardized Data**: Use consistent formats and collection methods across
+  your toolchain
+- **Future-Proof Integration**: Connect with existing and future observability
+  infrastructure
+- **No Vendor Lock-in**: Switch between backends without changing your
+  instrumentation
 
 [OpenTelemetry]: https://opentelemetry.io/
 
-## Enabling telemetry
+## Configuration
 
-You can enable telemetry in multiple ways. Configuration is primarily managed via the [`.gemini/settings.json` file](./cli/configuration.md) and environment variables, but CLI flags can override these settings for a specific session.
+All telemetry behavior is controlled through your `.gemini/settings.json` file.
+These settings can be overridden by environment variables or CLI flags.
 
-### Order of precedence
+| Setting        | Environment Variable             | CLI Flag                                                 | Description                                       | Values            | Default                 |
+| -------------- | -------------------------------- | -------------------------------------------------------- | ------------------------------------------------- | ----------------- | ----------------------- |
+| `enabled`      | `GEMINI_TELEMETRY_ENABLED`       | `--telemetry` / `--no-telemetry`                         | Enable or disable telemetry                       | `true`/`false`    | `false`                 |
+| `target`       | `GEMINI_TELEMETRY_TARGET`        | `--telemetry-target <local\|gcp>`                        | Where to send telemetry data                      | `"gcp"`/`"local"` | `"local"`               |
+| `otlpEndpoint` | `GEMINI_TELEMETRY_OTLP_ENDPOINT` | `--telemetry-otlp-endpoint <URL>`                        | OTLP collector endpoint                           | URL string        | `http://localhost:4317` |
+| `otlpProtocol` | `GEMINI_TELEMETRY_OTLP_PROTOCOL` | `--telemetry-otlp-protocol <grpc\|http>`                 | OTLP transport protocol                           | `"grpc"`/`"http"` | `"grpc"`                |
+| `outfile`      | `GEMINI_TELEMETRY_OUTFILE`       | `--telemetry-outfile <path>`                             | Save telemetry to file (overrides `otlpEndpoint`) | file path         | -                       |
+| `logPrompts`   | `GEMINI_TELEMETRY_LOG_PROMPTS`   | `--telemetry-log-prompts` / `--no-telemetry-log-prompts` | Include prompts in telemetry logs                 | `true`/`false`    | `true`                  |
+| `useCollector` | `GEMINI_TELEMETRY_USE_COLLECTOR` | -                                                        | Use external OTLP collector (advanced)            | `true`/`false`    | `false`                 |
 
-The following lists the precedence for applying telemetry settings, with items listed higher having greater precedence:
+**Note on boolean environment variables:** For the boolean settings (`enabled`,
+`logPrompts`, `useCollector`), setting the corresponding environment variable to
+`true` or `1` will enable the feature. Any other value will disable it.
 
-1.  **CLI flags (for `gemini` command):**
-    - `--telemetry` / `--no-telemetry`: Overrides `telemetry.enabled`.
-    - `--telemetry-target <local|gcp>`: Overrides `telemetry.target`.
-    - `--telemetry-otlp-endpoint <URL>`: Overrides `telemetry.otlpEndpoint`.
-    - `--telemetry-log-prompts` / `--no-telemetry-log-prompts`: Overrides `telemetry.logPrompts`.
-    - `--telemetry-outfile <path>`: Redirects telemetry output to a file. See [Exporting to a file](#exporting-to-a-file).
+For detailed information about all configuration options, see the
+[Configuration Guide](./cli/configuration.md).
 
-1.  **Environment variables:**
-    - `OTEL_EXPORTER_OTLP_ENDPOINT`: Overrides `telemetry.otlpEndpoint`.
+## Google Cloud Telemetry
 
-1.  **Workspace settings file (`.gemini/settings.json`):** Values from the `telemetry` object in this project-specific file.
+### Prerequisites
 
-1.  **User settings file (`~/.gemini/settings.json`):** Values from the `telemetry` object in this global user file.
+Before using either method below, complete these steps:
 
-1.  **Defaults:** applied if not set by any of the above.
-    - `telemetry.enabled`: `false`
-    - `telemetry.target`: `local`
-    - `telemetry.otlpEndpoint`: `http://localhost:4317`
-    - `telemetry.logPrompts`: `true`
+1. Set your Google Cloud project ID:
+   - For telemetry in a separate project from inference:
+     ```bash
+     export OTLP_GOOGLE_CLOUD_PROJECT="your-telemetry-project-id"
+     ```
+   - For telemetry in the same project as inference:
+     ```bash
+     export GOOGLE_CLOUD_PROJECT="your-project-id"
+     ```
 
-**For the `npm run telemetry -- --target=<gcp|local>` script:**
-The `--target` argument to this script _only_ overrides the `telemetry.target` for the duration and purpose of that script (i.e., choosing which collector to start). It does not permanently change your `settings.json`. The script will first look at `settings.json` for a `telemetry.target` to use as its default.
+2. Authenticate with Google Cloud:
+   - If using a user account:
+     ```bash
+     gcloud auth application-default login
+     ```
+   - If using a service account:
+     ```bash
+     export GOOGLE_APPLICATION_CREDENTIALS="/path/to/your/service-account.json"
+     ```
+3. Make sure your account or service account has these IAM roles:
+   - Cloud Trace Agent
+   - Monitoring Metric Writer
+   - Logs Writer
 
-### Example settings
+4. Enable the required Google Cloud APIs (if not already enabled):
+   ```bash
+   gcloud services enable \
+     cloudtrace.googleapis.com \
+     monitoring.googleapis.com \
+     logging.googleapis.com \
+     --project="$OTLP_GOOGLE_CLOUD_PROJECT"
+   ```
 
-The following code can be added to your workspace (`.gemini/settings.json`) or user (`~/.gemini/settings.json`) settings to enable telemetry and send the output to Google Cloud:
+### Direct Export (Recommended)
 
-```json
-{
-  "telemetry": {
-    "enabled": true,
-    "target": "gcp"
-  },
-  "tools": {
-    "sandbox": false
-  }
-}
-```
+Sends telemetry directly to Google Cloud services. No collector needed.
 
-### Exporting to a file
+1. Enable telemetry in your `.gemini/settings.json`:
+   ```json
+   {
+     "telemetry": {
+       "enabled": true,
+       "target": "gcp"
+     }
+   }
+   ```
+2. Run Gemini CLI and send prompts.
+3. View logs and metrics:
+   - Open the Google Cloud Console in your browser after sending prompts:
+     - Logs: https://console.cloud.google.com/logs/
+     - Metrics: https://console.cloud.google.com/monitoring/metrics-explorer
+     - Traces: https://console.cloud.google.com/traces/list
 
-You can export all telemetry data to a file for local inspection.
+### Collector-Based Export (Advanced)
 
-To enable file export, use the `--telemetry-outfile` flag with a path to your desired output file. This must be run using `--telemetry-target=local`.
+For custom processing, filtering, or routing, use an OpenTelemetry collector to
+forward data to Google Cloud.
 
-```bash
-# Set your desired output file path
-TELEMETRY_FILE=".gemini/telemetry.log"
+1. Configure your `.gemini/settings.json`:
+   ```json
+   {
+     "telemetry": {
+       "enabled": true,
+       "target": "gcp",
+       "useCollector": true
+     }
+   }
+   ```
+2. Run the automation script:
+   ```bash
+   npm run telemetry -- --target=gcp
+   ```
+   This will:
+   - Start a local OTEL collector that forwards to Google Cloud
+   - Configure your workspace
+   - Provide links to view traces, metrics, and logs in Google Cloud Console
+   - Save collector logs to `~/.gemini/tmp/<projectHash>/otel/collector-gcp.log`
+   - Stop collector on exit (e.g. `Ctrl+C`)
+3. Run Gemini CLI and send prompts.
+4. View logs and metrics:
+   - Open the Google Cloud Console in your browser after sending prompts:
+     - Logs: https://console.cloud.google.com/logs/
+     - Metrics: https://console.cloud.google.com/monitoring/metrics-explorer
+     - Traces: https://console.cloud.google.com/traces/list
+   - Open `~/.gemini/tmp/<projectHash>/otel/collector-gcp.log` to view local
+     collector logs.
 
-# Run Gemini CLI with local telemetry
-# NOTE: --telemetry-otlp-endpoint="" is required to override the default
-# OTLP exporter and ensure telemetry is written to the local file.
-gemini --telemetry \
-  --telemetry-target=local \
-  --telemetry-otlp-endpoint="" \
-  --telemetry-outfile="$TELEMETRY_FILE" \
-  --prompt "What is OpenTelemetry?"
-```
+## Local Telemetry
 
-## Running an OTEL Collector
+For local development and debugging, you can capture telemetry data locally:
 
-An OTEL Collector is a service that receives, processes, and exports telemetry data.
-The CLI can send data using either the OTLP/gRPC or OTLP/HTTP protocol.
-You can specify which protocol to use via the `--telemetry-otlp-protocol` flag
-or the `telemetry.otlpProtocol` setting in your `settings.json` file. See the
-[configuration docs](./cli/configuration.md#--telemetry-otlp-protocol) for more
-details.
+### File-based Output (Recommended)
 
-Learn more about OTEL exporter standard configuration in [documentation][otel-config-docs].
+1. Enable telemetry in your `.gemini/settings.json`:
+   ```json
+   {
+     "telemetry": {
+       "enabled": true,
+       "target": "local",
+       "otlpEndpoint": "",
+       "outfile": ".gemini/telemetry.log"
+     }
+   }
+   ```
+2. Run Gemini CLI and send prompts.
+3. View logs and metrics in the specified file (e.g., `.gemini/telemetry.log`).
 
-[otel-config-docs]: https://opentelemetry.io/docs/languages/sdk-configuration/otlp-exporter/
+### Collector-Based Export (Advanced)
 
-### Local
+1. Run the automation script:
+   ```bash
+   npm run telemetry -- --target=local
+   ```
+   This will:
+   - Download and start Jaeger and OTEL collector
+   - Configure your workspace for local telemetry
+   - Provide a Jaeger UI at http://localhost:16686
+   - Save logs/metrics to `~/.gemini/tmp/<projectHash>/otel/collector.log`
+   - Stop collector on exit (e.g. `Ctrl+C`)
+2. Run Gemini CLI and send prompts.
+3. View traces at http://localhost:16686 and logs/metrics in the collector log
+   file.
 
-Use the `npm run telemetry -- --target=local` command to automate the process of setting up a local telemetry pipeline, including configuring the necessary settings in your `.gemini/settings.json` file. The underlying script installs `otelcol-contrib` (the OpenTelemetry Collector) and `jaeger` (The Jaeger UI for viewing traces). To use it:
+## Logs and Metrics
 
-1.  **Run the command**:
-    Execute the command from the root of the repository:
-
-    ```bash
-    npm run telemetry -- --target=local
-    ```
-
-    The script will:
-    - Download Jaeger and OTEL if needed.
-    - Start a local Jaeger instance.
-    - Start an OTEL collector configured to receive data from Gemini CLI.
-    - Automatically enable telemetry in your workspace settings.
-    - On exit, disable telemetry.
-
-1.  **View traces**:
-    Open your web browser and navigate to **http://localhost:16686** to access the Jaeger UI. Here you can inspect detailed traces of Gemini CLI operations.
-
-1.  **Inspect logs and metrics**:
-    The script redirects the OTEL collector output (which includes logs and metrics) to `~/.gemini/tmp/<projectHash>/otel/collector.log`. The script will provide links to view and a command to tail your telemetry data (traces, metrics, logs) locally.
-
-1.  **Stop the services**:
-    Press `Ctrl+C` in the terminal where the script is running to stop the OTEL Collector and Jaeger services.
-
-### Google Cloud
-
-Use the `npm run telemetry -- --target=gcp` command to automate setting up a local OpenTelemetry collector that forwards data to your Google Cloud project, including configuring the necessary settings in your `.gemini/settings.json` file. The underlying script installs `otelcol-contrib`. To use it:
-
-1.  **Prerequisites**:
-    - Have a Google Cloud project ID.
-    - Export the `GOOGLE_CLOUD_PROJECT` environment variable to make it available to the OTEL collector.
-      ```bash
-      export OTLP_GOOGLE_CLOUD_PROJECT="your-project-id"
-      ```
-    - Authenticate with Google Cloud (e.g., run `gcloud auth application-default login` or ensure `GOOGLE_APPLICATION_CREDENTIALS` is set).
-    - Ensure your Google Cloud account/service account has the necessary IAM roles: "Cloud Trace Agent", "Monitoring Metric Writer", and "Logs Writer".
-
-1.  **Run the command**:
-    Execute the command from the root of the repository:
-
-    ```bash
-    npm run telemetry -- --target=gcp
-    ```
-
-    The script will:
-    - Download the `otelcol-contrib` binary if needed.
-    - Start an OTEL collector configured to receive data from Gemini CLI and export it to your specified Google Cloud project.
-    - Automatically enable telemetry and disable sandbox mode in your workspace settings (`.gemini/settings.json`).
-    - Provide direct links to view traces, metrics, and logs in your Google Cloud Console.
-    - On exit (Ctrl+C), it will attempt to restore your original telemetry and sandbox settings.
-
-1.  **Run Gemini CLI:**
-    In a separate terminal, run your Gemini CLI commands. This generates telemetry data that the collector captures.
-
-1.  **View telemetry in Google Cloud**:
-    Use the links provided by the script to navigate to the Google Cloud Console and view your traces, metrics, and logs.
-
-1.  **Inspect local collector logs**:
-    The script redirects the local OTEL collector output to `~/.gemini/tmp/<projectHash>/otel/collector-gcp.log`. The script provides links to view and command to tail your collector logs locally.
-
-1.  **Stop the service**:
-    Press `Ctrl+C` in the terminal where the script is running to stop the OTEL Collector.
-
-## Logs and metric reference
-
-The following section describes the structure of logs and metrics generated for Gemini CLI.
+The following section describes the structure of logs and metrics generated for
+Gemini CLI.
 
 - A `sessionId` is included as a common attribute on all logs and metrics.
 
 ### Logs
 
-Logs are timestamped records of specific events. The following events are logged for Gemini CLI:
+Logs are timestamped records of specific events. The following events are logged
+for Gemini CLI:
 
-- `gemini_cli.config`: This event occurs once at startup with the CLI's configuration.
+- `gemini_cli.config`: This event occurs once at startup with the CLI's
+  configuration.
   - **Attributes**:
     - `model` (string)
     - `embedding_model` (string)
@@ -176,12 +224,14 @@ Logs are timestamped records of specific events. The following events are logged
     - `file_filtering_respect_git_ignore` (boolean)
     - `debug_mode` (boolean)
     - `mcp_servers` (string)
+    - `output_format` (string: "text" or "json")
 
 - `gemini_cli.user_prompt`: This event occurs when a user submits a prompt.
   - **Attributes**:
     - `prompt_length` (int)
     - `prompt_id` (string)
-    - `prompt` (string, this attribute is excluded if `log_prompts_enabled` is configured to be `false`)
+    - `prompt` (string, this attribute is excluded if `log_prompts_enabled` is
+      configured to be `false`)
     - `auth_type` (string)
 
 - `gemini_cli.tool_call`: This event occurs for each function call.
@@ -190,9 +240,11 @@ Logs are timestamped records of specific events. The following events are logged
     - `function_args`
     - `duration_ms`
     - `success` (boolean)
-    - `decision` (string: "accept", "reject", "auto_accept", or "modify", if applicable)
+    - `decision` (string: "accept", "reject", "auto_accept", or "modify", if
+      applicable)
     - `error` (if applicable)
     - `error_type` (if applicable)
+    - `content_length` (int, if applicable)
     - `metadata` (if applicable, dictionary of string -> any)
 
 - `gemini_cli.file_operation`: This event occurs for each file operation.
@@ -237,6 +289,15 @@ Logs are timestamped records of specific events. The following events are logged
     - `response_text` (if applicable)
     - `auth_type`
 
+- `gemini_cli.tool_output_truncated`: This event occurs when the output of a tool call is too large and gets truncated.
+  - **Attributes**:
+    - `tool_name` (string)
+    - `original_content_length` (int)
+    - `truncated_content_length` (int)
+    - `threshold` (int)
+    - `lines` (int)
+    - `prompt_id` (string)
+
 - `gemini_cli.malformed_json_response`: This event occurs when a `generateJson` response from Gemini API cannot be parsed as a json.
   - **Attributes**:
     - `model`
@@ -250,6 +311,15 @@ Logs are timestamped records of specific events. The following events are logged
     - `command` (string)
     - `subcommand` (string, if applicable)
 
+- `gemini_cli.extension_enable`: This event occurs when an extension is enabled
+- `gemini_cli.extension_install`: This event occurs when an extension is installed
+  - **Attributes**:
+    - `extension_name` (string)
+    - `extension_version` (string)
+    - `extension_source` (string)
+    - `status` (string)
+- `gemini_cli.extension_uninstall`: This event occurs when an extension is uninstalled
+
 ### Metrics
 
 Metrics are numerical measurements of behavior over time. The following metrics are collected for Gemini CLI:

docs/tools/shell.md

@@ -4,7 +4,9 @@ This document describes the `run_shell_command` tool for the Gemini CLI.
 
 ## Description
 
-Use `run_shell_command` to interact with the underlying system, run scripts, or perform command-line operations. `run_shell_command` executes a given shell command. On Windows, the command will be executed with `cmd.exe /c`. On other platforms, the command will be executed with `bash -c`.
+Use `run_shell_command` to interact with the underlying system, run scripts, or perform command-line operations. `run_shell_command` executes a given shell command, including interactive commands that require user input (e.g., `vim`, `git rebase -i`) if the `tools.shell.enableInteractiveShell` setting is set to `true`.
+
+On Windows, commands are executed with `cmd.exe /c`. On other platforms, they are executed with `bash -c`.
 
 ### Arguments
 
@@ -53,10 +55,67 @@ Start a background server:
 run_shell_command(command="npm run dev &", description="Start development server in background")
 ```
 
+## Configuration
+
+You can configure the behavior of the `run_shell_command` tool by modifying your `settings.json` file or by using the `/settings` command in the Gemini CLI.
+
+### Enabling Interactive Commands
+
+To enable interactive commands, you need to set the `tools.shell.enableInteractiveShell` setting to `true`. This will use `node-pty` for shell command execution, which allows for interactive sessions. If `node-pty` is not available, it will fall back to the `child_process` implementation, which does not support interactive commands.
+
+**Example `settings.json`:**
+
+```json
+{
+  "tools": {
+    "shell": {
+      "enableInteractiveShell": true
+    }
+  }
+}
+```
+
+### Showing Color in Output
+
+To show color in the shell output, you need to set the `tools.shell.showColor` setting to `true`. **Note: This setting only applies when `tools.shell.enableInteractiveShell` is enabled.**
+
+**Example `settings.json`:**
+
+```json
+{
+  "tools": {
+    "shell": {
+      "showColor": true
+    }
+  }
+}
+```
+
+### Setting the Pager
+
+You can set a custom pager for the shell output by setting the `tools.shell.pager` setting. The default pager is `cat`. **Note: This setting only applies when `tools.shell.enableInteractiveShell` is enabled.**
+
+**Example `settings.json`:**
+
+```json
+{
+  "tools": {
+    "shell": {
+      "pager": "less"
+    }
+  }
+}
+```
+
+## Interactive Commands
+
+The `run_shell_command` tool now supports interactive commands by integrating a pseudo-terminal (pty). This allows you to run commands that require real-time user input, such as text editors (`vim`, `nano`), terminal-based UIs (`htop`), and interactive version control operations (`git rebase -i`).
+
+When an interactive command is running, you can send input to it from the Gemini CLI. To focus on the interactive shell, press `ctrl+f`. The terminal output, including complex TUIs, will be rendered correctly.
+
 ## Important notes
 
 - **Security:** Be cautious when executing commands, especially those constructed from user input, to prevent security vulnerabilities.
-- **Interactive commands:** Avoid commands that require interactive user input, as this can cause the tool to hang. Use non-interactive flags if available (e.g., `npm init -y`).
 - **Error handling:** Check the `Stderr`, `Error`, and `Exit Code` fields to determine if a command executed successfully.
 - **Background processes:** When a command is run in the background with `&`, the tool will return immediately and the process will continue to run in the background. The `Background PIDs` field will contain the process ID of the background process.
 

docs/trusted-folders.md

@@ -0,0 +1,61 @@
+# Trusted Folders
+
+The Trusted Folders feature is a security setting that gives you control over which projects can use the full capabilities of the Gemini CLI. It prevents potentially malicious code from running by asking you to approve a folder before the CLI loads any project-specific configurations from it.
+
+## Enabling the Feature
+
+The Trusted Folders feature is **disabled by default**. To use it, you must first enable it in your settings.
+
+Add the following to your user `settings.json` file:
+
+```json
+{
+  "security": {
+    "folderTrust": {
+      "enabled": true
+    }
+  }
+}
+```
+
+## How It Works: The Trust Dialog
+
+Once the feature is enabled, the first time you run the Gemini CLI from a folder, a dialog will automatically appear, prompting you to make a choice:
+
+- **Trust folder**: Grants full trust to the current folder (e.g., `my-project`).
+- **Trust parent folder**: Grants trust to the parent directory (e.g., `safe-projects`), which automatically trusts all of its subdirectories as well. This is useful if you keep all your safe projects in one place.
+- **Don't trust**: Marks the folder as untrusted. The CLI will operate in a restricted "safe mode."
+
+Your choice is saved in a central file (`~/.gemini/trustedFolders.json`), so you will only be asked once per folder.
+
+## Why Trust Matters: The Impact of an Untrusted Workspace
+
+When a folder is **untrusted**, the Gemini CLI runs in a restricted "safe mode" to protect you. In this mode, the following features are disabled:
+
+1.  **Workspace Settings are Ignored**: The CLI will **not** load the `.gemini/settings.json` file from the project. This prevents the loading of custom tools and other potentially dangerous configurations.
+
+2.  **Environment Variables are Ignored**: The CLI will **not** load any `.env` files from the project.
+
+3.  **Extension Management is Restricted**: You **cannot install, update, or uninstall** extensions.
+
+4.  **Tool Auto-Acceptance is Disabled**: You will always be prompted before any tool is run, even if you have auto-acceptance enabled globally.
+
+5.  **Automatic Memory Loading is Disabled**: The CLI will not automatically load files into context from directories specified in local settings.
+
+Granting trust to a folder unlocks the full functionality of the Gemini CLI for that workspace.
+
+## Managing Your Trust Settings
+
+If you need to change a decision or see all your settings, you have a couple of options:
+
+- **Change the Current Folder's Trust**: Run the `/permissions` command from within the CLI. This will bring up the same interactive dialog, allowing you to change the trust level for the current folder.
+
+- **View All Trust Rules**: To see a complete list of all your trusted and untrusted folder rules, you can inspect the contents of the `~/.gemini/trustedFolders.json` file in your home directory.
+
+## The Trust Check Process (Advanced)
+
+For advanced users, it's helpful to know the exact order of operations for how trust is determined:
+
+1.  **IDE Trust Signal**: If you are using the [IDE Integration](./ide-integration.md), the CLI first asks the IDE if the workspace is trusted. The IDE's response takes highest priority.
+
+2.  **Local Trust File**: If the IDE is not connected, the CLI checks the central `~/.gemini/trustedFolders.json` file.

esbuild.config.js

@@ -4,12 +4,19 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import esbuild from 'esbuild';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 import { writeFileSync } from 'node:fs';
 
+let esbuild;
+try {
+  esbuild = (await import('esbuild')).default;
+} catch (_error) {
+  console.warn('esbuild not available, skipping bundle step');
+  process.exit(0);
+}
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const require = createRequire(import.meta.url);

eslint.config.js

@@ -35,6 +35,7 @@ export default tseslint.config(
       'bundle/**',
       'package/bundle/**',
       '.integration-tests/**',
+      'dist/**',
     ],
   },
   eslint.configs.recommended,

integration-tests/ctrl-c-exit.test.ts

@@ -0,0 +1,54 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect } from 'vitest';
+import { TestRig } from './test-helper.js';
+
+describe('Ctrl+C exit', () => {
+  it('should exit gracefully on second Ctrl+C', async () => {
+    const rig = new TestRig();
+    await rig.setup('should exit gracefully on second Ctrl+C');
+
+    const { ptyProcess, promise } = rig.runInteractive();
+
+    let output = '';
+    ptyProcess.onData((data) => {
+      output += data;
+    });
+
+    // Wait for the app to be ready by looking for the initial prompt indicator
+    await rig.poll(() => output.includes('▶'), 5000, 100);
+
+    // Send first Ctrl+C
+    ptyProcess.write('\x03');
+
+    // Wait for the exit prompt
+    await rig.poll(
+      () => output.includes('Press Ctrl+C again to exit'),
+      1500,
+      50,
+    );
+
+    // Send second Ctrl+C
+    ptyProcess.write('\x03');
+
+    const result = await promise;
+
+    // Expect a graceful exit (code 0)
+    expect(
+      result.exitCode,
+      `Process exited with code ${result.exitCode}. Output: ${result.output}`,
+    ).toBe(0);
+
+    // Check that the quitting message is displayed
+    const quittingMessage = 'Agent powering down. Goodbye!';
+    // The regex below is intentionally matching the ESC control character (\x1b)
+    // to strip ANSI color codes from the terminal output.
+    // eslint-disable-next-line no-control-regex
+    const cleanOutput = output.replace(/\x1b\[[0-9;]*m/g, '');
+    expect(cleanOutput).toContain(quittingMessage);
+  });
+});

integration-tests/json-output.test.ts

@@ -0,0 +1,89 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { expect, describe, it, beforeEach, afterEach } from 'vitest';
+import { TestRig } from './test-helper.js';
+
+describe('JSON output', () => {
+  let rig: TestRig;
+
+  beforeEach(async () => {
+    rig = new TestRig();
+    await rig.setup('json-output-test');
+  });
+
+  afterEach(async () => {
+    await rig.cleanup();
+  });
+
+  it('should return a valid JSON with response and stats', async () => {
+    const result = await rig.run(
+      'What is the capital of France?',
+      '--output-format',
+      'json',
+    );
+    const parsed = JSON.parse(result);
+
+    expect(parsed).toHaveProperty('response');
+    expect(typeof parsed.response).toBe('string');
+    expect(parsed.response.toLowerCase()).toContain('paris');
+
+    expect(parsed).toHaveProperty('stats');
+    expect(typeof parsed.stats).toBe('object');
+  });
+
+  it('should return a JSON error for enforced auth mismatch before running', async () => {
+    process.env['GOOGLE_GENAI_USE_GCA'] = 'true';
+    await rig.setup('json-output-auth-mismatch', {
+      settings: {
+        security: { auth: { enforcedType: 'gemini-api-key' } },
+      },
+    });
+
+    let thrown: Error | undefined;
+    try {
+      await rig.run('Hello', '--output-format', 'json');
+      expect.fail('Expected process to exit with error');
+    } catch (e) {
+      thrown = e as Error;
+    } finally {
+      delete process.env['GOOGLE_GENAI_USE_GCA'];
+    }
+
+    expect(thrown).toBeDefined();
+    const message = (thrown as Error).message;
+
+    // Use a regex to find the first complete JSON object in the string
+    const jsonMatch = message.match(/{[\s\S]*}/);
+
+    // Fail if no JSON-like text was found
+    expect(
+      jsonMatch,
+      'Expected to find a JSON object in the error output',
+    ).toBeTruthy();
+
+    let payload;
+    try {
+      // Parse the matched JSON string
+      payload = JSON.parse(jsonMatch![0]);
+    } catch (parseError) {
+      console.error('Failed to parse the following JSON:', jsonMatch![0]);
+      throw new Error(
+        `Test failed: Could not parse JSON from error message. Details: ${parseError}`,
+      );
+    }
+
+    expect(payload.error).toBeDefined();
+    expect(payload.error.type).toBe('Error');
+    expect(payload.error.code).toBe(1);
+    expect(payload.error.message).toContain(
+      'configured auth type is gemini-api-key',
+    );
+    expect(payload.error.message).toContain(
+      'current auth type is oauth-personal',
+    );
+  });
+});

integration-tests/list_directory.test.ts

@@ -29,7 +29,7 @@ describe('list_directory', () => {
       50, // check every 50ms
     );
 
-    const prompt = `Can you list the files in the current directory. Display them in the style of 'ls'`;
+    const prompt = `Can you list the files in the current directory.`;
 
     const result = await rig.run(prompt);
 

integration-tests/mixed-input-crash.test.ts

@@ -0,0 +1,62 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect } from 'vitest';
+import { TestRig } from './test-helper.js';
+
+describe('mixed input crash prevention', () => {
+  it('should not crash when using mixed prompt inputs', async () => {
+    const rig = new TestRig();
+    rig.setup('should not crash when using mixed prompt inputs');
+
+    // Test: echo "say '1'." | gemini --prompt-interactive="say '2'." say '3'.
+    const stdinContent = "say '1'.";
+
+    try {
+      await rig.run(
+        { stdin: stdinContent },
+        '--prompt-interactive',
+        "say '2'.",
+        "say '3'.",
+      );
+      throw new Error('Expected the command to fail, but it succeeded');
+    } catch (error: unknown) {
+      expect(error).toBeInstanceOf(Error);
+      const err = error as Error;
+
+      expect(err.message).toContain('Process exited with code 1');
+      expect(err.message).toContain(
+        '--prompt-interactive flag cannot be used when input is piped',
+      );
+      expect(err.message).not.toContain('setRawMode is not a function');
+      expect(err.message).not.toContain('unexpected critical error');
+    }
+
+    const lastRequest = rig.readLastApiRequest();
+    expect(lastRequest).toBeNull();
+  });
+
+  it('should provide clear error message for mixed input', async () => {
+    const rig = new TestRig();
+    rig.setup('should provide clear error message for mixed input');
+
+    try {
+      await rig.run(
+        { stdin: 'test input' },
+        '--prompt-interactive',
+        'test prompt',
+      );
+      throw new Error('Expected the command to fail, but it succeeded');
+    } catch (error: unknown) {
+      expect(error).toBeInstanceOf(Error);
+      const err = error as Error;
+
+      expect(err.message).toContain(
+        '--prompt-interactive flag cannot be used when input is piped',
+      );
+    }
+  });
+});

integration-tests/replace.test.ts

@@ -61,4 +61,34 @@ describe('replace', () => {
       console.log('File replaced successfully. New content:', newFileContent);
     }
   });
+
+  it('should handle $ literally when replacing text ending with $', async () => {
+    const rig = new TestRig();
+    await rig.setup(
+      'should handle $ literally when replacing text ending with $',
+    );
+
+    const fileName = 'regex.yml';
+    const originalContent = "| select('match', '^[sv]d[a-z]$')\n";
+    const expectedContent = "| select('match', '^[sv]d[a-z]$') # updated\n";
+
+    rig.createFile(fileName, originalContent);
+
+    const prompt =
+      "Open regex.yml and append ' # updated' after the line containing ^[sv]d[a-z]$ without breaking the $ character.";
+
+    const result = await rig.run(prompt);
+    const foundToolCall = await rig.waitForToolCall('replace');
+
+    if (!foundToolCall) {
+      printDebugInfo(rig, result);
+    }
+
+    expect(foundToolCall, 'Expected to find a replace tool call').toBeTruthy();
+
+    validateModelOutput(result, ['regex.yml'], 'Replace $ literal test');
+
+    const newFileContent = rig.readFile(fileName);
+    expect(newFileContent).toBe(expectedContent);
+  });
 });

integration-tests/session-summary.test.ts

@@ -1,37 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-import { TestRig } from './test-helper.js';
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { join } from 'node:path';
-import { readFileSync } from 'node:fs';
-
-describe('session-summary flag', () => {
-  let rig: TestRig;
-
-  beforeEach(function (context) {
-    rig = new TestRig();
-    if (context.task.name) {
-      rig.setup(context.task.name);
-    }
-  });
-
-  afterEach(async () => {
-    await rig.cleanup();
-  });
-
-  it('should write a session summary in non-interactive mode', async () => {
-    const summaryPath = join(rig.testDir!, 'summary.json');
-    await rig.run('Say hello', '--session-summary', summaryPath);
-
-    const summaryContent = readFileSync(summaryPath, 'utf-8');
-    const summary = JSON.parse(summaryContent);
-
-    expect(summary).toBeDefined();
-    expect(summary.sessionMetrics.models).toBeDefined();
-    expect(summary.sessionMetrics.tools).toBeDefined();
-  });
-});

integration-tests/shell-service.test.ts

@@ -96,8 +96,8 @@ describe('ShellExecutionService programmatic integration tests', () => {
   );
 
   it('should abort a running process', async () => {
-    // A command that runs for a bit. 'sleep' on unix, 'timeout' on windows.
-    const command = process.platform === 'win32' ? 'timeout /t 20' : 'sleep 20';
+    // A command that runs for a bit.
+    const command = 'node -e "setTimeout(() => {}, 20000)"';
     const onOutputEvent = vi.fn();
     const abortController = new AbortController();
 

integration-tests/simple-mcp-server.test.ts

@@ -189,6 +189,25 @@ describe('simple-mcp-server', () => {
       const { chmodSync } = await import('node:fs');
       chmodSync(testServerPath, 0o755);
     }
+
+    // Poll for script for up to 5s
+    const { accessSync, constants } = await import('node:fs');
+    const isReady = await rig.poll(
+      () => {
+        try {
+          accessSync(testServerPath, constants.F_OK);
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      5000, // Max wait 5 seconds
+      100, // Poll every 100ms
+    );
+
+    if (!isReady) {
+      throw new Error('MCP server script was not ready in time.');
+    }
   });
 
   it('should add two numbers', async () => {

integration-tests/test-helper.ts

@@ -5,12 +5,13 @@
  */
 
 import { execSync, spawn } from 'node:child_process';
-import { parse } from 'shell-quote';
 import { mkdirSync, writeFileSync, readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { env } from 'node:process';
+import { DEFAULT_GEMINI_MODEL } from '../packages/core/src/config/models.js';
 import fs from 'node:fs';
+import * as pty from '@lydell/node-pty';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -152,6 +153,7 @@ export class TestRig {
         otlpEndpoint: '',
         outfile: telemetryPath,
       },
+      model: DEFAULT_GEMINI_MODEL,
       sandbox: env.GEMINI_SANDBOX !== 'false' ? env.GEMINI_SANDBOX : false,
       ...options.settings, // Allow tests to override/add settings
     };
@@ -182,7 +184,7 @@ export class TestRig {
       | { prompt?: string; stdin?: string; stdinDoesNotEnd?: boolean },
     ...args: string[]
   ): Promise<string> {
-    let command = `node ${this.bundlePath} --yolo`;
+    const commandArgs = [this.bundlePath, '--yolo'];
     const execOptions: {
       cwd: string;
       encoding: 'utf-8';
@@ -193,25 +195,22 @@ export class TestRig {
     };
 
     if (typeof promptOrOptions === 'string') {
-      command += ` --prompt ${JSON.stringify(promptOrOptions)}`;
+      commandArgs.push('--prompt', promptOrOptions);
     } else if (
       typeof promptOrOptions === 'object' &&
       promptOrOptions !== null
     ) {
       if (promptOrOptions.prompt) {
-        command += ` --prompt ${JSON.stringify(promptOrOptions.prompt)}`;
+        commandArgs.push('--prompt', promptOrOptions.prompt);
       }
       if (promptOrOptions.stdin) {
         execOptions.input = promptOrOptions.stdin;
       }
     }
 
-    command += ` ${args.join(' ')}`;
+    commandArgs.push(...args);
 
-    const commandArgs = parse(command);
-    const node = commandArgs.shift() as string;
-
-    const child = spawn(node, commandArgs as string[], {
+    const child = spawn('node', commandArgs, {
       cwd: this.testDir!,
       stdio: 'pipe',
     });
@@ -288,8 +287,15 @@ export class TestRig {
 
             result = filteredLines.join('\n');
           }
-          // If we have stderr output, include that also
-          if (stderr) {
+
+          // Check if this is a JSON output test - if so, don't include stderr
+          // as it would corrupt the JSON
+          const isJsonOutput =
+            commandArgs.includes('--output-format') &&
+            commandArgs.includes('json');
+
+          // If we have stderr output and it's not a JSON test, include that also
+          if (stderr && !isJsonOutput) {
             result += `\n\nStdErr:\n${stderr}`;
           }
 
@@ -716,4 +722,39 @@ export class TestRig {
     }
     return lastApiRequest;
   }
+
+  runInteractive(...args: string[]): {
+    ptyProcess: pty.IPty;
+    promise: Promise<{ exitCode: number; signal?: number; output: string }>;
+  } {
+    const commandArgs = [this.bundlePath, '--yolo', ...args];
+
+    const ptyProcess = pty.spawn('node', commandArgs, {
+      name: 'xterm-color',
+      cols: 80,
+      rows: 30,
+      cwd: this.testDir!,
+      env: process.env as { [key: string]: string },
+    });
+
+    let output = '';
+    ptyProcess.onData((data) => {
+      output += data;
+      if (env.KEEP_OUTPUT === 'true' || env.VERBOSE === 'true') {
+        process.stdout.write(data);
+      }
+    });
+
+    const promise = new Promise<{
+      exitCode: number;
+      signal?: number;
+      output: string;
+    }>((resolve) => {
+      ptyProcess.onExit(({ exitCode, signal }) => {
+        resolve({ exitCode, signal, output });
+      });
+    });
+
+    return { ptyProcess, promise };
+  }
 }

integration-tests/vitest.config.ts

@@ -13,6 +13,12 @@ export default defineConfig({
     reporters: ['default'],
     include: ['**/*.test.ts'],
     retry: 2,
-    fileParallelism: false,
+    fileParallelism: true,
+    poolOptions: {
+      threads: {
+        minThreads: 8,
+        maxThreads: 16,
+      },
+    },
   },
 });

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.4.1",
+  "version": "0.7.0-preview.1",
   "engines": {
     "node": ">=20.0.0"
   },
@@ -14,10 +14,10 @@
     "url": "git+https://github.com/google-gemini/gemini-cli.git"
   },
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.4.1"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.7.0-preview.1"
   },
   "scripts": {
-    "start": "node scripts/start.js",
+    "start": "cross-env node scripts/start.js",
     "start:a2a-server": "CODER_AGENT_PORT=41242 npm run start --workspace @google/gemini-cli-a2a-server",
     "debug": "cross-env DEBUG=1 node --inspect-brk scripts/start.js",
     "auth:npm": "npx google-artifactregistry-auth",
@@ -31,26 +31,28 @@
     "build:packages": "npm run build --workspaces",
     "build:sandbox": "node scripts/build_sandbox.js --skip-npm-install-build",
     "bundle": "npm run generate && node esbuild.config.js && node scripts/copy_bundle_assets.js",
-    "test": "npm run test --workspaces --if-present",
-    "test:ci": "npm run test:ci --workspaces --if-present && npm run test:scripts",
+    "test": "npm run test --workspaces --if-present --parallel",
+    "test:ci": "npm run test:ci --workspaces --if-present --parallel && npm run test:scripts",
     "test:scripts": "vitest run --config ./scripts/tests/vitest.config.ts",
     "test:e2e": "cross-env VERBOSE=true KEEP_OUTPUT=true npm run test:integration:sandbox:none",
     "test:integration:all": "npm run test:integration:sandbox:none && npm run test:integration:sandbox:docker && npm run test:integration:sandbox:podman",
-    "test:integration:sandbox:none": "GEMINI_SANDBOX=false vitest run --root ./integration-tests",
-    "test:integration:sandbox:docker": "GEMINI_SANDBOX=docker npm run build:sandbox && GEMINI_SANDBOX=docker vitest run --root ./integration-tests",
-    "test:integration:sandbox:podman": "GEMINI_SANDBOX=podman vitest run --root ./integration-tests",
+    "test:integration:sandbox:none": "cross-env GEMINI_SANDBOX=false vitest run --root ./integration-tests",
+    "test:integration:sandbox:docker": "cross-env GEMINI_SANDBOX=docker npm run build:sandbox && cross-env GEMINI_SANDBOX=docker vitest run --root ./integration-tests",
+    "test:integration:sandbox:podman": "cross-env GEMINI_SANDBOX=podman vitest run --root ./integration-tests",
     "lint": "eslint . --ext .ts,.tsx && eslint integration-tests",
     "lint:fix": "eslint . --fix && eslint integration-tests --fix",
     "lint:ci": "eslint . --ext .ts,.tsx --max-warnings 0 && eslint integration-tests --max-warnings 0",
+    "lint:all": "node scripts/lint.js",
     "format": "prettier --experimental-cli --write .",
     "typecheck": "npm run typecheck --workspaces --if-present",
     "preflight": "npm run clean && npm ci && npm run format && npm run lint:ci && npm run build && npm run typecheck && npm run test:ci",
-    "prepare": "npm run bundle",
+    "prepare": "husky && npm run bundle",
     "prepare:package": "node scripts/prepare-package.js",
     "release:version": "node scripts/version.js",
     "telemetry": "node scripts/telemetry.js",
     "check:lockfile": "node scripts/check-lockfile.js",
-    "clean": "node scripts/clean.js"
+    "clean": "node scripts/clean.js",
+    "pre-commit": "node scripts/pre-commit.js"
   },
   "bin": {
     "gemini": "bundle/gemini.js"
@@ -78,11 +80,15 @@
     "eslint-plugin-react-hooks": "^5.2.0",
     "glob": "^10.4.5",
     "globals": "^16.0.0",
+    "google-artifactregistry-auth": "^3.4.0",
+    "husky": "^9.1.7",
     "json": "^11.0.0",
-    "memfs": "^4.17.2",
+    "lint-staged": "^16.1.6",
+    "memfs": "^4.42.0",
     "mnemonist": "^0.40.3",
     "mock-fs": "^5.5.0",
     "msw": "^2.10.4",
+    "npm-run-all": "^4.1.5",
     "prettier": "^3.5.3",
     "react-devtools-core": "^4.28.5",
     "tsx": "^4.20.3",
@@ -91,7 +97,6 @@
     "yargs": "^17.7.2"
   },
   "dependencies": {
-    "@lvce-editor/ripgrep": "^1.6.0",
     "simple-git": "^3.28.0"
   },
   "optionalDependencies": {
@@ -102,5 +107,20 @@
     "@lydell/node-pty-win32-arm64": "1.1.0",
     "@lydell/node-pty-win32-x64": "1.1.0",
     "node-pty": "^1.0.0"
+  },
+  "overrides": {
+    "wrap-ansi": "9.0.2",
+    "cliui": {
+      "wrap-ansi": "7.0.0"
+    }
+  },
+  "lint-staged": {
+    "*.{js,jsx,ts,tsx}": [
+      "prettier --write",
+      "eslint --fix --max-warnings 0"
+    ],
+    "*.{json,md}": [
+      "prettier --write"
+    ]
   }
 }

packages/a2a-server/development-extension-rfc.md

@@ -0,0 +1,418 @@
+# RFC: Gemini CLI A2A Development-Tool Extension
+
+## 1. Introduction
+
+### 1.1 Overview
+
+To standardize client integrations with the Gemini CLI agent, this document proposes the `development-tool` extension for the A2A protocol.
+
+Rather than creating a new protocol, this specification builds upon the existing A2A protocol. As an open-source standard recently adopted by the Linux Foundation, A2A provides a robust foundation for core concepts like tasks, messages, and streaming events. This extension-based approach allows us to leverage A2A's proven architecture while defining the specific capabilities required for rich, interactive workflows with the Gemini CLI agent.
+
+### 1.2 Motivation
+
+Recent work integrating Gemini CLI with clients like Zed and Gemini Code Assist’s agent mode has highlighted the need for a robust, standard communication protocol. Standardizing on A2A provides several key advantages:
+
+- **Solid Foundation**: Provides a robust, open standard that ensures a stable, predictable, and consistent integration experience across different IDEs and client surfaces.
+- **Extensibility**: Creates a flexible foundation to support new tools and workflows as they emerge.
+- **Ecosystem Alignment**: Aligns Gemini CLI with a growing industry standard, fostering broader interoperability.
+
+## 2. Communication Flow
+
+The interaction follows A2A’s task-based, streaming pattern. The client sends a `message/stream` request and the agent responds with a `contextId` / `taskId` and a stream of events. `TaskStatusUpdateEvent` events are used to convey the overall state of the task. The task is complete when the agent sends a final `TaskStatusUpdateEvent` with `final: true` and a terminal status like `completed` or `failed`.
+
+### 2.1 Asynchronous Responses and Notifications
+
+Clients that may disconnect from the agent should supply a `PushNotificationConfig` to the agent with the initial `message/stream` method or subsequently with the `tasks/pushNotificationConfig/set` method so that the agent can call back when updates are ready.
+
+## 3. The `development-tool` extension
+
+### 3.1 Overview
+
+The `development-tool` extension establishes a communication contract for workflows between a client and the Gemini CLI agent. It consists of a specialized set of schemas, embedded within core A2A data structures, that enable the agent to stream real-time updates on its state and thought process. These schemas also provide the mechanism for the agent to request user permission before executing tools.
+
+**Sample Agent Card**
+
+```json
+{
+  "name": "Gemini CLI Agent",
+  "description": "An agent that generates code based on natural language instructions.",
+  "capabilities": {
+    "streaming": true,
+    "extensions": [
+      {
+        "uri": "https://github.com/google-gemini/gemini-cli/blob/main/docs/a2a/developer-profile/v0/spec.md",
+        "description": "An extension for interactive development tasks, enabling features like code generation, tool usage, and real-time status updates.",
+        "required": true
+      }
+    ]
+  }
+}
+```
+
+**Versioning**
+
+The agent card `uri` field contains an embedded semantic version. The client must extract this version to determine compatibility with the agent extension using the compatibility logic defined in Semantic Versioning 2.0.0 spec.
+
+### 3.2 Schema Definitions
+
+This section defines the schemas for the `development-tool` A2A extension, organized by their function within the communication flow. Note that all custom objects included in the `metadata` field (e.g. `Message.metadata`) must be keyed by the unique URI that points to that extension’s spec to prevent naming collisions with other extensions.
+
+**Initialization & Configuration**
+
+The first message in a session must contain an `AgentSettings` object in its metadata. This object provides the agent with the necessary configuration information for proper initialization. Additional configuration settings (ex. MCP servers, allowed tools, etc.) can be added to this message.
+
+**Schema**
+
+```proto
+syntax = "proto3";
+
+// Configuration settings for the Gemini CLI agent.
+message AgentSettings {
+  // The absolute path to the workspace directory where the agent will execute.
+  string workspace_path = 1;
+}
+```
+
+**Agent-to-Client Messages**
+
+All real-time updates from the agent (including its thoughts, tool calls, and simple text replies) are streamed to the client as `TaskStatusUpdateEvents`.
+
+Each Event contains a `Message` object, which holds the content in one of two formats:
+
+- **TextPart**: Used for standard text messages. This part requires no custom schema.
+- **DataPart**: Used for complex, structured objects. Tool Calls and Thoughts are sent this way, each using their respective schemas defined below.
+
+**Tool Calls**
+
+The `ToolCall` schema is designed to provide a structured representation of a tool’s execution lifecycle. This protocol defines a clear state machine and provides detailed schemas for common development tasks (file edits, shell commands, MCP Tool), ensuring clients can build reliable UIs without being tied to a specific agent implementation.
+
+The core principle is that the agent sends a `ToolCall` object on every update. This makes client-side logic stateless and simple.
+
+**Tool Call Lifecycle**
+
+1.  **Creation**: The agent sends a `ToolCall` object with `status: PENDING`. If user permission is required, the `confirmation_request` field will be populated.
+2.  **Confirmation**: If the client needs to confirm the message, the client will send a `ToolCallConfirmation`. If the client responds with a cancellation, execution will be skipped.
+3.  **Execution**: Once approved (or if no approval is required), the agent sends an update with `status: EXECUTING`. It can stream real-time progress by updating the `live_content` field.
+4.  **Completion**: The agent sends a final update with the status set to `SUCCEEDED`, `FAILED`, or `CANCELLED` and populates the appropriate result field.
+
+**Schema**
+
+```proto
+syntax = "proto3";
+
+import "google/protobuf/struct.proto";
+
+// ToolCall is the central message represeting a tool's execution lifecycle.
+// The entire object is sent from the agent to client on every update.
+message ToolCall {
+  // A unique identifier, assigned by the agent
+  string tool_call_id = 1;
+
+  // The current state of the tool call in its lifecycle
+  ToolCallStatus status = 2;
+
+  // Name of the tool being called (e.g. 'Edit', 'ShellTool')
+  string tool_name = 3;
+
+  // An optional description of the tool call's purpose to show the user
+  optional string description = 4;
+
+  // The structured input params provided by the LLM for tool invocation.
+  google.protobuf.Struct input_parameters = 5;
+
+  // String containing the real-time output from the tool as it executes (primarily designed for shell output).
+  // During streaming the entire string is replaced on each update
+  optional string live_content = 6;
+
+  // The final result of the tool (used to replace live_content when applicable)
+  oneof result {
+    // The output on tool success
+    ToolOutput output = 7;
+    // The error details if the tool failed
+    ErrorDetails error = 8;
+  }
+
+  // If the tool requires user confirmation, this field will be populated while status is PENDING
+  optional ConfirmationRequest confirmation_request = 9;
+}
+
+// Possible execution status of a ToolCall
+enum ToolCallStatus {
+  STATUS_UNSPECIFIED = 0;
+  PENDING = 1;
+  EXECUTING = 2;
+  SUCCEEDED = 3;
+  FAILED = 4;
+  CANCELLED = 5;
+}
+
+// ToolOuput represents the final, successful, output of a tool
+message ToolOutput {
+  oneof result {
+    string text = 1;
+    // For ToolCalls which resulted in a file modification
+    FileDiff diff = 2;
+    // A generic fallback for any other structured JSON data
+    google.protobuf.Struct structured_data = 3;
+  }
+}
+
+// A structured representation of an error
+message ErrorDetails {
+  // User facing error message
+  string message = 1;
+  // Optional agent-specific error type or category (e.g. read_content_failure, grep_execution_error, mcp_tool_error)
+  optional string type = 2;
+  // Optional status code
+  optional int32 status_code = 3;
+}
+
+// ConfirmationRequest is sent from the agent to client to request user permission for a ToolCall
+message ConfirmationRequest {
+  // A list of choices for the user to select from
+  repeated ConfirmationOption options = 1;
+  // Specific details of the action requiring user confirmation
+  oneof details {
+    ExecuteDetails execute_details = 2;
+    FileDiff file_edit_details = 3;
+    McpDetails mcp_details = 4;
+    GenericDetails generic_details = 5;
+  }
+}
+
+// A single choice presented to the user during a confirmation request
+message ConfirmationOption {
+  // Unique ID for the choice (e.g. proceed_once, cancel)
+  string id = 1;
+  // Human-readable choice (e.g. Allow Once, Reject).
+  string name = 2;
+  // An optional longer description for a tooltip
+  optional string description = 3;
+}
+
+// Details for a request to execute a shell command
+message ExecuteDetails {
+  // The shell command to be executed
+  string command = 1;
+  // An optional directory in which the command will be run
+  optional string working_directory = 2;
+}
+
+
+message FileDiff {
+  string file_name = 1;
+  // The absolute path to the file to modify
+  string file_path = 2;
+  // The original content, if the file exists
+  optional string old_content = 3;
+  string new_content = 4;
+  // Pre-formatted diff string for display
+  optional string formatted_diff = 5;
+}
+
+// Details for an MCP (Model Context Protocol) tool confirmation
+message McpDetails {
+  // The name of the MCP server that provides the tool
+  string server_name = 1;
+  // THe name of the tool being called from the MCP Server
+  string tool_name = 2;
+}
+
+// Generic catch-all for ToolCall requests that don't fit other types
+message GenericDetails {
+  // Description of the action requiring confirmation
+  string description = 1;
+}
+```
+
+**Agent Thoughts**
+
+**Schema**
+
+```proto
+syntax = "proto3";
+
+// Represents a thought with a subject and a detailed description.
+message AgentThought {
+  // A concise subject line or title for the thought.
+  string subject = 1;
+
+  // The description or elaboration of the thought itself.
+  string description = 2;
+}
+```
+
+**Event Metadata**
+
+The `metadata` object in `TaskStatusUpdateEvent` is used by the A2A client to deserialize the `TaskStatusUpdateEvents` into their appropriate objects.
+
+**Schema**
+
+```proto
+syntax = "proto3";
+
+// A DevelopmentToolEvent event.
+message DevelopmentToolEvent {
+  // Enum representing the specific type of development tool event.
+  enum DevelopmentToolEventKind {
+    // The default, unspecified value.
+    DEVELOPMENT_TOOL_EVENT_KIND_UNSPECIFIED = 0;
+    TOOL_CALL_CONFIRMATION = 1;
+    TOOL_CALL_UPDATE = 2;
+    TEXT_CONTENT = 3;
+    STATE_CHANGE = 4;
+    THOUGHT = 5;
+  }
+
+  // The specific kind of event that occurred.
+  DevelopmentToolEventKind kind = 1;
+
+  // The model used for this event.
+  string model = 2;
+
+  // The tier of the user (optional).
+  string user_tier = 3;
+
+  // An unexpected error occurred in the agent execution (optional).
+  string error = 4;
+}
+```
+
+**Client-to-Agent Messages**
+
+When the agent sends a `TaskStatusUpdateEvent` with `status.state` set to `input-required` and its message contains a `ConfirmationRequest`, the client must respond by sending a new `message/stream` request.
+
+This new request must include the `contextId` and the `taskId` from the ongoing task and contain a `ToolCallConfirmation` object. This object conveys the user's decision regarding the tool call that was awaiting approval.
+
+**Schema**
+
+```proto
+syntax = "proto3";
+
+// The client's response to a ConfirmationRequest.
+message ToolCallConfirmation {
+  // A unique identifier, assigned by the agent
+  string tool_call_id = 1;
+  // The 'id' of the ConfirmationOption chosen by the user.
+  string selected_option_id = 2;
+  // Included if the user modifies the proposed change.
+  // The type should correspond to the original ConfirmationRequest details.
+  oneof modified_details {
+    // Corresponds to a FileDiff confirmation
+    ModifiedFileDetails file_details = 3;
+  }
+}
+
+message ModifiedFileDetails {
+  // The new content after user edits.
+  string new_content = 1;
+}
+```
+
+### 3.3 Method Definitions
+
+This section defines the new methods introduced by the `development-tool` extension.
+
+**Method: `commands/get`**
+
+This method allows the client to discover slash commands supported by Gemini CLI. The client should call this method during startup to dynamically populate its command list.
+
+```proto
+// Response message containing the list of all top-level slash commands.
+message GetAllSlashCommandsResponse {
+  // A list of the top-level slash commands.
+  repeated SlashCommand commands = 1;
+}
+
+// Represents a single slash command, which can contain subcommands.
+message SlashCommand {
+  // The primary name of the command.
+  string name = 1;
+  // A detailed description of what the command does.
+  string description = 2;
+  // A list of arguments that the command accepts.
+  repeated SlashCommandArgument arguments = 3;
+  // A list of nested subcommands.
+  repeated SlashCommand sub_commands = 4;
+}
+
+// Defines the structure for a single slash command argument.
+message SlashCommandArgument {
+  // The name of the argument.
+  string name = 1;
+  // A brief description of what the argument is for.
+  string description = 2;
+  // Whether the argument is required or optional.
+  bool is_required = 3;
+}
+```
+
+**Method: `command/execute`**
+
+This method allows the client to execute a slash command. Following the initial `ExecuteSlashCommandResponse`, the agent will use the standard streaming mechanism to communicate the command's progress and output. All subsequent updates, including textual output, agent thoughts, and any required user confirmations for tool calls (like executing a shell command), will be sent as `TaskStatusUpdateEvent` messages, re-using the schemas defined above.
+
+```proto
+// Request to execute a specific slash command.
+message ExecuteSlashCommandRequest {
+  // The path to the command, e.g., ["memory", "add"] for /memory add
+  repeated string command_path = 1;
+  // The arguments for the command as a single string.
+  string args = 2;
+}
+
+// Enum for the initial status of a command execution request.
+enum CommandExecutionStatus {
+  // Default unspecified status.
+  COMMAND_EXECUTION_STATUS_UNSPECIFIED = 0;
+  // The command was successfully received and its execution has started.
+  STARTED = 1;
+  // The command failed to start (e.g., command not found, invalid format).
+  FAILED_TO_START = 2;
+  // The command has been paused and is waiting for the user to confirm
+  // a set of shell commands.
+  AWAITING_SHELL_CONFIRMATION = 3;
+  // The command has been paused and is waiting for the user to confirm
+  // a specific action.
+  AWAITING_ACTION_CONFIRMATION = 4;
+}
+
+// The immediate, async response after requesting a command execution.
+message ExecuteSlashCommandResponse {
+  // A unique taskID for this specific command execution.
+  string execution_id = 1;
+  // The initial status of the command execution.
+  CommandExecutionStatus status = 2;
+  // An optional message, particularly useful for explaining why a command
+  // failed to start.
+  string message = 3;
+}
+```
+
+## 4. Separation of Concerns
+
+We believe that all client-side context (ex., workspace state) and client-side tool execution (ex. read active buffers) should be routed through MCP.
+
+This approach enforces a strict separation of concerns: the A2A `development-tool` extension standardizes communication to the agent, while MCP serves as the single, authoritative interface for client-side capabilities.
+
+## Appendix
+
+### A. Example Interaction Flow
+
+1.  **Client -> Server**: The client sends a `message/stream` request containing the initial prompt and configuration in an `AgentSettings` object.
+2.  **Server -> Client**: SSE stream begins.
+    - **Event 1**: The server sends a `Task` object with `status.state: 'submitted'` and the new `taskId`.
+    - **Event 2**: The server sends a `TaskStatusUpdateEvent` with the metadata `kind` set to `'STATE_CHANGE'` and `status.state` set to `'working'`.
+3.  **Agent Logic**: The agent processes the prompt and decides to call the `write_file` tool, which requires user confirmation.
+4.  **Server -> Client**:
+    - **Event 3**: The server sends a `TaskStatusUpdateEvent`. The metadata `kind` is `'TOOL_CALL_UPDATE'`, and the `DataPart` contains a `ToolCall` object with its `status` as `'PENDING'` and a populated `confirmation_request`.
+    - **Event 4**: The server sends a final `TaskStatusUpdateEvent` for this exchange. The metadata `kind` is `'STATE_CHANGE'`, the `status.state` is `'input-required'`, and `final` is `true`. The stream for this request ends.
+5.  **Client**: The client UI renders the confirmation prompt based on the `ToolCall` object from Event 3. The user clicks "Approve."
+6.  **Client -> Server**: The client sends a new `message/stream` request. It includes the `taskId` from the ongoing task and a `DataPart` containing a `ToolCallConfirmation` object (e.g., `{"tool_call_id": "...", "selected_option_id": "proceed_once"}`).
+7.  **Server -> Client**: A new SSE stream begins for the second request.
+    - **Event 1**: The server sends a `TaskStatusUpdateEvent` with `kind: 'TOOL_CALL_UPDATE'`, containing the `ToolCall` object with its `status` now set to `'EXECUTING'`.
+    - **Event 2**: After the tool runs, the server sends another `TaskStatusUpdateEvent` with `kind: 'TOOL_CALL_UPDATE'`, containing the `ToolCall` with its `status` as `'SUCCEEDED'`.
+8.  **Agent Logic**: The agent receives the successful tool result and generates a final textual response.
+9.  **Server -> Client**:
+    - **Event 3**: The server sends a `TaskStatusUpdateEvent` with `kind: 'TEXT_CONTENT'` and a `TextPart` containing the agent's final answer.
+    - **Event 4**: The server sends the final `TaskStatusUpdateEvent`. The `kind` is `'STATE_CHANGE'`, the `status.state` is `'completed'`, and `final` is `true`. The stream ends.
+10. **Client**: The client displays the final answer. The task is now complete but can be continued by sending another message with the same `taskId`.

packages/a2a-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-a2a-server",
-  "version": "0.4.1",
+  "version": "0.7.0-preview.1",
   "private": true,
   "description": "Gemini CLI A2A Server",
   "repository": {

packages/a2a-server/src/agent/executor.ts

@@ -36,6 +36,7 @@ import { loadSettings } from '../config/settings.js';
 import { loadExtensions } from '../config/extension.js';
 import { Task } from './task.js';
 import { requestStorage } from '../http/requestStorage.js';
+import { pushTaskStateFailed } from '../utils/executor_utils.js';
 
 /**
  * Provides a wrapper for Task. Passes data from Task to SDKTask.
@@ -116,8 +117,8 @@ export class CoderAgentExecutor implements AgentExecutor {
 
     const agentSettings = persistedState._agentSettings;
     const config = await this.getConfig(agentSettings, sdkTask.id);
-    const contextId =
-      (metadata['_contextId'] as string) || (sdkTask.contextId as string);
+    const contextId: string =
+      (metadata['_contextId'] as string) || sdkTask.contextId;
     const runtimeTask = await Task.create(
       sdkTask.id,
       contextId,
@@ -125,9 +126,7 @@ export class CoderAgentExecutor implements AgentExecutor {
       eventBus,
     );
     runtimeTask.taskState = persistedState._taskState;
-    await runtimeTask.geminiClient.initialize(
-      runtimeTask.config.getContentGeneratorConfig(),
-    );
+    await runtimeTask.geminiClient.initialize();
 
     const wrapper = new TaskWrapper(runtimeTask, agentSettings);
     this.tasks.set(sdkTask.id, wrapper);
@@ -144,9 +143,7 @@ export class CoderAgentExecutor implements AgentExecutor {
     const agentSettings = agentSettingsInput || ({} as AgentSettings);
     const config = await this.getConfig(agentSettings, taskId);
     const runtimeTask = await Task.create(taskId, contextId, config, eventBus);
-    await runtimeTask.geminiClient.initialize(
-      runtimeTask.config.getContentGeneratorConfig(),
-    );
+    await runtimeTask.geminiClient.initialize();
 
     const wrapper = new TaskWrapper(runtimeTask, agentSettings);
     this.tasks.set(taskId, wrapper);
@@ -284,10 +281,10 @@ export class CoderAgentExecutor implements AgentExecutor {
     const sdkTask = requestContext.task as SDKTask | undefined;
 
     const taskId = sdkTask?.id || userMessage.taskId || uuidv4();
-    const contextId =
+    const contextId: string =
       userMessage.contextId ||
       sdkTask?.contextId ||
-      sdkTask?.metadata?.['_contextId'] ||
+      (sdkTask?.metadata?.['_contextId'] as string) ||
       uuidv4();
 
     logger.info(
@@ -385,12 +382,21 @@ export class CoderAgentExecutor implements AgentExecutor {
       const agentSettings = userMessage.metadata?.[
         'coderAgent'
       ] as AgentSettings;
-      wrapper = await this.createTask(
-        taskId,
-        contextId as string,
-        agentSettings,
-        eventBus,
-      );
+      try {
+        wrapper = await this.createTask(
+          taskId,
+          contextId,
+          agentSettings,
+          eventBus,
+        );
+      } catch (error) {
+        logger.error(
+          `[CoderAgentExecutor] Error creating task ${taskId}:`,
+          error,
+        );
+        pushTaskStateFailed(error, eventBus, taskId, contextId);
+        return;
+      }
       const newTaskSDK = wrapper.toSDKTask();
       eventBus.publish({
         ...newTaskSDK,

packages/a2a-server/src/agent/task.ts

@@ -6,7 +6,7 @@
 
 import {
   CoreToolScheduler,
-  GeminiClient,
+  type GeminiClient,
   GeminiEventType,
   ToolConfirmationOutcome,
   ApprovalMode,
@@ -14,6 +14,7 @@ import {
   MCPServerStatus,
   isNodeError,
   parseAndFormatApiError,
+  safeLiteralReplace,
 } from '@google/gemini-cli-core';
 import type {
   ToolConfirmationPayload,
@@ -25,6 +26,7 @@ import type {
   ToolCallConfirmationDetails,
   Config,
   UserTierId,
+  AnsiOutput,
 } from '@google/gemini-cli-core';
 import type { RequestContext } from '@a2a-js/sdk/server';
 import { type ExecutionEventBus } from '@a2a-js/sdk/server';
@@ -82,18 +84,17 @@ export class Task {
     this.contextId = contextId;
     this.config = config;
     this.scheduler = this.createScheduler();
-    this.geminiClient = new GeminiClient(this.config);
+    this.geminiClient = this.config.getGeminiClient();
     this.pendingToolConfirmationDetails = new Map();
     this.taskState = 'submitted';
     this.eventBus = eventBus;
     this.completedToolCalls = [];
     this._resetToolCompletionPromise();
-    this.config.setFlashFallbackHandler(
-      async (currentModel: string, fallbackModel: string): Promise<boolean> => {
-        config.setModel(fallbackModel); // gemini-cli-core sets to DEFAULT_GEMINI_FLASH_MODEL
-        // Switch model for future use but return false to stop current retry
-        return false;
-      },
+    this.config.setFallbackModelHandler(
+      // For a2a-server, we want to automatically switch to the fallback model
+      // for future requests without retrying the current one. The 'stop'
+      // intent achieves this.
+      async () => 'stop',
     );
   }
 
@@ -133,7 +134,7 @@ export class Task {
       id: this.id,
       contextId: this.contextId,
       taskState: this.taskState,
-      model: this.config.getContentGeneratorConfig().model,
+      model: this.config.getModel(),
       mcpServers: servers,
       availableTools,
     };
@@ -227,7 +228,7 @@ export class Task {
     } = {
       coderAgent: coderAgentMessage,
       model: this.config.getModel(),
-      userTier: this.geminiClient.getUserTier(),
+      userTier: this.config.getUserTier(),
     };
 
     if (metadataError) {
@@ -285,20 +286,29 @@ export class Task {
 
   private _schedulerOutputUpdate(
     toolCallId: string,
-    outputChunk: string,
+    outputChunk: string | AnsiOutput,
   ): void {
+    let outputAsText: string;
+    if (typeof outputChunk === 'string') {
+      outputAsText = outputChunk;
+    } else {
+      outputAsText = outputChunk
+        .map((line) => line.map((token) => token.text).join(''))
+        .join('\n');
+    }
+
     logger.info(
       '[Task] Scheduler output update for tool call ' +
         toolCallId +
         ': ' +
-        outputChunk,
+        outputAsText,
     );
     const artifact: Artifact = {
       artifactId: `tool-${toolCallId}-output`,
       parts: [
         {
           kind: 'text',
-          text: outputChunk,
+          text: outputAsText,
         } as Part,
       ],
     };
@@ -509,7 +519,9 @@ export class Task {
     if (oldString === '' && !isNewFile) {
       return currentContent;
     }
-    return currentContent.replaceAll(oldString, newString);
+
+    // Use intelligent replacement that handles $ sequences safely
+    return safeLiteralReplace(currentContent, oldString, newString);
   }
 
   async scheduleToolCalls(

packages/a2a-server/src/config/config.ts

@@ -69,6 +69,7 @@ export async function loadConfig(
         settings.fileFiltering?.enableRecursiveFileSearch,
     },
     ideMode: false,
+    folderTrust: settings.folderTrust === true,
   };
 
   const fileService = new FileDiscoveryService(workspaceDir);
@@ -79,7 +80,7 @@ export async function loadConfig(
     false,
     fileService,
     extensionContextFilePaths,
-    true, /// TODO: Wire up folder trust logic here.
+    settings.folderTrust === true,
   );
   configParams.userMemory = memoryContent;
   configParams.geminiMdFileCount = fileCount;
@@ -108,9 +109,10 @@ export async function loadConfig(
     logger.info('[Config] Using Gemini API Key');
     await config.refreshAuth(AuthType.USE_GEMINI);
   } else {
-    logger.error(
-      `[Config] Unable to set GeneratorConfig. Please provide a GEMINI_API_KEY or set USE_CCPA.`,
-    );
+    const errorMessage =
+      '[Config] Unable to set GeneratorConfig. Please provide a GEMINI_API_KEY or set USE_CCPA.';
+    logger.error(errorMessage);
+    throw new Error(errorMessage);
   }
 
   return config;

packages/a2a-server/src/config/settings.ts

@@ -27,6 +27,7 @@ export interface Settings {
   telemetry?: TelemetrySettings;
   showMemoryUsage?: boolean;
   checkpointing?: CheckpointingSettings;
+  folderTrust?: boolean;
 
   // Git-aware file filtering settings
   fileFiltering?: {

packages/a2a-server/src/http/app.test.ts

@@ -64,6 +64,7 @@ vi.mock('../utils/logger.js', () => ({
 let config: Config;
 const getToolRegistrySpy = vi.fn().mockReturnValue(ApprovalMode.DEFAULT);
 const getApprovalModeSpy = vi.fn();
+const getShellExecutionConfigSpy = vi.fn();
 vi.mock('../config/config.js', async () => {
   const actual = await vi.importActual('../config/config.js');
   return {
@@ -72,6 +73,7 @@ vi.mock('../config/config.js', async () => {
       const mockConfig = createMockConfig({
         getToolRegistry: getToolRegistrySpy,
         getApprovalMode: getApprovalModeSpy,
+        getShellExecutionConfig: getShellExecutionConfigSpy,
       });
       config = mockConfig as Config;
       return config;

packages/a2a-server/src/http/endpoints.test.ts

@@ -7,14 +7,17 @@
 import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
 import request from 'supertest';
 import type express from 'express';
-import { createApp, updateCoderAgentCardUrl } from './app.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import type { Server } from 'node:http';
-import type { TaskMetadata } from '../types.js';
 import type { AddressInfo } from 'node:net';
 
+import { createApp, updateCoderAgentCardUrl } from './app.js';
+import type { TaskMetadata } from '../types.js';
+import { createMockConfig } from '../utils/testing_utils.js';
+import type { Config } from '@google/gemini-cli-core';
+
 // Mock the logger to avoid polluting test output
 // Comment out to help debug
 vi.mock('../utils/logger.js', () => ({
@@ -56,6 +59,16 @@ vi.mock('../agent/task.js', () => {
   return { Task: MockTask };
 });
 
+vi.mock('../config/config.js', async () => {
+  const actual = await vi.importActual('../config/config.js');
+  return {
+    ...actual,
+    loadConfig: vi
+      .fn()
+      .mockImplementation(async () => createMockConfig({}) as Config),
+  };
+});
+
 describe('Agent Server Endpoints', () => {
   let app: express.Express;
   let server: Server;

packages/a2a-server/src/persistence/gcs.test.ts

@@ -201,7 +201,7 @@ describe('GCSTaskStore', () => {
       metadata: {},
     };
 
-    it('should save metadata and workspace', async () => {
+    it.skip('should save metadata and workspace', async () => {
       const store = new GCSTaskStore(bucketName);
       await store.save(mockTask);
 

packages/a2a-server/src/utils/executor_utils.ts

@@ -0,0 +1,52 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import type { Message } from '@a2a-js/sdk';
+import type { ExecutionEventBus } from '@a2a-js/sdk/server';
+import { v4 as uuidv4 } from 'uuid';
+
+import { CoderAgentEvent } from '../types.js';
+import type { StateChange } from '../types.js';
+
+export async function pushTaskStateFailed(
+  error: unknown,
+  eventBus: ExecutionEventBus,
+  taskId: string,
+  contextId: string,
+) {
+  const errorMessage =
+    error instanceof Error ? error.message : 'Agent execution error';
+  const stateChange: StateChange = {
+    kind: CoderAgentEvent.StateChangeEvent,
+  };
+  eventBus.publish({
+    kind: 'status-update',
+    taskId,
+    contextId,
+    status: {
+      state: 'failed',
+      message: {
+        kind: 'message',
+        role: 'agent',
+        parts: [
+          {
+            kind: 'text',
+            text: errorMessage,
+          },
+        ],
+        messageId: uuidv4(),
+        taskId,
+        contextId,
+      } as Message,
+    },
+    final: true,
+    metadata: {
+      coderAgent: stateChange,
+      model: 'unknown',
+      error: errorMessage,
+    },
+  });
+}

packages/a2a-server/src/utils/testing_utils.ts

@@ -9,8 +9,13 @@ import type {
   TaskStatusUpdateEvent,
   SendStreamingMessageSuccessResponse,
 } from '@a2a-js/sdk';
-import { ApprovalMode } from '@google/gemini-cli-core';
-import type { Config } from '@google/gemini-cli-core';
+import {
+  ApprovalMode,
+  DEFAULT_TRUNCATE_TOOL_OUTPUT_LINES,
+  DEFAULT_TRUNCATE_TOOL_OUTPUT_THRESHOLD,
+  GeminiClient,
+} from '@google/gemini-cli-core';
+import type { Config, Storage } from '@google/gemini-cli-core';
 import { expect, vi } from 'vitest';
 
 export function createMockConfig(
@@ -28,19 +33,29 @@ export function createMockConfig(
       isPathWithinWorkspace: () => true,
     }),
     getTargetDir: () => '/test',
-    getGeminiClient: vi.fn(),
+    storage: {
+      getProjectTempDir: () => '/tmp',
+    } as Storage,
+    getTruncateToolOutputThreshold: () =>
+      DEFAULT_TRUNCATE_TOOL_OUTPUT_THRESHOLD,
+    getTruncateToolOutputLines: () => DEFAULT_TRUNCATE_TOOL_OUTPUT_LINES,
     getDebugMode: vi.fn().mockReturnValue(false),
     getContentGeneratorConfig: vi.fn().mockReturnValue({ model: 'gemini-pro' }),
     getModel: vi.fn().mockReturnValue('gemini-pro'),
     getUsageStatisticsEnabled: vi.fn().mockReturnValue(false),
-    setFlashFallbackHandler: vi.fn(),
+    setFallbackModelHandler: vi.fn(),
     initialize: vi.fn().mockResolvedValue(undefined),
     getProxy: vi.fn().mockReturnValue(undefined),
     getHistory: vi.fn().mockReturnValue([]),
     getEmbeddingModel: vi.fn().mockReturnValue('text-embedding-004'),
     getSessionId: vi.fn().mockReturnValue('test-session-id'),
+    getUserTier: vi.fn(),
     ...overrides,
-  };
+  } as unknown as Config;
+
+  mockConfig.getGeminiClient = vi
+    .fn()
+    .mockReturnValue(new GeminiClient(mockConfig));
   return mockConfig;
 }
 

packages/a2a-server/tsconfig.json

@@ -2,7 +2,7 @@
   "extends": "../../tsconfig.json",
   "compilerOptions": {
     "outDir": "dist",
-    "lib": ["DOM", "DOM.Iterable", "ES2021"],
+    "lib": ["DOM", "DOM.Iterable", "ES2023"],
     "composite": true,
     "types": ["node", "vitest/globals"]
   },

packages/a2a-server/vitest.config.ts

@@ -4,15 +4,25 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+/// <reference types="vitest" />
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
   test: {
-    reporters: [['default'], ['junit', { outputFile: 'junit.xml' }]],
-    passWithNoTests: true,
+    include: ['**/*.{test,spec}.?(c|m)[jt]s?(x)'],
+    exclude: ['**/node_modules/**', '**/dist/**'],
+    environment: 'jsdom',
+    globals: true,
+    reporters: ['default', 'junit'],
+    silent: true,
+    outputFile: {
+      junit: 'junit.xml',
+    },
     coverage: {
+      enabled: true,
       provider: 'v8',
       reportsDirectory: './coverage',
+      include: ['src/**/*'],
       reporter: [
         ['text', { file: 'full-text-summary.txt' }],
         'html',
@@ -22,5 +32,16 @@ export default defineConfig({
         ['json-summary', { outputFile: 'coverage-summary.json' }],
       ],
     },
+    poolOptions: {
+      threads: {
+        minThreads: 8,
+        maxThreads: 16,
+      },
+    },
+    server: {
+      deps: {
+        inline: [/@google\/gemini-cli-core/],
+      },
+    },
   },
 });

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.4.1",
+  "version": "0.7.0-preview.1",
   "description": "Gemini CLI",
   "repository": {
     "type": "git",
@@ -25,7 +25,7 @@
     "dist"
   ],
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.4.1"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.7.0-preview.1"
   },
   "dependencies": {
     "@google/gemini-cli-core": "file:../core",
@@ -34,10 +34,11 @@
     "@modelcontextprotocol/sdk": "^1.15.1",
     "@types/update-notifier": "^6.0.8",
     "command-exists": "^1.2.9",
+    "comment-json": "^4.2.5",
     "diff": "^7.0.0",
     "dotenv": "^17.1.0",
     "fzf": "^0.5.2",
-    "glob": "^10.4.1",
+    "glob": "^10.4.5",
     "highlight.js": "^11.11.1",
     "ink": "^6.2.3",
     "ink-gradient": "^3.0.0",
@@ -53,6 +54,7 @@
     "strip-json-comments": "^3.1.1",
     "undici": "^7.10.0",
     "update-notifier": "^7.3.1",
+    "wrap-ansi": "9.0.2",
     "yargs": "^17.7.2",
     "zod": "^3.23.8"
   },

packages/cli/src/commands/extensions/disable.ts

@@ -11,12 +11,16 @@ import { getErrorMessage } from '../../utils/errors.js';
 
 interface DisableArgs {
   name: string;
-  scope: SettingScope;
+  scope?: string;
 }
 
-export async function handleDisable(args: DisableArgs) {
+export function handleDisable(args: DisableArgs) {
   try {
-    disableExtension(args.name, args.scope);
+    if (args.scope?.toLowerCase() === 'workspace') {
+      disableExtension(args.name, SettingScope.Workspace);
+    } else {
+      disableExtension(args.name, SettingScope.User);
+    }
     console.log(
       `Extension "${args.name}" successfully disabled for scope "${args.scope}".`,
     );
@@ -39,13 +43,28 @@ export const disableCommand: CommandModule = {
         describe: 'The scope to disable the extenison in.',
         type: 'string',
         default: SettingScope.User,
-        choices: [SettingScope.User, SettingScope.Workspace],
       })
-      .check((_argv) => true),
-  handler: async (argv) => {
-    await handleDisable({
+      .check((argv) => {
+        if (
+          argv.scope &&
+          !Object.values(SettingScope)
+            .map((s) => s.toLowerCase())
+            .includes((argv.scope as string).toLowerCase())
+        ) {
+          throw new Error(
+            `Invalid scope: ${argv.scope}. Please use one of ${Object.values(
+              SettingScope,
+            )
+              .map((s) => s.toLowerCase())
+              .join(', ')}.`,
+          );
+        }
+        return true;
+      }),
+  handler: (argv) => {
+    handleDisable({
       name: argv['name'] as string,
-      scope: argv['scope'] as SettingScope,
+      scope: argv['scope'] as string,
     });
   },
 };

packages/cli/src/commands/extensions/enable.ts

@@ -11,15 +11,16 @@ import { SettingScope } from '../../config/settings.js';
 
 interface EnableArgs {
   name: string;
-  scope?: SettingScope;
+  scope?: string;
 }
 
-export async function handleEnable(args: EnableArgs) {
+export function handleEnable(args: EnableArgs) {
   try {
-    const scopes = args.scope
-      ? [args.scope]
-      : [SettingScope.User, SettingScope.Workspace];
-    enableExtension(args.name, scopes);
+    if (args.scope?.toLowerCase() === 'workspace') {
+      enableExtension(args.name, SettingScope.Workspace);
+    } else {
+      enableExtension(args.name, SettingScope.User);
+    }
     if (args.scope) {
       console.log(
         `Extension "${args.name}" successfully enabled for scope "${args.scope}".`,
@@ -47,13 +48,28 @@ export const enableCommand: CommandModule = {
         describe:
           'The scope to enable the extenison in. If not set, will be enabled in all scopes.',
         type: 'string',
-        choices: [SettingScope.User, SettingScope.Workspace],
       })
-      .check((_argv) => true),
-  handler: async (argv) => {
-    await handleEnable({
+      .check((argv) => {
+        if (
+          argv.scope &&
+          !Object.values(SettingScope)
+            .map((s) => s.toLowerCase())
+            .includes((argv.scope as string).toLowerCase())
+        ) {
+          throw new Error(
+            `Invalid scope: ${argv.scope}. Please use one of ${Object.values(
+              SettingScope,
+            )
+              .map((s) => s.toLowerCase())
+              .join(', ')}.`,
+          );
+        }
+        return true;
+      }),
+  handler: (argv) => {
+    handleEnable({
       name: argv['name'] as string,
-      scope: argv['scope'] as SettingScope,
+      scope: argv['scope'] as string,
     });
   },
 };

packages/cli/src/commands/extensions/install.test.ts

@@ -4,12 +4,18 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { describe, it, expect } from 'vitest';
-import { installCommand } from './install.js';
+import { describe, it, expect, vi, type MockInstance } from 'vitest';
+import { handleInstall, installCommand } from './install.js';
 import yargs from 'yargs';
 
+const mockInstallExtension = vi.hoisted(() => vi.fn());
+
 vi.mock('../../config/extension.js', () => ({
-  installExtension: vi.fn(),
+  installExtension: mockInstallExtension,
+}));
+
+vi.mock('../../utils/errors.js', () => ({
+  getErrorMessage: vi.fn((error: Error) => error.message),
 }));
 
 describe('extensions install command', () => {
@@ -21,9 +27,134 @@ describe('extensions install command', () => {
   });
 
   it('should fail if both git source and local path are provided', () => {
-    const validationParser = yargs([]).command(installCommand).fail(false);
+    const validationParser = yargs([])
+      .command(installCommand)
+      .fail(false)
+      .locale('en');
     expect(() =>
       validationParser.parse('install some-url --path /some/path'),
     ).toThrow('Arguments source and path are mutually exclusive');
   });
+
+  it('should fail if both auto update and local path are provided', () => {
+    const validationParser = yargs([])
+      .command(installCommand)
+      .fail(false)
+      .locale('en');
+    expect(() =>
+      validationParser.parse(
+        'install some-url --path /some/path --auto-update',
+      ),
+    ).toThrow('Arguments path and auto-update are mutually exclusive');
+  });
+});
+
+describe('handleInstall', () => {
+  let consoleLogSpy: MockInstance;
+  let consoleErrorSpy: MockInstance;
+  let processSpy: MockInstance;
+
+  beforeEach(() => {
+    consoleLogSpy = vi.spyOn(console, 'log');
+    consoleErrorSpy = vi.spyOn(console, 'error');
+    processSpy = vi
+      .spyOn(process, 'exit')
+      .mockImplementation(() => undefined as never);
+  });
+
+  afterEach(() => {
+    mockInstallExtension.mockClear();
+    vi.resetAllMocks();
+  });
+
+  it('should install an extension from a http source', async () => {
+    mockInstallExtension.mockResolvedValue('http-extension');
+
+    await handleInstall({
+      source: 'http://google.com',
+    });
+
+    expect(consoleLogSpy).toHaveBeenCalledWith(
+      'Extension "http-extension" installed successfully and enabled.',
+    );
+  });
+
+  it('should install an extension from a https source', async () => {
+    mockInstallExtension.mockResolvedValue('https-extension');
+
+    await handleInstall({
+      source: 'https://google.com',
+    });
+
+    expect(consoleLogSpy).toHaveBeenCalledWith(
+      'Extension "https-extension" installed successfully and enabled.',
+    );
+  });
+
+  it('should install an extension from a git source', async () => {
+    mockInstallExtension.mockResolvedValue('git-extension');
+
+    await handleInstall({
+      source: 'git@some-url',
+    });
+
+    expect(consoleLogSpy).toHaveBeenCalledWith(
+      'Extension "git-extension" installed successfully and enabled.',
+    );
+  });
+
+  it('throws an error from an unknown source', async () => {
+    await handleInstall({
+      source: 'test://google.com',
+    });
+
+    expect(consoleErrorSpy).toHaveBeenCalledWith(
+      'The source "test://google.com" is not a valid URL format.',
+    );
+    expect(processSpy).toHaveBeenCalledWith(1);
+  });
+
+  it('should install an extension from a sso source', async () => {
+    mockInstallExtension.mockResolvedValue('sso-extension');
+
+    await handleInstall({
+      source: 'sso://google.com',
+    });
+
+    expect(consoleLogSpy).toHaveBeenCalledWith(
+      'Extension "sso-extension" installed successfully and enabled.',
+    );
+  });
+
+  it('should install an extension from a local path', async () => {
+    mockInstallExtension.mockResolvedValue('local-extension');
+
+    await handleInstall({
+      path: '/some/path',
+    });
+
+    expect(consoleLogSpy).toHaveBeenCalledWith(
+      'Extension "local-extension" installed successfully and enabled.',
+    );
+  });
+
+  it('should throw an error if no source or path is provided', async () => {
+    await handleInstall({});
+
+    expect(consoleErrorSpy).toHaveBeenCalledWith(
+      'Either --source or --path must be provided.',
+    );
+    expect(processSpy).toHaveBeenCalledWith(1);
+  });
+
+  it('should throw an error if install extension fails', async () => {
+    mockInstallExtension.mockRejectedValue(
+      new Error('Install extension failed'),
+    );
+
+    await handleInstall({ source: 'git@some-url' });
+
+    expect(consoleErrorSpy).toHaveBeenCalledWith('Install extension failed');
+    expect(processSpy).toHaveBeenCalledWith(1);
+  });
 });

packages/cli/src/commands/extensions/install.ts

@@ -5,32 +5,34 @@
  */
 
 import type { CommandModule } from 'yargs';
-import {
-  installExtension,
-  type ExtensionInstallMetadata,
-} from '../../config/extension.js';
+import { installExtension } from '../../config/extension.js';
+import type { ExtensionInstallMetadata } from '@google/gemini-cli-core';
 
 import { getErrorMessage } from '../../utils/errors.js';
 
 interface InstallArgs {
   source?: string;
   path?: string;
+  ref?: string;
+  autoUpdate?: boolean;
 }
 
 export async function handleInstall(args: InstallArgs) {
   try {
     let installMetadata: ExtensionInstallMetadata;
-
     if (args.source) {
       const { source } = args;
       if (
         source.startsWith('http://') ||
         source.startsWith('https://') ||
-        source.startsWith('git@')
+        source.startsWith('git@') ||
+        source.startsWith('sso://')
       ) {
         installMetadata = {
           source,
           type: 'git',
+          ref: args.ref,
+          autoUpdate: args.autoUpdate,
         };
       } else {
         throw new Error(`The source "${source}" is not a valid URL format.`);
@@ -39,13 +41,14 @@ export async function handleInstall(args: InstallArgs) {
       installMetadata = {
         source: args.path,
         type: 'local',
+        autoUpdate: args.autoUpdate,
       };
     } else {
       // This should not be reached due to the yargs check.
       throw new Error('Either --source or --path must be provided.');
     }
 
-    const name = await installExtension(installMetadata);
+    const name = await installExtension(installMetadata, true);
     console.log(`Extension "${name}" installed successfully and enabled.`);
   } catch (error) {
     console.error(getErrorMessage(error));
@@ -54,7 +57,7 @@ export async function handleInstall(args: InstallArgs) {
 }
 
 export const installCommand: CommandModule = {
-  command: 'install [source]',
+  command: 'install [<source>] [--path] [--ref] [--auto-update]',
   describe: 'Installs an extension from a git repository URL or a local path.',
   builder: (yargs) =>
     yargs
@@ -66,7 +69,17 @@ export const installCommand: CommandModule = {
         describe: 'Path to a local extension directory.',
         type: 'string',
       })
+      .option('ref', {
+        describe: 'The git ref to install from.',
+        type: 'string',
+      })
+      .option('auto-update', {
+        describe: 'Enable auto-update for this extension.',
+        type: 'boolean',
+      })
       .conflicts('source', 'path')
+      .conflicts('path', 'ref')
+      .conflicts('path', 'auto-update')
       .check((argv) => {
         if (!argv.source && !argv.path) {
           throw new Error('Either source or --path must be provided.');
@@ -77,6 +90,8 @@ export const installCommand: CommandModule = {
     await handleInstall({
       source: argv['source'] as string | undefined,
       path: argv['path'] as string | undefined,
+      ref: argv['ref'] as string | undefined,
+      autoUpdate: argv['auto-update'] as boolean | undefined,
     });
   },
 };

packages/cli/src/commands/extensions/link.ts

@@ -5,10 +5,8 @@
  */
 
 import type { CommandModule } from 'yargs';
-import {
-  installExtension,
-  type ExtensionInstallMetadata,
-} from '../../config/extension.js';
+import { installExtension } from '../../config/extension.js';
+import type { ExtensionInstallMetadata } from '@google/gemini-cli-core';
 
 import { getErrorMessage } from '../../utils/errors.js';
 

packages/cli/src/commands/extensions/new.test.ts

@@ -27,14 +27,14 @@ describe('extensions new command', () => {
   });
 
   it('should fail if no path is provided', async () => {
-    const parser = yargs([]).command(newCommand).fail(false);
+    const parser = yargs([]).command(newCommand).fail(false).locale('en');
     await expect(parser.parseAsync('new')).rejects.toThrow(
       'Not enough non-option arguments: got 0, need at least 2',
     );
   });
 
   it('should fail if no template is provided', async () => {
-    const parser = yargs([]).command(newCommand).fail(false);
+    const parser = yargs([]).command(newCommand).fail(false).locale('en');
     await expect(parser.parseAsync('new /some/path')).rejects.toThrow(
       'Not enough non-option arguments: got 1, need at least 2',
     );

packages/cli/src/commands/extensions/uninstall.test.ts

@@ -10,7 +10,10 @@ import yargs from 'yargs';
 
 describe('extensions uninstall command', () => {
   it('should fail if no source is provided', () => {
-    const validationParser = yargs([]).command(uninstallCommand).fail(false);
+    const validationParser = yargs([])
+      .command(uninstallCommand)
+      .fail(false)
+      .locale('en');
     expect(() => validationParser.parse('uninstall')).toThrow(
       'Not enough non-option arguments: got 0, need at least 1',
     );

packages/cli/src/commands/extensions/uninstall.ts

@@ -9,7 +9,7 @@ import { uninstallExtension } from '../../config/extension.js';
 import { getErrorMessage } from '../../utils/errors.js';
 
 interface UninstallArgs {
-  name: string;
+  name: string; // can be extension name or source URL.
 }
 
 export async function handleUninstall(args: UninstallArgs) {
@@ -28,7 +28,7 @@ export const uninstallCommand: CommandModule = {
   builder: (yargs) =>
     yargs
       .positional('name', {
-        describe: 'The name of the extension to uninstall.',
+        describe: 'The name or source path of the extension to uninstall.',
         type: 'string',
       })
       .check((argv) => {

packages/cli/src/commands/extensions/update.ts

@@ -6,11 +6,18 @@
 
 import type { CommandModule } from 'yargs';
 import {
-  updateExtensionByName,
+  loadExtensions,
+  annotateActiveExtensions,
+} from '../../config/extension.js';
+import {
   updateAllUpdatableExtensions,
   type ExtensionUpdateInfo,
-} from '../../config/extension.js';
+  checkForAllExtensionUpdates,
+  updateExtension,
+} from '../../config/extensions/update.js';
+import { checkForExtensionUpdate } from '../../config/extensions/github.js';
 import { getErrorMessage } from '../../utils/errors.js';
+import { ExtensionUpdateState } from '../../ui/state/extensions.js';
 
 interface UpdateArgs {
   name?: string;
@@ -21,9 +28,68 @@ const updateOutput = (info: ExtensionUpdateInfo) =>
   `Extension "${info.name}" successfully updated: ${info.originalVersion} → ${info.updatedVersion}.`;
 
 export async function handleUpdate(args: UpdateArgs) {
+  const workingDir = process.cwd();
+  const allExtensions = loadExtensions();
+  const extensions = annotateActiveExtensions(
+    allExtensions,
+    allExtensions.map((e) => e.config.name),
+    workingDir,
+  );
+  if (args.name) {
+    try {
+      const extension = extensions.find(
+        (extension) => extension.name === args.name,
+      );
+      if (!extension) {
+        console.log(`Extension "${args.name}" not found.`);
+        return;
+      }
+      let updateState: ExtensionUpdateState | undefined;
+      if (!extension.installMetadata) {
+        console.log(
+          `Unable to install extension "${args.name}" due to missing install metadata`,
+        );
+        return;
+      }
+      await checkForExtensionUpdate(extension, (newState) => {
+        updateState = newState;
+      });
+      if (updateState !== ExtensionUpdateState.UPDATE_AVAILABLE) {
+        console.log(`Extension "${args.name}" is already up to date.`);
+        return;
+      }
+      // TODO(chrstnb): we should list extensions if the requested extension is not installed.
+      const updatedExtensionInfo = (await updateExtension(
+        extension,
+        workingDir,
+        updateState,
+        () => {},
+      ))!;
+      if (
+        updatedExtensionInfo.originalVersion !==
+        updatedExtensionInfo.updatedVersion
+      ) {
+        console.log(
+          `Extension "${args.name}" successfully updated: ${updatedExtensionInfo.originalVersion} → ${updatedExtensionInfo.updatedVersion}.`,
+        );
+      } else {
+        console.log(`Extension "${args.name}" is already up to date.`);
+      }
+    } catch (error) {
+      console.error(getErrorMessage(error));
+    }
+  }
   if (args.all) {
     try {
-      const updateInfos = await updateAllUpdatableExtensions();
+      let updateInfos = await updateAllUpdatableExtensions(
+        workingDir,
+        extensions,
+        await checkForAllExtensionUpdates(extensions, new Map(), (_) => {}),
+        () => {},
+      );
+      updateInfos = updateInfos.filter(
+        (info) => info.originalVersion !== info.updatedVersion,
+      );
       if (updateInfos.length === 0) {
         console.log('No extensions to update.');
         return;
@@ -33,20 +99,10 @@ export async function handleUpdate(args: UpdateArgs) {
       console.error(getErrorMessage(error));
     }
   }
-  if (args.name)
-    try {
-      // TODO(chrstnb): we should list extensions if the requested extension is not installed.
-      const updatedExtensionInfo = await updateExtensionByName(args.name);
-      console.log(
-        `Extension "${args.name}" successfully updated: ${updatedExtensionInfo.originalVersion} → ${updatedExtensionInfo.updatedVersion}.`,
-      );
-    } catch (error) {
-      console.error(getErrorMessage(error));
-    }
 }
 
 export const updateCommand: CommandModule = {
-  command: 'update [--all] [name]',
+  command: 'update [<name>] [--all]',
   describe:
     'Updates all extensions or a named extension to the latest version.',
   builder: (yargs) =>

packages/cli/src/commands/mcp/add.test.ts

@@ -13,6 +13,16 @@ vi.mock('fs/promises', () => ({
   writeFile: vi.fn(),
 }));
 
+vi.mock('os', () => {
+  const homedir = vi.fn(() => '/home/user');
+  return {
+    default: {
+      homedir,
+    },
+    homedir,
+  };
+});
+
 vi.mock('../../config/settings.js', async () => {
   const actual = await vi.importActual('../../config/settings.js');
   return {
@@ -26,15 +36,20 @@ const mockedLoadSettings = loadSettings as vi.Mock;
 describe('mcp add command', () => {
   let parser: yargs.Argv;
   let mockSetValue: vi.Mock;
+  let mockConsoleError: vi.Mock;
 
   beforeEach(() => {
     vi.resetAllMocks();
     const yargsInstance = yargs([]).command(addCommand);
     parser = yargsInstance;
     mockSetValue = vi.fn();
+    mockConsoleError = vi.fn();
+    vi.spyOn(console, 'error').mockImplementation(mockConsoleError);
     mockedLoadSettings.mockReturnValue({
       forScope: () => ({ settings: {} }),
       setValue: mockSetValue,
+      workspace: { path: '/path/to/project' },
+      user: { path: '/home/user' },
     });
   });
 
@@ -119,4 +134,218 @@ describe('mcp add command', () => {
       },
     );
   });
+
+  describe('when handling scope and directory', () => {
+    const serverName = 'test-server';
+    const command = 'echo';
+
+    const setupMocks = (cwd: string, workspacePath: string) => {
+      vi.spyOn(process, 'cwd').mockReturnValue(cwd);
+      mockedLoadSettings.mockReturnValue({
+        forScope: () => ({ settings: {} }),
+        setValue: mockSetValue,
+        workspace: { path: workspacePath },
+        user: { path: '/home/user' },
+      });
+    };
+
+    describe('when in a project directory', () => {
+      beforeEach(() => {
+        setupMocks('/path/to/project', '/path/to/project');
+      });
+
+      it('should use project scope by default', async () => {
+        await parser.parseAsync(`add ${serverName} ${command}`);
+        expect(mockSetValue).toHaveBeenCalledWith(
+          SettingScope.Workspace,
+          'mcpServers',
+          expect.any(Object),
+        );
+      });
+
+      it('should use project scope when --scope=project is used', async () => {
+        await parser.parseAsync(`add --scope project ${serverName} ${command}`);
+        expect(mockSetValue).toHaveBeenCalledWith(
+          SettingScope.Workspace,
+          'mcpServers',
+          expect.any(Object),
+        );
+      });
+
+      it('should use user scope when --scope=user is used', async () => {
+        await parser.parseAsync(`add --scope user ${serverName} ${command}`);
+        expect(mockSetValue).toHaveBeenCalledWith(
+          SettingScope.User,
+          'mcpServers',
+          expect.any(Object),
+        );
+      });
+    });
+
+    describe('when in a subdirectory of a project', () => {
+      beforeEach(() => {
+        setupMocks('/path/to/project/subdir', '/path/to/project');
+      });
+
+      it('should use project scope by default', async () => {
+        await parser.parseAsync(`add ${serverName} ${command}`);
+        expect(mockSetValue).toHaveBeenCalledWith(
+          SettingScope.Workspace,
+          'mcpServers',
+          expect.any(Object),
+        );
+      });
+    });
+
+    describe('when in the home directory', () => {
+      beforeEach(() => {
+        setupMocks('/home/user', '/home/user');
+      });
+
+      it('should show an error by default', async () => {
+        const mockProcessExit = vi
+          .spyOn(process, 'exit')
+          .mockImplementation((() => {
+            throw new Error('process.exit called');
+          }) as (code?: number) => never);
+
+        await expect(
+          parser.parseAsync(`add ${serverName} ${command}`),
+        ).rejects.toThrow('process.exit called');
+
+        expect(mockConsoleError).toHaveBeenCalledWith(
+          'Error: Please use --scope user to edit settings in the home directory.',
+        );
+        expect(mockProcessExit).toHaveBeenCalledWith(1);
+        expect(mockSetValue).not.toHaveBeenCalled();
+      });
+
+      it('should show an error when --scope=project is used explicitly', async () => {
+        const mockProcessExit = vi
+          .spyOn(process, 'exit')
+          .mockImplementation((() => {
+            throw new Error('process.exit called');
+          }) as (code?: number) => never);
+
+        await expect(
+          parser.parseAsync(`add --scope project ${serverName} ${command}`),
+        ).rejects.toThrow('process.exit called');
+
+        expect(mockConsoleError).toHaveBeenCalledWith(
+          'Error: Please use --scope user to edit settings in the home directory.',
+        );
+        expect(mockProcessExit).toHaveBeenCalledWith(1);
+        expect(mockSetValue).not.toHaveBeenCalled();
+      });
+
+      it('should use user scope when --scope=user is used', async () => {
+        await parser.parseAsync(`add --scope user ${serverName} ${command}`);
+        expect(mockSetValue).toHaveBeenCalledWith(
+          SettingScope.User,
+          'mcpServers',
+          expect.any(Object),
+        );
+        expect(mockConsoleError).not.toHaveBeenCalled();
+      });
+    });
+
+    describe('when in a subdirectory of home (not a project)', () => {
+      beforeEach(() => {
+        setupMocks('/home/user/some/dir', '/home/user/some/dir');
+      });
+
+      it('should use project scope by default', async () => {
+        await parser.parseAsync(`add ${serverName} ${command}`);
+        expect(mockSetValue).toHaveBeenCalledWith(
+          SettingScope.Workspace,
+          'mcpServers',
+          expect.any(Object),
+        );
+      });
+
+      it('should write to the WORKSPACE scope, not the USER scope', async () => {
+        await parser.parseAsync(`add my-new-server echo`);
+
+        // We expect setValue to be called once.
+        expect(mockSetValue).toHaveBeenCalledTimes(1);
+
+        // We get the scope that setValue was called with.
+        const calledScope = mockSetValue.mock.calls[0][0];
+
+        // We assert that the scope was Workspace, not User.
+        expect(calledScope).toBe(SettingScope.Workspace);
+      });
+    });
+
+    describe('when outside of home (not a project)', () => {
+      beforeEach(() => {
+        setupMocks('/tmp/foo', '/tmp/foo');
+      });
+
+      it('should use project scope by default', async () => {
+        await parser.parseAsync(`add ${serverName} ${command}`);
+        expect(mockSetValue).toHaveBeenCalledWith(
+          SettingScope.Workspace,
+          'mcpServers',
+          expect.any(Object),
+        );
+      });
+    });
+  });
+
+  describe('when updating an existing server', () => {
+    const serverName = 'existing-server';
+    const initialCommand = 'echo old';
+    const updatedCommand = 'echo';
+    const updatedArgs = ['new'];
+
+    beforeEach(() => {
+      mockedLoadSettings.mockReturnValue({
+        forScope: () => ({
+          settings: {
+            mcpServers: {
+              [serverName]: {
+                command: initialCommand,
+              },
+            },
+          },
+        }),
+        setValue: mockSetValue,
+        workspace: { path: '/path/to/project' },
+        user: { path: '/home/user' },
+      });
+    });
+
+    it('should update the existing server in the project scope', async () => {
+      await parser.parseAsync(
+        `add ${serverName} ${updatedCommand} ${updatedArgs.join(' ')}`,
+      );
+      expect(mockSetValue).toHaveBeenCalledWith(
+        SettingScope.Workspace,
+        'mcpServers',
+        expect.objectContaining({
+          [serverName]: expect.objectContaining({
+            command: updatedCommand,
+            args: updatedArgs,
+          }),
+        }),
+      );
+    });
+
+    it('should update the existing server in the user scope', async () => {
+      await parser.parseAsync(
+        `add --scope user ${serverName} ${updatedCommand} ${updatedArgs.join(' ')}`,
+      );
+      expect(mockSetValue).toHaveBeenCalledWith(
+        SettingScope.User,
+        'mcpServers',
+        expect.objectContaining({
+          [serverName]: expect.objectContaining({
+            command: updatedCommand,
+            args: updatedArgs,
+          }),
+        }),
+      );
+    });
+  });
 });

packages/cli/src/commands/mcp/add.ts

@@ -36,9 +36,19 @@ async function addMcpServer(
     includeTools,
     excludeTools,
   } = options;
+
+  const settings = loadSettings(process.cwd());
+  const inHome = settings.workspace.path === settings.user.path;
+
+  if (scope === 'project' && inHome) {
+    console.error(
+      'Error: Please use --scope user to edit settings in the home directory.',
+    );
+    process.exit(1);
+  }
+
   const settingsScope =
     scope === 'user' ? SettingScope.User : SettingScope.Workspace;
-  const settings = loadSettings();
 
   let newServer: Partial<MCPServerConfig> = {};
 

packages/cli/src/config/config.test.ts

@@ -7,7 +7,14 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import * as os from 'node:os';
 import * as path from 'node:path';
-import { ShellTool, EditTool, WriteFileTool } from '@google/gemini-cli-core';
+import {
+  ShellTool,
+  EditTool,
+  WriteFileTool,
+  DEFAULT_GEMINI_MODEL,
+  DEFAULT_GEMINI_MODEL_AUTO,
+  OutputFormat,
+} from '@google/gemini-cli-core';
 import { loadCliConfig, parseArguments, type CliArgs } from './config.js';
 import type { Settings } from './settings.js';
 import type { Extension } from './extension.js';
@@ -15,7 +22,9 @@ import * as ServerConfig from '@google/gemini-cli-core';
 import { isWorkspaceTrusted } from './trustedFolders.js';
 
 vi.mock('./trustedFolders.js', () => ({
-  isWorkspaceTrusted: vi.fn().mockReturnValue(true), // Default to trusted
+  isWorkspaceTrusted: vi
+    .fn()
+    .mockReturnValue({ isTrusted: true, source: 'file' }), // Default to trusted
 }));
 
 vi.mock('fs', async (importOriginal) => {
@@ -289,6 +298,34 @@ describe('parseArguments', () => {
     mockExit.mockRestore();
     mockConsoleError.mockRestore();
   });
+
+  it('should support comma-separated values for --allowed-tools', async () => {
+    process.argv = [
+      'node',
+      'script.js',
+      '--allowed-tools',
+      'read_file,ShellTool(git status)',
+    ];
+    const argv = await parseArguments({} as Settings);
+    expect(argv.allowedTools).toEqual(['read_file', 'ShellTool(git status)']);
+  });
+
+  it('should support comma-separated values for --allowed-mcp-server-names', async () => {
+    process.argv = [
+      'node',
+      'script.js',
+      '--allowed-mcp-server-names',
+      'server1,server2',
+    ];
+    const argv = await parseArguments({} as Settings);
+    expect(argv.allowedMcpServerNames).toEqual(['server1', 'server2']);
+  });
+
+  it('should support comma-separated values for --extensions', async () => {
+    process.argv = ['node', 'script.js', '--extensions', 'ext1,ext2'];
+    const argv = await parseArguments({} as Settings);
+    expect(argv.extensions).toEqual(['ext1', 'ext2']);
+  });
 });
 
 describe('loadCliConfig', () => {
@@ -1448,7 +1485,7 @@ describe('loadCliConfig model selection', () => {
       argv,
     );
 
-    expect(config.getModel()).toBe('gemini-2.5-pro');
+    expect(config.getModel()).toBe(DEFAULT_GEMINI_MODEL_AUTO);
   });
 
   it('always prefers model from argvs', async () => {
@@ -1484,6 +1521,97 @@ describe('loadCliConfig model selection', () => {
   });
 });
 
+describe('loadCliConfig model selection with model router', () => {
+  it('should use auto model when useModelRouter is true and no model is provided', async () => {
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig(
+      {
+        experimental: {
+          useModelRouter: true,
+        },
+      },
+      [],
+      'test-session',
+      argv,
+    );
+
+    expect(config.getModel()).toBe(DEFAULT_GEMINI_MODEL_AUTO);
+  });
+
+  it('should use default model when useModelRouter is false and no model is provided', async () => {
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig(
+      {
+        experimental: {
+          useModelRouter: false,
+        },
+      },
+      [],
+      'test-session',
+      argv,
+    );
+
+    expect(config.getModel()).toBe(DEFAULT_GEMINI_MODEL);
+  });
+
+  it('should prioritize argv over useModelRouter', async () => {
+    process.argv = ['node', 'script.js', '--model', 'gemini-from-argv'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig(
+      {
+        experimental: {
+          useModelRouter: true,
+        },
+      },
+      [],
+      'test-session',
+      argv,
+    );
+
+    expect(config.getModel()).toBe('gemini-from-argv');
+  });
+
+  it('should prioritize settings over useModelRouter', async () => {
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig(
+      {
+        experimental: {
+          useModelRouter: true,
+        },
+        model: {
+          name: 'gemini-from-settings',
+        },
+      },
+      [],
+      'test-session',
+      argv,
+    );
+
+    expect(config.getModel()).toBe('gemini-from-settings');
+  });
+
+  it('should prioritize environment variable over useModelRouter', async () => {
+    process.argv = ['node', 'script.js'];
+    vi.stubEnv('GEMINI_MODEL', 'gemini-from-env');
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig(
+      {
+        experimental: {
+          useModelRouter: true,
+        },
+      },
+      [],
+      'test-session',
+      argv,
+    );
+
+    expect(config.getModel()).toBe('gemini-from-env');
+  });
+});
+
 describe('loadCliConfig folderTrust', () => {
   const originalArgv = process.argv;
 
@@ -1645,15 +1773,23 @@ describe('loadCliConfig useRipgrep', () => {
     vi.restoreAllMocks();
   });
 
-  it('should be false by default when useRipgrep is not set in settings', async () => {
+  it('should be true by default when useRipgrep is not set in settings', async () => {
     process.argv = ['node', 'script.js'];
     const argv = await parseArguments({} as Settings);
     const settings: Settings = {};
     const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getUseRipgrep()).toBe(true);
+  });
+
+  it('should be false when useRipgrep is set to false in settings', async () => {
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = { tools: { useRipgrep: false } };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
     expect(config.getUseRipgrep()).toBe(false);
   });
 
-  it('should be true when useRipgrep is set to true in settings', async () => {
+  it('should be true when useRipgrep is explicitly set to true in settings', async () => {
     process.argv = ['node', 'script.js'];
     const argv = await parseArguments({} as Settings);
     const settings: Settings = { tools: { useRipgrep: true } };
@@ -1661,12 +1797,84 @@ describe('loadCliConfig useRipgrep', () => {
     expect(config.getUseRipgrep()).toBe(true);
   });
 
-  it('should be false when useRipgrep is explicitly set to false in settings', async () => {
+  describe('loadCliConfig useModelRouter', () => {
+    it('should be false by default when useModelRouter is not set in settings', async () => {
+      process.argv = ['node', 'script.js'];
+      const argv = await parseArguments({} as Settings);
+      const settings: Settings = {};
+      const config = await loadCliConfig(settings, [], 'test-session', argv);
+      expect(config.getUseModelRouter()).toBe(true);
+    });
+
+    it('should be true when useModelRouter is set to true in settings', async () => {
+      process.argv = ['node', 'script.js'];
+      const argv = await parseArguments({} as Settings);
+      const settings: Settings = { experimental: { useModelRouter: true } };
+      const config = await loadCliConfig(settings, [], 'test-session', argv);
+      expect(config.getUseModelRouter()).toBe(true);
+    });
+
+    it('should be false when useModelRouter is explicitly set to false in settings', async () => {
+      process.argv = ['node', 'script.js'];
+      const argv = await parseArguments({} as Settings);
+      const settings: Settings = { experimental: { useModelRouter: false } };
+      const config = await loadCliConfig(settings, [], 'test-session', argv);
+      expect(config.getUseModelRouter()).toBe(false);
+    });
+  });
+});
+
+describe('screenReader configuration', () => {
+  const originalArgv = process.argv;
+
+  beforeEach(() => {
+    vi.resetAllMocks();
+    vi.mocked(os.homedir).mockReturnValue('/mock/home/user');
+    vi.stubEnv('GEMINI_API_KEY', 'test-api-key');
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    vi.unstubAllEnvs();
+    vi.restoreAllMocks();
+  });
+
+  it('should use screenReader value from settings if CLI flag is not present (settings true)', async () => {
     process.argv = ['node', 'script.js'];
     const argv = await parseArguments({} as Settings);
-    const settings: Settings = { tools: { useRipgrep: false } };
+    const settings: Settings = {
+      ui: { accessibility: { screenReader: true } },
+    };
     const config = await loadCliConfig(settings, [], 'test-session', argv);
-    expect(config.getUseRipgrep()).toBe(false);
+    expect(config.getScreenReader()).toBe(true);
+  });
+
+  it('should use screenReader value from settings if CLI flag is not present (settings false)', async () => {
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = {
+      ui: { accessibility: { screenReader: false } },
+    };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getScreenReader()).toBe(false);
+  });
+
+  it('should prioritize --screen-reader CLI flag (true) over settings (false)', async () => {
+    process.argv = ['node', 'script.js', '--screen-reader'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = {
+      ui: { accessibility: { screenReader: false } },
+    };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getScreenReader()).toBe(true);
+  });
+
+  it('should be false by default when no flag or setting is present', async () => {
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = {};
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getScreenReader()).toBe(false);
   });
 });
 
@@ -1779,6 +1987,37 @@ describe('loadCliConfig interactive', () => {
     const config = await loadCliConfig({}, [], 'test-session', argv);
     expect(config.isInteractive()).toBe(false);
   });
+
+  it('should not be interactive if positional prompt words are provided with other flags', async () => {
+    process.stdin.isTTY = true;
+    process.argv = ['node', 'script.js', '--model', 'gemini-1.5-pro', 'Hello'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig({}, [], 'test-session', argv);
+    expect(config.isInteractive()).toBe(false);
+  });
+
+  it('should not be interactive if positional prompt words are provided with multiple flags', async () => {
+    process.stdin.isTTY = true;
+    process.argv = [
+      'node',
+      'script.js',
+      '--model',
+      'gemini-1.5-pro',
+      '--sandbox',
+      'Hello world',
+    ];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig({}, [], 'test-session', argv);
+    expect(config.isInteractive()).toBe(false);
+  });
+
+  it('should be interactive if no positional prompt words are provided with flags', async () => {
+    process.stdin.isTTY = true;
+    process.argv = ['node', 'script.js', '--model', 'gemini-1.5-pro'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig({}, [], 'test-session', argv);
+    expect(config.isInteractive()).toBe(true);
+  });
 });
 
 describe('loadCliConfig approval mode', () => {
@@ -1861,7 +2100,10 @@ describe('loadCliConfig approval mode', () => {
   // --- Untrusted Folder Scenarios ---
   describe('when folder is NOT trusted', () => {
     beforeEach(() => {
-      vi.mocked(isWorkspaceTrusted).mockReturnValue(false);
+      vi.mocked(isWorkspaceTrusted).mockReturnValue({
+        isTrusted: false,
+        source: 'file',
+      });
     });
 
     it('should override --approval-mode=yolo to DEFAULT', async () => {
@@ -1972,6 +2214,57 @@ describe('loadCliConfig fileFiltering', () => {
   );
 });
 
+describe('Output format', () => {
+  it('should default to TEXT', async () => {
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig({}, [], 'test-session', argv);
+    expect(config.getOutputFormat()).toBe(OutputFormat.TEXT);
+  });
+
+  it('should use the format from settings', async () => {
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig(
+      { output: { format: OutputFormat.JSON } },
+      [],
+      'test-session',
+      argv,
+    );
+    expect(config.getOutputFormat()).toBe(OutputFormat.JSON);
+  });
+
+  it('should prioritize the format from argv', async () => {
+    process.argv = ['node', 'script.js', '--output-format', 'json'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig(
+      { output: { format: OutputFormat.JSON } },
+      [],
+      'test-session',
+      argv,
+    );
+    expect(config.getOutputFormat()).toBe(OutputFormat.JSON);
+  });
+
+  it('should error on invalid --output-format argument', async () => {
+    process.argv = ['node', 'script.js', '--output-format', 'yaml'];
+    const mockExit = vi.spyOn(process, 'exit').mockImplementation(() => {
+      throw new Error('process.exit called');
+    });
+    const mockConsoleError = vi
+      .spyOn(console, 'error')
+      .mockImplementation(() => {});
+    await expect(parseArguments({} as Settings)).rejects.toThrow(
+      'process.exit called',
+    );
+    expect(mockConsoleError).toHaveBeenCalledWith(
+      expect.stringContaining('Invalid values:'),
+    );
+    mockExit.mockRestore();
+    mockConsoleError.mockRestore();
+  });
+});
+
 describe('parseArguments with positional prompt', () => {
   const originalArgv = process.argv;
 
@@ -2023,3 +2316,146 @@ describe('parseArguments with positional prompt', () => {
     expect(argv.prompt).toBe('test prompt');
   });
 });
+
+describe('Telemetry configuration via environment variables', () => {
+  it('should prioritize GEMINI_TELEMETRY_ENABLED over settings', async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_ENABLED', 'true');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = { telemetry: { enabled: false } };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getTelemetryEnabled()).toBe(true);
+  });
+
+  it('should prioritize GEMINI_TELEMETRY_TARGET over settings', async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_TARGET', 'gcp');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = { telemetry: { target: 'local' } };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getTelemetryTarget()).toBe('gcp');
+  });
+
+  it('should throw when GEMINI_TELEMETRY_TARGET is invalid', async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_TARGET', 'bogus');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = { telemetry: { target: 'gcp' } };
+    await expect(
+      loadCliConfig(settings, [], 'test-session', argv),
+    ).rejects.toThrow(
+      /Invalid telemetry configuration: .*Invalid telemetry target/i,
+    );
+    vi.unstubAllEnvs();
+  });
+
+  it('should prioritize GEMINI_TELEMETRY_OTLP_ENDPOINT over settings and default env var', async () => {
+    vi.stubEnv('OTEL_EXPORTER_OTLP_ENDPOINT', 'http://default.env.com');
+    vi.stubEnv('GEMINI_TELEMETRY_OTLP_ENDPOINT', 'http://gemini.env.com');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = {
+      telemetry: { otlpEndpoint: 'http://settings.com' },
+    };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getTelemetryOtlpEndpoint()).toBe('http://gemini.env.com');
+  });
+
+  it('should prioritize GEMINI_TELEMETRY_OTLP_PROTOCOL over settings', async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_OTLP_PROTOCOL', 'http');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = { telemetry: { otlpProtocol: 'grpc' } };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getTelemetryOtlpProtocol()).toBe('http');
+  });
+
+  it('should prioritize GEMINI_TELEMETRY_LOG_PROMPTS over settings', async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_LOG_PROMPTS', 'false');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = { telemetry: { logPrompts: true } };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getTelemetryLogPromptsEnabled()).toBe(false);
+  });
+
+  it('should prioritize GEMINI_TELEMETRY_OUTFILE over settings', async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_OUTFILE', '/gemini/env/telemetry.log');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = {
+      telemetry: { outfile: '/settings/telemetry.log' },
+    };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getTelemetryOutfile()).toBe('/gemini/env/telemetry.log');
+  });
+
+  it('should prioritize GEMINI_TELEMETRY_USE_COLLECTOR over settings', async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_USE_COLLECTOR', 'true');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = { telemetry: { useCollector: false } };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getTelemetryUseCollector()).toBe(true);
+  });
+
+  it('should use settings value when GEMINI_TELEMETRY_ENABLED is not set', async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_ENABLED', undefined);
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = { telemetry: { enabled: true } };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getTelemetryEnabled()).toBe(true);
+  });
+
+  it('should use settings value when GEMINI_TELEMETRY_TARGET is not set', async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_TARGET', undefined);
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const settings: Settings = { telemetry: { target: 'local' } };
+    const config = await loadCliConfig(settings, [], 'test-session', argv);
+    expect(config.getTelemetryTarget()).toBe('local');
+  });
+
+  it("should treat GEMINI_TELEMETRY_ENABLED='1' as true", async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_ENABLED', '1');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig({}, [], 'test-session', argv);
+    expect(config.getTelemetryEnabled()).toBe(true);
+  });
+
+  it("should treat GEMINI_TELEMETRY_ENABLED='0' as false", async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_ENABLED', '0');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig(
+      { telemetry: { enabled: true } },
+      [],
+      'test-session',
+      argv,
+    );
+    expect(config.getTelemetryEnabled()).toBe(false);
+  });
+
+  it("should treat GEMINI_TELEMETRY_LOG_PROMPTS='1' as true", async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_LOG_PROMPTS', '1');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig({}, [], 'test-session', argv);
+    expect(config.getTelemetryLogPromptsEnabled()).toBe(true);
+  });
+
+  it("should treat GEMINI_TELEMETRY_LOG_PROMPTS='false' as false", async () => {
+    vi.stubEnv('GEMINI_TELEMETRY_LOG_PROMPTS', 'false');
+    process.argv = ['node', 'script.js'];
+    const argv = await parseArguments({} as Settings);
+    const config = await loadCliConfig(
+      { telemetry: { logPrompts: true } },
+      [],
+      'test-session',
+      argv,
+    );
+    expect(config.getTelemetryLogPromptsEnabled()).toBe(false);
+  });
+});

packages/cli/src/config/config.ts

@@ -12,9 +12,9 @@ import { hideBin } from 'yargs/helpers';
 import process from 'node:process';
 import { mcpCommand } from '../commands/mcp.js';
 import type {
-  TelemetryTarget,
   FileFilteringOptions,
   MCPServerConfig,
+  OutputFormat,
 } from '@google/gemini-cli-core';
 import { extensionsCommand } from '../commands/extensions.js';
 import {
@@ -24,12 +24,15 @@ import {
   getCurrentGeminiMdFilename,
   ApprovalMode,
   DEFAULT_GEMINI_MODEL,
+  DEFAULT_GEMINI_MODEL_AUTO,
   DEFAULT_GEMINI_EMBEDDING_MODEL,
   DEFAULT_MEMORY_FILE_FILTERING_OPTIONS,
   FileDiscoveryService,
   ShellTool,
   EditTool,
   WriteFileTool,
+  resolveTelemetrySettings,
+  FatalConfigError,
 } from '@google/gemini-cli-core';
 import type { Settings } from './settings.js';
 
@@ -41,6 +44,7 @@ import { resolvePath } from '../utils/resolvePath.js';
 import { appEvents } from '../utils/events.js';
 
 import { isWorkspaceTrusted } from './trustedFolders.js';
+import { createPolicyEngineConfig } from './policy.js';
 
 // Simple console logger for now - replace with actual logger if available
 const logger = {
@@ -79,8 +83,9 @@ export interface CliArgs {
   includeDirectories: string[] | undefined;
   screenReader: boolean | undefined;
   useSmartEdit: boolean | undefined;
-  sessionSummary: string | undefined;
+  useWriteTodos: boolean | undefined;
   promptWords: string[] | undefined;
+  outputFormat: string | undefined;
 }
 
 export async function parseArguments(settings: Settings): Promise<CliArgs> {
@@ -90,13 +95,82 @@ export async function parseArguments(settings: Settings): Promise<CliArgs> {
     .usage(
       'Usage: gemini [options] [command]\n\nGemini CLI - Launch an interactive CLI, use -p/--prompt for non-interactive mode',
     )
+    .option('telemetry', {
+      type: 'boolean',
+      description:
+        'Enable telemetry? This flag specifically controls if telemetry is sent. Other --telemetry-* flags set specific values but do not enable telemetry on their own.',
+    })
+    .option('telemetry-target', {
+      type: 'string',
+      choices: ['local', 'gcp'],
+      description:
+        'Set the telemetry target (local or gcp). Overrides settings files.',
+    })
+    .option('telemetry-otlp-endpoint', {
+      type: 'string',
+      description:
+        'Set the OTLP endpoint for telemetry. Overrides environment variables and settings files.',
+    })
+    .option('telemetry-otlp-protocol', {
+      type: 'string',
+      choices: ['grpc', 'http'],
+      description:
+        'Set the OTLP protocol for telemetry (grpc or http). Overrides settings files.',
+    })
+    .option('telemetry-log-prompts', {
+      type: 'boolean',
+      description:
+        'Enable or disable logging of user prompts for telemetry. Overrides settings files.',
+    })
+    .option('telemetry-outfile', {
+      type: 'string',
+      description: 'Redirect all telemetry output to the specified file.',
+    })
+    .deprecateOption(
+      'telemetry',
+      'Use the "telemetry.enabled" setting in settings.json instead. This flag will be removed in a future version.',
+    )
+    .deprecateOption(
+      'telemetry-target',
+      'Use the "telemetry.target" setting in settings.json instead. This flag will be removed in a future version.',
+    )
+    .deprecateOption(
+      'telemetry-otlp-endpoint',
+      'Use the "telemetry.otlpEndpoint" setting in settings.json instead. This flag will be removed in a future version.',
+    )
+    .deprecateOption(
+      'telemetry-otlp-protocol',
+      'Use the "telemetry.otlpProtocol" setting in settings.json instead. This flag will be removed in a future version.',
+    )
+    .deprecateOption(
+      'telemetry-log-prompts',
+      'Use the "telemetry.logPrompts" setting in settings.json instead. This flag will be removed in a future version.',
+    )
+    .deprecateOption(
+      'telemetry-outfile',
+      'Use the "telemetry.outfile" setting in settings.json instead. This flag will be removed in a future version.',
+    )
+    .option('debug', {
+      alias: 'd',
+      type: 'boolean',
+      description: 'Run in debug mode?',
+      default: false,
+    })
+    .option('proxy', {
+      type: 'string',
+      description:
+        'Proxy for gemini client, like schema://user:password@host:port',
+    })
+    .deprecateOption(
+      'proxy',
+      'Use the "proxy" setting in settings.json instead. This flag will be removed in a future version.',
+    )
     .command('$0 [promptWords...]', 'Launch Gemini CLI', (yargsInstance) =>
       yargsInstance
         .option('model', {
           alias: 'm',
           type: 'string',
           description: `Model`,
-          default: process.env['GEMINI_MODEL'],
         })
         .option('prompt', {
           alias: 'p',
@@ -118,12 +192,6 @@ export async function parseArguments(settings: Settings): Promise<CliArgs> {
           type: 'string',
           description: 'Sandbox image URI.',
         })
-        .option('debug', {
-          alias: 'd',
-          type: 'boolean',
-          description: 'Run in debug mode?',
-          default: false,
-        })
         .option('all-files', {
           alias: ['a'],
           type: 'boolean',
@@ -148,37 +216,6 @@ export async function parseArguments(settings: Settings): Promise<CliArgs> {
           description:
             'Set the approval mode: default (prompt for approval), auto_edit (auto-approve edit tools), yolo (auto-approve all tools)',
         })
-        .option('telemetry', {
-          type: 'boolean',
-          description:
-            'Enable telemetry? This flag specifically controls if telemetry is sent. Other --telemetry-* flags set specific values but do not enable telemetry on their own.',
-        })
-        .option('telemetry-target', {
-          type: 'string',
-          choices: ['local', 'gcp'],
-          description:
-            'Set the telemetry target (local or gcp). Overrides settings files.',
-        })
-        .option('telemetry-otlp-endpoint', {
-          type: 'string',
-          description:
-            'Set the OTLP endpoint for telemetry. Overrides environment variables and settings files.',
-        })
-        .option('telemetry-otlp-protocol', {
-          type: 'string',
-          choices: ['grpc', 'http'],
-          description:
-            'Set the OTLP protocol for telemetry (grpc or http). Overrides settings files.',
-        })
-        .option('telemetry-log-prompts', {
-          type: 'boolean',
-          description:
-            'Enable or disable logging of user prompts for telemetry. Overrides settings files.',
-        })
-        .option('telemetry-outfile', {
-          type: 'string',
-          description: 'Redirect all telemetry output to the specified file.',
-        })
         .option('checkpointing', {
           alias: 'c',
           type: 'boolean',
@@ -193,11 +230,19 @@ export async function parseArguments(settings: Settings): Promise<CliArgs> {
           type: 'array',
           string: true,
           description: 'Allowed MCP server names',
+          coerce: (mcpServerNames: string[]) =>
+            // Handle comma-separated values
+            mcpServerNames.flatMap((mcpServerName) =>
+              mcpServerName.split(',').map((m) => m.trim()),
+            ),
         })
         .option('allowed-tools', {
           type: 'array',
           string: true,
           description: 'Tools that are allowed to run without confirmation',
+          coerce: (tools: string[]) =>
+            // Handle comma-separated values
+            tools.flatMap((tool) => tool.split(',').map((t) => t.trim())),
         })
         .option('extensions', {
           alias: 'e',
@@ -205,17 +250,17 @@ export async function parseArguments(settings: Settings): Promise<CliArgs> {
           string: true,
           description:
             'A list of extensions to use. If not provided, all extensions are used.',
+          coerce: (extensions: string[]) =>
+            // Handle comma-separated values
+            extensions.flatMap((extension) =>
+              extension.split(',').map((e) => e.trim()),
+            ),
         })
         .option('list-extensions', {
           alias: 'l',
           type: 'boolean',
           description: 'List all available extensions and exit.',
         })
-        .option('proxy', {
-          type: 'string',
-          description:
-            'Proxy for gemini client, like schema://user:password@host:port',
-        })
         .option('include-directories', {
           type: 'array',
           string: true,
@@ -228,51 +273,24 @@ export async function parseArguments(settings: Settings): Promise<CliArgs> {
         .option('screen-reader', {
           type: 'boolean',
           description: 'Enable screen reader mode for accessibility.',
-          default: false,
         })
-        .option('session-summary', {
+        .option('output-format', {
+          alias: 'o',
           type: 'string',
-          description: 'File to write session summary to.',
+          description: 'The format of the CLI output.',
+          choices: ['text', 'json'],
         })
-        .deprecateOption(
-          'telemetry',
-          'Use settings.json instead. This flag will be removed in a future version.',
-        )
-        .deprecateOption(
-          'telemetry-target',
-          'Use settings.json instead. This flag will be removed in a future version.',
-        )
-        .deprecateOption(
-          'telemetry-otlp-endpoint',
-          'Use settings.json instead. This flag will be removed in a future version.',
-        )
-        .deprecateOption(
-          'telemetry-otlp-protocol',
-          'Use settings.json instead. This flag will be removed in a future version.',
-        )
-        .deprecateOption(
-          'telemetry-log-prompts',
-          'Use settings.json instead. This flag will be removed in a future version.',
-        )
-        .deprecateOption(
-          'telemetry-outfile',
-          'Use settings.json instead. This flag will be removed in a future version.',
-        )
         .deprecateOption(
           'show-memory-usage',
-          'Use settings.json instead. This flag will be removed in a future version.',
+          'Use the "ui.showMemoryUsage" setting in settings.json instead. This flag will be removed in a future version.',
         )
         .deprecateOption(
           'sandbox-image',
-          'Use settings.json instead. This flag will be removed in a future version.',
-        )
-        .deprecateOption(
-          'proxy',
-          'Use settings.json instead. This flag will be removed in a future version.',
+          'Use the "tools.sandbox" setting in settings.json instead. This flag will be removed in a future version.',
         )
         .deprecateOption(
           'checkpointing',
-          'Use settings.json instead. This flag will be removed in a future version.',
+          'Use the "general.checkpointing.enabled" setting in settings.json instead. This flag will be removed in a future version.',
         )
         .deprecateOption(
           'all-files',
@@ -378,6 +396,15 @@ export async function loadHierarchicalGeminiMemory(
   );
 }
 
+export function isDebugMode(argv: CliArgs): boolean {
+  return (
+    argv.debug ||
+    [process.env['DEBUG'], process.env['DEBUG_MODE']].some(
+      (v) => v === 'true' || v === '1',
+    )
+  );
+}
+
 export async function loadCliConfig(
   settings: Settings,
   extensions: Extension[],
@@ -385,18 +412,14 @@ export async function loadCliConfig(
   argv: CliArgs,
   cwd: string = process.cwd(),
 ): Promise<Config> {
-  const debugMode =
-    argv.debug ||
-    [process.env['DEBUG'], process.env['DEBUG_MODE']].some(
-      (v) => v === 'true' || v === '1',
-    ) ||
-    false;
+  const debugMode = isDebugMode(argv);
+
   const memoryImportFormat = settings.context?.importFormat || 'tree';
 
   const ideMode = settings.ide?.enabled ?? false;
 
   const folderTrust = settings.security?.folderTrust?.enabled ?? false;
-  const trustedFolder = isWorkspaceTrusted(settings) ?? true;
+  const trustedFolder = isWorkspaceTrusted(settings)?.isTrusted ?? true;
 
   const allExtensions = annotateActiveExtensions(
     extensions,
@@ -486,8 +509,29 @@ export async function loadCliConfig(
     approvalMode = ApprovalMode.DEFAULT;
   }
 
+  let telemetrySettings;
+  try {
+    telemetrySettings = await resolveTelemetrySettings({
+      argv,
+      env: process.env as unknown as Record<string, string | undefined>,
+      settings: settings.telemetry,
+    });
+  } catch (err) {
+    if (err instanceof FatalConfigError) {
+      throw new FatalConfigError(
+        `Invalid telemetry configuration: ${err.message}.`,
+      );
+    }
+    throw err;
+  }
+
+  const policyEngineConfig = createPolicyEngineConfig(settings, approvalMode);
+
+  // Fix: If promptWords are provided, always use non-interactive mode
+  const hasPromptWords = argv.promptWords && argv.promptWords.length > 0;
   const interactive =
-    !!argv.promptInteractive || (process.stdin.isTTY && question.length === 0);
+    !!argv.promptInteractive ||
+    (process.stdin.isTTY && !hasPromptWords && !argv.prompt);
   // In non-interactive mode, exclude tools that require a prompt.
   const extraExcludes: string[] = [];
   if (!interactive && !argv.experimentalAcp) {
@@ -543,6 +587,16 @@ export async function loadCliConfig(
     );
   }
 
+  const useModelRouter = settings.experimental?.useModelRouter ?? true;
+  const defaultModel = useModelRouter
+    ? DEFAULT_GEMINI_MODEL_AUTO
+    : DEFAULT_GEMINI_MODEL;
+  const resolvedModel: string =
+    argv.model ||
+    process.env['GEMINI_MODEL'] ||
+    settings.model?.name ||
+    defaultModel;
+
   const sandboxConfig = await loadSandboxConfig(settings, argv);
   const screenReader =
     argv.screenReader !== undefined
@@ -561,6 +615,7 @@ export async function loadCliConfig(
     fullContext: argv.allFiles || false,
     coreTools: settings.tools?.core || undefined,
     allowedTools: argv.allowedTools || settings.tools?.allowed || undefined,
+    policyEngineConfig,
     excludeTools,
     toolDiscoveryCommand: settings.tools?.discoveryCommand,
     toolCallCommand: settings.tools?.callCommand,
@@ -575,22 +630,7 @@ export async function loadCliConfig(
       ...settings.ui?.accessibility,
       screenReader,
     },
-    telemetry: {
-      enabled: argv.telemetry ?? settings.telemetry?.enabled,
-      target: (argv.telemetryTarget ??
-        settings.telemetry?.target) as TelemetryTarget,
-      otlpEndpoint:
-        argv.telemetryOtlpEndpoint ??
-        process.env['OTEL_EXPORTER_OTLP_ENDPOINT'] ??
-        settings.telemetry?.otlpEndpoint,
-      otlpProtocol: (['grpc', 'http'] as const).find(
-        (p) =>
-          p ===
-          (argv.telemetryOtlpProtocol ?? settings.telemetry?.otlpProtocol),
-      ),
-      logPrompts: argv.telemetryLogPrompts ?? settings.telemetry?.logPrompts,
-      outfile: argv.telemetryOutfile ?? settings.telemetry?.outfile,
-    },
+    telemetry: telemetrySettings,
     usageStatisticsEnabled: settings.privacy?.usageStatisticsEnabled ?? true,
     fileFiltering: settings.context?.fileFiltering,
     checkpointing:
@@ -604,7 +644,7 @@ export async function loadCliConfig(
     cwd,
     fileDiscoveryService: fileService,
     bugCommand: settings.advanced?.bugCommand,
-    model: argv.model || settings.model?.name || DEFAULT_GEMINI_MODEL,
+    model: resolvedModel,
     extensionContextFilePaths,
     maxSessionTurns: settings.model?.maxSessionTurns ?? -1,
     experimentalZedIntegration: argv.experimentalAcp || false,
@@ -619,11 +659,21 @@ export async function loadCliConfig(
     interactive,
     trustedFolder,
     useRipgrep: settings.tools?.useRipgrep,
-    shouldUseNodePtyShell: settings.tools?.usePty,
+    shouldUseNodePtyShell: settings.tools?.shell?.enableInteractiveShell,
     skipNextSpeakerCheck: settings.model?.skipNextSpeakerCheck,
     enablePromptCompletion: settings.general?.enablePromptCompletion ?? false,
+    truncateToolOutputThreshold: settings.tools?.truncateToolOutputThreshold,
+    truncateToolOutputLines: settings.tools?.truncateToolOutputLines,
+    enableToolOutputTruncation: settings.tools?.enableToolOutputTruncation,
     eventEmitter: appEvents,
     useSmartEdit: argv.useSmartEdit ?? settings.useSmartEdit,
+    useWriteTodos: argv.useWriteTodos ?? settings.useWriteTodos,
+    output: {
+      format: (argv.outputFormat ?? settings.output?.format) as OutputFormat,
+    },
+    useModelRouter,
+    enableMessageBusIntegration:
+      settings.tools?.enableMessageBusIntegration ?? false,
   });
 }
 

packages/cli/src/config/extension.ts

@@ -7,24 +7,36 @@
 import type {
   MCPServerConfig,
   GeminiCLIExtension,
+  ExtensionInstallMetadata,
 } from '@google/gemini-cli-core';
 import {
   GEMINI_DIR,
   Storage,
-  ClearcutLogger,
   Config,
   ExtensionInstallEvent,
+  ExtensionUninstallEvent,
+  ExtensionDisableEvent,
+  ExtensionEnableEvent,
+  logExtensionEnable,
+  logExtensionInstallEvent,
+  logExtensionUninstall,
+  logExtensionDisable,
 } from '@google/gemini-cli-core';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
-import { simpleGit } from 'simple-git';
 import { SettingScope, loadSettings } from '../config/settings.js';
 import { getErrorMessage } from '../utils/errors.js';
 import { recursivelyHydrateStrings } from './extensions/variables.js';
 import { isWorkspaceTrusted } from './trustedFolders.js';
 import { resolveEnvVarsInObject } from '../utils/envVarResolver.js';
 import { randomUUID } from 'node:crypto';
+import {
+  cloneFromGit,
+  downloadFromGitHubRelease,
+} from './extensions/github.js';
+import type { LoadExtensionContext } from './extensions/variableSchema.js';
+import { ExtensionEnablementManager } from './extensions/extensionEnablement.js';
 
 export const EXTENSIONS_DIRECTORY_NAME = path.join(GEMINI_DIR, 'extensions');
 
@@ -46,11 +58,6 @@ export interface ExtensionConfig {
   excludeTools?: string[];
 }
 
-export interface ExtensionInstallMetadata {
-  source: string;
-  type: 'git' | 'local' | 'link';
-}
-
 export interface ExtensionUpdateInfo {
   name: string;
   originalVersion: string;
@@ -88,10 +95,14 @@ export class ExtensionStorage {
 }
 
 export function getWorkspaceExtensions(workspaceDir: string): Extension[] {
+  // If the workspace dir is the user extensions dir, there are no workspace extensions.
+  if (path.resolve(workspaceDir) === path.resolve(os.homedir())) {
+    return [];
+  }
   return loadExtensionsFromDir(workspaceDir);
 }
 
-async function copyExtension(
+export async function copyExtension(
   source: string,
   destination: string,
 ): Promise<void> {
@@ -117,11 +128,24 @@ export async function performWorkspaceExtensionMigration(
   return failedInstallNames;
 }
 
+function getTelemetryConfig(cwd: string) {
+  const settings = loadSettings(cwd);
+  const config = new Config({
+    telemetry: settings.merged.telemetry,
+    interactive: false,
+    sessionId: randomUUID(),
+    targetDir: cwd,
+    cwd,
+    model: '',
+    debugMode: false,
+  });
+  return config;
+}
+
 export function loadExtensions(
   workspaceDir: string = process.cwd(),
 ): Extension[] {
   const settings = loadSettings(workspaceDir).merged;
-  const disabledExtensions = settings.extensions?.disabled ?? [];
   const allExtensions = [...loadUserExtensions()];
 
   if (
@@ -133,10 +157,14 @@ export function loadExtensions(
   }
 
   const uniqueExtensions = new Map<string, Extension>();
+  const manager = new ExtensionEnablementManager(
+    ExtensionStorage.getUserExtensionsDir(),
+  );
+
   for (const extension of allExtensions) {
     if (
       !uniqueExtensions.has(extension.config.name) &&
-      !disabledExtensions.includes(extension.config.name)
+      manager.isEnabled(extension.config.name, workspaceDir)
     ) {
       uniqueExtensions.set(extension.config.name, extension);
     }
@@ -169,7 +197,7 @@ export function loadExtensionsFromDir(dir: string): Extension[] {
   for (const subdir of fs.readdirSync(extensionsDir)) {
     const extensionDir = path.join(extensionsDir, subdir);
 
-    const extension = loadExtension(extensionDir);
+    const extension = loadExtension({ extensionDir, workspaceDir: dir });
     if (extension != null) {
       extensions.push(extension);
     }
@@ -177,11 +205,9 @@ export function loadExtensionsFromDir(dir: string): Extension[] {
   return extensions;
 }
 
-export function loadExtension(extensionDir: string): Extension | null {
+export function loadExtension(context: LoadExtensionContext): Extension | null {
+  const { extensionDir, workspaceDir } = context;
   if (!fs.statSync(extensionDir).isDirectory()) {
-    console.error(
-      `Warning: unexpected file ${extensionDir} in extensions directory.`,
-    );
     return null;
   }
 
@@ -192,33 +218,23 @@ export function loadExtension(extensionDir: string): Extension | null {
     effectiveExtensionPath = installMetadata.source;
   }
 
-  const configFilePath = path.join(
-    effectiveExtensionPath,
-    EXTENSIONS_CONFIG_FILENAME,
-  );
-  if (!fs.existsSync(configFilePath)) {
-    console.error(
-      `Warning: extension directory ${effectiveExtensionPath} does not contain a config file ${configFilePath}.`,
-    );
-    return null;
-  }
-
   try {
-    const configContent = fs.readFileSync(configFilePath, 'utf-8');
-    let config = recursivelyHydrateStrings(JSON.parse(configContent), {
-      extensionPath: extensionDir,
-      '/': path.sep,
-      pathSeparator: path.sep,
-    }) as unknown as ExtensionConfig;
-    if (!config.name || !config.version) {
-      console.error(
-        `Invalid extension config in ${configFilePath}: missing name or version.`,
-      );
-      return null;
-    }
+    let config = loadExtensionConfig({
+      extensionDir: effectiveExtensionPath,
+      workspaceDir,
+    });
 
     config = resolveEnvVarsInObject(config);
 
+    if (config.mcpServers) {
+      config.mcpServers = Object.fromEntries(
+        Object.entries(config.mcpServers).map(([key, value]) => [
+          key,
+          filterMcpConfig(value),
+        ]),
+      );
+    }
+
     const contextFiles = getContextFileNames(config)
       .map((contextFileName) =>
         path.join(effectiveExtensionPath, contextFileName),
@@ -233,7 +249,7 @@ export function loadExtension(extensionDir: string): Extension | null {
     };
   } catch (e) {
     console.error(
-      `Warning: error parsing extension config in ${configFilePath}: ${getErrorMessage(
+      `Warning: Skipping extension in ${effectiveExtensionPath}: ${getErrorMessage(
         e,
       )}`,
     );
@@ -241,7 +257,13 @@ export function loadExtension(extensionDir: string): Extension | null {
   }
 }
 
-function loadInstallMetadata(
+function filterMcpConfig(original: MCPServerConfig): MCPServerConfig {
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  const { trust, ...rest } = original;
+  return Object.freeze(rest);
+}
+
+export function loadInstallMetadata(
   extensionDir: string,
 ): ExtensionInstallMetadata | undefined {
   const metadataFilePath = path.join(extensionDir, INSTALL_METADATA_FILENAME);
@@ -265,7 +287,7 @@ function getContextFileNames(config: ExtensionConfig): string[] {
 
 /**
  * Returns an annotated list of extensions. If an extension is listed in enabledExtensionNames, it will be active.
- * If enabledExtensionNames is empty, an extension is active unless it is in list of disabled extensions in settings.
+ * If enabledExtensionNames is empty, an extension is active unless it is disabled.
  * @param extensions The base list of extensions.
  * @param enabledExtensionNames The names of explicitly enabled extensions.
  * @param workspaceDir The current workspace directory.
@@ -275,17 +297,17 @@ export function annotateActiveExtensions(
   enabledExtensionNames: string[],
   workspaceDir: string,
 ): GeminiCLIExtension[] {
-  const settings = loadSettings(workspaceDir).merged;
-  const disabledExtensions = settings.extensions?.disabled ?? [];
-
+  const manager = new ExtensionEnablementManager(
+    ExtensionStorage.getUserExtensionsDir(),
+  );
   const annotatedExtensions: GeminiCLIExtension[] = [];
-
   if (enabledExtensionNames.length === 0) {
     return extensions.map((extension) => ({
       name: extension.config.name,
       version: extension.config.version,
-      isActive: !disabledExtensions.includes(extension.config.name),
+      isActive: manager.isEnabled(extension.config.name, workspaceDir),
       path: extension.path,
+      installMetadata: extension.installMetadata,
     }));
   }
 
@@ -302,6 +324,7 @@ export function annotateActiveExtensions(
       version: extension.config.version,
       isActive: false,
       path: extension.path,
+      installMetadata: extension.installMetadata,
     }));
   }
 
@@ -320,6 +343,7 @@ export function annotateActiveExtensions(
       version: extension.config.version,
       isActive,
       path: extension.path,
+      installMetadata: extension.installMetadata,
     });
   }
 
@@ -331,36 +355,31 @@ export function annotateActiveExtensions(
 }
 
 /**
- * Clones a Git repository to a specified local path.
- * @param gitUrl The Git URL to clone.
- * @param destination The destination path to clone the repository to.
+ * Asks users a prompt and awaits for a y/n response
+ * @param prompt A yes/no prompt to ask the user
+ * @returns Whether or not the user answers 'y' (yes). Defaults to 'yes' on enter.
  */
-async function cloneFromGit(
-  gitUrl: string,
-  destination: string,
-): Promise<void> {
-  try {
-    // TODO(chrstnb): Download the archive instead to avoid unnecessary .git info.
-    await simpleGit().clone(gitUrl, destination, ['--depth', '1']);
-  } catch (error) {
-    throw new Error(`Failed to clone Git repository from ${gitUrl}`, {
-      cause: error,
+async function promptForContinuation(prompt: string): Promise<boolean> {
+  const readline = await import('node:readline');
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+
+  return new Promise((resolve) => {
+    rl.question(prompt, (answer) => {
+      rl.close();
+      resolve(['y', ''].includes(answer.trim().toLowerCase()));
     });
-  }
+  });
 }
 
 export async function installExtension(
   installMetadata: ExtensionInstallMetadata,
+  askConsent: boolean = false,
   cwd: string = process.cwd(),
 ): Promise<string> {
-  const config = new Config({
-    sessionId: randomUUID(),
-    targetDir: process.cwd(),
-    cwd: process.cwd(),
-    model: '',
-    debugMode: false,
-  });
-  const logger = ClearcutLogger.getInstance(config);
+  const telemetryConfig = getTelemetryConfig(cwd);
   let newExtensionConfig: ExtensionConfig | null = null;
   let localSourcePath: string | undefined;
 
@@ -384,9 +403,22 @@ export async function installExtension(
 
     let tempDir: string | undefined;
 
-    if (installMetadata.type === 'git') {
+    if (
+      installMetadata.type === 'git' ||
+      installMetadata.type === 'github-release'
+    ) {
       tempDir = await ExtensionStorage.createTmpDir();
-      await cloneFromGit(installMetadata.source, tempDir);
+      try {
+        const result = await downloadFromGitHubRelease(
+          installMetadata,
+          tempDir,
+        );
+        installMetadata.type = result.type;
+        installMetadata.releaseTag = result.tagName;
+      } catch (_error) {
+        await cloneFromGit(installMetadata, tempDir);
+        installMetadata.type = 'git';
+      }
       localSourcePath = tempDir;
     } else if (
       installMetadata.type === 'local' ||
@@ -398,12 +430,10 @@ export async function installExtension(
     }
 
     try {
-      newExtensionConfig = await loadExtensionConfig(localSourcePath);
-      if (!newExtensionConfig) {
-        throw new Error(
-          `Invalid extension at ${installMetadata.source}. Please make sure it has a valid gemini-extension.json file.`,
-        );
-      }
+      newExtensionConfig = loadExtensionConfig({
+        extensionDir: localSourcePath,
+        workspaceDir: cwd,
+      });
 
       const newExtensionName = newExtensionConfig.name;
       const extensionStorage = new ExtensionStorage(newExtensionName);
@@ -419,10 +449,16 @@ export async function installExtension(
           `Extension "${newExtensionName}" is already installed. Please uninstall it first.`,
         );
       }
-
+      if (askConsent) {
+        await requestConsent(newExtensionConfig);
+      }
       await fs.promises.mkdir(destinationPath, { recursive: true });
 
-      if (installMetadata.type === 'local' || installMetadata.type === 'git') {
+      if (
+        installMetadata.type === 'local' ||
+        installMetadata.type === 'git' ||
+        installMetadata.type === 'github-release'
+      ) {
         await copyExtension(localSourcePath, destinationPath);
       }
 
@@ -438,7 +474,8 @@ export async function installExtension(
       }
     }
 
-    logger?.logExtensionInstallEvent(
+    logExtensionInstallEvent(
+      telemetryConfig,
       new ExtensionInstallEvent(
         newExtensionConfig!.name,
         newExtensionConfig!.version,
@@ -447,14 +484,23 @@ export async function installExtension(
       ),
     );
 
+    enableExtension(newExtensionConfig!.name, SettingScope.User);
     return newExtensionConfig!.name;
   } catch (error) {
     // Attempt to load config from the source path even if installation fails
     // to get the name and version for logging.
     if (!newExtensionConfig && localSourcePath) {
-      newExtensionConfig = await loadExtensionConfig(localSourcePath);
+      try {
+        newExtensionConfig = loadExtensionConfig({
+          extensionDir: localSourcePath,
+          workspaceDir: cwd,
+        });
+      } catch {
+        // Ignore error, this is just for logging.
+      }
     }
-    logger?.logExtensionInstallEvent(
+    logExtensionInstallEvent(
+      telemetryConfig,
       new ExtensionInstallEvent(
         newExtensionConfig?.name ?? '',
         newExtensionConfig?.version ?? '',
@@ -466,51 +512,104 @@ export async function installExtension(
   }
 }
 
-export async function loadExtensionConfig(
-  extensionDir: string,
-): Promise<ExtensionConfig | null> {
+async function requestConsent(extensionConfig: ExtensionConfig) {
+  const output: string[] = [];
+  const mcpServerEntries = Object.entries(extensionConfig.mcpServers || {});
+  output.push('Extensions may introduce unexpected behavior.');
+  output.push(
+    'Ensure you have investigated the extension source and trust the author.',
+  );
+
+  if (mcpServerEntries.length) {
+    output.push('This extension will run the following MCP servers:');
+    for (const [key, mcpServer] of mcpServerEntries) {
+      const isLocal = !!mcpServer.command;
+      const source =
+        mcpServer.httpUrl ??
+        `${mcpServer.command || ''}${mcpServer.args ? ' ' + mcpServer.args.join(' ') : ''}`;
+      output.push(`  * ${key} (${isLocal ? 'local' : 'remote'}): ${source}`);
+    }
+  }
+  if (extensionConfig.contextFileName) {
+    output.push(
+      `This extension will append info to your gemini.md context using ${extensionConfig.contextFileName}`,
+    );
+  }
+  if (extensionConfig.excludeTools) {
+    output.push(
+      `This extension will exclude the following core tools: ${extensionConfig.excludeTools}`,
+    );
+  }
+  console.info(output.join('\n'));
+  const shouldContinue = await promptForContinuation(
+    'Do you want to continue? [Y/n]: ',
+  );
+  if (!shouldContinue) {
+    throw new Error('Installation cancelled by user.');
+  }
+}
+
+export function loadExtensionConfig(
+  context: LoadExtensionContext,
+): ExtensionConfig {
+  const { extensionDir, workspaceDir } = context;
   const configFilePath = path.join(extensionDir, EXTENSIONS_CONFIG_FILENAME);
   if (!fs.existsSync(configFilePath)) {
-    return null;
+    throw new Error(`Configuration file not found at ${configFilePath}`);
   }
   try {
     const configContent = fs.readFileSync(configFilePath, 'utf-8');
     const config = recursivelyHydrateStrings(JSON.parse(configContent), {
       extensionPath: extensionDir,
+      workspacePath: workspaceDir,
       '/': path.sep,
       pathSeparator: path.sep,
     }) as unknown as ExtensionConfig;
     if (!config.name || !config.version) {
-      return null;
+      throw new Error(
+        `Invalid configuration in ${configFilePath}: missing ${!config.name ? '"name"' : '"version"'}`,
+      );
     }
     return config;
-  } catch (_) {
-    return null;
+  } catch (e) {
+    throw new Error(
+      `Failed to load extension config from ${configFilePath}: ${getErrorMessage(
+        e,
+      )}`,
+    );
   }
 }
 
 export async function uninstallExtension(
-  extensionName: string,
+  extensionIdentifier: string,
   cwd: string = process.cwd(),
 ): Promise<void> {
+  const telemetryConfig = getTelemetryConfig(cwd);
   const installedExtensions = loadUserExtensions();
-  if (
-    !installedExtensions.some(
-      (installed) => installed.config.name === extensionName,
-    )
-  ) {
-    throw new Error(`Extension "${extensionName}" not found.`);
+  const extensionName = installedExtensions.find(
+    (installed) =>
+      installed.config.name.toLowerCase() ===
+        extensionIdentifier.toLowerCase() ||
+      installed.installMetadata?.source.toLowerCase() ===
+        extensionIdentifier.toLowerCase(),
+  )?.config.name;
+  if (!extensionName) {
+    throw new Error(`Extension not found.`);
   }
-  removeFromDisabledExtensions(
-    extensionName,
-    [SettingScope.User, SettingScope.Workspace],
-    cwd,
+  const manager = new ExtensionEnablementManager(
+    ExtensionStorage.getUserExtensionsDir(),
   );
+  manager.remove(extensionName);
   const storage = new ExtensionStorage(extensionName);
-  return await fs.promises.rm(storage.getExtensionDir(), {
+
+  await fs.promises.rm(storage.getExtensionDir(), {
     recursive: true,
     force: true,
   });
+  logExtensionUninstall(
+    telemetryConfig,
+    new ExtensionUninstallEvent(extensionName, 'success'),
+  );
 }
 
 export function toOutputString(extension: Extension): string {
@@ -518,6 +617,12 @@ export function toOutputString(extension: Extension): string {
   output += `\n Path: ${extension.path}`;
   if (extension.installMetadata) {
     output += `\n Source: ${extension.installMetadata.source} (Type: ${extension.installMetadata.type})`;
+    if (extension.installMetadata.ref) {
+      output += `\n Ref: ${extension.installMetadata.ref}`;
+    }
+    if (extension.installMetadata.releaseTag) {
+      output += `\n Release tag: ${extension.installMetadata.releaseTag}`;
+    }
   }
   if (extension.contextFiles.length > 0) {
     output += `\n Context files:`;
@@ -540,120 +645,37 @@ export function toOutputString(extension: Extension): string {
   return output;
 }
 
-export async function updateExtensionByName(
-  extensionName: string,
-  cwd: string = process.cwd(),
-): Promise<ExtensionUpdateInfo> {
-  const installedExtensions = loadUserExtensions();
-  const extension = installedExtensions.find(
-    (installed) => installed.config.name === extensionName,
-  );
-  if (!extension) {
-    throw new Error(
-      `Extension "${extensionName}" not found. Run gemini extensions list to see available extensions.`,
-    );
-  }
-  return await updateExtension(extension, cwd);
-}
-
-export async function updateExtension(
-  extension: Extension,
-  cwd: string = process.cwd(),
-): Promise<ExtensionUpdateInfo> {
-  if (!extension.installMetadata) {
-    throw new Error(`Extension ${extension.config.name} cannot be updated.`);
-  }
-  if (extension.installMetadata.type === 'link') {
-    throw new Error(`Extension is linked so does not need to be updated`);
-  }
-  const originalVersion = extension.config.version;
-
-  const tempDir = await ExtensionStorage.createTmpDir();
-  try {
-    await copyExtension(extension.path, tempDir);
-    await uninstallExtension(extension.config.name, cwd);
-    await installExtension(extension.installMetadata, cwd);
-
-    const updatedExtensionStorage = new ExtensionStorage(extension.config.name);
-    const updatedExtension = loadExtension(
-      updatedExtensionStorage.getExtensionDir(),
-    );
-    if (!updatedExtension) {
-      throw new Error('Updated extension not found after installation.');
-    }
-    const updatedVersion = updatedExtension.config.version;
-    return {
-      name: extension.config.name,
-      originalVersion,
-      updatedVersion,
-    };
-  } catch (e) {
-    console.error(
-      `Error updating extension, rolling back. ${getErrorMessage(e)}`,
-    );
-    await copyExtension(tempDir, extension.path);
-    throw e;
-  } finally {
-    await fs.promises.rm(tempDir, { recursive: true, force: true });
-  }
-}
-
 export function disableExtension(
   name: string,
   scope: SettingScope,
   cwd: string = process.cwd(),
+) {
+  const config = getTelemetryConfig(cwd);
+  if (scope === SettingScope.System || scope === SettingScope.SystemDefaults) {
+    throw new Error('System and SystemDefaults scopes are not supported.');
+  }
+
+  const manager = new ExtensionEnablementManager(
+    ExtensionStorage.getUserExtensionsDir(),
+  );
+  const scopePath = scope === SettingScope.Workspace ? cwd : os.homedir();
+  manager.disable(name, true, scopePath);
+  logExtensionDisable(config, new ExtensionDisableEvent(name, scope));
+}
+
+export function enableExtension(
+  name: string,
+  scope: SettingScope,
+  cwd: string = process.cwd(),
 ) {
   if (scope === SettingScope.System || scope === SettingScope.SystemDefaults) {
     throw new Error('System and SystemDefaults scopes are not supported.');
   }
-  const settings = loadSettings(cwd);
-  const settingsFile = settings.forScope(scope);
-  const extensionSettings = settingsFile.settings.extensions || {
-    disabled: [],
-  };
-  const disabledExtensions = extensionSettings.disabled || [];
-  if (!disabledExtensions.includes(name)) {
-    disabledExtensions.push(name);
-    extensionSettings.disabled = disabledExtensions;
-    settings.setValue(scope, 'extensions', extensionSettings);
-  }
-}
-
-export function enableExtension(name: string, scopes: SettingScope[]) {
-  removeFromDisabledExtensions(name, scopes);
-}
-
-/**
- * Removes an extension from the list of disabled extensions.
- * @param name The name of the extension to remove.
- * @param scope The scopes to remove the name from.
- */
-function removeFromDisabledExtensions(
-  name: string,
-  scopes: SettingScope[],
-  cwd: string = process.cwd(),
-) {
-  const settings = loadSettings(cwd);
-  for (const scope of scopes) {
-    const settingsFile = settings.forScope(scope);
-    const extensionSettings = settingsFile.settings.extensions || {
-      disabled: [],
-    };
-    const disabledExtensions = extensionSettings.disabled || [];
-    extensionSettings.disabled = disabledExtensions.filter(
-      (extension) => extension !== name,
-    );
-    settings.setValue(scope, 'extensions', extensionSettings);
-  }
-}
-
-export async function updateAllUpdatableExtensions(
-  cwd: string = process.cwd(),
-): Promise<ExtensionUpdateInfo[]> {
-  const extensions = loadExtensions(cwd).filter(
-    (extension) => !!extension.installMetadata,
-  );
-  return await Promise.all(
-    extensions.map((extension) => updateExtension(extension, cwd)),
+  const manager = new ExtensionEnablementManager(
+    ExtensionStorage.getUserExtensionsDir(),
   );
+  const scopePath = scope === SettingScope.Workspace ? cwd : os.homedir();
+  manager.enable(name, true, scopePath);
+  const config = getTelemetryConfig(cwd);
+  logExtensionEnable(config, new ExtensionEnableEvent(name, scope));
 }

packages/cli/src/config/extensions/extensionEnablement.test.ts

@@ -0,0 +1,330 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import * as path from 'node:path';
+import fs from 'node:fs';
+import os from 'node:os';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { ExtensionEnablementManager, Override } from './extensionEnablement.js';
+
+// Helper to create a temporary directory for testing
+function createTestDir() {
+  const dirPath = fs.mkdtempSync(path.join(os.tmpdir(), 'gemini-test-'));
+  return {
+    path: dirPath,
+    cleanup: () => fs.rmSync(dirPath, { recursive: true, force: true }),
+  };
+}
+
+let testDir: { path: string; cleanup: () => void };
+let configDir: string;
+let manager: ExtensionEnablementManager;
+
+describe('ExtensionEnablementManager', () => {
+  beforeEach(() => {
+    testDir = createTestDir();
+    configDir = path.join(testDir.path, '.gemini');
+    manager = new ExtensionEnablementManager(configDir);
+  });
+
+  afterEach(() => {
+    testDir.cleanup();
+    // Reset the singleton instance for test isolation
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (ExtensionEnablementManager as any).instance = undefined;
+  });
+
+  describe('isEnabled', () => {
+    it('should return true if extension is not configured', () => {
+      expect(manager.isEnabled('ext-test', '/any/path')).toBe(true);
+    });
+
+    it('should return true if no overrides match', () => {
+      manager.disable('ext-test', false, '/another/path');
+      expect(manager.isEnabled('ext-test', '/any/path')).toBe(true);
+    });
+
+    it('should enable a path based on an override rule', () => {
+      manager.disable('ext-test', true, '/');
+      manager.enable('ext-test', true, '/home/user/projects/');
+      expect(manager.isEnabled('ext-test', '/home/user/projects/my-app')).toBe(
+        true,
+      );
+    });
+
+    it('should disable a path based on a disable override rule', () => {
+      manager.enable('ext-test', true, '/');
+      manager.disable('ext-test', true, '/home/user/projects/');
+      expect(manager.isEnabled('ext-test', '/home/user/projects/my-app')).toBe(
+        false,
+      );
+    });
+
+    it('should respect the last matching rule (enable wins)', () => {
+      manager.disable('ext-test', true, '/home/user/projects/');
+      manager.enable('ext-test', false, '/home/user/projects/my-app');
+      expect(manager.isEnabled('ext-test', '/home/user/projects/my-app')).toBe(
+        true,
+      );
+    });
+
+    it('should respect the last matching rule (disable wins)', () => {
+      manager.enable('ext-test', true, '/home/user/projects/');
+      manager.disable('ext-test', false, '/home/user/projects/my-app');
+      expect(manager.isEnabled('ext-test', '/home/user/projects/my-app')).toBe(
+        false,
+      );
+    });
+
+    it('should handle', () => {
+      manager.enable('ext-test', true, '/home/user/projects');
+      manager.disable('ext-test', false, '/home/user/projects/my-app');
+      expect(manager.isEnabled('ext-test', '/home/user/projects/my-app')).toBe(
+        false,
+      );
+      expect(
+        manager.isEnabled('ext-test', '/home/user/projects/something-else'),
+      ).toBe(true);
+    });
+  });
+
+  describe('includeSubdirs', () => {
+    it('should add a glob when enabling with includeSubdirs', () => {
+      manager.enable('ext-test', true, '/path/to/dir');
+      const config = manager.readConfig();
+      expect(config['ext-test'].overrides).toContain('/path/to/dir/*');
+    });
+
+    it('should not add a glob when enabling without includeSubdirs', () => {
+      manager.enable('ext-test', false, '/path/to/dir');
+      const config = manager.readConfig();
+      expect(config['ext-test'].overrides).toContain('/path/to/dir/');
+      expect(config['ext-test'].overrides).not.toContain('/path/to/dir/*');
+    });
+
+    it('should add a glob when disabling with includeSubdirs', () => {
+      manager.disable('ext-test', true, '/path/to/dir');
+      const config = manager.readConfig();
+      expect(config['ext-test'].overrides).toContain('!/path/to/dir/*');
+    });
+
+    it('should remove conflicting glob rule when enabling without subdirs', () => {
+      manager.enable('ext-test', true, '/path/to/dir'); // Adds /path/to/dir*
+      manager.enable('ext-test', false, '/path/to/dir'); // Should remove the glob
+      const config = manager.readConfig();
+      expect(config['ext-test'].overrides).toContain('/path/to/dir/');
+      expect(config['ext-test'].overrides).not.toContain('/path/to/dir/*');
+    });
+
+    it('should remove conflicting non-glob rule when enabling with subdirs', () => {
+      manager.enable('ext-test', false, '/path/to/dir'); // Adds /path/to/dir
+      manager.enable('ext-test', true, '/path/to/dir'); // Should remove the non-glob
+      const config = manager.readConfig();
+      expect(config['ext-test'].overrides).toContain('/path/to/dir/*');
+      expect(config['ext-test'].overrides).not.toContain('/path/to/dir/');
+    });
+
+    it('should remove conflicting rules when disabling', () => {
+      manager.enable('ext-test', true, '/path/to/dir'); // enabled with glob
+      manager.disable('ext-test', false, '/path/to/dir'); // disabled without
+      const config = manager.readConfig();
+      expect(config['ext-test'].overrides).toContain('!/path/to/dir/');
+      expect(config['ext-test'].overrides).not.toContain('/path/to/dir/*');
+    });
+
+    it('should correctly evaluate isEnabled with subdirs', () => {
+      manager.disable('ext-test', true, '/');
+      manager.enable('ext-test', true, '/path/to/dir');
+      expect(manager.isEnabled('ext-test', '/path/to/dir/')).toBe(true);
+      expect(manager.isEnabled('ext-test', '/path/to/dir/sub/')).toBe(true);
+      expect(manager.isEnabled('ext-test', '/path/to/another/')).toBe(false);
+    });
+
+    it('should correctly evaluate isEnabled without subdirs', () => {
+      manager.disable('ext-test', true, '/*');
+      manager.enable('ext-test', false, '/path/to/dir');
+      expect(manager.isEnabled('ext-test', '/path/to/dir')).toBe(true);
+      expect(manager.isEnabled('ext-test', '/path/to/dir/sub')).toBe(false);
+    });
+  });
+
+  describe('pruning child rules', () => {
+    it('should remove child rules when enabling a parent with subdirs', () => {
+      // Pre-existing rules for children
+      manager.enable('ext-test', false, '/path/to/dir/subdir1');
+      manager.disable('ext-test', true, '/path/to/dir/subdir2');
+      manager.enable('ext-test', false, '/path/to/another/dir');
+
+      // Enable the parent directory
+      manager.enable('ext-test', true, '/path/to/dir');
+
+      const config = manager.readConfig();
+      const overrides = config['ext-test'].overrides;
+
+      // The new parent rule should be present
+      expect(overrides).toContain(`/path/to/dir/*`);
+
+      // Child rules should be removed
+      expect(overrides).not.toContain('/path/to/dir/subdir1/');
+      expect(overrides).not.toContain(`!/path/to/dir/subdir2/*`);
+
+      // Unrelated rules should remain
+      expect(overrides).toContain('/path/to/another/dir/');
+    });
+
+    it('should remove child rules when disabling a parent with subdirs', () => {
+      // Pre-existing rules for children
+      manager.enable('ext-test', false, '/path/to/dir/subdir1');
+      manager.disable('ext-test', true, '/path/to/dir/subdir2');
+      manager.enable('ext-test', false, '/path/to/another/dir');
+
+      // Disable the parent directory
+      manager.disable('ext-test', true, '/path/to/dir');
+
+      const config = manager.readConfig();
+      const overrides = config['ext-test'].overrides;
+
+      // The new parent rule should be present
+      expect(overrides).toContain(`!/path/to/dir/*`);
+
+      // Child rules should be removed
+      expect(overrides).not.toContain('/path/to/dir/subdir1/');
+      expect(overrides).not.toContain(`!/path/to/dir/subdir2/*`);
+
+      // Unrelated rules should remain
+      expect(overrides).toContain('/path/to/another/dir/');
+    });
+
+    it('should not remove child rules if includeSubdirs is false', () => {
+      manager.enable('ext-test', false, '/path/to/dir/subdir1');
+      manager.enable('ext-test', false, '/path/to/dir'); // Not including subdirs
+
+      const config = manager.readConfig();
+      const overrides = config['ext-test'].overrides;
+
+      expect(overrides).toContain('/path/to/dir/subdir1/');
+      expect(overrides).toContain('/path/to/dir/');
+    });
+  });
+
+  it('should enable a path based on an enable override', () => {
+    manager.disable('ext-test', true, '/Users/chrstn');
+    manager.enable('ext-test', true, '/Users/chrstn/gemini-cli');
+
+    expect(manager.isEnabled('ext-test', '/Users/chrstn/gemini-cli')).toBe(
+      true,
+    );
+  });
+
+  it('should ignore subdirs', () => {
+    manager.disable('ext-test', false, '/Users/chrstn');
+    expect(manager.isEnabled('ext-test', '/Users/chrstn/gemini-cli')).toBe(
+      true,
+    );
+  });
+});
+
+describe('Override', () => {
+  it('should create an override from input', () => {
+    const override = Override.fromInput('/path/to/dir', true);
+    expect(override.baseRule).toBe(`/path/to/dir/`);
+    expect(override.isDisable).toBe(false);
+    expect(override.includeSubdirs).toBe(true);
+  });
+
+  it('should create a disable override from input', () => {
+    const override = Override.fromInput('!/path/to/dir', false);
+    expect(override.baseRule).toBe(`/path/to/dir/`);
+    expect(override.isDisable).toBe(true);
+    expect(override.includeSubdirs).toBe(false);
+  });
+
+  it('should create an override from a file rule', () => {
+    const override = Override.fromFileRule('/path/to/dir');
+    expect(override.baseRule).toBe('/path/to/dir');
+    expect(override.isDisable).toBe(false);
+    expect(override.includeSubdirs).toBe(false);
+  });
+
+  it('should create a disable override from a file rule', () => {
+    const override = Override.fromFileRule('!/path/to/dir/');
+    expect(override.isDisable).toBe(true);
+    expect(override.baseRule).toBe('/path/to/dir/');
+    expect(override.includeSubdirs).toBe(false);
+  });
+
+  it('should create an override with subdirs from a file rule', () => {
+    const override = Override.fromFileRule('/path/to/dir/*');
+    expect(override.baseRule).toBe('/path/to/dir/');
+    expect(override.isDisable).toBe(false);
+    expect(override.includeSubdirs).toBe(true);
+  });
+
+  it('should correctly identify conflicting overrides', () => {
+    const override1 = Override.fromInput('/path/to/dir', true);
+    const override2 = Override.fromInput('/path/to/dir', false);
+    expect(override1.conflictsWith(override2)).toBe(true);
+  });
+
+  it('should correctly identify non-conflicting overrides', () => {
+    const override1 = Override.fromInput('/path/to/dir', true);
+    const override2 = Override.fromInput('/path/to/another/dir', true);
+    expect(override1.conflictsWith(override2)).toBe(false);
+  });
+
+  it('should correctly identify equal overrides', () => {
+    const override1 = Override.fromInput('/path/to/dir', true);
+    const override2 = Override.fromInput('/path/to/dir', true);
+    expect(override1.isEqualTo(override2)).toBe(true);
+  });
+
+  it('should correctly identify unequal overrides', () => {
+    const override1 = Override.fromInput('/path/to/dir', true);
+    const override2 = Override.fromInput('!/path/to/dir', true);
+    expect(override1.isEqualTo(override2)).toBe(false);
+  });
+
+  it('should generate the correct regex', () => {
+    const override = Override.fromInput('/path/to/dir', true);
+    const regex = override.asRegex();
+    expect(regex.test('/path/to/dir/')).toBe(true);
+    expect(regex.test('/path/to/dir/subdir')).toBe(true);
+    expect(regex.test('/path/to/another/dir')).toBe(false);
+  });
+
+  it('should correctly identify child overrides', () => {
+    const parent = Override.fromInput('/path/to/dir', true);
+    const child = Override.fromInput('/path/to/dir/subdir', false);
+    expect(child.isChildOf(parent)).toBe(true);
+  });
+
+  it('should correctly identify child overrides with glob', () => {
+    const parent = Override.fromInput('/path/to/dir/*', true);
+    const child = Override.fromInput('/path/to/dir/subdir', false);
+    expect(child.isChildOf(parent)).toBe(true);
+  });
+
+  it('should correctly identify non-child overrides', () => {
+    const parent = Override.fromInput('/path/to/dir', true);
+    const other = Override.fromInput('/path/to/another/dir', false);
+    expect(other.isChildOf(parent)).toBe(false);
+  });
+
+  it('should generate the correct output string', () => {
+    const override = Override.fromInput('/path/to/dir', true);
+    expect(override.output()).toBe(`/path/to/dir/*`);
+  });
+
+  it('should generate the correct output string for a disable override', () => {
+    const override = Override.fromInput('!/path/to/dir', false);
+    expect(override.output()).toBe(`!/path/to/dir/`);
+  });
+
+  it('should disable a path based on a disable override rule', () => {
+    const override = Override.fromInput('!/path/to/dir', false);
+    expect(override.output()).toBe(`!/path/to/dir/`);
+  });
+});