chore(release): v0.55.1

Co-authored-by: David Pierce <davidapierce@google.com>

.github/actions/publish-release/action.yml

@@ -172,7 +172,7 @@ runs:
           --workspace="${INPUTS_CORE_PACKAGE_NAME}" \
           --tag staging-tmp
         if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
-          npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} staging-tmp
+          npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} staging-tmp || echo "Warning: Failed to remove staging-tmp tag (this is normal on registries that forbid tag deletion, like Wombat)"
         fi
 
     - name: '🔗 Install latest core package'
@@ -251,7 +251,7 @@ runs:
           ${PUBLISH_TARGET} \
           --tag staging-tmp
         if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
-          npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} staging-tmp
+          npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} staging-tmp || echo "Warning: Failed to remove staging-tmp tag (this is normal on registries that forbid tag deletion, like Wombat)"
         fi
 
     - name: 'Get a2a-server Token'
@@ -278,9 +278,9 @@ runs:
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_A2A_PACKAGE_NAME}" \
           --tag staging-tmp
-          if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
-            npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} staging-tmp
-          fi
+        if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+          npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} staging-tmp || echo "Warning: Failed to remove staging-tmp tag (this is normal on registries that forbid tag deletion, like Wombat)"
+        fi
 
     - name: '🏷️ Tag release'
       uses: './.github/actions/tag-npm-release'

docs/behavioral-evals.md

@@ -0,0 +1,185 @@
+# Behavioral Evaluations & EDK Guide
+
+This guide introduces the **Eval Development Kit (EDK)** and details how to
+write, validate, run, and report on **behavioral evaluations** in the Gemini CLI
+codebase.
+
+---
+
+## Overview
+
+Behavioral evaluations are automated tests designed to assert on the
+**behavior** of the Gemini CLI agent (e.g., verifying which tools are called,
+checking call ordering, or avoiding destructive commands) rather than checking
+the final prose output.
+
+Evaluating agent behavior is critical because:
+
+1. Model responses are non-deterministic, making exact prose matching highly
+   fragile.
+2. We must ensure the model utilizes the most efficient tools (e.g., batching
+   files via `read_many_files` instead of sequential `read_file` calls).
+3. We must enforce safety boundaries (e.g., preventing execution of raw shell
+   commands when safe alternatives exist).
+
+All behavioral evaluations are stored under the `evals/` directory.
+
+---
+
+## EDK Developer Commands
+
+The EDK provides CLI tools under `scripts/` to help contributors audit, check,
+and monitor evals.
+
+### 1. `npm run eval:inventory`
+
+Scans all eval files under `evals/`, statically parses them, and provides a
+structured overview of what exists in the repository.
+
+- **Usage:**
+  ```bash
+  npm run eval:inventory
+  ```
+- **JSON Output:** For CI integration or inventory indexing, generate a
+  machine-readable JSON report:
+  ```bash
+  npm run eval:inventory -- --json
+  ```
+- **Custom Root:** Run against another directory or repository:
+  ```bash
+  npm run eval:inventory -- --root /path/to/other/repo
+  ```
+
+---
+
+### 2. `npm run eval:validate`
+
+A lint-like checker that validates eval source files against standard structural
+guidelines and best practices.
+
+- **Usage:**
+  ```bash
+  npm run eval:validate
+  ```
+- **Custom Scopes:** Validate a specific file:
+  ```bash
+  npm run eval:validate -- evals/my-test.eval.ts
+  ```
+
+#### Validation Rules & Severities
+
+| Rule ID              | Severity    | Description                                                                                                            |
+| :------------------- | :---------- | :--------------------------------------------------------------------------------------------------------------------- |
+| `file-naming`        | **Error**   | File must match `*.eval.ts` or `*.eval.tsx` naming conventions.                                                        |
+| `valid-policy`       | **Error**   | Policy must be one of `ALWAYS_PASSES`, `USUALLY_PASSES`, or `USUALLY_FAILS`.                                           |
+| `suite-metadata`     | **Error**   | Both `suiteName` and `suiteType` must be present as static string literals.                                            |
+| `prompt-presence`    | **Error**   | Every eval case must have a non-empty `prompt` string.                                                                 |
+| `case-name-static`   | **Error**   | The case name must be a static string literal, not computed dynamically.                                               |
+| `invalid-tool-refs`  | **Error**   | All tools referenced in assertions must match known built-in or legacy tools.                                          |
+| `positive-assertion` | **Error**   | Evaluation cases must assert on at least one tool call (e.g., check `waitForToolCall` has been invoked).               |
+| `workspace-setup`    | **Error**   | Workspace behaviors (like file-system edits/reads) must set up a `files` object.                                       |
+| `new-evals-policy`   | **Warning** | New evals must not use `ALWAYS_PASSES` policy initially (they should be promoted after nightly data proves stability). |
+
+Warnings (`new-evals-policy`) will be logged with `⚠` and will **not** cause
+the CLI process to exit with status `1`. Errors (`✗`) will block CI builds and
+return exit status `1`.
+
+---
+
+### 3. `npm run eval:report`
+
+Aggregates local vitest `report.json` artifacts, maps them against inventory
+policies, and summarizes the pass rates per model.
+
+- **Usage:**
+  ```bash
+  npm run eval:report
+  ```
+  By default, it scans `evals/logs/` recursively for `report.json` files.
+- **Specifying Directory:**
+  ```bash
+  npm run eval:report -- /path/to/logs
+  ```
+- **JSON Output:**
+  ```bash
+  npm run eval:report -- --json
+  ```
+
+---
+
+## Contributor Workflow
+
+When writing a new behavioral evaluation, adhere to this workflow to ensure
+high-quality, non-flaky test runs.
+
+### Step-by-Step Guide
+
+1. **Identify the Target Behavior**: Determine which tool calls need
+   verification (e.g., `web_fetch` must be called).
+2. **Author the Eval File**: Create your file under `evals/<name>.eval.ts`
+   naming it properly.
+3. **Configure Workspace Files**: If the eval reads or edits files, define them
+   inside the `files` metadata field.
+4. **Assert Behavior, Not Prose**: Ensure the `assert` block checks tool
+   interactions using `rig.waitForToolCall` or similar. Do not check final
+   prose.
+5. **Run Locally**:
+   ```bash
+   RUN_EVALS=true npx vitest run evals/my-test.eval.ts
+   ```
+6. **Deflake**: Run your eval at least 3 times locally to verify it does not
+   fail due to model variance.
+7. **Run Validation**: Run `npm run eval:validate` to ensure no linting errors
+   are present.
+
+### Acceptance Criteria Checklist
+
+- [ ] **Naming**: File ends with `.eval.ts` or `.eval.tsx`.
+- [ ] **Policy**: New evals start as `USUALLY_PASSES`.
+- [ ] **Metadata**: Static `suiteName` and `suiteType` (e.g. `'behavioral'`) are
+      specified.
+- [ ] **Assertions**: Uses `rig.waitForToolCall` or asserts tool arguments
+      explicitly.
+- [ ] **Clean workspace**: Does not write to files outside `rig.testDir`.
+
+### Common Anti-Patterns to Avoid
+
+- **Restricting core tools**: Never override `settings.tools.core` to limit
+  tools. Evals must run against the default toolset.
+- **Checking model prose**: Avoid `expect(result).toContain('something')` since
+  model wording is non-deterministic.
+- **Integration-only testing**: Evals that only write files without checking
+  realistic model prompts are integration tests and belong under
+  `integration-tests/`.
+
+---
+
+## CI & Dashboard Integration
+
+You can easily automate behavioral evaluations or compile dashboard data using
+EDK's JSON reporters.
+
+### CI Validation Block
+
+Add a step in your PR checks or GitHub workflows to automatically lint new evals
+and block pull requests containing validation errors:
+
+```yaml
+- name: Run Eval Validator
+  run: npm run eval:validate
+```
+
+### Publishing to a Dashboard
+
+To record nightly performance metrics across multiple models:
+
+1. Configure your workflow to run evaluations with the JSON reporter:
+   ```bash
+   cross-env GEMINI_MODEL=gemini-2.5-pro npx vitest run --config evals/vitest.config.ts --reporter=json --outputFile="evals/logs/eval-logs-gemini-2.5-pro/report.json"
+   ```
+2. Aggregate all test runs using the reporting tool:
+   ```bash
+   npm run eval:report -- evals/logs --json > aggregated_report.json
+   ```
+3. Upload `aggregated_report.json` to your dashboard storage backend to
+   visualize pass rates over time.

docs/changelogs/index.md

@@ -18,6 +18,61 @@ on GitHub.
 | [Preview](preview.md) | Experimental features ready for early feedback. |
 | [Stable](latest.md)   | Stable, recommended for general use.            |
 
+## Announcements: v0.54.0 - 2026-08-06
+
+- **PR Automation & Antigravity Agent:** Integrated the Antigravity agent runner
+  with dual-locking Firestore concurrency controls to secure the PR generator
+  ([#28434](https://github.com/google-gemini/gemini-cli/pull/28434),
+  [#28432](https://github.com/google-gemini/gemini-cli/pull/28432) by
+  @joneba-google).
+- **Caretaker Triaging & Security:** Enhanced caretaker triage to post comments
+  prior to auto-closing issues and sanitized issue titles under untrusted
+  context ([#28411](https://github.com/google-gemini/gemini-cli/pull/28411),
+  [#28352](https://github.com/google-gemini/gemini-cli/pull/28352) by @chadd28).
+- **Security and Session Robustness:** Prevented cleartext credential leakage by
+  enforcing HTTPS, rotated session IDs on model fallbacks, and skipped merged
+  function-response turns in active loops
+  ([#28517](https://github.com/google-gemini/gemini-cli/pull/28517) by
+  @amelidev, [#28565](https://github.com/google-gemini/gemini-cli/pull/28565) by
+  @adamfweidman).
+
+## Announcements: v0.53.0 - 2026-07-28
+
+- **Caretaker Triage Orchestration:** Implemented an LLM triage orchestrator and
+  container build setup
+  ([#28345](https://github.com/google-gemini/gemini-cli/pull/28345) by
+  @chadd28).
+- **Eval Coverage Reporting:** Introduced a new command for generating
+  evaluation coverage reports
+  ([#28169](https://github.com/google-gemini/gemini-cli/pull/28169) by @ved015).
+- **Security & Loop Mitigations:** Enforced workspace trust and task isolation
+  in the A2A server, aligned macOS Seatbelt profiles with the deny-default
+  model, and mitigated infinite ReAct/prompt injection loops
+  ([#28470](https://github.com/google-gemini/gemini-cli/pull/28470) by
+  @luisfelipe-alt,
+  [#28424](https://github.com/google-gemini/gemini-cli/pull/28424) by
+  @ompatel-aiml).
+
+## Announcements: v0.52.0 - 2026-07-22
+
+- **Caretaker Triage & Egress Services:** Implemented the core triage worker
+  foundational modules, main worker execution loops, and egress action
+  publishers alongside the octokit GitHub Action handler for egress services
+  ([#28163](https://github.com/google-gemini/gemini-cli/pull/28163),
+  [#28306](https://github.com/google-gemini/gemini-cli/pull/28306) by @chadd28).
+- **Core Tool Enhancements:** Bypassed LLM correction for JSON and IPYNB files
+  in `write_file` and `replace` tools, and simplified plan mode write policy to
+  support relative paths
+  ([#28223](https://github.com/google-gemini/gemini-cli/pull/28223) by
+  @amelidev, [#28398](https://github.com/google-gemini/gemini-cli/pull/28398) by
+  @DavidAPierce).
+- **Auth & Privacy Improvements:** Displayed clear error messages when user
+  account has no Code Assist tier, and bumped `google-auth-library` to version
+  10.9.0 ([#28304](https://github.com/google-gemini/gemini-cli/pull/28304) by
+  @ompatel-aiml,
+  [#28385](https://github.com/google-gemini/gemini-cli/pull/28385) by
+  @jerrylin3321).
+
 ## Announcements: v0.50.0 - 2026-07-08
 
 - **Tool Registry Discovery:** Introduced tool registry discovery capabilities

docs/changelogs/latest.md

@@ -1,6 +1,6 @@
-# Latest stable release: v0.50.0
+# Latest stable release: v0.54.0
 
-Released: July 08, 2026
+Released: August 6, 2026
 
 For most users, our latest stable release is the recommended release. Install
 the latest stable version with:
@@ -11,24 +11,66 @@ npm install -g @google/gemini-cli
 
 ## Highlights
 
-- **Tool Registry Discovery:** Introduced tool registry discovery capabilities,
-  enabling automatic detection and registration of tools to improve
-  extensibility.
-- **Release Verification Improvements:** Enhanced release verification by
-  ignoring scripts during `npm ci` and preventing workspace binary shadowing.
-- **CI Pipeline Safeguards:** Strengthened the CI pipeline to prevent bad NPM
-  releases and ensure promote job failures are correctly surfaced.
+- **PR Generation & Antigravity Agent:** Implemented Firestore concurrency
+  dual-locking mechanisms in the database and introduced the Antigravity agent
+  runner with comprehensive prompt templates.
+- **Caretaker Triaging & Issue Security:** Improved the caretaker triage loop to
+  post a descriptive comment prior to auto-closing issues, and sanitized issue
+  titles within an untrusted context to ensure secure processing.
+- **Enhanced Authentication & Security:** Enforced strict HTTPS validation for
+  GoogleCredentialsAuthProvider to block cleartext leakage, and implemented tag
+  length validation for the file keychain system.
+- **Model Fallback & History Filtering:** Resolved stateful API errors by
+  rotating session IDs on model fallback, optimized conversation history
+  retrieval by filtering out thought parts when context management is disabled,
+  and correctly skipped merged function responses when tracking active loops.
 
 ## What's Changed
 
-- fix/verify release npm ci ignore scripts by @rmedranollamas in
-  [#28116](https://github.com/google-gemini/gemini-cli/pull/28116)
-- fix(ci): prevent workspace binary shadowing in release verification by
-  @galdawave in [#28132](https://github.com/google-gemini/gemini-cli/pull/28132)
-- Feat/tool registry discovery by @ved015 in
-  [#28113](https://github.com/google-gemini/gemini-cli/pull/28113)
-- fix(ci): prevent bad NPM releases and promote job crashes by @galdawave in
-  [#28147](https://github.com/google-gemini/gemini-cli/pull/28147)
+- Changelog for v0.53.0-preview.0 by @gemini-cli-robot in
+  [#28507](https://github.com/google-gemini/gemini-cli/pull/28507)
+- Changelog for v0.52.0 by @gemini-cli-robot in
+  [#28508](https://github.com/google-gemini/gemini-cli/pull/28508)
+- chore(release): bump version to 0.54.0-nightly.20260722.gf743ab579 by
+  @gemini-cli-robot in
+  [#28510](https://github.com/google-gemini/gemini-cli/pull/28510)
+- fix(caretaker): sanitize and wrap issue title in untrusted_context by @chadd28
+  in [#28352](https://github.com/google-gemini/gemini-cli/pull/28352)
+- chore(caretaker): update vitest to v3.2.4 and add package-lock.json files by
+  @chadd28 in [#28409](https://github.com/google-gemini/gemini-cli/pull/28409)
+- fix(core): rotate session ID on model fallback to prevent stateful API errors
+  by @amelidev in
+  [#28469](https://github.com/google-gemini/gemini-cli/pull/28469)
+- feat(caretaker-triage): post comment before auto-closing issues by @chadd28 in
+  [#28411](https://github.com/google-gemini/gemini-cli/pull/28411)
+- fix(core): enforce HTTPS for GoogleCredentialsAuthProvider to prevent
+  cleartext leakage by @amelidev in
+  [#28517](https://github.com/google-gemini/gemini-cli/pull/28517)
+- fix(core): filter out thought parts from getHistoryTurns when context
+  management is disabled by @DavidAPierce in
+  [#28509](https://github.com/google-gemini/gemini-cli/pull/28509)
+- fix(a2a-server): normalize CRLF line endings to LF in getProposedContent by
+  @luisfelipe-alt in
+  [#28531](https://github.com/google-gemini/gemini-cli/pull/28531)
+- fix(core): enforce explicit tag length and validation in file keychain by
+  @luisfelipe-alt in
+  [#28523](https://github.com/google-gemini/gemini-cli/pull/28523)
+- chore/release: bump version to 0.54.0-nightly.20260728.gbef611950 by
+  @gemini-cli-robot in
+  [#28552](https://github.com/google-gemini/gemini-cli/pull/28552)
+- feat(pr-generator-db): implement Firestore concurrency dual-locking and test
+  ingestion utilities by @joneba-google in
+  [#28432](https://github.com/google-gemini/gemini-cli/pull/28432)
+- feat(pr-generator-agent): implement Antigravity agent runner and prompt
+  templates … by @joneba-google in
+  [#28434](https://github.com/google-gemini/gemini-cli/pull/28434)
+- fix(core): skip merged function-response turns when finding the active loop by
+  @adamfweidman in
+  [#28565](https://github.com/google-gemini/gemini-cli/pull/28565)
+- fix(patch): cherry-pick f47d6c6 to release/v0.54.0-preview.0-pr-28566 to patch
+  version v0.54.0-preview.0 and create version 0.54.0-preview.1 by
+  @gemini-cli-robot in
+  [#28609](https://github.com/google-gemini/gemini-cli/pull/28609)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.49.0...v0.50.0
+https://github.com/google-gemini/gemini-cli/compare/v0.53.1...v0.54.0

docs/changelogs/preview.md

@@ -1,6 +1,6 @@
-# Preview release: v0.51.0-preview.0
+# Preview release: v0.55.0-preview.1
 
-Released: July 8, 2026
+Released: August 06, 2026
 
 Our preview release includes the latest, new, and experimental features. This
 release may not be as stable as our [latest weekly release](latest.md).
@@ -13,53 +13,101 @@ npm install -g @google/gemini-cli@preview
 
 ## Highlights
 
-- **Caretaker Cloud Run Services**: Implemented a Cloud Run webhook ingestion
-  service and egress service skeleton to support advanced caretaker features.
-- **Enhanced Security & Sandbox Hardening**: Enforced a case-insensitive
-  sensitive path blocklist and VS Code human-in-the-loop (HITL) checks, resolved
-  a directory escape vulnerability in the memory import processor, and marked
-  `~/.gitconfig` as read-only within the macOS sandbox.
-- **Improved Thought Leakage and Escape Handling**: Resolved potential thought
-  leakage by stripping thinking/thought processes from scrubbed history turns,
-  and ensured escape sequences in string literals are correctly preserved for
-  modern models.
-- **Robust Path & API Updates**: Enhanced defensive path resolution for
-  at-reference files, and updated the Vertex AI base URL configuration to
-  support the latest API updates.
+- **Antigravity Agent & PR Generator:** Integrated the Antigravity agent runner,
+  Firestore dual-locking for concurrency, prompt templates, and ingestion
+  testing utilities.
+- **Caretaker Triage & Issue Management:** Enhanced the issue triage workflow by
+  automatically posting a comment before closing issues, and sanitizing and
+  wrapping issue titles in `untrusted_context`.
+- **Core API & Session Stability:** Enforced HTTPS for
+  GoogleCredentialsAuthProvider to prevent cleartext leakage, rotated session
+  IDs on model fallback to prevent stateful API errors, and refined chat history
+  by filtering out thought parts when context management is disabled.
 
 ## What's Changed
 
-- Changelog for v0.50.0-preview.1 by @gemini-cli-robot in
-  [#28150](https://github.com/google-gemini/gemini-cli/pull/28150)
-- Fix no_proxy test by @jerrylin3321 in
-  [#28131](https://github.com/google-gemini/gemini-cli/pull/28131)
-- chore(release): bump version to 0.51.0-nightly.20260625.g3fbf93e26 by
+- chore(release): bump version to 0.55.0-nightly.20260728.gd29268d36 by
   @gemini-cli-robot in
-  [#28151](https://github.com/google-gemini/gemini-cli/pull/28151)
-- Vertex base url update by @DavidAPierce in
-  [#28145](https://github.com/google-gemini/gemini-cli/pull/28145)
-- fix(security): enforce case-insensitive sensitive path blocklist and vscode
-  hitl by @luisfelipe-alt in
-  [#27966](https://github.com/google-gemini/gemini-cli/pull/27966)
-- fix(core-tools): resolve defensive path resolution for at-reference files and
-  fix macOS tests by @luisfelipe-alt in
-  [#28053](https://github.com/google-gemini/gemini-cli/pull/28053)
-- feat(caretaker): implement Cloud Run webhook ingestion service by @chadd28 in
-  [#28015](https://github.com/google-gemini/gemini-cli/pull/28015)
-- fix(core): resolve symbolic link directory escape in memory import processor
-  by @luisfelipe-alt in
-  [#28233](https://github.com/google-gemini/gemini-cli/pull/28233)
-- feat(caretaker): egress cloud run service skeleton by @chadd28 in
-  [#28167](https://github.com/google-gemini/gemini-cli/pull/28167)
-- fix(sandbox): make ~/.gitconfig read-only in the macOS sandbox by
-  @ompatel-aiml in
-  [#28221](https://github.com/google-gemini/gemini-cli/pull/28221)
-- fix(core): preserve escape sequences in string literals for modern models by
+  [#28569](https://github.com/google-gemini/gemini-cli/pull/28569)
+- Changelog for v0.54.0-preview.0 by @gemini-cli-robot in
+  [#28567](https://github.com/google-gemini/gemini-cli/pull/28567)
+- Changelog for v0.53.0 by @gemini-cli-robot in
+  [#28568](https://github.com/google-gemini/gemini-cli/pull/28568)
+- chore/release: bump version to 0.55.0-nightly.20260729.g3499c84f7 by
+  @gemini-cli-robot in
+  [#28573](https://github.com/google-gemini/gemini-cli/pull/28573)
+- fix(core): classify capacity exhaustion as terminal to prevent retry hangs by
   @luisfelipe-alt in
-  [#28299](https://github.com/google-gemini/gemini-cli/pull/28299)
-- fix(core): strip thoughts from scrubbed history turns and resolve thought
-  leakage by @amelidev in
-  [#27971](https://github.com/google-gemini/gemini-cli/pull/27971)
+  [#28599](https://github.com/google-gemini/gemini-cli/pull/28599)
+- fix(core,cli): propagate InvalidStreamError details to UI for specific empty
+  response guidance by @DavidAPierce in
+  [#28566](https://github.com/google-gemini/gemini-cli/pull/28566)
+- fix(cli): fall back to embedded macOS seatbelt profiles if missing by
+  @amelidev in [#28551](https://github.com/google-gemini/gemini-cli/pull/28551)
+- feat(pr-generator-core): add environment config parser, command executor,
+  GitHub R… by @joneba-google in
+  [#28435](https://github.com/google-gemini/gemini-cli/pull/28435)
+- feat(pr-generator-orchestrator): implement iterative bug-fixing state machine
+  and container worker entrypoint by @joneba-google in
+  [#28433](https://github.com/google-gemini/gemini-cli/pull/28433)
+- feat(pr-generator-infra): configure Cloud Run job, Workflows definition, and
+  Dockerfile by @joneba-google in
+  [#28431](https://github.com/google-gemini/gemini-cli/pull/28431)
+- fix(release): handle npm dist-tag deletion failures on registries that forbid
+  it by @DavidAPierce in
+  [#28694](https://github.com/google-gemini/gemini-cli/pull/28694)
+- fix(core): stop a new user message fusing into an unanswered tool response by
+  @adamfweidman in
+  [#28700](https://github.com/google-gemini/gemini-cli/pull/28700)
+- fix(core,cli): repair /compress session reload and quota-fallback tool
+  response loss by @adamfweidman in
+  [#28672](https://github.com/google-gemini/gemini-cli/pull/28672)
+- fix(core): preserve functionCall thoughtSignature when stripping thought parts
+  by @sarbojitrana in
+  [#28607](https://github.com/google-gemini/gemini-cli/pull/28607)
+- fix(core): unwrap and parse nested gaxios streaming errors from cause message
+  by @luisfelipe-alt in
+  [#28689](https://github.com/google-gemini/gemini-cli/pull/28689)
+- Changelog for v0.53.0-preview.0 by @gemini-cli-robot in
+  [#28507](https://github.com/google-gemini/gemini-cli/pull/28507)
+- Changelog for v0.52.0 by @gemini-cli-robot in
+  [#28508](https://github.com/google-gemini/gemini-cli/pull/28508)
+- chore(release): bump version to 0.54.0-nightly.20260722.gf743ab579 by
+  @gemini-cli-robot in
+  [#28510](https://github.com/google-gemini/gemini-cli/pull/28510)
+- fix(caretaker): sanitize and wrap issue title in untrusted_context by @chadd28
+  in [#28352](https://github.com/google-gemini/gemini-cli/pull/28352)
+- chore(caretaker): update vitest to v3.2.4 and add package-lock.json files by
+  @chadd28 in [#28409](https://github.com/google-gemini/gemini-cli/pull/28409)
+- fix(core): rotate session ID on model fallback to prevent stateful API errors
+  by @amelidev in
+  [#28469](https://github.com/google-gemini/gemini-cli/pull/28469)
+- feat(caretaker-triage): post comment before auto-closing issues by @chadd28 in
+  [#28411](https://github.com/google-gemini/gemini-cli/pull/28411)
+- fix(core): enforce HTTPS for GoogleCredentialsAuthProvider to prevent
+  cleartext leakage by @amelidev in
+  [#28517](https://github.com/google-gemini/gemini-cli/pull/28517)
+- fix(core): filter out thought parts from getHistoryTurns when context
+  management is disabled by @DavidAPierce in
+  [#28509](https://github.com/google-gemini/gemini-cli/pull/28509)
+- fix(a2a-server): normalize CRLF line endings to LF in getProposedContent by
+  @luisfelipe-alt in
+  [#28531](https://github.com/google-gemini/gemini-cli/pull/28531)
+- fix(core): enforce explicit tag length and validation in file keychain by
+  @luisfelipe-alt in
+  [#28523](https://github.com/google-gemini/gemini-cli/pull/28523)
+- chore/release: bump version to 0.54.0-nightly.20260728.gbef611950 by
+  @gemini-cli-robot in
+  [#28552](https://github.com/google-gemini/gemini-cli/pull/28552)
+- feat(pr-generator-db): implement Firestore concurrency dual-locking and test
+  ingestion utilities by @joneba-google in
+  [#28432](https://github.com/google-gemini/gemini-cli/pull/28432)
+- feat(pr-generator-agent): implement Antigravity agent runner and prompt
+  templates … by @joneba-google in
+  [#28434](https://github.com/google-gemini/gemini-cli/pull/28434)
+- fix(core): skip merged function-response turns when finding the active loop by
+  @adamfweidman in
+  [#28565](https://github.com/google-gemini/gemini-cli/pull/28565)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.50.0-preview.1...v0.51.0-preview.0
+https://github.com/google-gemini/gemini-cli/compare/v0.53.0-preview.0...v0.55.0-preview.1

docs/sidebar.json

@@ -217,6 +217,10 @@
       {
         "label": "Development",
         "items": [
+          {
+            "label": "Behavioral evaluations",
+            "slug": "docs/behavioral-evals"
+          },
           { "label": "Contribution guide", "slug": "docs/contributing" },
           { "label": "Integration testing", "slug": "docs/integration-tests" },
           {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.52.0-nightly.20260715.gfa975395b",
+  "version": "0.55.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@google/gemini-cli",
-      "version": "0.52.0-nightly.20260715.gfa975395b",
+      "version": "0.55.1",
       "workspaces": [
         "packages/*"
       ],
@@ -17782,7 +17782,7 @@
     },
     "packages/a2a-server": {
       "name": "@google/gemini-cli-a2a-server",
-      "version": "0.52.0-nightly.20260715.gfa975395b",
+      "version": "0.55.1",
       "dependencies": {
         "@a2a-js/sdk": "0.3.11",
         "@google-cloud/storage": "7.19.0",
@@ -18242,7 +18242,7 @@
     },
     "packages/cli": {
       "name": "@google/gemini-cli",
-      "version": "0.52.0-nightly.20260715.gfa975395b",
+      "version": "0.55.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "0.16.1",
@@ -18458,7 +18458,7 @@
     },
     "packages/core": {
       "name": "@google/gemini-cli-core",
-      "version": "0.52.0-nightly.20260715.gfa975395b",
+      "version": "0.55.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@a2a-js/sdk": "0.3.11",
@@ -19131,7 +19131,7 @@
     },
     "packages/devtools": {
       "name": "@google/gemini-cli-devtools",
-      "version": "0.52.0-nightly.20260715.gfa975395b",
+      "version": "0.55.1",
       "license": "Apache-2.0",
       "dependencies": {
         "ws": "8.16.0"
@@ -19167,7 +19167,7 @@
     },
     "packages/sdk": {
       "name": "@google/gemini-cli-sdk",
-      "version": "0.52.0-nightly.20260715.gfa975395b",
+      "version": "0.55.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@google/gemini-cli-core": "file:../core",
@@ -19506,7 +19506,7 @@
     },
     "packages/test-utils": {
       "name": "@google/gemini-cli-test-utils",
-      "version": "0.52.0-nightly.20260715.gfa975395b",
+      "version": "0.55.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@google/gemini-cli-core": "file:../core",
@@ -19524,7 +19524,7 @@
     },
     "packages/vscode-ide-companion": {
       "name": "gemini-cli-vscode-ide-companion",
-      "version": "0.52.0-nightly.20260715.gfa975395b",
+      "version": "0.55.1",
       "license": "LICENSE",
       "dependencies": {
         "@modelcontextprotocol/sdk": "1.23.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.52.0-nightly.20260715.gfa975395b",
+  "version": "0.55.1",
   "engines": {
     "node": ">=20.0.0"
   },
@@ -14,7 +14,7 @@
     "url": "git+https://github.com/google-gemini/gemini-cli.git"
   },
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.52.0-nightly.20260715.gfa975395b"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.55.1"
   },
   "scripts": {
     "start": "cross-env NODE_ENV=development node scripts/start.js",
@@ -34,6 +34,7 @@
     "docs:keybindings": "tsx ./scripts/generate-keybindings-doc.ts",
     "eval:inventory": "tsx ./scripts/eval-inventory-cli.ts",
     "eval:inventory:json": "tsx ./scripts/eval-inventory-cli.ts --json",
+    "eval:report": "tsx ./scripts/eval-report-cli.ts",
     "eval:coverage": "tsx ./scripts/eval-coverage-cli.ts",
     "build": "node scripts/build.js",
     "build-and-start": "npm run build && npm run start --",

packages/a2a-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-a2a-server",
-  "version": "0.52.0-nightly.20260715.gfa975395b",
+  "version": "0.55.1",
   "description": "Gemini CLI A2A Server",
   "repository": {
     "type": "git",

packages/a2a-server/src/agent/task.test.ts

@@ -752,4 +752,107 @@ describe('Task', () => {
       expect(changed3).toBe(true);
     });
   });
+
+  describe('getProposedContent (CRLF Line Ending Normalization)', () => {
+    it('should successfully replace LF-based strings in CRLF-based files', async () => {
+      const fs = await import('node:fs');
+      const path = await import('node:path');
+      const os = await import('node:os');
+
+      const mockConfig = createMockConfig({
+        getTargetDir: () => os.tmpdir(),
+        validatePathAccess: () => null,
+      });
+      const mockEventBus: ExecutionEventBus = {
+        publish: vi.fn(),
+        on: vi.fn(),
+        off: vi.fn(),
+        once: vi.fn(),
+        removeAllListeners: vi.fn(),
+        finished: vi.fn(),
+      };
+
+      // @ts-expect-error - Calling private constructor
+      const task = new Task(
+        'task-id',
+        'context-id',
+        mockConfig as Config,
+        mockEventBus,
+      );
+
+      const tempFile = path.resolve(os.tmpdir(), 'crlf_test_file.txt');
+      const crlfContent = 'line1\r\nline2\r\nline3\r\n';
+      fs.writeFileSync(tempFile, crlfContent, 'utf8');
+
+      try {
+        const oldString = 'line2\n';
+        const newString = 'line2-optimized\n';
+
+        const result = await task['getProposedContent'](
+          tempFile,
+          oldString,
+          newString,
+        );
+
+        expect(result).toContain('line2-optimized');
+        expect(result).toContain('\r\n'); // It should preserve the original CRLF line endings
+      } finally {
+        if (fs.existsSync(tempFile)) {
+          fs.unlinkSync(tempFile);
+        }
+      }
+    });
+
+    it('should successfully replace CRLF-based strings in CRLF-based files by normalizing all to LF', async () => {
+      const fs = await import('node:fs');
+      const path = await import('node:path');
+      const os = await import('node:os');
+
+      const mockConfig = createMockConfig({
+        getTargetDir: () => os.tmpdir(),
+        validatePathAccess: () => null,
+      });
+      const mockEventBus: ExecutionEventBus = {
+        publish: vi.fn(),
+        on: vi.fn(),
+        off: vi.fn(),
+        once: vi.fn(),
+        removeAllListeners: vi.fn(),
+        finished: vi.fn(),
+      };
+
+      // @ts-expect-error - Calling private constructor
+      const task = new Task(
+        'task-id',
+        'context-id',
+        mockConfig as Config,
+        mockEventBus,
+      );
+
+      const tempFile = path.resolve(
+        os.tmpdir(),
+        'crlf_test_file_crlf_inputs.txt',
+      );
+      const crlfContent = 'line1\r\nline2\r\nline3\r\n';
+      fs.writeFileSync(tempFile, crlfContent, 'utf8');
+
+      try {
+        const oldString = 'line2\r\n';
+        const newString = 'line2-optimized\r\n';
+
+        const result = await task['getProposedContent'](
+          tempFile,
+          oldString,
+          newString,
+        );
+
+        expect(result).toContain('line2-optimized');
+        expect(result).toContain('\r\n'); // It should preserve the original CRLF line endings
+      } finally {
+        if (fs.existsSync(tempFile)) {
+          fs.unlinkSync(tempFile);
+        }
+      }
+    });
+  });
 });

packages/a2a-server/src/agent/task.ts

@@ -131,9 +131,11 @@ export class Task {
     this.autoExecute = autoExecute;
     this.config.setFallbackModelHandler(
       // For a2a-server, we want to automatically switch to the fallback model
-      // for future requests without retrying the current one. The 'stop'
-      // intent achieves this.
-      async () => 'stop',
+      // for future requests without retrying the current one.
+      async (failedModel, fallbackModel) => {
+        this.config.activateFallbackMode(fallbackModel, failedModel);
+        return 'stop';
+      },
     );
   }
 
@@ -666,13 +668,18 @@ export class Task {
     }
 
     try {
-      const currentContent = await fs.readFile(resolvedPath, 'utf8');
-      return this._applyReplacement(
+      const rawContent = await fs.readFile(resolvedPath, 'utf8');
+      const hasCrlf = rawContent.includes('\r\n');
+      const currentContent = rawContent.replace(/\r\n/g, '\n');
+      const normalizedOldString = old_string.replace(/\r\n/g, '\n');
+      const normalizedNewString = new_string.replace(/\r\n/g, '\n');
+      const proposedContent = this._applyReplacement(
         currentContent,
-        old_string,
-        new_string,
-        old_string === '' && currentContent === '',
+        normalizedOldString,
+        normalizedNewString,
+        normalizedOldString === '' && currentContent === '',
       );
+      return hasCrlf ? proposedContent.replace(/\n/g, '\r\n') : proposedContent;
     } catch (err) {
       if (!isNodeError(err) || err.code !== 'ENOENT') throw err;
       return '';

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.52.0-nightly.20260715.gfa975395b",
+  "version": "0.55.1",
   "description": "Gemini CLI",
   "license": "Apache-2.0",
   "repository": {
@@ -27,7 +27,7 @@
     "dist"
   ],
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.52.0-nightly.20260715.gfa975395b"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.55.1"
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "0.16.1",

packages/cli/src/acp/acpSession.test.ts

@@ -319,6 +319,41 @@ describe('Session', () => {
     expect(result).toMatchObject({ stopReason: 'end_turn' });
   });
 
+  it.each([
+    { type: 'MAX_TOKENS_EXCEEDED', reason: 'MAX_TOKENS' },
+    { type: 'SAFETY_BLOCKED', reason: 'SAFETY' },
+    { type: 'RECITATION_BLOCKED', reason: 'RECITATION' },
+    { type: 'OTHER_BLOCKED', reason: 'OTHER' },
+    { type: 'THINKING_ONLY_RESPONSE', reason: 'STOP' },
+  ])(
+    'should gracefully handle InvalidStreamError with type $type in ACP session',
+    async ({ type, reason }) => {
+      const error = new InvalidStreamError(
+        `Stream failed with ${reason}`,
+        type as InvalidStreamError['type'],
+      );
+      mockSendMessageStream.mockImplementation(() => {
+        async function* errorGen(): AsyncGenerator<
+          ServerGeminiStreamEvent,
+          void,
+          unknown
+        > {
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          yield* [] as any;
+          throw error;
+        }
+        return errorGen();
+      });
+
+      const result = await session.prompt({
+        sessionId: 'session-1',
+        prompt: [{ type: 'text', text: 'Hi' }],
+      });
+
+      expect(result).toMatchObject({ stopReason: 'end_turn' });
+    },
+  );
+
   it('should handle /memory command', async () => {
     const handleCommandSpy = vi
       .spyOn(

packages/cli/src/acp/acpSession.ts

@@ -510,7 +510,12 @@ export class Session {
             (error.type === 'NO_RESPONSE_TEXT' ||
               error.type === 'NO_FINISH_REASON' ||
               error.type === 'MALFORMED_FUNCTION_CALL' ||
-              error.type === 'UNEXPECTED_TOOL_CALL'))
+              error.type === 'UNEXPECTED_TOOL_CALL' ||
+              error.type === 'MAX_TOKENS_EXCEEDED' ||
+              error.type === 'SAFETY_BLOCKED' ||
+              error.type === 'RECITATION_BLOCKED' ||
+              error.type === 'OTHER_BLOCKED' ||
+              error.type === 'THINKING_ONLY_RESPONSE'))
         ) {
           // The stream ended with an empty response or malformed tool call.
           // Treat this as a graceful end to the model's turn rather than a crash.

packages/cli/src/commands/extensions/install.test.ts

@@ -103,7 +103,10 @@ vi.mock('../utils.js', () => ({
 
 describe('extensions install command', () => {
   it('should fail if no source is provided', () => {
-    const validationParser = yargs([]).command(installCommand).fail(false);
+    const validationParser = yargs([])
+      .locale('en')
+      .command(installCommand)
+      .fail(false);
     expect(() => validationParser.parse('install')).toThrow(
       'Not enough non-option arguments: got 0, need at least 1',
     );

packages/cli/src/commands/extensions/validate.test.ts

@@ -27,7 +27,10 @@ vi.mock('../utils.js', () => ({
 
 describe('extensions validate command', () => {
   it('should fail if no path is provided', () => {
-    const validationParser = yargs([]).command(validateCommand).fail(false);
+    const validationParser = yargs([])
+      .locale('en')
+      .command(validateCommand)
+      .fail(false);
     expect(() => validationParser.parse('validate')).toThrow(
       'Not enough non-option arguments: got 0, need at least 1',
     );

packages/cli/src/commands/mcp.test.ts

@@ -17,7 +17,7 @@ describe('mcp command', () => {
   });
 
   it('should show help when no subcommand is provided', async () => {
-    const yargsInstance = yargs();
+    const yargsInstance = yargs().locale('en');
     (mcpCommand.builder as (y: Argv) => Argv)(yargsInstance);
 
     const parser = yargsInstance.command(mcpCommand).help();

packages/cli/src/nonInteractiveCli.test.ts

@@ -22,6 +22,7 @@ import {
   CoreEvent,
   CoreToolCallStatus,
   JsonStreamEventType,
+  TRUE_EMPTY_RESPONSE_MESSAGE,
 } from '@google/gemini-cli-core';
 import type { Part } from '@google/genai';
 import { runNonInteractive } from './nonInteractiveCli.js';
@@ -78,6 +79,7 @@ vi.mock('@google/gemini-cli-core', async (importOriginal) => {
     ChatRecordingService: MockChatRecordingService,
     uiTelemetryService: {
       getMetrics: vi.fn(),
+      recordSemanticValidationError: vi.fn(),
     },
     coreEvents: mockCoreEvents,
     createWorkingStdio: vi.fn(() => ({
@@ -110,6 +112,7 @@ describe('runNonInteractive', () => {
     sendMessageStream: Mock;
     resumeChat: Mock;
     getChatRecordingService: Mock;
+    getCurrentSequenceModel: Mock;
   };
   const MOCK_SESSION_METRICS: SessionMetrics = {
     models: {},
@@ -165,6 +168,7 @@ describe('runNonInteractive', () => {
         recordMessageTokens: vi.fn(),
         recordToolCalls: vi.fn(),
       })),
+      getCurrentSequenceModel: vi.fn().mockReturnValue('gemini-2.5-flash'),
     };
 
     mockConfig = {
@@ -193,6 +197,7 @@ describe('runNonInteractive', () => {
       getRawOutput: vi.fn().mockReturnValue(false),
       getAcceptRawOutputRisk: vi.fn().mockReturnValue(false),
       getAgentSessionNoninteractiveEnabled: vi.fn().mockReturnValue(false),
+      getUsageStatisticsEnabled: vi.fn().mockReturnValue(false),
     } as unknown as Config;
 
     mockSettings = {
@@ -1820,7 +1825,6 @@ describe('runNonInteractive', () => {
     };
     // @ts-expect-error - Mocking internal structure
     mockGeminiClient.getChat = vi.fn().mockReturnValue(mockChat);
-    // @ts-expect-error - Mocking internal structure
     mockGeminiClient.getCurrentSequenceModel = vi
       .fn()
       .mockReturnValue('model-1');
@@ -2298,7 +2302,13 @@ describe('runNonInteractive', () => {
 
     it('should handle InvalidStream event gracefully in TEXT mode', async () => {
       const events: ServerGeminiStreamEvent[] = [
-        { type: GeminiEventType.InvalidStream },
+        {
+          type: GeminiEventType.InvalidStream,
+          value: {
+            type: 'NO_RESPONSE_TEXT',
+            message: 'Empty response',
+          },
+        },
       ];
       mockGeminiClient.sendMessageStream.mockReturnValue(
         createStreamFromEvents(events),
@@ -2312,7 +2322,7 @@ describe('runNonInteractive', () => {
       });
 
       expect(processStderrSpy).toHaveBeenCalledWith(
-        '[ERROR] Invalid stream: The model returned an empty response or malformed tool call.\n',
+        `[ERROR] ${TRUE_EMPTY_RESPONSE_MESSAGE}\n`,
       );
       expect(mockGeminiClient.sendMessageStream).toHaveBeenCalledTimes(1);
     });
@@ -2325,7 +2335,13 @@ describe('runNonInteractive', () => {
         OutputFormat.STREAM_JSON,
       );
       const events: ServerGeminiStreamEvent[] = [
-        { type: GeminiEventType.InvalidStream },
+        {
+          type: GeminiEventType.InvalidStream,
+          value: {
+            type: 'NO_RESPONSE_TEXT',
+            message: 'Empty response',
+          },
+        },
       ];
       mockGeminiClient.sendMessageStream.mockReturnValue(
         createStreamFromEvents(events),
@@ -2341,9 +2357,7 @@ describe('runNonInteractive', () => {
       const output = getWrittenOutput();
       expect(output).toContain('"type":"error"');
       expect(output).toContain('"severity":"error"');
-      expect(output).toContain(
-        'Invalid stream: The model returned an empty response or malformed tool call.',
-      );
+      expect(output).toContain(TRUE_EMPTY_RESPONSE_MESSAGE);
       expect(mockGeminiClient.sendMessageStream).toHaveBeenCalledTimes(1);
     });
 
@@ -2355,7 +2369,13 @@ describe('runNonInteractive', () => {
         OutputFormat.JSON,
       );
       const events: ServerGeminiStreamEvent[] = [
-        { type: GeminiEventType.InvalidStream },
+        {
+          type: GeminiEventType.InvalidStream,
+          value: {
+            type: 'NO_RESPONSE_TEXT',
+            message: 'Empty response',
+          },
+        },
       ];
       mockGeminiClient.sendMessageStream.mockReturnValue(
         createStreamFromEvents(events),
@@ -2371,8 +2391,33 @@ describe('runNonInteractive', () => {
       const output = getWrittenOutput();
       expect(output).toContain('"error": {');
       expect(output).toContain('"type": "INVALID_STREAM"');
-      expect(output).toContain(
-        'Invalid stream: The model returned an empty response or malformed tool call.',
+      expect(output).toContain(TRUE_EMPTY_RESPONSE_MESSAGE);
+      expect(mockGeminiClient.sendMessageStream).toHaveBeenCalledTimes(1);
+    });
+
+    it('should handle non-NO_RESPONSE_TEXT InvalidStream event gracefully and use message from eventValue', async () => {
+      const events: ServerGeminiStreamEvent[] = [
+        {
+          type: GeminiEventType.InvalidStream,
+          value: {
+            type: 'MALFORMED_FUNCTION_CALL',
+            message: 'Custom malformed function call message',
+          },
+        },
+      ];
+      mockGeminiClient.sendMessageStream.mockReturnValue(
+        createStreamFromEvents(events),
+      );
+
+      await runNonInteractive({
+        config: mockConfig,
+        settings: mockSettings,
+        input: 'test invalid stream malformed',
+        prompt_id: 'prompt-id-invalid-malformed',
+      });
+
+      expect(processStderrSpy).toHaveBeenCalledWith(
+        '[ERROR] Custom malformed function call message\n',
       );
       expect(mockGeminiClient.sendMessageStream).toHaveBeenCalledTimes(1);
     });

packages/cli/src/nonInteractiveCli.ts

@@ -30,6 +30,12 @@ import {
   ToolErrorType,
   Scheduler,
   ROOT_SCHEDULER_ID,
+  THINKING_ONLY_COMPRESS_SUGGESTION,
+  MAX_TOKENS_EXCEEDED_SUGGESTION,
+  SAFETY_BLOCKED_MESSAGE,
+  RECITATION_BLOCKED_MESSAGE,
+  OTHER_BLOCKED_MESSAGE,
+  TRUE_EMPTY_RESPONSE_MESSAGE,
 } from '@google/gemini-cli-core';
 
 import type { Content, Part } from '@google/genai';
@@ -433,8 +439,31 @@ export async function runNonInteractive(
             }
             warnings.push(blockMessage);
           } else if (event.type === GeminiEventType.InvalidStream) {
-            invalidStreamError =
-              'Invalid stream: The model returned an empty response or malformed tool call.';
+            const eventValue = event.value;
+            if (eventValue?.type === 'NO_RESPONSE_TEXT') {
+              invalidStreamError = TRUE_EMPTY_RESPONSE_MESSAGE;
+            } else if (eventValue?.type === 'THINKING_ONLY_RESPONSE') {
+              invalidStreamError = THINKING_ONLY_COMPRESS_SUGGESTION;
+            } else if (eventValue?.type === 'MAX_TOKENS_EXCEEDED') {
+              invalidStreamError = MAX_TOKENS_EXCEEDED_SUGGESTION;
+            } else if (eventValue?.type === 'SAFETY_BLOCKED') {
+              invalidStreamError = SAFETY_BLOCKED_MESSAGE;
+            } else if (eventValue?.type === 'RECITATION_BLOCKED') {
+              invalidStreamError = RECITATION_BLOCKED_MESSAGE;
+            } else if (eventValue?.type === 'OTHER_BLOCKED') {
+              invalidStreamError = OTHER_BLOCKED_MESSAGE;
+            } else {
+              invalidStreamError =
+                eventValue?.message?.trim() ||
+                'Invalid stream: The model returned an empty response or malformed tool call.';
+            }
+
+            // Log semantic error telemetry without double-counting requests
+            uiTelemetryService.recordSemanticValidationError(
+              geminiClient.getCurrentSequenceModel() ?? config.getModel(),
+              eventValue?.type || 'INVALID_STREAM',
+            );
+
             if (streamFormatter) {
               streamFormatter.emitEvent({
                 type: JsonStreamEventType.ERROR,

packages/cli/src/nonInteractiveCliAgentSession.test.ts

@@ -22,6 +22,7 @@ import {
   CoreEvent,
   CoreToolCallStatus,
   JsonStreamEventType,
+  TRUE_EMPTY_RESPONSE_MESSAGE,
 } from '@google/gemini-cli-core';
 import type { Part } from '@google/genai';
 import { runNonInteractive } from './nonInteractiveCliAgentSession.js';
@@ -78,6 +79,7 @@ vi.mock('@google/gemini-cli-core', async (importOriginal) => {
     ChatRecordingService: MockChatRecordingService,
     uiTelemetryService: {
       getMetrics: vi.fn(),
+      recordSemanticValidationError: vi.fn(),
     },
     LegacyAgentSession: original.LegacyAgentSession,
     geminiPartsToContentParts: original.geminiPartsToContentParts,
@@ -199,6 +201,7 @@ describe('runNonInteractive', () => {
       getRawOutput: vi.fn().mockReturnValue(false),
       getAcceptRawOutputRisk: vi.fn().mockReturnValue(false),
       getAgentSessionNoninteractiveEnabled: vi.fn().mockReturnValue(false),
+      getUsageStatisticsEnabled: vi.fn().mockReturnValue(false),
     } as unknown as Config;
 
     mockSettings = {
@@ -2457,6 +2460,126 @@ describe('runNonInteractive', () => {
       const output = JSON.parse(getWrittenOutput());
       expect(output.warnings).toBeUndefined();
     });
+
+    it('should handle InvalidStream event gracefully in TEXT mode', async () => {
+      const events: ServerGeminiStreamEvent[] = [
+        {
+          type: GeminiEventType.InvalidStream,
+          value: {
+            type: 'NO_RESPONSE_TEXT',
+            message: 'Empty response',
+          },
+        },
+      ];
+      mockGeminiClient.sendMessageStream.mockReturnValue(
+        createStreamFromEvents(events),
+      );
+
+      await runNonInteractive({
+        config: mockConfig,
+        settings: mockSettings,
+        input: 'test invalid stream',
+        prompt_id: 'prompt-id-invalid',
+      });
+
+      expect(processStderrSpy).toHaveBeenCalledWith(
+        `[ERROR] ${TRUE_EMPTY_RESPONSE_MESSAGE}\n`,
+      );
+      expect(mockGeminiClient.sendMessageStream).toHaveBeenCalledTimes(1);
+    });
+
+    it('should handle InvalidStream event gracefully in STREAM_JSON mode', async () => {
+      vi.spyOn(uiTelemetryService, 'getMetrics').mockReturnValue(
+        MOCK_SESSION_METRICS,
+      );
+      vi.spyOn(mockConfig, 'getOutputFormat').mockReturnValue(
+        OutputFormat.STREAM_JSON,
+      );
+      const events: ServerGeminiStreamEvent[] = [
+        {
+          type: GeminiEventType.InvalidStream,
+          value: {
+            type: 'NO_RESPONSE_TEXT',
+            message: 'Empty response',
+          },
+        },
+      ];
+      mockGeminiClient.sendMessageStream.mockReturnValue(
+        createStreamFromEvents(events),
+      );
+
+      await runNonInteractive({
+        config: mockConfig,
+        settings: mockSettings,
+        input: 'test invalid stream',
+        prompt_id: 'prompt-id-invalid',
+      });
+
+      const output = getWrittenOutput();
+      expect(output).toContain('"type":"error"');
+      expect(output).toContain('"severity":"error"');
+      expect(output).toContain(TRUE_EMPTY_RESPONSE_MESSAGE);
+      expect(mockGeminiClient.sendMessageStream).toHaveBeenCalledTimes(1);
+    });
+
+    it('should handle InvalidStream event gracefully in JSON mode', async () => {
+      vi.spyOn(uiTelemetryService, 'getMetrics').mockReturnValue(
+        MOCK_SESSION_METRICS,
+      );
+      vi.spyOn(mockConfig, 'getOutputFormat').mockReturnValue(
+        OutputFormat.JSON,
+      );
+      const events: ServerGeminiStreamEvent[] = [
+        {
+          type: GeminiEventType.InvalidStream,
+          value: {
+            type: 'NO_RESPONSE_TEXT',
+            message: 'Empty response',
+          },
+        },
+      ];
+      mockGeminiClient.sendMessageStream.mockReturnValue(
+        createStreamFromEvents(events),
+      );
+
+      await runNonInteractive({
+        config: mockConfig,
+        settings: mockSettings,
+        input: 'test invalid stream',
+        prompt_id: 'prompt-id-invalid',
+      });
+
+      const output = getWrittenOutput();
+      expect(output).toContain('"error": {');
+      expect(output).toContain('"type": "INVALID_STREAM"');
+      expect(output).toContain(TRUE_EMPTY_RESPONSE_MESSAGE);
+      expect(mockGeminiClient.sendMessageStream).toHaveBeenCalledTimes(1);
+    });
+
+    it('should handle non-NO_RESPONSE_TEXT InvalidStream event gracefully and use message from eventValue', async () => {
+      const events: ServerGeminiStreamEvent[] = [
+        {
+          type: GeminiEventType.InvalidStream,
+          value: {
+            type: 'MALFORMED_FUNCTION_CALL',
+            message: 'Malformed call',
+          },
+        },
+      ];
+      mockGeminiClient.sendMessageStream.mockReturnValue(
+        createStreamFromEvents(events),
+      );
+
+      await runNonInteractive({
+        config: mockConfig,
+        settings: mockSettings,
+        input: 'test invalid stream',
+        prompt_id: 'prompt-id-invalid',
+      });
+
+      expect(processStderrSpy).toHaveBeenCalledWith('[ERROR] Malformed call\n');
+      expect(mockGeminiClient.sendMessageStream).toHaveBeenCalledTimes(1);
+    });
   });
 
   describe('Output Sanitization', () => {

packages/cli/src/nonInteractiveCliAgentSession.ts

@@ -39,6 +39,12 @@ import {
   geminiPartsToContentParts,
   displayContentToString,
   debugLogger,
+  THINKING_ONLY_COMPRESS_SUGGESTION,
+  MAX_TOKENS_EXCEEDED_SUGGESTION,
+  SAFETY_BLOCKED_MESSAGE,
+  RECITATION_BLOCKED_MESSAGE,
+  OTHER_BLOCKED_MESSAGE,
+  TRUE_EMPTY_RESPONSE_MESSAGE,
 } from '@google/gemini-cli-core';
 
 import type { Part } from '@google/genai';
@@ -332,14 +338,17 @@ export async function runNonInteractive({
         return text ? text : undefined;
       };
 
-      const emitFinalSuccessResult = (): void => {
+      const emitFinalResult = (errorPayload?: {
+        type: string;
+        message: string;
+      }): void => {
         if (streamFormatter) {
           const metrics = uiTelemetryService.getMetrics();
           const durationMs = Date.now() - startTime;
           streamFormatter.emitEvent({
             type: JsonStreamEventType.RESULT,
             timestamp: new Date().toISOString(),
-            status: 'success',
+            status: errorPayload ? 'error' : 'success',
             stats: streamFormatter.convertToStreamStats(metrics, durationMs),
           });
         } else if (config.getOutputFormat() === OutputFormat.JSON) {
@@ -350,7 +359,7 @@ export async function runNonInteractive({
               config.getSessionId(),
               responseText,
               stats,
-              undefined,
+              errorPayload,
               warnings,
             ),
           );
@@ -545,6 +554,52 @@ export async function runNonInteractive({
             break;
           }
           case 'error': {
+            if (event._meta?.['code'] === 'INVALID_STREAM') {
+              const errorTypeVal = event._meta?.['errorType'];
+              const errorType =
+                typeof errorTypeVal === 'string' ? errorTypeVal : undefined;
+
+              let errorMessage = event.message;
+              if (errorType === 'NO_RESPONSE_TEXT') {
+                errorMessage = TRUE_EMPTY_RESPONSE_MESSAGE;
+              } else if (errorType === 'THINKING_ONLY_RESPONSE') {
+                errorMessage = THINKING_ONLY_COMPRESS_SUGGESTION;
+              } else if (errorType === 'MAX_TOKENS_EXCEEDED') {
+                errorMessage = MAX_TOKENS_EXCEEDED_SUGGESTION;
+              } else if (errorType === 'SAFETY_BLOCKED') {
+                errorMessage = SAFETY_BLOCKED_MESSAGE;
+              } else if (errorType === 'RECITATION_BLOCKED') {
+                errorMessage = RECITATION_BLOCKED_MESSAGE;
+              } else if (errorType === 'OTHER_BLOCKED') {
+                errorMessage = OTHER_BLOCKED_MESSAGE;
+              }
+
+              if (streamFormatter) {
+                streamFormatter.emitEvent({
+                  type: JsonStreamEventType.ERROR,
+                  timestamp: new Date().toISOString(),
+                  severity: 'error',
+                  message: errorMessage,
+                });
+              } else if (config.getOutputFormat() === OutputFormat.TEXT) {
+                process.stderr.write(`[ERROR] ${errorMessage}\n`);
+              }
+
+              // Log semantic error telemetry without double-counting requests
+              uiTelemetryService.recordSemanticValidationError(
+                geminiClient.getCurrentSequenceModel() ?? config.getModel(),
+                errorType || 'INVALID_STREAM',
+              );
+
+              // If it's a fatal stream error, we should terminate and output final results
+              emitFinalResult({
+                type: 'INVALID_STREAM',
+                message: errorMessage,
+              });
+              streamEnded = true;
+              break;
+            }
+
             if (event.fatal) {
               throw reconstructFatalError(event);
             }
@@ -613,7 +668,7 @@ export async function runNonInteractive({
               process.stderr.write(`Agent execution stopped: ${stopMessage}\n`);
             }
 
-            emitFinalSuccessResult();
+            emitFinalResult();
             streamEnded = true;
             break;
           }

packages/cli/src/ui/components/DialogManager.tsx

@@ -86,6 +86,7 @@ export const DialogManager = ({
         message={quotaState.proQuotaRequest.message}
         isTerminalQuotaError={quotaState.proQuotaRequest.isTerminalQuotaError}
         isModelNotFoundError={!!quotaState.proQuotaRequest.isModelNotFoundError}
+        isCapacityExceeded={!!quotaState.proQuotaRequest.isCapacityExceeded}
         authType={quotaState.proQuotaRequest.authType}
         tierName={config?.getUserTierName()}
         onChoice={uiActions.handleProQuotaChoice}

packages/cli/src/ui/components/ProQuotaDialog.test.tsx

@@ -271,6 +271,40 @@ describe('ProQuotaDialog', () => {
         );
         unmount();
       });
+
+      it('should render keep trying, switch, and stop options even if isTerminalQuotaError is true when isCapacityExceeded is true', async () => {
+        const { unmount } = await render(
+          <ProQuotaDialog
+            failedModel="gemini-2.5-pro"
+            fallbackModel="gemini-2.5-flash"
+            message="capacity error"
+            isTerminalQuotaError={true}
+            isCapacityExceeded={true}
+            isModelNotFoundError={false}
+            onChoice={mockOnChoice}
+          />,
+        );
+
+        expect(RadioButtonSelect).toHaveBeenCalledWith(
+          expect.objectContaining({
+            items: [
+              {
+                label: 'Keep trying',
+                value: 'retry_once',
+                key: 'retry_once',
+              },
+              {
+                label: 'Switch to gemini-2.5-flash',
+                value: 'retry_always',
+                key: 'retry_always',
+              },
+              { label: 'Stop', value: 'retry_later', key: 'retry_later' },
+            ],
+          }),
+          undefined,
+        );
+        unmount();
+      });
     });
 
     describe('when it is a model not found error', () => {

packages/cli/src/ui/components/ProQuotaDialog.tsx

@@ -17,6 +17,7 @@ interface ProQuotaDialogProps {
   message: string;
   isTerminalQuotaError: boolean;
   isModelNotFoundError?: boolean;
+  isCapacityExceeded?: boolean;
   authType?: AuthType;
   tierName?: string;
   onChoice: (
@@ -30,6 +31,7 @@ export function ProQuotaDialog({
   message,
   isTerminalQuotaError,
   isModelNotFoundError,
+  isCapacityExceeded,
   authType,
   tierName,
   onChoice,
@@ -49,6 +51,24 @@ export function ProQuotaDialog({
         key: 'retry_later',
       },
     ];
+  } else if (isCapacityExceeded) {
+    items = [
+      {
+        label: 'Keep trying',
+        value: 'retry_once' as const,
+        key: 'retry_once',
+      },
+      {
+        label: `Switch to ${fallbackModel}`,
+        value: 'retry_always' as const,
+        key: 'retry_always',
+      },
+      {
+        label: 'Stop',
+        value: 'retry_later' as const,
+        key: 'retry_later',
+      },
+    ];
   } else if (isModelNotFoundError || isTerminalQuotaError) {
     const isUltra = isUltraTier(tierName);
 
@@ -75,7 +95,7 @@ export function ProQuotaDialog({
       },
     ];
   } else {
-    // capacity error
+    // capacity error or generic fallback
     items = [
       {
         label: 'Keep trying',

packages/cli/src/ui/contexts/SessionContext.tsx

@@ -36,6 +36,18 @@ function areModelMetricsEqual(a: ModelMetrics, b: ModelMetrics): boolean {
   ) {
     return false;
   }
+  const errorsA = a.api.errorsByType || {};
+  const errorsB = b.api.errorsByType || {};
+  const keysA = Object.keys(errorsA);
+  const keysB = Object.keys(errorsB);
+  if (keysA.length !== keysB.length) {
+    return false;
+  }
+  for (const key of keysA) {
+    if (errorsA[key] !== errorsB[key]) {
+      return false;
+    }
+  }
   if (
     a.tokens.input !== b.tokens.input ||
     a.tokens.prompt !== b.tokens.prompt ||

packages/cli/src/ui/contexts/UIStateContext.tsx

@@ -40,6 +40,7 @@ export interface ProQuotaDialogRequest {
   message: string;
   isTerminalQuotaError: boolean;
   isModelNotFoundError?: boolean;
+  isCapacityExceeded?: boolean;
   authType?: AuthType;
   resolve: (intent: FallbackIntent) => void;
 }

packages/cli/src/ui/hooks/useGeminiStream.test.tsx

@@ -54,6 +54,7 @@ import {
   GeminiCliOperation,
   getPlanModeExitMessage,
   UPDATE_TOPIC_TOOL_NAME,
+  TRUE_EMPTY_RESPONSE_MESSAGE,
 } from '@google/gemini-cli-core';
 import type { Part, PartListUnion } from '@google/genai';
 import type { UseHistoryManagerReturn } from './useHistoryManager.js';
@@ -1045,6 +1046,107 @@ describe('useGeminiStream', () => {
     });
   });
 
+  it('should record tool responses in history when the model was switched due to a quota error', async () => {
+    // Regression test: returning early on a quota-triggered model switch
+    // without recording the responses leaves the already-recorded
+    // functionCall unpaired, which corrupts all subsequent requests.
+    const responseParts: Part[] = [
+      {
+        functionResponse: {
+          name: 'testTool',
+          id: 'call1',
+          response: { output: 'tool result' },
+        },
+      },
+    ];
+    const completedToolCalls: TrackedToolCall[] = [
+      {
+        request: {
+          callId: 'call1',
+          name: 'testTool',
+          args: {},
+          isClientInitiated: false,
+          prompt_id: 'prompt-id-quota',
+        },
+        status: CoreToolCallStatus.Success,
+        responseSubmittedToGemini: false,
+        response: {
+          callId: 'call1',
+          responseParts,
+          errorType: undefined,
+        },
+        tool: { displayName: 'MockTool' },
+        invocation: {
+          getDescription: () => `Mock description`,
+        } as unknown as AnyToolInvocation,
+      } as TrackedCompletedToolCall,
+    ];
+
+    const client = new MockedGeminiClientClass(mockConfig);
+    const mockConsumeUserHint = vi.fn(() => 'switch to the nprd database');
+
+    let capturedOnComplete:
+      | ((completedTools: TrackedToolCall[]) => Promise<void>)
+      | null = null;
+
+    mockUseToolScheduler.mockImplementation((onComplete) => {
+      capturedOnComplete = onComplete;
+      return [
+        [],
+        mockScheduleToolCalls,
+        mockMarkToolsAsSubmitted,
+        vi.fn(),
+        mockCancelAllToolCalls,
+        0,
+      ];
+    });
+
+    await renderHookWithProviders(() =>
+      useGeminiStream(
+        client,
+        [],
+        mockAddItem,
+        mockConfig,
+        mockLoadedSettings,
+        mockOnDebugMessage,
+        mockHandleSlashCommand,
+        false,
+        () => 'vscode' as EditorType,
+        () => {},
+        () => Promise.resolve(),
+        true, // modelSwitchedFromQuotaError
+        () => {},
+        () => {},
+        () => {},
+        80,
+        24,
+        false,
+        mockConsumeUserHint,
+      ),
+    );
+
+    await act(async () => {
+      if (capturedOnComplete) {
+        await new Promise((resolve) => setTimeout(resolve, 0));
+        await capturedOnComplete(completedToolCalls);
+      }
+    });
+
+    await waitFor(() => {
+      expect(mockMarkToolsAsSubmitted).toHaveBeenCalledWith(['call1']);
+      // The tool response must be paired with its functionCall in history,
+      // with no steering-hint text ahead of it...
+      expect(client.addHistory).toHaveBeenCalledWith({
+        role: 'user',
+        parts: responseParts,
+      });
+      // ...the turn must NOT auto-continue on the fallback model...
+      expect(mockSendMessageStream).not.toHaveBeenCalled();
+      // ...and the pending hint is left for the next real submit.
+      expect(mockConsumeUserHint).not.toHaveBeenCalled();
+    });
+  });
+
   it('should NOT stop responding when only update_topic is called', async () => {
     const topicToolCalls: TrackedToolCall[] = [
       {
@@ -1772,6 +1874,120 @@ describe('useGeminiStream', () => {
       expect(mockCancelAllToolCalls).toHaveBeenCalled();
     });
 
+    it('should transition to Idle state when cancelled while a tool call is in progress and completes', async () => {
+      const toolCalls: TrackedToolCall[] = [
+        {
+          request: { callId: 'call1', name: 'tool1', args: {} },
+          status: CoreToolCallStatus.Executing,
+          responseSubmittedToGemini: false,
+          tool: {
+            name: 'tool1',
+            description: 'desc1',
+            build: vi.fn().mockImplementation((_) => ({
+              getDescription: () => `Mock description`,
+            })),
+          } as any,
+          invocation: {
+            getDescription: () => `Mock description`,
+          },
+          startTime: Date.now(),
+          liveOutput: '...',
+        } as TrackedExecutingToolCall,
+      ];
+
+      const { result } = await renderTestHook(toolCalls);
+
+      // State is `Responding` because a tool is running
+      expect(result.current.streamingState).toBe(StreamingState.Responding);
+
+      // Try to cancel
+      simulateEscapeKeyPress();
+
+      // Trigger the onComplete callback with the cancelled tool call
+      await act(async () => {
+        if (capturedOnComplete) {
+          await capturedOnComplete([
+            {
+              ...toolCalls[0],
+              status: CoreToolCallStatus.Cancelled,
+              response: {
+                callId: 'call1',
+                responseParts: [],
+              },
+            } as any,
+          ]);
+        }
+      });
+
+      // The final state should be idle because the cancelled tool call was marked as submitted
+      expect(result.current.streamingState).toBe(StreamingState.Idle);
+    });
+
+    it('should append cancelled tool responses to history when cancelled while a tool call is in progress and completes with response parts', async () => {
+      const toolCalls: TrackedToolCall[] = [
+        {
+          request: { callId: 'call1', name: 'tool1', args: {} },
+          status: CoreToolCallStatus.Executing,
+          responseSubmittedToGemini: false,
+          tool: {
+            name: 'tool1',
+            description: 'desc1',
+            build: vi.fn().mockImplementation((_) => ({
+              getDescription: () => `Mock description`,
+            })),
+          } as any,
+          invocation: {
+            getDescription: () => `Mock description`,
+          },
+          startTime: Date.now(),
+          liveOutput: '...',
+        } as TrackedExecutingToolCall,
+      ];
+
+      const { result, client } = await renderTestHook(toolCalls);
+
+      // State is `Responding` because a tool is running
+      expect(result.current.streamingState).toBe(StreamingState.Responding);
+
+      // Try to cancel
+      simulateEscapeKeyPress();
+
+      const expectedResponseParts = [
+        {
+          functionResponse: {
+            name: 'tool1',
+            id: 'call1',
+            response: { error: 'cancelled' },
+          },
+        },
+      ];
+
+      // Trigger the onComplete callback with the cancelled tool call having non-empty response parts
+      await act(async () => {
+        if (capturedOnComplete) {
+          await capturedOnComplete([
+            {
+              ...toolCalls[0],
+              status: CoreToolCallStatus.Cancelled,
+              response: {
+                callId: 'call1',
+                responseParts: expectedResponseParts,
+              },
+            } as any,
+          ]);
+        }
+      });
+
+      // Assert that addHistory was called with the combined response parts
+      expect(client.addHistory).toHaveBeenCalledWith({
+        role: 'user',
+        parts: expectedResponseParts,
+      });
+
+      // The final state should be idle because the cancelled tool call was marked as submitted
+      expect(result.current.streamingState).toBe(StreamingState.Idle);
+    });
+
     it('should cancel a request when a tool is awaiting confirmation', async () => {
       const mockOnConfirm = vi.fn().mockResolvedValue(undefined);
       const toolCalls: TrackedToolCall[] = [
@@ -2306,6 +2522,68 @@ describe('useGeminiStream', () => {
         );
       });
     });
+
+    it('should use TRUE_EMPTY_RESPONSE_MESSAGE when receiving an invalid stream event of type NO_RESPONSE_TEXT', async () => {
+      mockSendMessageStream.mockClear();
+      mockSendMessageStream.mockReturnValue(
+        (async function* () {
+          yield {
+            type: ServerGeminiEventType.InvalidStream,
+            value: {
+              type: 'NO_RESPONSE_TEXT',
+              message: 'empty response text',
+            },
+          };
+        })(),
+      );
+
+      const { result } = await renderTestHook();
+
+      await act(async () => {
+        await result.current.submitQuery('test query');
+      });
+
+      await waitFor(() => {
+        expect(mockAddItem).toHaveBeenCalledWith(
+          expect.objectContaining({
+            type: MessageType.ERROR,
+            text: TRUE_EMPTY_RESPONSE_MESSAGE,
+          }),
+          expect.any(Number),
+        );
+      });
+    });
+
+    it('should use the event message when receiving a non-NO_RESPONSE_TEXT invalid stream event', async () => {
+      mockSendMessageStream.mockClear();
+      mockSendMessageStream.mockReturnValue(
+        (async function* () {
+          yield {
+            type: ServerGeminiEventType.InvalidStream,
+            value: {
+              type: 'MALFORMED_FUNCTION_CALL',
+              message: 'Custom malformed function call message',
+            },
+          };
+        })(),
+      );
+
+      const { result } = await renderTestHook();
+
+      await act(async () => {
+        await result.current.submitQuery('test query');
+      });
+
+      await waitFor(() => {
+        expect(mockAddItem).toHaveBeenCalledWith(
+          expect.objectContaining({
+            type: MessageType.ERROR,
+            text: 'Custom malformed function call message',
+          }),
+          expect.any(Number),
+        );
+      });
+    });
   });
 
   describe('handleApprovalModeChange', () => {

packages/cli/src/ui/hooks/useGeminiStream.ts

@@ -14,6 +14,7 @@ import {
   GitService,
   UnauthorizedError,
   UserPromptEvent,
+  uiTelemetryService,
   DEFAULT_GEMINI_FLASH_MODEL,
   logConversationFinishedEvent,
   ConversationFinishedEvent,
@@ -45,6 +46,12 @@ import {
   buildToolVisibilityContext,
   UPDATE_TOPIC_TOOL_NAME,
   UPDATE_TOPIC_DISPLAY_NAME,
+  THINKING_ONLY_COMPRESS_SUGGESTION,
+  MAX_TOKENS_EXCEEDED_SUGGESTION,
+  SAFETY_BLOCKED_MESSAGE,
+  RECITATION_BLOCKED_MESSAGE,
+  OTHER_BLOCKED_MESSAGE,
+  TRUE_EMPTY_RESPONSE_MESSAGE,
 } from '@google/gemini-cli-core';
 import type {
   Config,
@@ -54,6 +61,7 @@ import type {
   ServerGeminiContentEvent as ContentEvent,
   ServerGeminiFinishedEvent,
   ServerGeminiStreamEvent as GeminiEvent,
+  ServerGeminiInvalidStreamEvent,
   ThoughtSummary,
   ToolCallRequestInfo,
   ToolCallResponseInfo,
@@ -1229,6 +1237,61 @@ export const useGeminiStream = (
     ],
   );
 
+  const handleInvalidStreamEvent = useCallback(
+    (
+      eventValue: ServerGeminiInvalidStreamEvent['value'],
+      userMessageTimestamp: number,
+    ) => {
+      if (pendingHistoryItemRef.current) {
+        addItem(pendingHistoryItemRef.current, userMessageTimestamp);
+        setPendingHistoryItem(null);
+      }
+      maybeAddSuppressedToolErrorNote(userMessageTimestamp);
+
+      let text =
+        eventValue?.message?.trim() || 'Invalid stream received from model';
+      if (eventValue?.type === 'NO_RESPONSE_TEXT') {
+        text = TRUE_EMPTY_RESPONSE_MESSAGE;
+      } else if (eventValue?.type === 'THINKING_ONLY_RESPONSE') {
+        text = THINKING_ONLY_COMPRESS_SUGGESTION;
+      } else if (eventValue?.type === 'MAX_TOKENS_EXCEEDED') {
+        text = MAX_TOKENS_EXCEEDED_SUGGESTION;
+      } else if (eventValue?.type === 'SAFETY_BLOCKED') {
+        text = SAFETY_BLOCKED_MESSAGE;
+      } else if (eventValue?.type === 'RECITATION_BLOCKED') {
+        text = RECITATION_BLOCKED_MESSAGE;
+      } else if (eventValue?.type === 'OTHER_BLOCKED') {
+        text = OTHER_BLOCKED_MESSAGE;
+      }
+
+      // Log semantic error telemetry without double-counting requests
+      uiTelemetryService.recordSemanticValidationError(
+        geminiClient.getCurrentSequenceModel() ?? config.getModel(),
+        eventValue?.type || 'INVALID_STREAM',
+      );
+
+      addItem(
+        {
+          type: MessageType.ERROR,
+          text,
+        },
+        userMessageTimestamp,
+      );
+      maybeAddLowVerbosityFailureNote(userMessageTimestamp);
+      setThought(null); // Reset thought when there's an error
+    },
+    [
+      addItem,
+      pendingHistoryItemRef,
+      setPendingHistoryItem,
+      setThought,
+      maybeAddSuppressedToolErrorNote,
+      maybeAddLowVerbosityFailureNote,
+      config,
+      geminiClient,
+    ],
+  );
+
   const handleCitationEvent = useCallback(
     (text: string, userMessageTimestamp: number) => {
       if (!showCitations(settings)) {
@@ -1541,8 +1604,10 @@ export const useGeminiStream = (
             loopDetectedRef.current = true;
             break;
           case ServerGeminiEventType.Retry:
+            // Handled transparently by the backend stream retries.
+            break;
           case ServerGeminiEventType.InvalidStream:
-            // Will add the missing logic later
+            handleInvalidStreamEvent(event.value, userMessageTimestamp);
             break;
           default: {
             // enforces exhaustive switch-case
@@ -1575,6 +1640,7 @@ export const useGeminiStream = (
       handleChatModelEvent,
       handleAgentExecutionStoppedEvent,
       handleAgentExecutionBlockedEvent,
+      handleInvalidStreamEvent,
       addItem,
       pendingHistoryItemRef,
       setPendingHistoryItem,
@@ -1886,6 +1952,30 @@ export const useGeminiStream = (
           },
         );
 
+      if (turnCancelledRef.current) {
+        setIsResponding(false);
+        const geminiTools = completedAndReadyToSubmitTools.filter(
+          (t) => !t.request.isClientInitiated,
+        );
+        if (geminiClient && geminiTools.length > 0) {
+          const combinedParts = geminiTools.flatMap(
+            (toolCall) => toolCall.response.responseParts,
+          );
+          if (combinedParts.length > 0) {
+            // eslint-disable-next-line @typescript-eslint/no-floating-promises
+            geminiClient.addHistory({
+              role: 'user',
+              parts: combinedParts,
+            });
+          }
+        }
+        const callIdsToMarkAsSubmitted = toolCalls.map(
+          (toolCall) => toolCall.request.callId,
+        );
+        markToolsAsSubmitted(callIdsToMarkAsSubmitted);
+        return;
+      }
+
       // Finalize any client-initiated tools as soon as they are done.
       const clientTools = completedAndReadyToSubmitTools.filter(
         (t) => t.request.isClientInitiated,
@@ -2020,6 +2110,27 @@ export const useGeminiStream = (
         (toolCall) => toolCall.response.responseParts,
       );
 
+      const callIdsToMarkAsSubmitted = geminiTools.map(
+        (toolCall) => toolCall.request.callId,
+      );
+
+      markToolsAsSubmitted(callIdsToMarkAsSubmitted);
+
+      // Don't continue if model was switched due to quota error, but still
+      // record the responses: the matching functionCall is already in history,
+      // and leaving it unpaired corrupts every subsequent request. Any pending
+      // steering hint is deliberately left unconsumed so it rides along with
+      // the next query the user actually submits.
+      if (modelSwitchedFromQuotaError) {
+        if (geminiClient && responsesToSend.length > 0) {
+          await geminiClient.addHistory({
+            role: 'user',
+            parts: responsesToSend,
+          });
+        }
+        return;
+      }
+
       if (consumeUserHint) {
         const userHint = consumeUserHint();
         if (userHint && userHint.trim().length > 0) {
@@ -2030,21 +2141,10 @@ export const useGeminiStream = (
         }
       }
 
-      const callIdsToMarkAsSubmitted = geminiTools.map(
-        (toolCall) => toolCall.request.callId,
-      );
-
       const prompt_ids = geminiTools.map(
         (toolCall) => toolCall.request.prompt_id,
       );
 
-      markToolsAsSubmitted(callIdsToMarkAsSubmitted);
-
-      // Don't continue if model was switched due to quota error
-      if (modelSwitchedFromQuotaError) {
-        return;
-      }
-
       // eslint-disable-next-line @typescript-eslint/no-floating-promises
       submitQuery(
         responsesToSend,
@@ -2066,6 +2166,7 @@ export const useGeminiStream = (
       maybeAddSuppressedToolErrorNote,
       maybeAddLowVerbosityFailureNote,
       setIsResponding,
+      toolCalls,
     ],
   );
 

packages/cli/src/ui/hooks/useQuotaAndFallback.test.ts

@@ -222,6 +222,126 @@ describe('useQuotaAndFallback', () => {
       await promise!;
     });
 
+    it('should auto-retry terminal quota capacity failures in low verbosity mode', async () => {
+      const { result } = await renderHook(() =>
+        useQuotaAndFallback({
+          config: mockConfig,
+          historyManager: mockHistoryManager,
+          userTier: UserTierId.FREE,
+          setModelSwitchedFromQuotaError: mockSetModelSwitchedFromQuotaError,
+          onShowAuthSelection: mockOnShowAuthSelection,
+          paidTier: null,
+          settings: mockSettings,
+          errorVerbosity: 'low',
+        }),
+      );
+
+      const handler = setFallbackHandlerSpy.mock
+        .calls[0][0] as FallbackModelHandler;
+      const intent = await handler(
+        'gemini-pro',
+        'gemini-flash',
+        new TerminalQuotaError(
+          'pro capacity exhausted',
+          mockGoogleApiError,
+          undefined,
+          'MODEL_CAPACITY_EXHAUSTED',
+        ),
+      );
+
+      expect(intent).toBe('retry_once');
+      expect(result.current.proQuotaRequest).toBeNull();
+    });
+
+    it('should auto-retry capacity failures matched by regex on message in low verbosity mode', async () => {
+      const { result } = await renderHook(() =>
+        useQuotaAndFallback({
+          config: mockConfig,
+          historyManager: mockHistoryManager,
+          userTier: UserTierId.FREE,
+          setModelSwitchedFromQuotaError: mockSetModelSwitchedFromQuotaError,
+          onShowAuthSelection: mockOnShowAuthSelection,
+          paidTier: null,
+          settings: mockSettings,
+          errorVerbosity: 'low',
+        }),
+      );
+
+      const handler = setFallbackHandlerSpy.mock
+        .calls[0][0] as FallbackModelHandler;
+      const intent = await handler(
+        'gemini-pro',
+        'gemini-flash',
+        new Error('you have exhausted your capacity limit'),
+      );
+
+      expect(intent).toBe('retry_once');
+      expect(result.current.proQuotaRequest).toBeNull();
+    });
+
+    it('should auto-retry capacity failures thrown as raw string error in low verbosity mode', async () => {
+      const { result } = await renderHook(() =>
+        useQuotaAndFallback({
+          config: mockConfig,
+          historyManager: mockHistoryManager,
+          userTier: UserTierId.FREE,
+          setModelSwitchedFromQuotaError: mockSetModelSwitchedFromQuotaError,
+          onShowAuthSelection: mockOnShowAuthSelection,
+          paidTier: null,
+          settings: mockSettings,
+          errorVerbosity: 'low',
+        }),
+      );
+
+      const handler = setFallbackHandlerSpy.mock
+        .calls[0][0] as FallbackModelHandler;
+      const intent = await handler(
+        'gemini-pro',
+        'gemini-flash',
+        'MODEL_CAPACITY_EXHAUSTED',
+      );
+
+      expect(intent).toBe('retry_once');
+      expect(result.current.proQuotaRequest).toBeNull();
+    });
+
+    it('should show high demand message for MODEL_CAPACITY_EXHAUSTED', async () => {
+      const { result } = await renderHook(() =>
+        useQuotaAndFallback({
+          config: mockConfig,
+          historyManager: mockHistoryManager,
+          userTier: UserTierId.FREE,
+          setModelSwitchedFromQuotaError: mockSetModelSwitchedFromQuotaError,
+          onShowAuthSelection: mockOnShowAuthSelection,
+          paidTier: null,
+          settings: mockSettings,
+        }),
+      );
+
+      const handler = setFallbackHandlerSpy.mock
+        .calls[0][0] as FallbackModelHandler;
+
+      const error = new TerminalQuotaError(
+        'pro capacity exhausted',
+        mockGoogleApiError,
+        undefined,
+        'MODEL_CAPACITY_EXHAUSTED',
+      );
+
+      act(() => {
+        void handler('gemini-pro', 'gemini-flash', error);
+      });
+
+      expect(result.current.proQuotaRequest).not.toBeNull();
+      expect(result.current.proQuotaRequest?.isCapacityExceeded).toBe(true);
+      expect(result.current.proQuotaRequest?.message).toContain(
+        'We are currently experiencing high demand',
+      );
+      expect(result.current.proQuotaRequest?.message).not.toContain(
+        'Usage limit reached',
+      );
+    });
+
     describe('Interactive Fallback', () => {
       it('should set an interactive request for a terminal quota error', async () => {
         const { result } = await renderHook(() =>
@@ -1040,7 +1160,7 @@ Your admin might have disabled the access. Contact them to enable the Preview Re
       );
     });
 
-    it('should show a special message when falling back from the preview model, but do not show periodical check message for flash model fallback', async () => {
+    it('should show a special message when falling back from the preview model, but not show the periodical check message for flash model fallbacks', async () => {
       const { result } = await renderHook(() =>
         useQuotaAndFallback({
           config: mockConfig,

packages/cli/src/ui/hooks/useQuotaAndFallback.ts

@@ -45,6 +45,9 @@ interface UseQuotaAndFallbackArgs {
   errorVerbosity?: 'low' | 'full';
 }
 
+const isObject = (val: unknown): val is Record<string, unknown> =>
+  typeof val === 'object' && val !== null;
+
 export function useQuotaAndFallback({
   config,
   historyManager,
@@ -79,6 +82,28 @@ export function useQuotaAndFallback({
       let message: string;
       let isTerminalQuotaError = false;
       let isModelNotFoundError = false;
+
+      const errorObj = isObject(error) ? error : null;
+
+      const errorReasonValue = errorObj?.['reason'];
+      const errorReason =
+        typeof errorReasonValue === 'string' ? errorReasonValue : undefined;
+
+      const errorMessageValue = errorObj?.['message'];
+      const errorMessage =
+        typeof errorMessageValue === 'string' ? errorMessageValue : undefined;
+
+      const isCapacityExceeded =
+        errorReason === 'MODEL_CAPACITY_EXHAUSTED' ||
+        errorReason === 'MODEL_CAPACITY_EXCEEDED' ||
+        (typeof errorMessage === 'string' &&
+          /exhausted your capacity|capacity exceeded|MODEL_CAPACITY_EXHAUSTED/i.test(
+            errorMessage,
+          )) ||
+        (typeof error === 'string' &&
+          /exhausted your capacity|capacity exceeded|MODEL_CAPACITY_EXHAUSTED/i.test(
+            error,
+          ));
       const usageLimitReachedModel = isProModel(failedModel)
         ? 'all Pro models'
         : failedModel;
@@ -121,18 +146,30 @@ export function useQuotaAndFallback({
         }
 
         // Default: Show existing ProQuotaDialog (for overageStrategy: 'never' or non-G1 users)
-        const messageLines = [
-          `Usage limit reached for ${usageLimitReachedModel}.`,
-          error.retryDelayMs
-            ? `Access resets at ${getResetTimeMessage(error.retryDelayMs)}.`
-            : null,
-          `/stats model for usage details`,
-          `/model to switch models.`,
-          contentGeneratorConfig?.authType === AuthType.LOGIN_WITH_GOOGLE
-            ? `/auth to switch to API key.`
-            : null,
-        ].filter(Boolean);
-        message = messageLines.join('\n');
+        if (isCapacityExceeded) {
+          const messageLines = [
+            `We are currently experiencing high demand for ${usageLimitReachedModel}.`,
+            'We apologize and appreciate your patience.',
+            error.retryDelayMs
+              ? `Access resets at ${getResetTimeMessage(error.retryDelayMs)}.`
+              : null,
+            `/model to switch models.`,
+          ].filter(Boolean);
+          message = messageLines.join('\n');
+        } else {
+          const messageLines = [
+            `Usage limit reached for ${usageLimitReachedModel}.`,
+            error.retryDelayMs
+              ? `Access resets at ${getResetTimeMessage(error.retryDelayMs)}.`
+              : null,
+            `/stats model for usage details`,
+            `/model to switch models.`,
+            contentGeneratorConfig?.authType === AuthType.LOGIN_WITH_GOOGLE
+              ? `/auth to switch to API key.`
+              : null,
+          ].filter(Boolean);
+          message = messageLines.join('\n');
+        }
       } else if (error instanceof ModelNotFoundError) {
         isModelNotFoundError = true;
         if (
@@ -174,7 +211,7 @@ export function useQuotaAndFallback({
       // without interrupting with a dialog.
       if (
         errorVerbosity === 'low' &&
-        !isTerminalQuotaError &&
+        (!isTerminalQuotaError || isCapacityExceeded) &&
         !isModelNotFoundError
       ) {
         return 'retry_once';
@@ -197,6 +234,7 @@ export function useQuotaAndFallback({
             message,
             isTerminalQuotaError,
             isModelNotFoundError,
+            isCapacityExceeded,
             authType: contentGeneratorConfig?.authType,
           });
         },

packages/cli/src/utils/sandbox.test.ts

@@ -292,6 +292,140 @@ describe('sandbox', () => {
       await expect(start_sandbox(config)).rejects.toThrow(FatalSandboxError);
     });
 
+    it('should fall back to embedded profile if the .sb file is missing on disk', async () => {
+      vi.mocked(os.platform).mockReturnValue('darwin');
+      vi.mocked(fs.existsSync).mockImplementation((p) =>
+        String(p).includes(
+          'gemini-sandbox-macos-permissive-open-a1b2c3d4e5f6.sb',
+        ),
+      );
+
+      const config: SandboxConfig = createMockSandboxConfig({
+        command: 'sandbox-exec',
+        image: 'some-image',
+      });
+
+      const onSpy = vi.spyOn(process, 'on');
+      const offSpy = vi.spyOn(process, 'off');
+
+      interface MockProcess extends EventEmitter {
+        stdout: EventEmitter;
+        stderr: EventEmitter;
+      }
+      const mockSpawnProcess = new EventEmitter() as MockProcess;
+      mockSpawnProcess.stdout = new EventEmitter();
+      mockSpawnProcess.stderr = new EventEmitter();
+      vi.mocked(spawn).mockReturnValue(
+        mockSpawnProcess as unknown as ReturnType<typeof spawn>,
+      );
+
+      const promise = start_sandbox(config, [], undefined, ['arg1']);
+
+      setTimeout(() => {
+        mockSpawnProcess.emit('close', 0);
+      }, 10);
+
+      await expect(promise).resolves.toBe(0);
+
+      // Verify fs.writeFileSync was called with the temp profile file, content, and 0o600 permissions
+      expect(fs.writeFileSync).toHaveBeenCalledWith(
+        expect.stringContaining(
+          'gemini-sandbox-macos-permissive-open-a1b2c3d4e5f6.sb',
+        ),
+        expect.stringContaining('deny default'),
+        expect.objectContaining({
+          encoding: 'utf8',
+          mode: 0o600,
+        }),
+      );
+
+      // Verify spawn was called with the temp profile file
+      expect(spawn).toHaveBeenCalledWith(
+        'sandbox-exec',
+        expect.arrayContaining([
+          '-f',
+          expect.stringContaining(
+            'gemini-sandbox-macos-permissive-open-a1b2c3d4e5f6.sb',
+          ),
+        ]),
+        expect.objectContaining({ stdio: 'inherit' }),
+      );
+
+      // Verify process on/off hooks were called for exit, SIGINT, and SIGTERM cleanups
+      expect(onSpy).toHaveBeenCalledWith('exit', expect.any(Function));
+      expect(onSpy).toHaveBeenCalledWith('SIGINT', expect.any(Function));
+      expect(onSpy).toHaveBeenCalledWith('SIGTERM', expect.any(Function));
+
+      expect(offSpy).toHaveBeenCalledWith('exit', expect.any(Function));
+      expect(offSpy).toHaveBeenCalledWith('SIGINT', expect.any(Function));
+      expect(offSpy).toHaveBeenCalledWith('SIGTERM', expect.any(Function));
+
+      // Verify fs.unlinkSync was called to clean up the temp file
+      expect(fs.unlinkSync).toHaveBeenCalledWith(
+        expect.stringContaining(
+          'gemini-sandbox-macos-permissive-open-a1b2c3d4e5f6.sb',
+        ),
+      );
+    });
+
+    it.each([
+      'permissive-open',
+      'permissive-closed',
+      'permissive-proxied',
+      'restrictive-open',
+      'restrictive-closed',
+      'restrictive-proxied',
+      'strict-open',
+      'strict-proxied',
+    ])(
+      'should fall back to embedded content successfully for profile "%s"',
+      async (profile) => {
+        vi.mocked(os.platform).mockReturnValue('darwin');
+        // Mock existsSync to return false for the profile file but true for temp directories
+        vi.mocked(fs.existsSync).mockImplementation((p) =>
+          String(p).includes('gemini-sandbox-macos-'),
+        );
+
+        vi.stubEnv('SEATBELT_PROFILE', profile);
+
+        const config: SandboxConfig = createMockSandboxConfig({
+          command: 'sandbox-exec',
+          image: 'some-image',
+        });
+
+        interface MockProcess extends EventEmitter {
+          stdout: EventEmitter;
+          stderr: EventEmitter;
+        }
+        const mockSpawnProcess = new EventEmitter() as MockProcess;
+        mockSpawnProcess.stdout = new EventEmitter();
+        mockSpawnProcess.stderr = new EventEmitter();
+        vi.mocked(spawn).mockReturnValue(
+          mockSpawnProcess as unknown as ReturnType<typeof spawn>,
+        );
+
+        const promise = start_sandbox(config, [], undefined, ['arg1']);
+
+        setTimeout(() => {
+          mockSpawnProcess.emit('close', 0);
+        }, 10);
+
+        await expect(promise).resolves.toBe(0);
+
+        // Verify fs.writeFileSync was called with the correct file mode and content for the profile
+        expect(fs.writeFileSync).toHaveBeenCalledWith(
+          expect.stringContaining(`gemini-sandbox-macos-${profile}-`),
+          expect.stringContaining('deny default'),
+          expect.objectContaining({
+            encoding: 'utf8',
+            mode: 0o600,
+          }),
+        );
+
+        vi.unstubAllEnvs();
+      },
+    );
+
     it('should handle Docker execution', async () => {
       const config: SandboxConfig = createMockSandboxConfig({
         command: 'docker',

packages/cli/src/utils/sandbox.ts

@@ -39,6 +39,7 @@ import {
   SANDBOX_PROXY_NAME,
   BUILTIN_SEATBELT_PROFILES,
 } from './sandboxUtils.js';
+import { BUILTIN_SEATBELT_PROFILE_CONTENTS } from './sandboxBuiltinProfiles.js';
 
 const execAsync = promisify(exec);
 const execFileAsync = promisify(execFile);
@@ -56,6 +57,41 @@ export async function start_sandbox(
   patcher.patch();
 
   let stopProxy: (() => void) | undefined = undefined;
+  let tempProfileFile: string | null = null;
+
+  const cleanup = () => {
+    if (tempProfileFile && fs.existsSync(tempProfileFile)) {
+      try {
+        fs.unlinkSync(tempProfileFile);
+      } catch {
+        // ignore
+      }
+      tempProfileFile = null;
+    }
+    if (stopProxy) {
+      try {
+        stopProxy();
+      } catch {
+        // ignore
+      }
+    }
+  };
+
+  const sigintHandler = () => {
+    cleanup();
+    process.off('SIGINT', sigintHandler);
+    process.kill(process.pid, 'SIGINT');
+  };
+
+  const sigtermHandler = () => {
+    cleanup();
+    process.off('SIGTERM', sigtermHandler);
+    process.kill(process.pid, 'SIGTERM');
+  };
+
+  process.on('exit', cleanup);
+  process.on('SIGINT', sigintHandler);
+  process.on('SIGTERM', sigtermHandler);
 
   try {
     if (config.command === 'sandbox-exec') {
@@ -81,161 +117,193 @@ export async function start_sandbox(
         profileFile = fs.existsSync(userProfileFile)
           ? userProfileFile
           : projectProfileFile;
-      }
-      if (!fs.existsSync(profileFile)) {
-        throw new FatalSandboxError(
-          `Missing macos seatbelt profile file '${profileFile}'`,
-        );
-      }
-      debugLogger.log(`using macos seatbelt (profile: ${profile}) ...`);
-      // if DEBUG is set, convert to --inspect-brk in NODE_OPTIONS
-      const nodeOptions = [
-        ...(process.env['DEBUG'] ? ['--inspect-brk'] : []),
-        ...nodeArgs,
-      ].join(' ');
-
-      const args = [
-        '-D',
-        `TARGET_DIR=${fs.realpathSync(process.cwd())}`,
-        '-D',
-        `TMP_DIR=${fs.realpathSync(os.tmpdir())}`,
-        '-D',
-        `HOME_DIR=${fs.realpathSync(homedir())}`,
-        '-D',
-        `CACHE_DIR=${fs.realpathSync((await execAsync('getconf DARWIN_USER_CACHE_DIR')).stdout.trim())}`,
-      ];
-
-      // Add included directories from the workspace context
-      // Always add 5 INCLUDE_DIR parameters to ensure .sb files can reference them
-      const MAX_INCLUDE_DIRS = 5;
-      const targetDir = fs.realpathSync(cliConfig?.getTargetDir() || '');
-      const includedDirs: string[] = [];
-
-      if (cliConfig) {
-        const workspaceContext = cliConfig.getWorkspaceContext();
-        const directories = workspaceContext.getDirectories();
-
-        // Filter out TARGET_DIR
-        for (const dir of directories) {
-          const realDir = fs.realpathSync(dir);
-          if (realDir !== targetDir) {
-            includedDirs.push(realDir);
+      } else {
+        // For builtin profiles, if the file doesn't exist on disk (e.g. bundled or bazel environments),
+        // write the embedded profile content to a temporary file.
+        if (!fs.existsSync(profileFile)) {
+          const content = BUILTIN_SEATBELT_PROFILE_CONTENTS[profile];
+          if (content) {
+            try {
+              const tempDir = fs.realpathSync(os.tmpdir());
+              const rand = randomBytes(8).toString('hex');
+              tempProfileFile = path.join(
+                tempDir,
+                `gemini-sandbox-macos-${profile}-${rand}.sb`,
+              );
+              fs.writeFileSync(tempProfileFile, content, {
+                encoding: 'utf8',
+                mode: 0o600,
+              });
+              profileFile = tempProfileFile;
+            } catch (err) {
+              debugLogger.warn(
+                `Failed to write temporary seatbelt profile: ${err}`,
+              );
+            }
           }
         }
       }
 
-      // Add custom allowed paths from config
-      if (config.allowedPaths) {
-        for (const hostPath of config.allowedPaths) {
-          if (
-            hostPath &&
-            path.isAbsolute(hostPath) &&
-            fs.existsSync(hostPath)
-          ) {
-            const realDir = fs.realpathSync(hostPath);
-            if (!includedDirs.includes(realDir) && realDir !== targetDir) {
+      try {
+        if (!fs.existsSync(profileFile)) {
+          throw new FatalSandboxError(
+            `Missing macos seatbelt profile file '${profileFile}'`,
+          );
+        }
+        debugLogger.log(`using macos seatbelt (profile: ${profile}) ...`);
+        // if DEBUG is set, convert to --inspect-brk in NODE_OPTIONS
+        const nodeOptions = [
+          ...(process.env['DEBUG'] ? ['--inspect-brk'] : []),
+          ...nodeArgs,
+        ].join(' ');
+
+        const args = [
+          '-D',
+          `TARGET_DIR=${fs.realpathSync(process.cwd())}`,
+          '-D',
+          `TMP_DIR=${fs.realpathSync(os.tmpdir())}`,
+          '-D',
+          `HOME_DIR=${fs.realpathSync(homedir())}`,
+          '-D',
+          `CACHE_DIR=${fs.realpathSync((await execAsync('getconf DARWIN_USER_CACHE_DIR')).stdout.trim())}`,
+        ];
+
+        // Add included directories from the workspace context
+        // Always add 5 INCLUDE_DIR parameters to ensure .sb files can reference them
+        const MAX_INCLUDE_DIRS = 5;
+        const targetDir = fs.realpathSync(cliConfig?.getTargetDir() || '');
+        const includedDirs: string[] = [];
+
+        if (cliConfig) {
+          const workspaceContext = cliConfig.getWorkspaceContext();
+          const directories = workspaceContext.getDirectories();
+
+          // Filter out TARGET_DIR
+          for (const dir of directories) {
+            const realDir = fs.realpathSync(dir);
+            if (realDir !== targetDir) {
               includedDirs.push(realDir);
             }
           }
         }
-      }
 
-      for (let i = 0; i < MAX_INCLUDE_DIRS; i++) {
-        let dirPath = '/dev/null'; // Default to a safe path that won't cause issues
-
-        if (i < includedDirs.length) {
-          dirPath = includedDirs[i];
-        }
-
-        args.push('-D', `INCLUDE_DIR_${i}=${dirPath}`);
-      }
-
-      const finalArgv = cliArgs;
-
-      args.push(
-        '-f',
-        profileFile,
-        'sh',
-        '-c',
-        [
-          `SANDBOX=sandbox-exec`,
-          `NODE_OPTIONS="${nodeOptions}"`,
-          ...finalArgv.map((arg) => quote([arg])),
-        ].join(' '),
-      );
-      // start and set up proxy if GEMINI_SANDBOX_PROXY_COMMAND is set
-      const proxyCommand = process.env['GEMINI_SANDBOX_PROXY_COMMAND'];
-      let proxyProcess: ChildProcess | undefined = undefined;
-      let sandboxProcess: ChildProcess | undefined = undefined;
-      const sandboxEnv = { ...process.env };
-      if (proxyCommand) {
-        const proxy =
-          process.env['HTTPS_PROXY'] ||
-          process.env['https_proxy'] ||
-          process.env['HTTP_PROXY'] ||
-          process.env['http_proxy'] ||
-          'http://localhost:8877';
-        sandboxEnv['HTTPS_PROXY'] = proxy;
-        sandboxEnv['https_proxy'] = proxy; // lower-case can be required, e.g. for curl
-        sandboxEnv['HTTP_PROXY'] = proxy;
-        sandboxEnv['http_proxy'] = proxy;
-        const noProxy = process.env['NO_PROXY'] || process.env['no_proxy'];
-        if (noProxy) {
-          sandboxEnv['NO_PROXY'] = noProxy;
-          sandboxEnv['no_proxy'] = noProxy;
-        }
-        proxyProcess = spawn(proxyCommand, {
-          stdio: ['ignore', 'pipe', 'pipe'],
-          shell: true,
-          detached: true,
-        });
-        // install handlers to stop proxy on exit/signal
-        stopProxy = () => {
-          debugLogger.log('stopping proxy ...');
-          if (proxyProcess?.pid) {
-            try {
-              process.kill(-proxyProcess.pid, 'SIGTERM');
-            } catch {
-              // ignore
+        // Add custom allowed paths from config
+        if (config.allowedPaths) {
+          for (const hostPath of config.allowedPaths) {
+            if (
+              hostPath &&
+              path.isAbsolute(hostPath) &&
+              fs.existsSync(hostPath)
+            ) {
+              const realDir = fs.realpathSync(hostPath);
+              if (!includedDirs.includes(realDir) && realDir !== targetDir) {
+                includedDirs.push(realDir);
+              }
             }
           }
-        };
-        process.on('exit', stopProxy);
-        process.on('SIGINT', stopProxy);
-        process.on('SIGTERM', stopProxy);
+        }
 
-        // commented out as it disrupts ink rendering
-        // proxyProcess.stdout?.on('data', (data) => {
-        //   console.info(data.toString());
-        // });
-        proxyProcess.stderr?.on('data', (data) => {
-          debugLogger.debug(`[PROXY STDERR]: ${data.toString().trim()}`);
-        });
-        proxyProcess.on('close', (code, signal) => {
-          if (sandboxProcess?.pid) {
-            process.kill(-sandboxProcess.pid, 'SIGTERM');
+        for (let i = 0; i < MAX_INCLUDE_DIRS; i++) {
+          let dirPath = '/dev/null'; // Default to a safe path that won't cause issues
+
+          if (i < includedDirs.length) {
+            dirPath = includedDirs[i];
           }
-          throw new FatalSandboxError(
-            `Proxy command '${proxyCommand}' exited with code ${code}, signal ${signal}`,
-          );
-        });
-        debugLogger.log('waiting for proxy to start ...');
-        await execAsync(
-          `until timeout 0.25 curl -s http://localhost:8877; do sleep 0.25; done`,
+
+          args.push('-D', `INCLUDE_DIR_${i}=${dirPath}`);
+        }
+
+        const finalArgv = cliArgs;
+
+        args.push(
+          '-f',
+          profileFile,
+          'sh',
+          '-c',
+          [
+            `SANDBOX=sandbox-exec`,
+            'NODE_OPTIONS=' + quote([nodeOptions]),
+            ...finalArgv.map((arg) => quote([arg])),
+          ].join(' '),
         );
-      }
-      // spawn child and let it inherit stdio
-      process.stdin.pause();
-      sandboxProcess = spawn(config.command, args, {
-        stdio: 'inherit',
-      });
-      return await new Promise((resolve, reject) => {
-        sandboxProcess?.on('error', reject);
-        sandboxProcess?.on('close', (code) => {
-          process.stdin.resume();
-          resolve(code ?? 1);
+        // start and set up proxy if GEMINI_SANDBOX_PROXY_COMMAND is set
+        const proxyCommand = process.env['GEMINI_SANDBOX_PROXY_COMMAND'];
+        let proxyProcess: ChildProcess | undefined = undefined;
+        let sandboxProcess: ChildProcess | undefined = undefined;
+        const sandboxEnv = { ...process.env };
+        if (proxyCommand) {
+          const proxy =
+            process.env['HTTPS_PROXY'] ||
+            process.env['https_proxy'] ||
+            process.env['HTTP_PROXY'] ||
+            process.env['http_proxy'] ||
+            'http://localhost:8877';
+          sandboxEnv['HTTPS_PROXY'] = proxy;
+          sandboxEnv['https_proxy'] = proxy; // lower-case can be required, e.g. for curl
+          sandboxEnv['HTTP_PROXY'] = proxy;
+          sandboxEnv['http_proxy'] = proxy;
+          const noProxy = process.env['NO_PROXY'] || process.env['no_proxy'];
+          if (noProxy) {
+            sandboxEnv['NO_PROXY'] = noProxy;
+            sandboxEnv['no_proxy'] = noProxy;
+          }
+          proxyProcess = spawn(proxyCommand, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            shell: true,
+            detached: true,
+          });
+          // install handlers to stop proxy on exit/signal
+          stopProxy = () => {
+            debugLogger.log('stopping proxy ...');
+            if (proxyProcess?.pid) {
+              try {
+                process.kill(-proxyProcess.pid, 'SIGTERM');
+              } catch {
+                // ignore
+              }
+            }
+          };
+
+          // commented out as it disrupts ink rendering
+          // proxyProcess.stdout?.on('data', (data) => {
+          //   console.info(data.toString());
+          // });
+          proxyProcess.stderr?.on('data', (data) => {
+            debugLogger.debug(`[PROXY STDERR]: ${data.toString().trim()}`);
+          });
+          proxyProcess.on('close', (code, signal) => {
+            if (sandboxProcess?.pid) {
+              process.kill(-sandboxProcess.pid, 'SIGTERM');
+            }
+            throw new FatalSandboxError(
+              `Proxy command '${proxyCommand}' exited with code ${code}, signal ${signal}`,
+            );
+          });
+          debugLogger.log('waiting for proxy to start ...');
+          await execAsync(
+            `until timeout 0.25 curl -s http://localhost:8877; do sleep 0.25; done`,
+          );
+        }
+        // spawn child and let it inherit stdio
+        process.stdin.pause();
+        sandboxProcess = spawn(config.command, args, {
+          stdio: 'inherit',
         });
-      });
+        return await new Promise((resolve, reject) => {
+          sandboxProcess?.on('error', (err) => {
+            cleanup();
+            reject(err);
+          });
+          sandboxProcess?.on('close', (code) => {
+            process.stdin.resume();
+            cleanup();
+            resolve(code ?? 1);
+          });
+        });
+      } catch (err) {
+        cleanup();
+        throw err;
+      }
     }
 
     if (config.command === 'lxc') {
@@ -768,9 +836,6 @@ export async function start_sandbox(
           // ignore
         }
       };
-      process.on('exit', stopProxy);
-      process.on('SIGINT', stopProxy);
-      process.on('SIGTERM', stopProxy);
 
       // commented out as it disrupts ink rendering
       // proxyProcess.stdout?.on('data', (data) => {
@@ -821,12 +886,10 @@ export async function start_sandbox(
       });
     });
   } finally {
-    if (stopProxy) {
-      stopProxy();
-      process.off('exit', stopProxy);
-      process.off('SIGINT', stopProxy);
-      process.off('SIGTERM', stopProxy);
-    }
+    process.off('exit', cleanup);
+    process.off('SIGINT', sigintHandler);
+    process.off('SIGTERM', sigtermHandler);
+    cleanup();
     patcher.cleanup();
   }
 }

packages/cli/src/utils/sandboxBuiltinProfiles.ts

@@ -0,0 +1,555 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+export const BUILTIN_SEATBELT_PROFILE_CONTENTS: Record<string, string> = {
+  'permissive-open': `(version 1)
+(deny default)
+(allow file-read*)
+(allow process-exec)
+(allow process-fork)
+(allow signal (target self))
+(allow sysctl-read
+    (sysctl-name "hw.activecpu")
+    (sysctl-name "hw.busfrequency_compat")
+    (sysctl-name "hw.byteorder")
+    (sysctl-name "hw.cacheconfig")
+    (sysctl-name "hw.cachelinesize_compat")
+    (sysctl-name "hw.cpufamily")
+    (sysctl-name "hw.cpufrequency_compat")
+    (sysctl-name "hw.cputype")
+    (sysctl-name "hw.l1dcachesize_compat")
+    (sysctl-name "hw.l1icachesize_compat")
+    (sysctl-name "hw.l2cachesize_compat")
+    (sysctl-name "hw.l3cachesize_compat")
+    (sysctl-name "hw.logicalcpu_max")
+    (sysctl-name "hw.machine")
+    (sysctl-name "hw.ncpu")
+    (sysctl-name "hw.nperflevels")
+    (sysctl-name "hw.optional.arm.FEAT_BF16")
+    (sysctl-name "hw.optional.arm.FEAT_DotProd")
+    (sysctl-name "hw.optional.arm.FEAT_FCMA")
+    (sysctl-name "hw.optional.arm.FEAT_FHM")
+    (sysctl-name "hw.optional.arm.FEAT_FP16")
+    (sysctl-name "hw.optional.arm.FEAT_I8MM")
+    (sysctl-name "hw.optional.arm.FEAT_JSCVT")
+    (sysctl-name "hw.optional.arm.FEAT_LSE")
+    (sysctl-name "hw.optional.arm.FEAT_RDM")
+    (sysctl-name "hw.optional.arm.FEAT_SHA512")
+    (sysctl-name "hw.optional.armv8_2_sha512")
+    (sysctl-name "hw.packages")
+    (sysctl-name "hw.pagesize_compat")
+    (sysctl-name "hw.physicalcpu_max")
+    (sysctl-name "hw.tbfrequency_compat")
+    (sysctl-name "hw.vectorunit")
+    (sysctl-name "kern.hostname")
+    (sysctl-name "kern.maxfilesperproc")
+    (sysctl-name "kern.osproductversion")
+    (sysctl-name "kern.osrelease")
+    (sysctl-name "kern.ostype")
+    (sysctl-name "kern.osvariant_status")
+    (sysctl-name "kern.osversion")
+    (sysctl-name "kern.secure_kernel")
+    (sysctl-name "kern.usrstack64")
+    (sysctl-name "kern.version")
+    (sysctl-name "sysctl.proc_cputype")
+    (sysctl-name-prefix "hw.perflevel")
+)
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+    (literal "/dev/ptmx")
+    (regex #"^/dev/ttys[0-9]*$")
+)
+(allow mach-lookup
+    (global-name "com.apple.sysmond")
+    (global-name "com.apple.system.opendirectoryd.libinfo")
+    (global-name "com.apple.system.opendirectoryd.membership")
+    (global-name "com.apple.bsd.dirhelper")
+    (global-name "com.apple.SecurityServer")
+    (global-name "com.apple.networkd")
+    (global-name "com.apple.ocspd")
+    (global-name "com.apple.trustd")
+    (global-name "com.apple.trustd.agent")
+    (global-name "com.apple.mDNSResponder")
+    (global-name "com.apple.mDNSResponderHelper")
+    (global-name "com.apple.SystemConfiguration.DNSConfiguration")
+    (global-name "com.apple.SystemConfiguration.configd")
+)
+(allow system-socket
+    (require-all
+        (socket-domain AF_SYSTEM)
+        (socket-protocol 2)
+    )
+)
+(allow file-ioctl (regex #"^/dev/tty.*"))
+(allow network-inbound (local ip "*:*"))
+(allow network-bind (local ip "*:*"))
+(allow network-outbound)`,
+
+  'permissive-proxied': `(version 1)
+(deny default)
+(allow file-read*)
+(allow process-exec)
+(allow process-fork)
+(allow signal (target self))
+(allow sysctl-read
+    (sysctl-name "hw.activecpu")
+    (sysctl-name "hw.busfrequency_compat")
+    (sysctl-name "hw.byteorder")
+    (sysctl-name "hw.cacheconfig")
+    (sysctl-name "hw.cachelinesize_compat")
+    (sysctl-name "hw.cpufamily")
+    (sysctl-name "hw.cpufrequency_compat")
+    (sysctl-name "hw.cputype")
+    (sysctl-name "hw.l1dcachesize_compat")
+    (sysctl-name "hw.l1icachesize_compat")
+    (sysctl-name "hw.l2cachesize_compat")
+    (sysctl-name "hw.l3cachesize_compat")
+    (sysctl-name "hw.logicalcpu_max")
+    (sysctl-name "hw.machine")
+    (sysctl-name "hw.ncpu")
+    (sysctl-name "hw.nperflevels")
+    (sysctl-name "hw.optional.arm.FEAT_BF16")
+    (sysctl-name "hw.optional.arm.FEAT_DotProd")
+    (sysctl-name "hw.optional.arm.FEAT_FCMA")
+    (sysctl-name "hw.optional.arm.FEAT_FHM")
+    (sysctl-name "hw.optional.arm.FEAT_FP16")
+    (sysctl-name "hw.optional.arm.FEAT_I8MM")
+    (sysctl-name "hw.optional.arm.FEAT_JSCVT")
+    (sysctl-name "hw.optional.arm.FEAT_LSE")
+    (sysctl-name "hw.optional.arm.FEAT_RDM")
+    (sysctl-name "hw.optional.arm.FEAT_SHA512")
+    (sysctl-name "hw.optional.armv8_2_sha512")
+    (sysctl-name "hw.packages")
+    (sysctl-name "hw.pagesize_compat")
+    (sysctl-name "hw.physicalcpu_max")
+    (sysctl-name "hw.tbfrequency_compat")
+    (sysctl-name "hw.vectorunit")
+    (sysctl-name "kern.hostname")
+    (sysctl-name "kern.maxfilesperproc")
+    (sysctl-name "kern.osproductversion")
+    (sysctl-name "kern.osrelease")
+    (sysctl-name "kern.ostype")
+    (sysctl-name "kern.osvariant_status")
+    (sysctl-name "kern.osversion")
+    (sysctl-name "kern.secure_kernel")
+    (sysctl-name "kern.usrstack64")
+    (sysctl-name "kern.version")
+    (sysctl-name "sysctl.proc_cputype")
+    (sysctl-name-prefix "hw.perflevel")
+)
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+    (literal "/dev/ptmx")
+    (regex #"^/dev/ttys[0-9]*$")
+)
+(allow mach-lookup
+    (global-name "com.apple.sysmond")
+    (global-name "com.apple.system.opendirectoryd.libinfo")
+    (global-name "com.apple.system.opendirectoryd.membership")
+    (global-name "com.apple.bsd.dirhelper")
+    (global-name "com.apple.SecurityServer")
+    (global-name "com.apple.networkd")
+    (global-name "com.apple.ocspd")
+    (global-name "com.apple.trustd")
+    (global-name "com.apple.trustd.agent")
+    (global-name "com.apple.mDNSResponder")
+    (global-name "com.apple.mDNSResponderHelper")
+    (global-name "com.apple.SystemConfiguration.DNSConfiguration")
+    (global-name "com.apple.SystemConfiguration.configd")
+)
+(allow system-socket
+    (require-all
+        (socket-domain AF_SYSTEM)
+        (socket-protocol 2)
+    )
+)
+(allow file-ioctl (regex #"^/dev/tty.*"))
+(allow network-inbound (local ip "localhost:9229"))
+(allow network-bind (local ip "*:*"))
+(allow network-outbound (remote tcp "localhost:8877"))`,
+
+  'restrictive-open': `(version 1)
+(deny default)
+(allow file-read*)
+(allow process-exec)
+(allow process-fork)
+(allow signal (target self))
+(allow sysctl-read
+  (sysctl-name "hw.activecpu")
+  (sysctl-name "hw.busfrequency_compat")
+  (sysctl-name "hw.byteorder")
+  (sysctl-name "hw.cacheconfig")
+  (sysctl-name "hw.cachelinesize_compat")
+  (sysctl-name "hw.cpufamily")
+  (sysctl-name "hw.cpufrequency_compat")
+  (sysctl-name "hw.cputype")
+  (sysctl-name "hw.l1dcachesize_compat")
+  (sysctl-name "hw.l1icachesize_compat")
+  (sysctl-name "hw.l2cachesize_compat")
+  (sysctl-name "hw.l3cachesize_compat")
+  (sysctl-name "hw.logicalcpu_max")
+  (sysctl-name "hw.machine")
+  (sysctl-name "hw.ncpu")
+  (sysctl-name "hw.nperflevels")
+  (sysctl-name "hw.optional.arm.FEAT_BF16")
+  (sysctl-name "hw.optional.arm.FEAT_DotProd")
+  (sysctl-name "hw.optional.arm.FEAT_FCMA")
+  (sysctl-name "hw.optional.arm.FEAT_FHM")
+  (sysctl-name "hw.optional.arm.FEAT_FP16")
+  (sysctl-name "hw.optional.arm.FEAT_I8MM")
+  (sysctl-name "hw.optional.arm.FEAT_JSCVT")
+  (sysctl-name "hw.optional.arm.FEAT_LSE")
+  (sysctl-name "hw.optional.arm.FEAT_RDM")
+  (sysctl-name "hw.optional.arm.FEAT_SHA512")
+  (sysctl-name "hw.optional.armv8_2_sha512")
+  (sysctl-name "hw.packages")
+  (sysctl-name "hw.pagesize_compat")
+  (sysctl-name "hw.physicalcpu_max")
+  (sysctl-name "hw.tbfrequency_compat")
+  (sysctl-name "hw.vectorunit")
+  (sysctl-name "kern.hostname")
+  (sysctl-name "kern.maxfilesperproc")
+  (sysctl-name "kern.osproductversion")
+  (sysctl-name "kern.osrelease")
+  (sysctl-name "kern.ostype")
+  (sysctl-name "kern.osvariant_status")
+  (sysctl-name "kern.osversion")
+  (sysctl-name "kern.secure_kernel")
+  (sysctl-name "kern.usrstack64")
+  (sysctl-name "kern.version")
+  (sysctl-name "sysctl.proc_cputype")
+  (sysctl-name-prefix "hw.perflevel")
+)
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+)
+(allow mach-lookup (global-name "com.apple.sysmond"))
+(allow file-ioctl (regex #"^/dev/tty.*"))
+(allow network-inbound (local ip "localhost:9229"))
+(allow network-outbound)`,
+
+  'restrictive-proxied': `(version 1)
+(deny default)
+(allow file-read*)
+(allow process-exec)
+(allow process-fork)
+(allow signal (target self))
+(allow sysctl-read
+  (sysctl-name "hw.activecpu")
+  (sysctl-name "hw.busfrequency_compat")
+  (sysctl-name "hw.byteorder")
+  (sysctl-name "hw.cacheconfig")
+  (sysctl-name "hw.cachelinesize_compat")
+  (sysctl-name "hw.cpufamily")
+  (sysctl-name "hw.cpufrequency_compat")
+  (sysctl-name "hw.cputype")
+  (sysctl-name "hw.l1dcachesize_compat")
+  (sysctl-name "hw.l1icachesize_compat")
+  (sysctl-name "hw.l2cachesize_compat")
+  (sysctl-name "hw.l3cachesize_compat")
+  (sysctl-name "hw.logicalcpu_max")
+  (sysctl-name "hw.machine")
+  (sysctl-name "hw.ncpu")
+  (sysctl-name "hw.nperflevels")
+  (sysctl-name "hw.optional.arm.FEAT_BF16")
+  (sysctl-name "hw.optional.arm.FEAT_DotProd")
+  (sysctl-name "hw.optional.arm.FEAT_FCMA")
+  (sysctl-name "hw.optional.arm.FEAT_FHM")
+  (sysctl-name "hw.optional.arm.FEAT_FP16")
+  (sysctl-name "hw.optional.arm.FEAT_I8MM")
+  (sysctl-name "hw.optional.arm.FEAT_JSCVT")
+  (sysctl-name "hw.optional.arm.FEAT_LSE")
+  (sysctl-name "hw.optional.arm.FEAT_RDM")
+  (sysctl-name "hw.optional.arm.FEAT_SHA512")
+  (sysctl-name "hw.optional.armv8_2_sha512")
+  (sysctl-name "hw.packages")
+  (sysctl-name "hw.pagesize_compat")
+  (sysctl-name "hw.physicalcpu_max")
+  (sysctl-name "hw.tbfrequency_compat")
+  (sysctl-name "hw.vectorunit")
+  (sysctl-name "kern.hostname")
+  (sysctl-name "kern.maxfilesperproc")
+  (sysctl-name "kern.osproductversion")
+  (sysctl-name "kern.osrelease")
+  (sysctl-name "kern.ostype")
+  (sysctl-name "kern.osvariant_status")
+  (sysctl-name "kern.osversion")
+  (sysctl-name "kern.secure_kernel")
+  (sysctl-name "kern.usrstack64")
+  (sysctl-name "kern.version")
+  (sysctl-name "sysctl.proc_cputype")
+  (sysctl-name-prefix "hw.perflevel")
+)
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+)
+(allow mach-lookup (global-name "com.apple.sysmond"))
+(allow file-ioctl (regex #"^/dev/tty.*"))
+(allow network-inbound (local ip "localhost:9229"))
+(allow network-outbound (remote tcp "localhost:8877"))`,
+
+  'strict-open': `(version 1)
+(deny default)
+(allow file-read*
+    (literal "/")
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (literal (string-append (param "HOME_DIR") "/.gitconfig"))
+    (subpath (string-append (param "HOME_DIR") "/.nvm"))
+    (subpath (string-append (param "HOME_DIR") "/.fnm"))
+    (subpath (string-append (param "HOME_DIR") "/.node"))
+    (subpath (string-append (param "HOME_DIR") "/.config"))
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (subpath "/usr")
+    (subpath "/bin")
+    (subpath "/sbin")
+    (subpath "/Library")
+    (subpath "/System")
+    (subpath "/private")
+    (subpath "/dev")
+    (subpath "/etc")
+    (subpath "/opt")
+    (subpath "/Applications")
+)
+(allow file-read-metadata)
+(allow process-exec)
+(allow process-fork)
+(allow signal (target self))
+(allow sysctl-read
+  (sysctl-name "hw.activecpu")
+  (sysctl-name "hw.busfrequency_compat")
+  (sysctl-name "hw.byteorder")
+  (sysctl-name "hw.cacheconfig")
+  (sysctl-name "hw.cachelinesize_compat")
+  (sysctl-name "hw.cpufamily")
+  (sysctl-name "hw.cpufrequency_compat")
+  (sysctl-name "hw.cputype")
+  (sysctl-name "hw.l1dcachesize_compat")
+  (sysctl-name "hw.l1icachesize_compat")
+  (sysctl-name "hw.l2cachesize_compat")
+  (sysctl-name "hw.l3cachesize_compat")
+  (sysctl-name "hw.logicalcpu_max")
+  (sysctl-name "hw.machine")
+  (sysctl-name "hw.ncpu")
+  (sysctl-name "hw.nperflevels")
+  (sysctl-name "hw.optional.arm.FEAT_BF16")
+  (sysctl-name "hw.optional.arm.FEAT_DotProd")
+  (sysctl-name "hw.optional.arm.FEAT_FCMA")
+  (sysctl-name "hw.optional.arm.FEAT_FHM")
+  (sysctl-name "hw.optional.arm.FEAT_FP16")
+  (sysctl-name "hw.optional.arm.FEAT_I8MM")
+  (sysctl-name "hw.optional.arm.FEAT_JSCVT")
+  (sysctl-name "hw.optional.arm.FEAT_LSE")
+  (sysctl-name "hw.optional.arm.FEAT_RDM")
+  (sysctl-name "hw.optional.arm.FEAT_SHA512")
+  (sysctl-name "hw.optional.armv8_2_sha512")
+  (sysctl-name "hw.packages")
+  (sysctl-name "hw.pagesize_compat")
+  (sysctl-name "hw.physicalcpu_max")
+  (sysctl-name "hw.tbfrequency_compat")
+  (sysctl-name "hw.vectorunit")
+  (sysctl-name "kern.hostname")
+  (sysctl-name "kern.maxfilesperproc")
+  (sysctl-name "kern.osproductversion")
+  (sysctl-name "kern.osrelease")
+  (sysctl-name "kern.ostype")
+  (sysctl-name "kern.osvariant_status")
+  (sysctl-name "kern.osversion")
+  (sysctl-name "kern.secure_kernel")
+  (sysctl-name "kern.usrstack64")
+  (sysctl-name "kern.version")
+  (sysctl-name "sysctl.proc_cputype")
+  (sysctl-name-prefix "hw.perflevel")
+)
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+)
+(allow mach-lookup (global-name "com.apple.sysmond"))
+(allow file-ioctl (regex #"^/dev/tty.*"))
+(allow network-inbound (local ip "localhost:9229"))
+(allow network-outbound)`,
+
+  'strict-proxied': `(version 1)
+(deny default)
+(allow file-read*
+    (literal "/")
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (literal (string-append (param "HOME_DIR") "/.gitconfig"))
+    (subpath (string-append (param "HOME_DIR") "/.nvm"))
+    (subpath (string-append (param "HOME_DIR") "/.fnm"))
+    (subpath (string-append (param "HOME_DIR") "/.node"))
+    (subpath (string-append (param "HOME_DIR") "/.config"))
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (subpath "/usr")
+    (subpath "/bin")
+    (subpath "/sbin")
+    (subpath "/Library")
+    (subpath "/System")
+    (subpath "/private")
+    (subpath "/dev")
+    (subpath "/etc")
+    (subpath "/opt")
+    (subpath "/Applications")
+)
+(allow file-read-metadata)
+(allow process-exec)
+(allow process-fork)
+(allow signal (target self))
+(allow sysctl-read
+  (sysctl-name "hw.activecpu")
+  (sysctl-name "hw.busfrequency_compat")
+  (sysctl-name "hw.byteorder")
+  (sysctl-name "hw.cacheconfig")
+  (sysctl-name "hw.cachelinesize_compat")
+  (sysctl-name "hw.cpufamily")
+  (sysctl-name "hw.cpufrequency_compat")
+  (sysctl-name "hw.cputype")
+  (sysctl-name "hw.l1dcachesize_compat")
+  (sysctl-name "hw.l1icachesize_compat")
+  (sysctl-name "hw.l2cachesize_compat")
+  (sysctl-name "hw.l3cachesize_compat")
+  (sysctl-name "hw.logicalcpu_max")
+  (sysctl-name "hw.machine")
+  (sysctl-name "hw.ncpu")
+  (sysctl-name "hw.nperflevels")
+  (sysctl-name "hw.optional.arm.FEAT_BF16")
+  (sysctl-name "hw.optional.arm.FEAT_DotProd")
+  (sysctl-name "hw.optional.arm.FEAT_FCMA")
+  (sysctl-name "hw.optional.arm.FEAT_FHM")
+  (sysctl-name "hw.optional.arm.FEAT_FP16")
+  (sysctl-name "hw.optional.arm.FEAT_I8MM")
+  (sysctl-name "hw.optional.arm.FEAT_JSCVT")
+  (sysctl-name "hw.optional.arm.FEAT_LSE")
+  (sysctl-name "hw.optional.arm.FEAT_RDM")
+  (sysctl-name "hw.optional.arm.FEAT_SHA512")
+  (sysctl-name "hw.optional.armv8_2_sha512")
+  (sysctl-name "hw.packages")
+  (sysctl-name "hw.pagesize_compat")
+  (sysctl-name "hw.physicalcpu_max")
+  (sysctl-name "hw.tbfrequency_compat")
+  (sysctl-name "hw.vectorunit")
+  (sysctl-name "kern.hostname")
+  (sysctl-name "kern.maxfilesperproc")
+  (sysctl-name "kern.osproductversion")
+  (sysctl-name "kern.osrelease")
+  (sysctl-name "kern.ostype")
+  (sysctl-name "kern.osvariant_status")
+  (sysctl-name "kern.osversion")
+  (sysctl-name "kern.secure_kernel")
+  (sysctl-name "kern.usrstack64")
+  (sysctl-name "kern.version")
+  (sysctl-name "sysctl.proc_cputype")
+  (sysctl-name-prefix "hw.perflevel")
+)
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+)
+(allow mach-lookup (global-name "com.apple.sysmond"))
+(allow file-ioctl (regex #"^/dev/tty.*"))
+(allow network-inbound (local ip "localhost:9229"))
+(allow network-outbound (remote tcp "localhost:8877"))`,
+};
+
+// Map standard 'closed' profiles to their strict counterparts for backward compatibility and fallback support
+BUILTIN_SEATBELT_PROFILE_CONTENTS['permissive-closed'] =
+  BUILTIN_SEATBELT_PROFILE_CONTENTS['strict-open'];
+BUILTIN_SEATBELT_PROFILE_CONTENTS['restrictive-closed'] =
+  BUILTIN_SEATBELT_PROFILE_CONTENTS['strict-proxied'];

packages/cli/src/utils/sandboxUtils.ts

@@ -15,8 +15,10 @@ export const SANDBOX_NETWORK_NAME = 'gemini-cli-sandbox';
 export const SANDBOX_PROXY_NAME = 'gemini-cli-sandbox-proxy';
 export const BUILTIN_SEATBELT_PROFILES = [
   'permissive-open',
+  'permissive-closed',
   'permissive-proxied',
   'restrictive-open',
+  'restrictive-closed',
   'restrictive-proxied',
   'strict-open',
   'strict-proxied',

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-core",
-  "version": "0.52.0-nightly.20260715.gfa975395b",
+  "version": "0.55.1",
   "description": "Gemini CLI Core",
   "license": "Apache-2.0",
   "repository": {

packages/core/src/agent/event-translator.test.ts

@@ -516,10 +516,34 @@ describe('translateEvent', () => {
   });
 
   describe('InvalidStream events', () => {
-    it('emits fatal error', () => {
+    it('emits fatal error with specific message from event', () => {
       state.streamStartEmitted = true;
       const event: ServerGeminiStreamEvent = {
         type: GeminiEventType.InvalidStream,
+        value: {
+          type: 'NO_RESPONSE_TEXT',
+          message: 'Empty response',
+        },
+      };
+      const result = translateEvent(event, state);
+      expect(result).toHaveLength(1);
+      const err = result[0] as AgentEvent<'error'>;
+      expect(err.status).toBe('INTERNAL');
+      expect(err.message).toBe('Empty response');
+      expect(err.fatal).toBe(true);
+      expect(err._meta?.['code']).toBe('INVALID_STREAM');
+      expect(err._meta?.['errorType']).toBe('NO_RESPONSE_TEXT');
+      expect(err._meta?.['rawMessage']).toBe('Empty response');
+    });
+
+    it('falls back to default message when message is missing', () => {
+      state.streamStartEmitted = true;
+      const event: ServerGeminiStreamEvent = {
+        type: GeminiEventType.InvalidStream,
+        value: {
+          type: 'NO_RESPONSE_TEXT',
+          message: '',
+        },
       };
       const result = translateEvent(event, state);
       expect(result).toHaveLength(1);

packages/core/src/agent/event-translator.ts

@@ -222,8 +222,15 @@ export function translateEvent(
       out.push(
         makeEvent('error', state, {
           status: 'INTERNAL',
-          message: 'Invalid stream received from model',
+          message:
+            event.value?.message?.trim() ||
+            'Invalid stream received from model',
           fatal: true,
+          _meta: {
+            code: 'INVALID_STREAM',
+            errorType: event.value?.type,
+            rawMessage: event.value?.message,
+          },
         }),
       );
       break;

packages/core/src/agent/legacy-agent-session.ts

@@ -10,7 +10,7 @@
  */
 
 import { GeminiEventType } from '../core/turn.js';
-import type { Part } from '@google/genai';
+import type { Part, FinishReason } from '@google/genai';
 import type { GeminiClient } from '../core/client.js';
 import type { Config } from '../config/config.js';
 import type { ToolCallRequestInfo } from '../scheduler/types.js';
@@ -192,6 +192,7 @@ export class LegacyAgentProtocol implements AgentProtocol {
       }
 
       const toolCallRequests: ToolCallRequestInfo[] = [];
+      let finishedReason: FinishReason | undefined = undefined;
       const responseStream = this._client.sendMessageStream(
         currentParts,
         this._abortController.signal,
@@ -220,10 +221,7 @@ export class LegacyAgentProtocol implements AgentProtocol {
             this._finishStream('failed');
             return;
           case GeminiEventType.Finished:
-            if (toolCallRequests.length === 0) {
-              this._finishStream(mapFinishReason(event.value.reason));
-              return;
-            }
+            finishedReason = event.value.reason;
             break;
           case GeminiEventType.AgentExecutionStopped:
           case GeminiEventType.UserCancelled:
@@ -241,7 +239,11 @@ export class LegacyAgentProtocol implements AgentProtocol {
       }
 
       if (toolCallRequests.length === 0) {
-        this._finishStream('completed');
+        if (finishedReason !== undefined) {
+          this._finishStream(mapFinishReason(finishedReason));
+        } else {
+          this._finishStream('completed');
+        }
         return;
       }
 

packages/core/src/agents/auth-provider/credential-leak-prevention.test.ts

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi, beforeEach, type Mock } from 'vitest';
+import { GoogleCredentialsAuthProvider } from './google-credentials-provider.js';
+import type { GoogleCredentialsAuthConfig } from './types.js';
+import { GoogleAuth } from 'google-auth-library';
+
+vi.mock('google-auth-library', () => ({
+  GoogleAuth: vi.fn(),
+}));
+
+describe('Credential Leak Prevention (RCA / PoC Verification)', () => {
+  const mockConfig: GoogleCredentialsAuthConfig = {
+    type: 'google-credentials',
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    (GoogleAuth as unknown as Mock).mockImplementation(() => ({
+      getClient: vi.fn().mockResolvedValue({
+        getAccessToken: vi.fn().mockResolvedValue({ token: 'leaked-token' }),
+        credentials: { expiry_date: Date.now() + 3600 * 1000 },
+      }),
+      getIdTokenClient: vi.fn().mockResolvedValue({
+        idTokenProvider: {
+          fetchIdToken: vi.fn().mockResolvedValue('leaked-id-token'),
+        },
+      }),
+    }));
+  });
+
+  it('should FAIL (throw error) when trying to initialize with an untrusted arbitrary remote agent URL (reproducing vulnerability prevention)', () => {
+    // This test simulates the reproduction scenario: registering a remote agent with an arbitrary external URL
+    // e.g., http://127.0.0.1:1337 or https://malicious-agent.evil.com
+    const untrustedUrls = [
+      {
+        url: 'http://127.0.0.1:1337/.well-known/agent.json',
+        error: /requires HTTPS/,
+      },
+      {
+        url: 'https://malicious-agent.evil.com/card',
+        error: /is not an allowed host/,
+      },
+      {
+        url: 'https://untrusted-third-party.com/agent',
+        error: /is not an allowed host/,
+      },
+    ];
+
+    for (const item of untrustedUrls) {
+      expect(() => {
+        new GoogleCredentialsAuthProvider(mockConfig, item.url);
+      }).toThrow(item.error);
+    }
+  });
+
+  it('should SUCCEED only for allowed Google Services (proving the allowlist constraint)', () => {
+    const trustedUrls = [
+      'https://language.googleapis.com/v1/models',
+      'https://vertex-ai-agent.googleapis.com/agent',
+      'https://my-secure-service-abc.run.app/card',
+    ];
+
+    for (const url of trustedUrls) {
+      expect(() => {
+        new GoogleCredentialsAuthProvider(mockConfig, url);
+      }).not.toThrow();
+    }
+  });
+});

packages/core/src/agents/auth-provider/google-credentials-provider.test.ts

@@ -82,6 +82,24 @@ describe('GoogleCredentialsAuthProvider', () => {
           ),
       ).not.toThrow();
     });
+
+    it('throws if the protocol is not HTTPS', () => {
+      expect(
+        () =>
+          new GoogleCredentialsAuthProvider(
+            mockConfig,
+            'http://language.googleapis.com/v1/models',
+          ),
+      ).toThrow(/requires HTTPS/);
+
+      expect(
+        () =>
+          new GoogleCredentialsAuthProvider(
+            mockConfig,
+            'http://my-cloud-run-service.run.app',
+          ),
+      ).toThrow(/requires HTTPS/);
+    });
   });
 
   describe('Token Fetching', () => {

packages/core/src/agents/auth-provider/google-credentials-provider.ts

@@ -40,7 +40,14 @@ export class GoogleCredentialsAuthProvider extends BaseA2AAuthProvider {
       );
     }
 
-    const hostname = new URL(targetUrl).hostname;
+    const urlObj = new URL(targetUrl);
+    if (urlObj.protocol !== 'https:') {
+      throw new Error(
+        `Protocol "${urlObj.protocol}" is not secure. Google Credential provider requires HTTPS.`,
+      );
+    }
+
+    const hostname = urlObj.hostname;
     const isRunAppHost = CLOUD_RUN_HOST_REGEX.test(hostname);
 
     if (isRunAppHost) {

packages/core/src/availability/autoRoutingFallback.integration.test.ts

@@ -414,4 +414,86 @@ describe('Auto Routing Fallback Integration', () => {
       'Pro success',
     );
   });
+
+  it('should rotate session ID on fallback and retry successfully with the Flash model', async () => {
+    const originalSessionId = 'test-session-rotate-id';
+    config = new Config({
+      sessionId: originalSessionId,
+      targetDir: '/test',
+      debugMode: false,
+      cwd: '/test',
+      model: PREVIEW_GEMINI_MODEL_AUTO,
+    });
+
+    vi.spyOn(config, 'isInteractive').mockReturnValue(true);
+
+    client = new BaseLlmClient(
+      fakeGenerator,
+      config,
+      AuthType.LOGIN_WITH_GOOGLE,
+    );
+
+    let attemptsPro = 0;
+    let attemptsFlash = 0;
+
+    const mockGoogleApiError = {
+      code: 429,
+      message:
+        'Automatically switching from gemini-2.5-pro to gemini-2.5-flash for faster responses for the remainder of this session. Possible reasons for this are...',
+      details: [],
+    };
+
+    vi.spyOn(fakeGenerator, 'generateContent').mockImplementation(
+      async (params) => {
+        if (params.model === PREVIEW_GEMINI_MODEL) {
+          attemptsPro++;
+          throw new RetryableQuotaError(
+            'Quota exceeded for Pro',
+            mockGoogleApiError,
+            0,
+          );
+        } else if (params.model === PREVIEW_GEMINI_FLASH_MODEL) {
+          attemptsFlash++;
+          return {
+            candidates: [
+              {
+                content: {
+                  role: 'model',
+                  parts: [{ text: 'Flash success after rotation' }],
+                },
+              },
+            ],
+          } as unknown as GenerateContentResponse;
+        }
+        throw new Error(`Unexpected model: ${params.model}`);
+      },
+    );
+
+    config.setFallbackModelHandler(
+      async (_failed, _fallback, _error): Promise<FallbackIntent | null> =>
+        'retry_always', // Approve switch to Flash
+    );
+
+    const promise = client.generateContent({
+      modelConfigKey: { model: PREVIEW_GEMINI_MODEL, isChatModel: true },
+      contents: [{ role: 'user', parts: [{ text: 'test query' }] }],
+      abortSignal: new AbortController().signal,
+      promptId: 'test-prompt',
+      role: LlmRole.UTILITY_TOOL,
+    });
+
+    await vi.runAllTimersAsync();
+    const result = await promise;
+
+    // Verify it resolved to Flash success instead of failing with Please submit a new query
+    expect(result.candidates?.[0]?.content?.parts?.[0]?.text).toBe(
+      'Flash success after rotation',
+    );
+    expect(attemptsPro).toBe(3);
+    expect(attemptsFlash).toBe(1);
+
+    // Verify session ID has been rotated
+    expect(config.getSessionId()).not.toBe(originalSessionId);
+    expect(config.getSessionId()).toBeDefined();
+  });
 });

packages/core/src/code_assist/server.ts

@@ -86,6 +86,10 @@ export class CodeAssistServer implements ContentGenerator {
     readonly config?: Config,
   ) {}
 
+  getEffectiveSessionId(): string | undefined {
+    return this.config?.getSessionId() ?? this.sessionId;
+  }
+
   async generateContentStream(
     req: GenerateContentParameters,
     userPromptId: string,
@@ -117,7 +121,7 @@ export class CodeAssistServer implements ContentGenerator {
           req,
           userPromptId,
           this.projectId,
-          this.sessionId,
+          this.getEffectiveSessionId(),
           enabledCreditTypes,
         ),
         req.config?.abortSignal,
@@ -153,7 +157,7 @@ export class CodeAssistServer implements ContentGenerator {
           translatedResponse,
           streamingLatency,
           req.config?.abortSignal,
-          server.sessionId, // Use sessionId as trajectoryId
+          server.getEffectiveSessionId(), // Use sessionId as trajectoryId
         );
 
         if (response.consumedCredits) {
@@ -204,7 +208,7 @@ export class CodeAssistServer implements ContentGenerator {
         req,
         userPromptId,
         this.projectId,
-        this.sessionId,
+        this.getEffectiveSessionId(),
         undefined,
       ),
       req.config?.abortSignal,
@@ -224,7 +228,7 @@ export class CodeAssistServer implements ContentGenerator {
       translatedResponse,
       streamingLatency,
       req.config?.abortSignal,
-      this.sessionId, // Use sessionId as trajectoryId
+      this.getEffectiveSessionId(), // Use sessionId as trajectoryId
     );
 
     if (response.remainingCredits) {

packages/core/src/config/config.test.ts

@@ -3198,6 +3198,24 @@ describe('Config Quota & Preview Model Access', () => {
       expect(config.getHasAccessToPreviewModel()).toBe(false);
     });
 
+    it('should reverse-map gemini-3-flash back to gemini-3.5-flash in modelQuotas', async () => {
+      mockCodeAssistServer.retrieveUserQuota.mockResolvedValue({
+        buckets: [
+          {
+            modelId: 'gemini-3-flash',
+            remainingAmount: '90',
+            remainingFraction: 0.9,
+          },
+        ],
+      });
+
+      config.setModel('gemini-3.5-flash');
+      await config.refreshUserQuota();
+
+      expect(config.getQuotaRemaining()).toBe(90);
+      expect(config.getQuotaLimit()).toBe(100);
+    });
+
     it('should calculate pooled quota correctly for auto models', async () => {
       mockCodeAssistServer.retrieveUserQuota.mockResolvedValue({
         buckets: [
@@ -4134,7 +4152,9 @@ describe('Plans Directory Initialization', () => {
 
     const plansDir = config.storage.getPlansDir();
     // Should NOT create the directory eagerly
-    expect(fs.promises.mkdir).not.toHaveBeenCalled();
+    expect(fs.promises.mkdir).not.toHaveBeenCalledWith(plansDir, {
+      recursive: true,
+    });
     // Should check if it exists
     expect(fs.promises.access).toHaveBeenCalledWith(plansDir);
 
@@ -4152,7 +4172,9 @@ describe('Plans Directory Initialization', () => {
     await config.initialize();
 
     const plansDir = config.storage.getPlansDir();
-    expect(fs.promises.mkdir).not.toHaveBeenCalled();
+    expect(fs.promises.mkdir).not.toHaveBeenCalledWith(plansDir, {
+      recursive: true,
+    });
     expect(fs.promises.access).toHaveBeenCalledWith(plansDir);
 
     const context = config.getWorkspaceContext();

packages/core/src/config/config.ts

@@ -87,6 +87,8 @@ import {
   PREVIEW_GEMINI_FLASH_MODEL,
   resolveModel,
   setFlashModels,
+  DEFAULT_GEMINI_3_5_FLASH_MODEL,
+  SECONDARY_GEMINI_3_5_FLASH_MODEL,
 } from './models.js';
 import { shouldAttemptBrowserLaunch } from '../utils/browser.js';
 import type { MCPOAuthConfig } from '../mcp/oauth-provider.js';
@@ -1861,6 +1863,10 @@ export class Config implements McpContext, AgentLoopContext {
     }
   }
 
+  rotateSessionId(sessionId: string): void {
+    this._sessionId = sessionId;
+  }
+
   resetNewSessionState(sessionId: string): void {
     this.setSessionId(sessionId);
   }
@@ -1934,6 +1940,9 @@ export class Config implements McpContext, AgentLoopContext {
   }
 
   activateFallbackMode(model: string, failedModel?: string): void {
+    debugLogger.log(
+      `Model fallback activated: switching from ${failedModel ?? 'unknown'} to ${model}`,
+    );
     if (this.getActiveModel() !== model) {
       this.setModel(model, true);
     }
@@ -2313,6 +2322,11 @@ export class Config implements McpContext, AgentLoopContext {
             continue;
           }
 
+          let modelId = bucket.modelId;
+          if (modelId === SECONDARY_GEMINI_3_5_FLASH_MODEL) {
+            modelId = DEFAULT_GEMINI_3_5_FLASH_MODEL;
+          }
+
           let remaining: number;
           let limit: number;
 
@@ -2321,7 +2335,7 @@ export class Config implements McpContext, AgentLoopContext {
             limit =
               bucket.remainingFraction > 0
                 ? Math.round(remaining / bucket.remainingFraction)
-                : (this.modelQuotas.get(bucket.modelId)?.limit ?? 0);
+                : (this.modelQuotas.get(modelId)?.limit ?? 0);
           } else {
             // Server only sent remainingFraction — use a normalized scale.
             limit = 100;
@@ -2329,7 +2343,7 @@ export class Config implements McpContext, AgentLoopContext {
           }
 
           if (!isNaN(remaining) && Number.isFinite(limit) && limit > 0) {
-            this.modelQuotas.set(bucket.modelId, {
+            this.modelQuotas.set(modelId, {
               remaining,
               limit,
               resetTime: bucket.resetTime,

packages/core/src/core/__snapshots__/prompts.test.ts.snap

@@ -165,6 +165,16 @@ ONLY use the built-in \`exit_plan_mode\` tool to present the plan for formal app
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -361,6 +371,16 @@ An approved plan is available for this task at \`../plans/feature-x.md\`.
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -671,6 +691,16 @@ ONLY use the built-in \`exit_plan_mode\` tool to present the plan for formal app
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -845,6 +875,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -1005,6 +1045,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -1148,6 +1198,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -1837,6 +1897,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -2011,6 +2081,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -2189,6 +2269,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -2367,6 +2457,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -2541,6 +2641,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -2709,6 +2819,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -2851,6 +2971,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -3025,6 +3155,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -3345,6 +3485,16 @@ You are operating with a persistent file-based task tracking system located at \
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -3774,6 +3924,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -3948,6 +4108,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -4241,6 +4411,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.
@@ -4415,6 +4595,16 @@ Operate using a **Research -> Strategy -> Execution** lifecycle. For the Executi
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. \`replace\`, \`write_file\`), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the \`replace\` tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the \`run_shell_command\` tool for running shell commands, remembering the safety rule to explain modifying commands first.

packages/core/src/core/agentChatHistory.test.ts

@@ -0,0 +1,110 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect } from 'vitest';
+import { AgentChatHistory, type HistoryTurn } from './agentChatHistory.js';
+
+describe('AgentChatHistory', () => {
+  const dummyTurns: HistoryTurn[] = [
+    {
+      id: 'turn-1',
+      content: { role: 'user', parts: [{ text: 'Hello' }] },
+    },
+    {
+      id: 'turn-2',
+      content: { role: 'model', parts: [{ text: 'Hi there' }] },
+    },
+    {
+      id: 'turn-3',
+      content: { role: 'user', parts: [{ text: 'How are you?' }] },
+    },
+  ];
+
+  it('should initialize with empty history by default', () => {
+    const history = new AgentChatHistory();
+    expect(history.length).toBe(0);
+    expect(history.get()).toEqual([]);
+  });
+
+  it('should initialize with provided turns', () => {
+    const history = new AgentChatHistory(dummyTurns);
+    expect(history.length).toBe(3);
+    expect(history.get()).toEqual(dummyTurns);
+  });
+
+  it('should push new turns', () => {
+    const history = new AgentChatHistory();
+    history.push(dummyTurns[0]);
+    expect(history.length).toBe(1);
+    expect(history.get()[0]).toEqual(dummyTurns[0]);
+  });
+
+  it('should set and overwrite history turns', () => {
+    const history = new AgentChatHistory(dummyTurns.slice(0, 1));
+    expect(history.length).toBe(1);
+    history.set(dummyTurns);
+    expect(history.length).toBe(3);
+    expect(history.get()).toEqual(dummyTurns);
+  });
+
+  it('should clear history', () => {
+    const history = new AgentChatHistory(dummyTurns);
+    expect(history.length).toBe(3);
+    history.clear();
+    expect(history.length).toBe(0);
+    expect(history.get()).toEqual([]);
+  });
+
+  describe('rollback', () => {
+    it('should roll back history to a specified length', () => {
+      const history = new AgentChatHistory(dummyTurns);
+      history.rollback(1);
+      expect(history.length).toBe(1);
+      expect(history.get()).toEqual([dummyTurns[0]]);
+    });
+
+    it('should roll back to 0', () => {
+      const history = new AgentChatHistory(dummyTurns);
+      history.rollback(0);
+      expect(history.length).toBe(0);
+      expect(history.get()).toEqual([]);
+    });
+
+    it('should do nothing if rollback length is out of bounds (negative)', () => {
+      const history = new AgentChatHistory(dummyTurns);
+      history.rollback(-1);
+      expect(history.length).toBe(3);
+      expect(history.get()).toEqual(dummyTurns);
+    });
+
+    it('should do nothing if rollback length is out of bounds (greater than current history length)', () => {
+      const history = new AgentChatHistory(dummyTurns);
+      history.rollback(5);
+      expect(history.length).toBe(3);
+      expect(history.get()).toEqual(dummyTurns);
+    });
+  });
+
+  it('should return raw Content array via getContents()', () => {
+    const history = new AgentChatHistory(dummyTurns);
+    expect(history.getContents()).toEqual(
+      dummyTurns.map((turn) => turn.content),
+    );
+  });
+
+  it('should support mapping and flatMapping operations', () => {
+    const history = new AgentChatHistory(dummyTurns);
+    const mappedIds = history.map((turn) => turn.id);
+    expect(mappedIds).toEqual(['turn-1', 'turn-2', 'turn-3']);
+
+    const flatMappedParts = history.flatMap((turn) => turn.content.parts || []);
+    expect(flatMappedParts).toEqual([
+      { text: 'Hello' },
+      { text: 'Hi there' },
+      { text: 'How are you?' },
+    ]);
+  });
+});

packages/core/src/core/agentChatHistory.ts

@@ -46,6 +46,16 @@ export class AgentChatHistory {
     this.history = [];
   }
 
+  /**
+   * Rolls back the history to a specified length.
+   * Useful when a stream fails and we need to remove the un-responded turn(s).
+   */
+  rollback(length: number) {
+    if (length >= 0 && length <= this.history.length) {
+      this.history = this.history.slice(0, length);
+    }
+  }
+
   get(): readonly HistoryTurn[] {
     return this.history;
   }

packages/core/src/core/client.test.ts

@@ -212,7 +212,7 @@ describe('Gemini Client (client.ts)', () => {
         .fn()
         .mockReturnValue(contentGeneratorConfig),
       getToolRegistry: vi.fn().mockReturnValue(mockToolRegistry),
-      getModel: vi.fn().mockReturnValue('test-model'),
+      getModel: vi.fn().mockReturnValue('gemini-1.5-pro'),
       getUserTier: vi.fn().mockReturnValue(undefined),
       getEmbeddingModel: vi.fn().mockReturnValue('test-embedding-model'),
       getApiKey: vi.fn().mockReturnValue('test-key'),

packages/core/src/core/geminiChat.ts

@@ -30,7 +30,11 @@ import {
   getRetryErrorType,
 } from '../utils/retry.js';
 import type { ValidationRequiredError } from '../utils/googleQuotaErrors.js';
-import { resolveModel, supportsModernFeatures } from '../config/models.js';
+import {
+  resolveModel,
+  supportsModernFeatures,
+  isGemini2Model,
+} from '../config/models.js';
 import { hasCycleInSchema } from '../tools/tools.js';
 import type { StructuredError } from './turn.js';
 import type { CompletedToolCall } from '../scheduler/types.js';
@@ -104,6 +108,13 @@ const MID_STREAM_RETRY_OPTIONS: MidStreamRetryOptions = {
 
 export const SYNTHETIC_THOUGHT_SIGNATURE = 'skip_thought_signature_validator';
 
+/**
+ * Stands in for a model turn that never arrived because the stream failed
+ * after a tool response was already committed to history.
+ */
+export const INTERRUPTED_RESPONSE_PLACEHOLDER =
+  '[The previous response was interrupted before it completed.]';
+
 /**
  * Internal interface for parts that carry the magic 'callIndex' property
  * used during model response consolidation.
@@ -221,7 +232,12 @@ export class InvalidStreamError extends Error {
     | 'NO_FINISH_REASON'
     | 'NO_RESPONSE_TEXT'
     | 'MALFORMED_FUNCTION_CALL'
-    | 'UNEXPECTED_TOOL_CALL';
+    | 'UNEXPECTED_TOOL_CALL'
+    | 'MAX_TOKENS_EXCEEDED'
+    | 'SAFETY_BLOCKED'
+    | 'RECITATION_BLOCKED'
+    | 'OTHER_BLOCKED'
+    | 'THINKING_ONLY_RESPONSE';
 
   constructor(
     message: string,
@@ -229,7 +245,12 @@ export class InvalidStreamError extends Error {
       | 'NO_FINISH_REASON'
       | 'NO_RESPONSE_TEXT'
       | 'MALFORMED_FUNCTION_CALL'
-      | 'UNEXPECTED_TOOL_CALL',
+      | 'UNEXPECTED_TOOL_CALL'
+      | 'MAX_TOKENS_EXCEEDED'
+      | 'SAFETY_BLOCKED'
+      | 'RECITATION_BLOCKED'
+      | 'OTHER_BLOCKED'
+      | 'THINKING_ONLY_RESPONSE',
   ) {
     super(message);
     this.name = 'InvalidStreamError';
@@ -383,6 +404,9 @@ export class GeminiChat {
   ): Promise<AsyncGenerator<StreamEvent>> {
     await this.sendPromise;
 
+    const historyLengthBefore = this.agentHistory.length;
+    const baselinePromptTokenCount = this.lastPromptTokenCount;
+
     let streamDoneResolver: () => void;
     const streamDonePromise = new Promise<void>((resolve) => {
       streamDoneResolver = resolve;
@@ -390,6 +414,17 @@ export class GeminiChat {
     this.sendPromise = streamDonePromise;
 
     let userContent = createUserContent(message);
+    const isOriginalFunctionResponse = isFunctionResponse(userContent);
+
+    // A turn can end leaving history on an unanswered tool response: a stream
+    // error after the response was committed, or a cancelled tool call. Close
+    // it before recording a genuinely new user message, otherwise the two user
+    // turns are coalesced into one and the model continues the trailing text
+    // instead of answering it.
+    if (!isOriginalFunctionResponse) {
+      this.closeUnansweredToolResponseTurn();
+    }
+
     const { model } =
       this.context.config.modelConfigService.getResolvedConfig(modelConfigKey);
 
@@ -398,7 +433,7 @@ export class GeminiChat {
 
     // Record user input - capture complete message with all parts (text, files, images, etc.)
     // but skip recording function responses (tool call results) as they should be stored in tool call records
-    if (!isFunctionResponse(userContent)) {
+    if (!isOriginalFunctionResponse) {
       const userMessageParts = userContent.parts || [];
       const userMessageContent = partListUnionToString(userMessageParts);
 
@@ -515,6 +550,7 @@ export class GeminiChat {
     ): AsyncGenerator<StreamEvent, void, void> {
       try {
         const maxAttempts = this.context.config.getMaxAttempts();
+        let lastStreamError: unknown = undefined;
 
         for (let attempt = 0; attempt < maxAttempts; attempt++) {
           let isConnectionPhase = true;
@@ -526,7 +562,7 @@ export class GeminiChat {
             // If this is a retry, update the key with the new context.
             const currentConfigKey =
               attempt > 0
-                ? { ...modelConfigKey, isRetry: true }
+                ? { ...modelConfigKey, isRetry: true, lastStreamError }
                 : modelConfigKey;
 
             isConnectionPhase = true;
@@ -545,6 +581,10 @@ export class GeminiChat {
 
             return;
           } catch (error) {
+            if (error instanceof InvalidStreamError) {
+              lastStreamError = error;
+            }
+
             if (error instanceof AgentExecutionStoppedError) {
               yield {
                 type: StreamEventType.AGENT_EXECUTION_STOPPED,
@@ -581,8 +621,7 @@ export class GeminiChat {
             );
 
             const isContentError = error instanceof InvalidStreamError;
-            const isRetryableContentError =
-              isContentError && error.type !== 'NO_RESPONSE_TEXT';
+            const isRetryableContentError = isContentError;
             const errorType = isContentError
               ? error.type
               : getRetryErrorType(error);
@@ -644,6 +683,15 @@ export class GeminiChat {
             throw error;
           }
         }
+      } catch (error) {
+        if (!isOriginalFunctionResponse) {
+          this.agentHistory.rollback(historyLengthBefore);
+          this.chatRecordingService.updateMessagesFromHistory(
+            this.agentHistory.get(),
+          );
+          this.lastPromptTokenCount = baselinePromptTokenCount;
+        }
+        throw error;
       } finally {
         streamDoneResolver!();
       }
@@ -652,6 +700,28 @@ export class GeminiChat {
     return streamWithRetries.call(this);
   }
 
+  /**
+   * Appends a closing model turn when history ends with an unanswered tool
+   * response, so the next user message stays a turn of its own.
+   */
+  private closeUnansweredToolResponseTurn(): void {
+    const turns = this.agentHistory.get();
+    const last = turns[turns.length - 1];
+    if (
+      last?.content.role !== 'user' ||
+      !last.content.parts?.some((part) => !!part.functionResponse)
+    ) {
+      return;
+    }
+    this.agentHistory.push({
+      id: randomUUID(),
+      content: {
+        role: 'model',
+        parts: [{ text: INTERRUPTED_RESPONSE_PLACEHOLDER }],
+      },
+    });
+  }
+
   private extractBinaryInjections(
     parts: Part[] | undefined,
   ): Part[] | undefined {
@@ -766,9 +836,34 @@ export class GeminiChat {
         abortSignal,
       };
 
-      let contentsToUse: Content[] = supportsModernFeatures(modelToUse)
-        ? [...contentsForPreviewModel]
-        : [...requestContents];
+      // Apply Context-Aware Retries (On-Retry Nudging) to guide the model out of silent loops
+      if (
+        modelConfigKey.isRetry &&
+        modelConfigKey.lastStreamError instanceof InvalidStreamError
+      ) {
+        const lastError = modelConfigKey.lastStreamError;
+        let nudgeMessage = '';
+        if (lastError.type === 'THINKING_ONLY_RESPONSE') {
+          nudgeMessage =
+            '\n[System: You previously generated thoughts but failed to provide a final user-facing response. Please ensure you provide your final answer or call a tool now.]';
+        } else if (lastError.type === 'NO_RESPONSE_TEXT') {
+          nudgeMessage =
+            '\n[System: You previously returned an empty response with no text or thoughts. Please ensure you provide your final answer or call a tool now.]';
+        }
+
+        if (nudgeMessage) {
+          if (typeof config.systemInstruction === 'string') {
+            config.systemInstruction += nudgeMessage;
+          } else if (config.systemInstruction === undefined) {
+            config.systemInstruction = nudgeMessage;
+          }
+        }
+      }
+
+      let contentsToUse: Content[] =
+        supportsModernFeatures(modelToUse) || isGemini2Model(modelToUse)
+          ? [...contentsForPreviewModel]
+          : [...requestContents];
 
       const hookSystem = this.context.config.getHookSystem();
       if (hookSystem) {
@@ -810,9 +905,10 @@ export class GeminiChat {
           );
           lastModelToUse = modelToUse;
           // Re-evaluate contentsToUse based on the new model's feature support
-          contentsToUse = supportsModernFeatures(modelToUse)
-            ? [...contentsForPreviewModel]
-            : [...requestContents];
+          contentsToUse =
+            supportsModernFeatures(modelToUse) || isGemini2Model(modelToUse)
+              ? [...contentsForPreviewModel]
+              : [...requestContents];
         }
         if (beforeModelResult.modifiedConfig) {
           Object.assign(config, beforeModelResult.modifiedConfig);
@@ -956,9 +1052,16 @@ export class GeminiChat {
       ? extractCuratedHistory(this.agentHistory.get())
       : [...this.agentHistory.get()];
 
-    return this.context.config.isContextManagementEnabled()
-      ? scrubHistory(history)
-      : history;
+    if (this.context.config.isContextManagementEnabled()) {
+      return scrubHistory(history);
+    }
+
+    const model = this.context.config.getModel();
+    if (isGemini2Model(model) || supportsModernFeatures(model)) {
+      return coalesceConsecutiveRoles(stripThoughts(history));
+    }
+
+    return history;
   }
 
   /**
@@ -1031,11 +1134,19 @@ export class GeminiChat {
     requestContents: readonly Content[],
   ): readonly Content[] {
     // First, find the start of the active loop by finding the last user turn
-    // with a text message, i.e. that is not a function response.
+    // with a text message, i.e. that is not a function response. Testing for
+    // text alone is not enough: `coalesceConsecutiveRoles` can merge a function
+    // response turn with the prompt that follows it, and starting the loop at
+    // such a turn starts it later than the API starts the turn, leaving earlier
+    // function calls unsigned but still validated.
     let activeLoopStartIndex = -1;
     for (let i = requestContents.length - 1; i >= 0; i--) {
       const content = requestContents[i];
-      if (content.role === 'user' && content.parts?.some((part) => part.text)) {
+      if (
+        content.role === 'user' &&
+        content.parts?.some((part) => part.text) &&
+        !content.parts?.some((part) => part.functionResponse)
+      ) {
         activeLoopStartIndex = i;
         break;
       }
@@ -1122,6 +1233,13 @@ export class GeminiChat {
     let hasThoughts = false;
     let finishReason: FinishReason | undefined;
 
+    // Buffers to prevent failed stream attempts from polluting telemetry and logs
+    const bufferedThoughts: Array<{ subject: string; description: string }> =
+      [];
+    let bufferedUsageMetadata:
+      | GenerateContentResponse['usageMetadata']
+      | undefined = undefined;
+
     // The SDK provides fully assembled FunctionCall objects in chunk.functionCalls
     // We use a Map to ensure we only keep the latest version of each call (by ID)
     const finalFunctionCallsMap = new Map<string, FunctionCall>();
@@ -1177,7 +1295,10 @@ export class GeminiChat {
           if (content.parts.some((part) => part.thought)) {
             // Record thoughts
             hasThoughts = true;
-            this.recordThoughtFromContent(content);
+            const thought = this.extractThoughtFromContent(content);
+            if (thought) {
+              bufferedThoughts.push(thought);
+            }
           }
           if (content.parts.some((part) => part.functionCall)) {
             hasToolCall = true;
@@ -1205,12 +1326,9 @@ export class GeminiChat {
         }
       }
 
-      // Record token usage if this chunk has usageMetadata
+      // Buffer token usage if this chunk has usageMetadata
       if (chunk.usageMetadata) {
-        this.chatRecordingService.recordMessageTokens(chunk.usageMetadata);
-        if (chunk.usageMetadata.promptTokenCount !== undefined) {
-          this.lastPromptTokenCount = chunk.usageMetadata.promptTokenCount;
-        }
+        bufferedUsageMetadata = chunk.usageMetadata;
       }
 
       const hookSystem = this.context.config.getHookSystem();
@@ -1297,29 +1415,22 @@ export class GeminiChat {
       }
     }
 
-    const responseText = consolidatedParts
+    const rawResponseText = consolidatedParts
       .filter((part) => part.text)
       .map((part) => part.text)
-      .join('')
-      .trim();
+      .join('');
 
-    let id: string;
-    // Record model response text from the collected parts.
-    // Also flush when there are thoughts or a tool call (even with no text)
-    // so that BeforeTool hooks always see the latest transcript state.
-    if (responseText || hasThoughts || hasToolCall) {
-      id = this.chatRecordingService.recordMessage({
-        model,
-        type: 'gemini',
-        content: responseText,
-      });
-    } else {
-      // Still need a durable ID even if response is empty (e.g. only tool calls)
-      id = this.chatRecordingService.recordSyntheticMessage(
-        'gemini',
-        consolidatedParts,
-      );
-    }
+    // Clean zero-width/invisible characters and HTML comments to determine actual printable/visible content
+    let responseText = rawResponseText.replace(
+      /[\u200B-\u200D\uFEFF\u200E\u200F]/g,
+      '',
+    );
+    let previous: string;
+    do {
+      previous = responseText;
+      responseText = responseText.replace(/<!--[\s\S]*?-->/g, '');
+    } while (responseText !== previous);
+    responseText = responseText.trim();
 
     // Stream validation logic: A stream is considered successful if:
     // 1. There's a tool call OR
@@ -1349,6 +1460,36 @@ export class GeminiChat {
         );
       }
       if (!responseText) {
+        if (finishReason === FinishReason.MAX_TOKENS) {
+          throw new InvalidStreamError(
+            'Model stream ended due to token limit exhaustion (MAX_TOKENS) with empty response text.',
+            'MAX_TOKENS_EXCEEDED',
+          );
+        }
+        if (finishReason === FinishReason.SAFETY) {
+          throw new InvalidStreamError(
+            'Model stream ended due to safety settings (SAFETY) with empty response text.',
+            'SAFETY_BLOCKED',
+          );
+        }
+        if (finishReason === FinishReason.RECITATION) {
+          throw new InvalidStreamError(
+            'Model stream ended due to recitation settings (RECITATION) with empty response text.',
+            'RECITATION_BLOCKED',
+          );
+        }
+        if (finishReason === FinishReason.OTHER) {
+          throw new InvalidStreamError(
+            'Model stream ended due to other settings (OTHER) with empty response text.',
+            'OTHER_BLOCKED',
+          );
+        }
+        if (hasThoughts) {
+          throw new InvalidStreamError(
+            'Model stream ended with empty response text but contained reasoning thoughts.',
+            'THINKING_ONLY_RESPONSE',
+          );
+        }
         throw new InvalidStreamError(
           'Model stream ended with empty response text.',
           'NO_RESPONSE_TEXT',
@@ -1356,6 +1497,37 @@ export class GeminiChat {
       }
     }
 
+    // Flush buffered thoughts from the successful attempt
+    for (const thought of bufferedThoughts) {
+      this.chatRecordingService.recordThought(thought);
+    }
+
+    // Flush buffered usage metadata and token counts from the successful attempt
+    if (bufferedUsageMetadata) {
+      this.chatRecordingService.recordMessageTokens(bufferedUsageMetadata);
+      if (bufferedUsageMetadata.promptTokenCount !== undefined) {
+        this.lastPromptTokenCount = bufferedUsageMetadata.promptTokenCount;
+      }
+    }
+
+    let id: string;
+    // Record model response text from the collected parts.
+    // Also flush when there are thoughts or a tool call (even with no text)
+    // so that BeforeTool hooks always see the latest transcript state.
+    if (responseText || hasThoughts || hasToolCall) {
+      id = this.chatRecordingService.recordMessage({
+        model,
+        type: 'gemini',
+        content: responseText,
+      });
+    } else {
+      // Still need a durable ID even if response is empty (e.g. only tool calls)
+      id = this.chatRecordingService.recordSyntheticMessage(
+        'gemini',
+        consolidatedParts,
+      );
+    }
+
     this.agentHistory.push({
       id,
       content: { role: 'model', parts: consolidatedParts },
@@ -1410,11 +1582,13 @@ export class GeminiChat {
   }
 
   /**
-   * Extracts and records thought from thought content.
+   * Extracts thought from thought content.
    */
-  private recordThoughtFromContent(content: Content): void {
+  private extractThoughtFromContent(
+    content: Content,
+  ): { subject: string; description: string } | undefined {
     if (!content.parts || content.parts.length === 0) {
-      return;
+      return undefined;
     }
 
     const thoughtPart = content.parts[0];
@@ -1427,11 +1601,12 @@ export class GeminiChat {
         : '';
       const description = rawText.replace(/\*\*(.*?)\*\*/s, '').trim();
 
-      this.chatRecordingService.recordThought({
+      return {
         subject,
         description,
-      });
+      };
     }
+    return undefined;
   }
 }
 
@@ -1503,3 +1678,45 @@ export function coalesceConsecutiveRoles(
   }
   return result;
 }
+
+export function stripThoughts(history: HistoryTurn[]): HistoryTurn[] {
+  return history
+    .map((turn) => {
+      if (!turn.content.parts) return turn;
+      const hasThought = turn.content.parts.some((p) => p && p.thought);
+      if (!hasThought) return turn;
+
+      const nonThoughtParts = turn.content.parts.filter((p) => p && !p.thought);
+
+      // The thoughtSignature the API requires on the first functionCall of a
+      // model turn is sometimes only carried by the thought part we just
+      // removed, not by the functionCall part itself. Without it, replaying
+      // this turn in a later request gets rejected with a 400 "missing
+      // thought_signature" error, so inject a synthetic one if needed.
+      let patchedFirstCall = false;
+      const finalParts =
+        turn.content.role === 'model'
+          ? nonThoughtParts.map((p) => {
+              if (!patchedFirstCall && p.functionCall) {
+                patchedFirstCall = true;
+                if (!p.thoughtSignature) {
+                  return {
+                    ...p,
+                    thoughtSignature: SYNTHETIC_THOUGHT_SIGNATURE,
+                  };
+                }
+              }
+              return p;
+            })
+          : nonThoughtParts;
+
+      return {
+        ...turn,
+        content: {
+          ...turn.content,
+          parts: finalParts,
+        },
+      };
+    })
+    .filter((turn) => !turn.content.parts || turn.content.parts.length > 0);
+}

packages/core/src/core/turn.test.ts

@@ -254,7 +254,15 @@ describe('Turn', () => {
         events.push(event);
       }
 
-      expect(events).toEqual([{ type: GeminiEventType.InvalidStream }]);
+      expect(events).toEqual([
+        {
+          type: GeminiEventType.InvalidStream,
+          value: {
+            type: 'NO_FINISH_REASON',
+            message: 'Test invalid stream',
+          },
+        },
+      ]);
       expect(turn.getDebugResponses().length).toBe(0);
       expect(reportError).not.toHaveBeenCalled(); // Should not report as error
     });

packages/core/src/core/turn.ts

@@ -105,6 +105,19 @@ export type ServerGeminiContextWindowWillOverflowEvent = {
 
 export type ServerGeminiInvalidStreamEvent = {
   type: GeminiEventType.InvalidStream;
+  value: {
+    type:
+      | 'NO_FINISH_REASON'
+      | 'NO_RESPONSE_TEXT'
+      | 'MALFORMED_FUNCTION_CALL'
+      | 'UNEXPECTED_TOOL_CALL'
+      | 'MAX_TOKENS_EXCEEDED'
+      | 'SAFETY_BLOCKED'
+      | 'RECITATION_BLOCKED'
+      | 'OTHER_BLOCKED'
+      | 'THINKING_ONLY_RESPONSE';
+    message: string;
+  };
 };
 
 export type ServerGeminiModelInfoEvent = {
@@ -408,7 +421,13 @@ export class Turn {
       }
 
       if (e instanceof InvalidStreamError) {
-        yield { type: GeminiEventType.InvalidStream };
+        yield {
+          type: GeminiEventType.InvalidStream,
+          value: {
+            type: e.type,
+            message: e.message,
+          },
+        };
         return;
       }
 

packages/core/src/fallback/handler.test.ts

@@ -67,6 +67,7 @@ const createMockConfig = (overrides: Partial<Config> = {}): Config =>
     setActiveModel: vi.fn(),
     setModel: vi.fn(),
     activateFallbackMode: vi.fn(),
+    rotateSessionId: vi.fn(),
     getModelAvailabilityService: vi.fn(() =>
       createAvailabilityServiceMock({
         selectedModel: FALLBACK_MODEL,

packages/core/src/fallback/handler.ts

@@ -5,6 +5,7 @@
  */
 
 import type { Config } from '../config/config.js';
+import { createSessionId } from '../utils/session.js';
 import {
   openBrowserSecurely,
   shouldLaunchBrowser,
@@ -161,8 +162,9 @@ async function processIntent(
 ): Promise<boolean> {
   switch (intent) {
     case 'retry_always':
-      // TODO(telemetry): Implement generic fallback event logging. Existing
-      // logFlashFallback is specific to a single Model.
+      // Rotate the session ID to ensure the backend treats the retried request
+      // as a brand-new session, preventing stateful model-switching errors.
+      config.rotateSessionId(createSessionId());
       config.activateFallbackMode(fallbackModel, failedModel);
       return true;
 

packages/core/src/mcp/oauth-provider.test.ts

@@ -203,6 +203,7 @@ describe('MCPOAuthProvider', () => {
 
   afterEach(() => {
     vi.restoreAllMocks();
+    vi.unstubAllEnvs();
   });
 
   describe('authenticate', () => {
@@ -440,6 +441,100 @@ describe('MCPOAuthProvider', () => {
       );
     });
 
+    it('should perform dynamic client registration with Cloud Workstations proxy redirect URI when running in Google Cloud Workstations', async () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const configWithoutClient: MCPOAuthConfig = {
+        ...mockConfig,
+        registrationUrl: 'https://auth.example.com/register',
+      };
+      delete configWithoutClient.clientId;
+      delete configWithoutClient.redirectUri;
+
+      const mockRegistrationResponse: OAuthClientRegistrationResponse = {
+        client_id: 'dynamic_client_id',
+        client_secret: 'dynamic_client_secret',
+        redirect_uris: [
+          'https://7777-my-workstation.cluster.workstations.cloud.google.com/oauth/callback',
+        ],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+      };
+
+      mockFetch.mockResolvedValueOnce(
+        createMockResponse({
+          ok: true,
+          contentType: 'application/json',
+          text: JSON.stringify(mockRegistrationResponse),
+          json: mockRegistrationResponse,
+        }),
+      );
+
+      // Setup callback handler
+      let callbackHandler: unknown;
+      vi.mocked(http.createServer).mockImplementation((handler) => {
+        callbackHandler = handler;
+        return mockHttpServer as unknown as http.Server;
+      });
+
+      mockHttpServer.listen.mockImplementation((port, callback) => {
+        callback?.();
+        setTimeout(() => {
+          const mockReq = {
+            url: '/oauth/callback?code=auth_code_123&state=bW9ja19zdGF0ZV8xNl9ieXRlcw',
+          };
+          const mockRes = {
+            writeHead: vi.fn(),
+            end: vi.fn(),
+          };
+          (callbackHandler as (req: unknown, res: unknown) => void)(
+            mockReq,
+            mockRes,
+          );
+        }, 10);
+      });
+
+      // Mock token exchange
+      mockFetch.mockResolvedValueOnce(
+        createMockResponse({
+          ok: true,
+          contentType: 'application/json',
+          text: JSON.stringify(mockTokenResponse),
+          json: mockTokenResponse,
+        }),
+      );
+
+      const authProvider = new MCPOAuthProvider();
+      const result = await authProvider.authenticate(
+        'test-server',
+        configWithoutClient,
+      );
+
+      expect(result).toBeDefined();
+      expect(mockFetch).toHaveBeenCalledWith(
+        'https://auth.example.com/register',
+        expect.objectContaining({
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            client_name: 'Gemini CLI MCP Client',
+            redirect_uris: [
+              'https://7777-my-workstation.cluster.workstations.cloud.google.com/oauth/callback',
+            ],
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: 'none',
+            scope: 'read write',
+          }),
+        }),
+      );
+    });
+
     it('should perform OAuth discovery and dynamic client registration when no client ID or registration URL provided', async () => {
       const configWithoutClient: MCPOAuthConfig = { ...mockConfig };
       delete configWithoutClient.clientId;
@@ -1458,6 +1553,50 @@ describe('MCPOAuthProvider', () => {
       );
     });
 
+    it('should refresh with the stored client ID when config has none', async () => {
+      const expiredCredentials = {
+        serverName: 'test-server',
+        token: { ...mockToken, expiresAt: Date.now() - 3600000 },
+        clientId: 'registered-client-id',
+        tokenUrl: 'https://auth.example.com/token',
+        updatedAt: Date.now(),
+      };
+
+      const tokenStorage = new MCPOAuthTokenStorage();
+      vi.mocked(tokenStorage.getCredentials).mockResolvedValue(
+        expiredCredentials,
+      );
+      vi.mocked(tokenStorage.isTokenExpired).mockReturnValue(true);
+
+      mockFetch.mockResolvedValueOnce(
+        createMockResponse({
+          ok: true,
+          contentType: 'application/json',
+          text: JSON.stringify(mockTokenResponse),
+          json: mockTokenResponse,
+        }),
+      );
+
+      const authProvider = new MCPOAuthProvider();
+      const result = await authProvider.getValidToken('test-server', {
+        ...mockConfig,
+        clientId: undefined,
+      });
+
+      expect(result).toBe('access_token_123');
+      expect(mockFetch.mock.calls[0][1].body).toContain(
+        'client_id=registered-client-id',
+      );
+      expect(tokenStorage.saveToken).toHaveBeenCalledWith(
+        'test-server',
+        expect.objectContaining({ accessToken: 'access_token_123' }),
+        'registered-client-id',
+        'https://auth.example.com/token',
+        undefined,
+      );
+      expect(tokenStorage.deleteCredentials).not.toHaveBeenCalled();
+    });
+
     it('should return null when no credentials exist', async () => {
       const tokenStorage = new MCPOAuthTokenStorage();
       vi.mocked(tokenStorage.getCredentials).mockResolvedValue(null);
@@ -1542,6 +1681,90 @@ describe('MCPOAuthProvider', () => {
     });
   });
 
+  describe('getValidTokenWithMetadata', () => {
+    it('should refresh with the stored client ID when config is empty', async () => {
+      // An empty config is what DynamicStoredOAuthProvider passes for servers
+      // configured via OAuth discovery and dynamic client registration.
+      const expiredCredentials = {
+        serverName: 'test-server',
+        token: { ...mockToken, expiresAt: Date.now() - 3600000 },
+        clientId: 'registered-client-id',
+        tokenUrl: 'https://auth.example.com/token',
+        updatedAt: Date.now(),
+      };
+
+      const tokenStorage = new MCPOAuthTokenStorage();
+      vi.mocked(tokenStorage.getCredentials).mockResolvedValue(
+        expiredCredentials,
+      );
+      vi.mocked(tokenStorage.isTokenExpired).mockReturnValue(true);
+
+      mockFetch.mockResolvedValueOnce(
+        createMockResponse({
+          ok: true,
+          contentType: 'application/json',
+          text: JSON.stringify(mockTokenResponse),
+          json: mockTokenResponse,
+        }),
+      );
+
+      const authProvider = new MCPOAuthProvider();
+      const result = await authProvider.getValidTokenWithMetadata(
+        'test-server',
+        {},
+      );
+
+      expect(result?.accessToken).toBe('access_token_123');
+      expect(mockFetch.mock.calls[0][1].body).toContain(
+        'client_id=registered-client-id',
+      );
+      expect(tokenStorage.saveToken).toHaveBeenCalledWith(
+        'test-server',
+        expect.objectContaining({ accessToken: 'access_token_123' }),
+        'registered-client-id',
+        'https://auth.example.com/token',
+        undefined,
+      );
+      expect(tokenStorage.deleteCredentials).not.toHaveBeenCalled();
+    });
+
+    it('should prefer the config client ID over the stored one', async () => {
+      const expiredCredentials = {
+        serverName: 'test-server',
+        token: { ...mockToken, expiresAt: Date.now() - 3600000 },
+        clientId: 'registered-client-id',
+        tokenUrl: 'https://auth.example.com/token',
+        updatedAt: Date.now(),
+      };
+
+      const tokenStorage = new MCPOAuthTokenStorage();
+      vi.mocked(tokenStorage.getCredentials).mockResolvedValue(
+        expiredCredentials,
+      );
+      vi.mocked(tokenStorage.isTokenExpired).mockReturnValue(true);
+
+      mockFetch.mockResolvedValueOnce(
+        createMockResponse({
+          ok: true,
+          contentType: 'application/json',
+          text: JSON.stringify(mockTokenResponse),
+          json: mockTokenResponse,
+        }),
+      );
+
+      const authProvider = new MCPOAuthProvider();
+      const result = await authProvider.getValidTokenWithMetadata(
+        'test-server',
+        { clientId: 'configured-client-id' },
+      );
+
+      expect(result?.accessToken).toBe('access_token_123');
+      expect(mockFetch.mock.calls[0][1].body).toContain(
+        'client_id=configured-client-id',
+      );
+    });
+  });
+
   describe('PKCE parameter generation', () => {
     it('should generate valid PKCE parameters', async () => {
       // Test is implicit in the authenticate flow tests, but we can verify

packages/core/src/mcp/oauth-provider.ts

@@ -21,7 +21,7 @@ import {
   buildAuthorizationUrl,
   exchangeCodeForToken,
   refreshAccessToken as refreshAccessTokenShared,
-  REDIRECT_PATH,
+  getRedirectUri,
   type OAuthFlowConfig,
   type OAuthTokenResponse,
 } from '../utils/oauth-flow.js';
@@ -99,8 +99,7 @@ export class MCPOAuthProvider {
     config: MCPOAuthConfig,
     redirectPort: number,
   ): Promise<OAuthClientRegistrationResponse> {
-    const redirectUri =
-      config.redirectUri || `http://localhost:${redirectPort}${REDIRECT_PATH}`;
+    const redirectUri = getRedirectUri(config, redirectPort);
 
     const registrationRequest: OAuthClientRegistrationRequest = {
       client_name: 'Gemini CLI MCP Client',
@@ -568,15 +567,18 @@ ${authUrl}
       return token.accessToken;
     }
 
-    // Try to refresh if we have a refresh token
-    if (token.refreshToken && config.clientId && credentials.tokenUrl) {
+    // Try to refresh if we have a refresh token. Fall back to the client ID
+    // persisted during dynamic client registration when the static config
+    // does not provide one.
+    const clientId = config.clientId ?? credentials.clientId;
+    if (token.refreshToken && clientId && credentials.tokenUrl) {
       try {
         debugLogger.log(
           `Refreshing expired token for MCP server: ${serverName}`,
         );
 
         const newTokenResponse = await this.refreshAccessToken(
-          config,
+          { ...config, clientId },
           token.refreshToken,
           credentials.tokenUrl,
           credentials.mcpServerUrl,
@@ -597,7 +599,7 @@ ${authUrl}
         await this.tokenStorage.saveToken(
           serverName,
           newToken,
-          config.clientId,
+          clientId,
           credentials.tokenUrl,
           credentials.mcpServerUrl,
         );
@@ -636,7 +638,7 @@ ${authUrl}
       if (current.refreshToken && clientId && credentials.tokenUrl) {
         try {
           const newTokenResponse = await this.refreshAccessToken(
-            config,
+            { ...config, clientId },
             current.refreshToken,
             credentials.tokenUrl,
             credentials.mcpServerUrl,

packages/core/src/prompts/snippets.ts

@@ -413,6 +413,16 @@ export function renderOperationalGuidelines(
 - **Security First:** Always apply security best practices. Never introduce code that exposes, logs, or commits secrets, API keys, or other sensitive information.
 
 ## Tool Usage
+- **Tool Execution Response Rules:**
+  1. After receiving a \`functionResponse\`, you MUST ALWAYS execute one of the following two actions:
+     a) Call another tool to proceed with the task.
+     b) Provide a user-facing text response explaining the tool output, your analysis, and next steps.
+  2. You MUST NEVER return an empty response with no text and no tool calls.
+- **Post-Edit Response Rules:**
+  1. After an edit tool execution (e.g. ${formatToolName(EDIT_TOOL_NAME)}, ${formatToolName(WRITE_FILE_TOOL_NAME)}), you MUST ALWAYS generate a user-facing text response summarizing:
+     - What changes were made to the file.
+     - Your verification plan or next steps (e.g. running tests).
+  2. You MUST NEVER return an empty response with 0 text tokens after completing an edit.
 - **Parallelism & Sequencing:** Tools execute in parallel by default. Execute multiple independent tool calls in parallel when feasible (e.g., searching, reading files, independent shell commands, or editing *different* files). If a tool depends on the output or side-effects of a previous tool in the same turn (e.g., running a shell command that depends on the success of a previous command), you MUST set the \`wait_for_previous\` parameter to \`true\` on the dependent tool to ensure sequential execution.
 - **File Editing Collisions:** Do NOT make multiple calls to the ${formatToolName(EDIT_TOOL_NAME)} tool for the SAME file in a single turn. To make multiple edits to the same file, you MUST perform them sequentially across multiple conversational turns to prevent race conditions and ensure the file state is accurate before each edit.
 - **Command Execution:** Use the ${formatToolName(SHELL_TOOL_NAME)} tool for running shell commands, remembering the safety rule to explain modifying commands first.${toolUsageInteractive(

packages/core/src/scheduler/scheduler.test.ts

@@ -630,8 +630,8 @@ describe('Scheduler (Orchestrator)', () => {
         CoreToolCallStatus.Cancelled,
         'Operation cancelled by user',
       );
-      // finalizeCall is handled by the processing loop, not synchronously by cancelAll
-      // expect(mockStateManager.finalizeCall).toHaveBeenCalledWith('call-1');
+      // finalizeCall is called synchronously by cancelAll to ensure completedBatch is populated and isActive is updated immediately
+      expect(mockStateManager.finalizeCall).toHaveBeenCalledWith('call-1');
       expect(mockStateManager.cancelAllQueued).toHaveBeenCalledWith(
         'Operation cancelled by user',
       );

packages/core/src/scheduler/scheduler.ts

@@ -278,6 +278,7 @@ export class Scheduler {
           CoreToolCallStatus.Cancelled,
           'Operation cancelled by user',
         );
+        this.state.finalizeCall(activeCall.request.callId);
       }
     }
 
@@ -438,6 +439,14 @@ export class Scheduler {
    */
   private async _processNextItem(signal: AbortSignal): Promise<boolean> {
     if (signal.aborted || this.isCancelling) {
+      // Finalize active calls that are terminal
+      const activeCalls = this.state.allActiveCalls;
+      for (const call of activeCalls) {
+        if (this.isTerminal(call.status)) {
+          this.state.finalizeCall(call.request.callId);
+        }
+      }
+
       this.state.cancelAllQueued('Operation cancelled');
       return false;
     }

packages/core/src/services/chatRecordingService.test.ts

@@ -308,6 +308,125 @@ describe('ChatRecordingService', () => {
       )) as ConversationRecord;
       expect(conversation.sessionId).toBe('old-session-id');
     });
+
+    it('should fall back to the in-memory conversation when the file cannot be reloaded', async () => {
+      // Regression test for the `/compress` "Failed to load resumed session
+      // data from file" bug: when resuming with a filePath that cannot be
+      // loaded from disk, initialize must NOT throw. It should adopt the
+      // in-memory conversation it was handed and rewrite a clean file.
+      const chatsDir = path.join(testTempDir, 'chats');
+      fs.mkdirSync(chatsDir, { recursive: true });
+      const missingFile = path.join(chatsDir, 'missing-session.jsonl');
+      expect(fs.existsSync(missingFile)).toBe(false);
+
+      const inMemoryConversation = {
+        sessionId: 'resumed-session-id',
+        projectHash: 'resumed-project-hash',
+        startTime: new Date().toISOString(),
+        lastUpdated: new Date().toISOString(),
+        messages: [
+          {
+            id: 'msg-1',
+            type: 'user',
+            timestamp: new Date().toISOString(),
+            content: 'hello from memory',
+          },
+        ],
+      } as unknown as ConversationRecord;
+
+      await expect(
+        chatRecordingService.initialize({
+          filePath: missingFile,
+          conversation: inMemoryConversation,
+        }),
+      ).resolves.not.toThrow();
+
+      // The in-memory conversation is adopted.
+      expect(chatRecordingService.getConversation()?.sessionId).toBe(
+        'resumed-session-id',
+      );
+
+      // A clean, loadable file is rewritten from the in-memory copy so future
+      // loads and appends succeed.
+      const reloaded = (await loadConversationRecord(
+        missingFile,
+      )) as ConversationRecord;
+      expect(reloaded).not.toBeNull();
+      expect(reloaded.sessionId).toBe('resumed-session-id');
+      expect(reloaded.projectHash).toBe('resumed-project-hash');
+      expect(reloaded.messages).toHaveLength(1);
+    });
+
+    it('should preserve an unreadable session file instead of destroying it', async () => {
+      // The reload may have failed only transiently, so the original bytes
+      // must survive the recovery rewrite.
+      const chatsDir = path.join(testTempDir, 'chats');
+      fs.mkdirSync(chatsDir, { recursive: true });
+      const sessionFile = path.join(chatsDir, 'unreadable.jsonl');
+
+      // No usable metadata line => loadConversationRecord() returns null.
+      const originalBytes = '{"not":"a valid metadata line"}\n';
+      fs.writeFileSync(sessionFile, originalBytes);
+
+      await chatRecordingService.initialize({
+        filePath: sessionFile,
+        conversation: {
+          sessionId: 'recovered-session-id',
+          projectHash: 'recovered-project-hash',
+          startTime: new Date().toISOString(),
+          lastUpdated: new Date().toISOString(),
+          messages: [],
+        } as unknown as ConversationRecord,
+      });
+
+      // The rewritten file is loadable again...
+      const reloaded = (await loadConversationRecord(
+        sessionFile,
+      )) as ConversationRecord;
+      expect(reloaded.sessionId).toBe('recovered-session-id');
+
+      // ...and the original bytes were kept alongside it.
+      const preserved = fs
+        .readdirSync(chatsDir)
+        .filter((f) => f.startsWith('unreadable.jsonl.unreadable-'));
+      expect(preserved).toHaveLength(1);
+      expect(fs.readFileSync(path.join(chatsDir, preserved[0]), 'utf-8')).toBe(
+        originalBytes,
+      );
+    });
+
+    it('should not leave a temp file behind when the rewrite fails', async () => {
+      const chatsDir = path.join(testTempDir, 'chats');
+      fs.mkdirSync(chatsDir, { recursive: true });
+      const sessionFile = path.join(chatsDir, 'rewrite-fails.jsonl');
+
+      // Fail the rename that publishes the temp file, leaving it orphaned.
+      const realRename = fs.renameSync;
+      vi.spyOn(fs, 'renameSync').mockImplementation((from, to) => {
+        if (String(from).includes('.tmp-')) {
+          throw new Error('simulated rename failure');
+        }
+        return realRename(from, to);
+      });
+
+      await expect(
+        chatRecordingService.initialize({
+          filePath: sessionFile,
+          conversation: {
+            sessionId: 'temp-cleanup-session',
+            projectHash: 'temp-cleanup-hash',
+            startTime: new Date().toISOString(),
+            lastUpdated: new Date().toISOString(),
+            messages: [],
+          } as unknown as ConversationRecord,
+        }),
+      ).rejects.toThrow('simulated rename failure');
+
+      const leftovers = fs
+        .readdirSync(chatsDir)
+        .filter((f) => f.includes('.tmp-'));
+      expect(leftovers).toEqual([]);
+    });
   });
 
   describe('recordMessage', () => {

packages/core/src/services/chatRecordingService.ts

@@ -462,7 +462,16 @@ export class ChatRecordingService {
           // Update the session ID in the existing file
           this.updateMetadata({ sessionId: this.sessionId });
         } else {
-          throw new Error('Failed to load resumed session data from file');
+          // The file could not be reloaded (missing, corrupt metadata, or an
+          // I/O error). Fall back to the in-memory conversation we were handed
+          // rather than failing the caller, and rewrite a clean file from it.
+          debugLogger.warn(
+            'Failed to reload resumed session data from file; falling back ' +
+              'to the in-memory conversation.',
+          );
+          this.cachedConversation = resumedSessionData.conversation;
+          this.projectHash = this.cachedConversation.projectHash;
+          this.rewriteConversationFile(this.cachedConversation);
         }
       } else {
         // Create new session
@@ -563,6 +572,73 @@ export class ChatRecordingService {
     }
   }
 
+  /**
+   * Rewrites the session file from an in-memory record. Any existing
+   * (unreadable) file is preserved alongside rather than destroyed, and the
+   * new file is written atomically (temp file + rename).
+   */
+  private rewriteConversationFile(conversation: ConversationRecord): void {
+    if (!this.conversationFile) return;
+
+    // Normalize legacy `.json` paths to the `.jsonl` format we write.
+    if (this.conversationFile.endsWith('.json')) {
+      this.conversationFile = this.conversationFile + 'l';
+    }
+
+    const { messages, memoryScratchpad, ...metadata } = conversation;
+    const lines: string[] = [JSON.stringify(metadata)];
+    for (const msg of messages) {
+      lines.push(JSON.stringify(msg));
+    }
+    if (memoryScratchpad) {
+      lines.push(JSON.stringify({ $set: { memoryScratchpad } }));
+    }
+    const content = lines.join('\n') + '\n';
+
+    try {
+      fs.mkdirSync(path.dirname(this.conversationFile), { recursive: true });
+
+      // The existing file was unreadable, but it may have been only
+      // transiently so (a lock or I/O blip) rather than truly corrupt. Keep
+      // its bytes rather than destroying them.
+      if (fs.existsSync(this.conversationFile)) {
+        const backup = `${this.conversationFile}.unreadable-${Date.now()}`;
+        try {
+          fs.renameSync(this.conversationFile, backup);
+          debugLogger.warn(
+            `Preserved the unreadable session file at ${backup}.`,
+          );
+        } catch (backupError) {
+          debugLogger.error(
+            'Failed to preserve the unreadable session file.',
+            backupError,
+          );
+        }
+      }
+
+      const tempFile = `${this.conversationFile}.tmp-${process.pid}`;
+      try {
+        fs.writeFileSync(tempFile, content);
+        fs.renameSync(tempFile, this.conversationFile);
+      } catch (error) {
+        // The rename did not complete, so the temp file would be left behind.
+        try {
+          fs.unlinkSync(tempFile);
+        } catch {
+          // Ignore cleanup errors so the original failure still surfaces.
+        }
+        throw error;
+      }
+    } catch (error) {
+      if (isNodeError(error) && error.code === 'ENOSPC') {
+        this.conversationFile = null;
+        debugLogger.warn(ENOSPC_WARNING_MESSAGE);
+      } else {
+        throw error;
+      }
+    }
+  }
+
   private updateMetadata(updates: Partial<ConversationRecord>): void {
     if (!this.cachedConversation) return;
     Object.assign(this.cachedConversation, updates);

packages/core/src/services/fileKeychain.ts

@@ -27,8 +27,15 @@ export class FileKeychain implements Keychain {
   }
 
   private encrypt(text: string): string {
-    const iv = crypto.randomBytes(16);
-    const cipher = crypto.createCipheriv('aes-256-gcm', this.encryptionKey, iv);
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv(
+      'aes-256-gcm',
+      this.encryptionKey,
+      iv,
+      {
+        authTagLength: 16,
+      },
+    );
 
     let encrypted = cipher.update(text, 'utf8', 'hex');
     encrypted += cipher.final('hex');
@@ -48,10 +55,19 @@ export class FileKeychain implements Keychain {
     const authTag = Buffer.from(parts[1], 'hex');
     const encrypted = parts[2];
 
+    if (iv.length !== 12 && iv.length !== 16) {
+      throw new Error('Invalid IV length: Must be 12 or 16 bytes');
+    }
+
+    if (authTag.length !== 16) {
+      throw new Error('Invalid authentication tag length: Must be 16 bytes');
+    }
+
     const decipher = crypto.createDecipheriv(
       'aes-256-gcm',
       this.encryptionKey,
       iv,
+      { authTagLength: 16 },
     );
     decipher.setAuthTag(authTag);
 
@@ -67,30 +83,28 @@ export class FileKeychain implements Keychain {
   }
 
   private async loadData(): Promise<Record<string, Record<string, string>>> {
+    let data: string;
     try {
-      const data = await fs.readFile(this.tokenFilePath, 'utf-8');
-      const decrypted = this.decrypt(data);
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
-      return JSON.parse(decrypted) as Record<string, Record<string, string>>;
+      data = await fs.readFile(this.tokenFilePath, 'utf-8');
     } catch (error: unknown) {
       // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
-      const err = error as NodeJS.ErrnoException & { message?: string };
+      const err = error as NodeJS.ErrnoException;
       if (err.code === 'ENOENT') {
         return {};
       }
-      if (
-        err.message?.includes('Invalid encrypted data format') ||
-        err.message?.includes(
-          'Unsupported state or unable to authenticate data',
-        )
-      ) {
-        throw new Error(
-          `Corrupted credentials file detected at: ${this.tokenFilePath}\n` +
-            `Please delete or rename this file to resolve the issue.`,
-        );
-      }
       throw error;
     }
+
+    try {
+      const decrypted = this.decrypt(data);
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+      return JSON.parse(decrypted) as Record<string, Record<string, string>>;
+    } catch {
+      throw new Error(
+        `Corrupted credentials file detected at: ${this.tokenFilePath}\n` +
+          `Please delete or rename this file to resolve the issue.`,
+      );
+    }
   }
 
   private async saveData(

packages/core/src/services/gcmTruncationReproduction.test.ts

@@ -0,0 +1,201 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as crypto from 'node:crypto';
+import { FileKeychain } from './fileKeychain.js';
+
+describe('AES-GCM Tag Length Verification', () => {
+  let tempDir: string;
+
+  beforeEach(async () => {
+    // Create a unique temporary directory for test isolation
+    tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'gemini-test-keychain-'));
+    vi.stubEnv('GEMINI_CLI_HOME', tempDir);
+  });
+
+  afterEach(async () => {
+    vi.unstubAllEnvs();
+    // Clean up the temporary directory
+    await fs.rm(tempDir, { recursive: true, force: true });
+  });
+
+  it('should use a secure 128-bit (16-byte) AES-GCM authentication tag and standard 12-byte IV', async () => {
+    const keychain = new FileKeychain();
+    const service = 'test-service';
+    const account = 'test-account';
+    const password = 'secure-password-123';
+
+    // 1. Save credentials to trigger encryption and file write
+    await keychain.setPassword(service, account, password);
+
+    // 2. Read the raw encrypted file from disk
+    const credentialsFilePath = path.join(
+      tempDir,
+      '.gemini',
+      'gemini-credentials.json',
+    );
+    const rawEncryptedData = await fs.readFile(credentialsFilePath, 'utf-8');
+
+    // 3. Parse the encrypted data format (iv:authTag:encrypted)
+    const parts = rawEncryptedData.split(':');
+    expect(parts).toHaveLength(3);
+
+    const ivHex = parts[0];
+    const authTagHex = parts[1];
+
+    // 4. Verify the lengths of the components
+    const ivBuffer = Buffer.from(ivHex, 'hex');
+    const authTagBuffer = Buffer.from(authTagHex, 'hex');
+
+    // IV should be exactly 12 bytes (96 bits) by default
+    expect(ivBuffer.length).toBe(12);
+    expect(ivHex.length).toBe(24);
+
+    // Authentication Tag should be exactly 16 bytes (128 bits)
+    expect(authTagBuffer.length).toBe(16);
+    expect(authTagHex.length).toBe(32); // 32 hex characters
+
+    // Assert that the tag is NOT truncated to 4 bytes (32 bits)
+    expect(authTagBuffer.length).not.toBe(4);
+    expect(authTagHex.length).not.toBe(8); // 8 hex characters
+
+    // 5. Verify that decryption works correctly with the 16-byte tag
+    const decryptedPassword = await keychain.getPassword(service, account);
+    expect(decryptedPassword).toBe(password);
+  });
+
+  it('should support both 12-byte and 16-byte IVs for backward compatibility', async () => {
+    const keychain = new FileKeychain();
+    const service = 'test-service';
+    const account = 'test-account';
+    const password = 'secure-password-123';
+
+    // 1. Save credentials to trigger encryption and file write (generates 12-byte IV)
+    await keychain.setPassword(service, account, password);
+
+    // 2. Verify 12-byte IV decryption works
+    let decryptedPassword = await keychain.getPassword(service, account);
+    expect(decryptedPassword).toBe(password);
+
+    // 3. Manually simulate a legacy 16-byte IV credentials file
+    const credentialsFilePath = path.join(
+      tempDir,
+      '.gemini',
+      'gemini-credentials.json',
+    );
+    const legacyIv = crypto.randomBytes(16);
+    const encryptionKey = (keychain as unknown as { encryptionKey: Buffer })
+      .encryptionKey;
+    const cipher = crypto.createCipheriv(
+      'aes-256-gcm',
+      encryptionKey,
+      legacyIv,
+      {
+        authTagLength: 16,
+      },
+    );
+
+    let encrypted = cipher.update(
+      JSON.stringify({ [service]: { [account]: password } }),
+      'utf8',
+      'hex',
+    );
+    encrypted += cipher.final('hex');
+    const authTag = cipher.getAuthTag();
+
+    const legacyPayload =
+      legacyIv.toString('hex') +
+      ':' +
+      authTag.toString('hex') +
+      ':' +
+      encrypted;
+    await fs.writeFile(credentialsFilePath, legacyPayload, 'utf-8');
+
+    // 4. Verify 16-byte IV decryption works successfully (backward compatibility)
+    decryptedPassword = await keychain.getPassword(service, account);
+    expect(decryptedPassword).toBe(password);
+  });
+
+  it('should reject decryption of a credentials file with a truncated tag', async () => {
+    const keychain = new FileKeychain();
+    const service = 'test-service';
+    const account = 'test-account';
+    const password = 'secure-password-123';
+
+    // 1. Save credentials to trigger encryption and file write
+    await keychain.setPassword(service, account, password);
+
+    // 2. Read the raw encrypted file from disk
+    const credentialsFilePath = path.join(
+      tempDir,
+      '.gemini',
+      'gemini-credentials.json',
+    );
+    const rawEncryptedData = await fs.readFile(credentialsFilePath, 'utf-8');
+
+    // 3. Parse the encrypted data format (iv:authTag:encrypted)
+    const parts = rawEncryptedData.split(':');
+    expect(parts).toHaveLength(3);
+
+    const ivHex = parts[0];
+    const authTagHex = parts[1];
+    const encryptedHex = parts[2];
+
+    // 4. Create a truncated 4-byte tag (8 hex characters)
+    const truncatedTagHex = authTagHex.substring(0, 8);
+    const truncatedEncryptedData = `${ivHex}:${truncatedTagHex}:${encryptedHex}`;
+
+    // 5. Overwrite the credentials file with the truncated-tag payload
+    await fs.writeFile(credentialsFilePath, truncatedEncryptedData, 'utf-8');
+
+    // 6. Attempt to retrieve the password and verify it throws a clear, handled validation error
+    await expect(keychain.getPassword(service, account)).rejects.toThrow(
+      'Corrupted credentials file detected',
+    );
+  });
+
+  it('should reject decryption of a credentials file with a truncated IV', async () => {
+    const keychain = new FileKeychain();
+    const service = 'test-service';
+    const account = 'test-account';
+    const password = 'secure-password-123';
+
+    // 1. Save credentials to trigger encryption and file write
+    await keychain.setPassword(service, account, password);
+
+    // 2. Read the raw encrypted file from disk
+    const credentialsFilePath = path.join(
+      tempDir,
+      '.gemini',
+      'gemini-credentials.json',
+    );
+    const rawEncryptedData = await fs.readFile(credentialsFilePath, 'utf-8');
+
+    // 3. Parse the encrypted data format (iv:authTag:encrypted)
+    const parts = rawEncryptedData.split(':');
+    expect(parts).toHaveLength(3);
+
+    const ivHex = parts[0];
+    const authTagHex = parts[1];
+    const encryptedHex = parts[2];
+
+    // 4. Create a truncated 4-byte IV (8 hex characters)
+    const truncatedIvHex = ivHex.substring(0, 8);
+    const truncatedEncryptedData = `${truncatedIvHex}:${authTagHex}:${encryptedHex}`;
+
+    // 5. Overwrite the credentials file with the truncated-IV payload
+    await fs.writeFile(credentialsFilePath, truncatedEncryptedData, 'utf-8');
+
+    // 6. Attempt to retrieve the password and verify it throws a clear, handled validation error
+    await expect(keychain.getPassword(service, account)).rejects.toThrow(
+      'Corrupted credentials file detected',
+    );
+  });
+});

packages/core/src/services/modelConfigService.ts

@@ -37,6 +37,9 @@ export interface ModelConfigKey {
   // Indicates whether this request originates from the primary interactive chat model.
   // Enables the default fallback configuration to `chat-base` when unknown.
   isChatModel?: boolean;
+
+  // The last stream error that triggered this retry attempt, if any.
+  lastStreamError?: unknown;
 }
 
 export interface ModelConfig {

packages/core/src/skills/builtin/antigravity-support/SKILL.md

@@ -1,34 +1,53 @@
 ---
 name: antigravity-support
-description: Use when the user asks questions, seeks help, or requests instructions related to installing, setting up, or migrating to Antigravity CLI. This skill provides the latest up to date details, requirements, and commands sourced from the official Antigravity CLI documentation.
+description:
+  Use when the user asks questions, seeks help, or requests instructions related
+  to installing, setting up, or migrating to Antigravity CLI. This skill
+  provides the latest up to date details, requirements, and commands sourced
+  from the official Antigravity CLI documentation.
 ---
 
 # Antigravity CLI Support
 
-This skill provides up-to-date information on how to install, configure, use, and migrate to Antigravity CLI, sourced from the official documentation at https://antigravity.google/docs/cli-getting-started.
+This skill provides up-to-date information on how to install, configure, use,
+and migrate to Antigravity CLI, sourced from the official documentation at
+https://antigravity.google/docs/cli-getting-started.
 
 ## What is Antigravity CLI?
 
-Antigravity CLI is a next-generation terminal interface for collaborating with autonomous agents on local codebases. It is designed to be highly interactive and agent-driven, launching a Terminal User Interface (TUI) to coordinate code generation, reasoning, and workspace tasks.
+Antigravity CLI is a next-generation terminal interface for collaborating with
+autonomous agents on local codebases. It is designed to be highly interactive
+and agent-driven, launching a Terminal User Interface (TUI) to coordinate code
+generation, reasoning, and workspace tasks.
 
 Key Features:
-- **Autonomous Agent Collaboration:** Work directly with agents within your terminal.
-- **Interactive TUI:** A full terminal user interface designed for agent workflows.
-- **Workspace Integration:** Deep understanding of your local workspace structure and context.
+
+- **Autonomous Agent Collaboration:** Work directly with agents within your
+  terminal.
+- **Interactive TUI:** A full terminal user interface designed for agent
+  workflows.
+- **Workspace Integration:** Deep understanding of your local workspace
+  structure and context.
 
 ## Installation
 
 To install the Antigravity CLI on your machine:
 
 ### macOS / Linux (Fast-Path Script)
+
 Run the following standard curl command in your terminal:
+
 ```bash
 curl -fsSL https://antigravity.google/cli/install.sh | bash
 ```
-This script downloads, verifies, and installs the latest version of Antigravity, and automatically registers the `agy` binary in your PATH.
+
+This script downloads, verifies, and installs the latest version of Antigravity,
+and automatically registers the `agy` binary in your PATH.
 
 ### Windows (PowerShell)
+
 For Windows environments, install via the official PowerShell setup command:
+
 ```powershell
 irm https://antigravity.google/cli/install.ps1 | iex
 ```
@@ -36,23 +55,41 @@ irm https://antigravity.google/cli/install.ps1 | iex
 ## Initial Setup & Configuration
 
 Once installed, navigate to any project or workspace directory and run:
+
 ```bash
 agy
 ```
-This command starts the Antigravity CLI. The first time you launch it, the interactive TUI will guide you through:
-1. **Workspace Trust Verification:** Confirming trust for the workspace folder to allow secure local command execution and file edits.
-2. **Visual Theme Configuration:** Setting up your preferred interactive terminal aesthetic and layout.
-3. **Rendering Modes:** Tailoring TUI performance and drawing behaviors to your terminal capabilities.
+
+This command starts the Antigravity CLI. The first time you launch it, the
+interactive TUI will guide you through:
+
+1. **Workspace Trust Verification:** Confirming trust for the workspace folder
+   to allow secure local command execution and file edits.
+2. **Visual Theme Configuration:** Setting up your preferred interactive
+   terminal aesthetic and layout.
+3. **Rendering Modes:** Tailoring TUI performance and drawing behaviors to your
+   terminal capabilities.
 
 ## How to Migrate to Antigravity CLI
 
-If you are transitioning or migrating from another tool (such as Gemini CLI) to Antigravity CLI, follow these steps:
-1. **Check Requirements:** Ensure your local environment meets standard requirements (e.g., node, git, shell access) and is running a compatible operating system (macOS, Linux, or Windows).
-2. **Install Antigravity:** Run the installation script above to make the `agy` command globally available.
-3. **Verify Installation:** Test the installation by running `agy --version` or launching `agy` in an empty or sample directory.
-4. **Transition Workspaces:** Run `agy` directly inside your project workspace root. The initial setup assistant will guide you to import or configure trust policies, similar to those you might have used previously.
+If you are transitioning or migrating from another tool (such as Gemini CLI) to
+Antigravity CLI, follow these steps:
+
+1. **Check Requirements:** Ensure your local environment meets standard
+   requirements (e.g., node, git, shell access) and is running a compatible
+   operating system (macOS, Linux, or Windows).
+2. **Install Antigravity:** Run the installation script above to make the `agy`
+   command globally available.
+3. **Verify Installation:** Test the installation by running `agy --version` or
+   launching `agy` in an empty or sample directory.
+4. **Transition Workspaces:** Run `agy` directly inside your project workspace
+   root. The initial setup assistant will guide you to import or configure trust
+   policies, similar to those you might have used previously.
 
 ## Official Resources and Learning More
 
-If you need more details or have advanced configuration/migration needs, please visit the official documentation:
-- **Official Documentation:** https://antigravity.google/docs/cli-getting-started
+If you need more details or have advanced configuration/migration needs, please
+visit the official documentation:
+
+- **Official Documentation:**
+  https://antigravity.google/docs/cli-getting-started

packages/core/src/skills/builtin/skill-creator/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: skill-creator
-description: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Gemini CLI's capabilities with specialized knowledge, workflows, or tool integrations.
+description:
+  Guide for creating effective skills. This skill should be used when users want
+  to create a new skill (or update an existing skill) that extends Gemini CLI's
+  capabilities with specialized knowledge, workflows, or tool integrations.
 ---
 
 # Skill Creator
@@ -9,22 +12,33 @@ This skill provides guidance for creating effective skills.
 
 ## About Skills
 
-Skills are modular, self-contained packages that extend Gemini CLI's capabilities by providing specialized knowledge, workflows, and tools. Think of them as "onboarding guides" for specific domains or tasks—they transform Gemini CLI from a general-purpose agent into a specialized agent equipped with procedural knowledge that no model can fully possess.
+Skills are modular, self-contained packages that extend Gemini CLI's
+capabilities by providing specialized knowledge, workflows, and tools. Think of
+them as "onboarding guides" for specific domains or tasks—they transform Gemini
+CLI from a general-purpose agent into a specialized agent equipped with
+procedural knowledge that no model can fully possess.
 
 ### What Skills Provide
 
 1. Specialized workflows - Multi-step procedures for specific domains
-2. Tool integrations - Instructions for working with specific file formats or APIs
+2. Tool integrations - Instructions for working with specific file formats or
+   APIs
 3. Domain expertise - Company-specific knowledge, schemas, business logic
-4. Bundled resources - Scripts, references, and assets for complex and repetitive tasks
+4. Bundled resources - Scripts, references, and assets for complex and
+   repetitive tasks
 
 ## Core Principles
 
 ### Concise is Key
 
-The context window is a public good. Skills share the context window with everything else Gemini CLI needs: system prompt, conversation history, other Skills' metadata, and the actual user request.
+The context window is a public good. Skills share the context window with
+everything else Gemini CLI needs: system prompt, conversation history, other
+Skills' metadata, and the actual user request.
 
-**Default assumption: Gemini CLI is already very smart.** Only add context Gemini CLI doesn't already have. Challenge each piece of information: "Does Gemini CLI really need this explanation?" and "Does this paragraph justify its token cost?"
+**Default assumption: Gemini CLI is already very smart.** Only add context
+Gemini CLI doesn't already have. Challenge each piece of information: "Does
+Gemini CLI really need this explanation?" and "Does this paragraph justify its
+token cost?"
 
 Prefer concise examples over verbose explanations.
 
@@ -32,13 +46,19 @@ Prefer concise examples over verbose explanations.
 
 Match the level of specificity to the task's fragility and variability:
 
-**High freedom (text-based instructions)**: Use when multiple approaches are valid, decisions depend on context, or heuristics guide the approach.
+**High freedom (text-based instructions)**: Use when multiple approaches are
+valid, decisions depend on context, or heuristics guide the approach.
 
-**Medium freedom (pseudocode or scripts with parameters)**: Use when a preferred pattern exists, some variation is acceptable, or configuration affects behavior.
+**Medium freedom (pseudocode or scripts with parameters)**: Use when a preferred
+pattern exists, some variation is acceptable, or configuration affects behavior.
 
-**Low freedom (specific scripts, few parameters)**: Use when operations are fragile and error-prone, consistency is critical, or a specific sequence must be followed.
+**Low freedom (specific scripts, few parameters)**: Use when operations are
+fragile and error-prone, consistency is critical, or a specific sequence must be
+followed.
 
-Think of Gemini CLI as exploring a path: a narrow bridge with cliffs needs specific guardrails (low freedom), while an open field allows many routes (high freedom).
+Think of Gemini CLI as exploring a path: a narrow bridge with cliffs needs
+specific guardrails (low freedom), while an open field allows many routes (high
+freedom).
 
 ### Anatomy of a Skill
 
@@ -61,45 +81,75 @@ skill-name/
 
 Every SKILL.md consists of:
 
-- **Frontmatter** (YAML): Contains `name` and `description` fields. These are the only fields that Gemini CLI reads to determine when the skill gets used, thus it is very important to be clear and comprehensive in describing what the skill is, and when it should be used.
-- **Body** (Markdown): Instructions and guidance for using the skill. Only loaded AFTER the skill triggers (if at all).
+- **Frontmatter** (YAML): Contains `name` and `description` fields. These are
+  the only fields that Gemini CLI reads to determine when the skill gets used,
+  thus it is very important to be clear and comprehensive in describing what the
+  skill is, and when it should be used.
+- **Body** (Markdown): Instructions and guidance for using the skill. Only
+  loaded AFTER the skill triggers (if at all).
 
 #### Bundled Resources (optional)
 
 ##### Scripts (`scripts/`)
 
-Executable code (Node.js/Python/Bash/etc.) for tasks that require deterministic reliability or are repeatedly rewritten.
+Executable code (Node.js/Python/Bash/etc.) for tasks that require deterministic
+reliability or are repeatedly rewritten.
 
-- **When to include**: When the same code is being rewritten repeatedly or deterministic reliability is needed
+- **When to include**: When the same code is being rewritten repeatedly or
+  deterministic reliability is needed
 - **Example**: `scripts/rotate_pdf.cjs` for PDF rotation tasks
-- **Benefits**: Token efficient, deterministic, may be executed without loading into context
-- **Agentic Ergonomics**: Scripts must output LLM-friendly stdout. Suppress standard tracebacks. Output clear, concise success/failure messages, and paginate or truncate outputs (e.g., "Success: First 50 lines of processed file...") to prevent context window overflow.
-- **Note**: Scripts may still need to be read by Gemini CLI for patching or environment-specific adjustments
+- **Benefits**: Token efficient, deterministic, may be executed without loading
+  into context
+- **Agentic Ergonomics**: Scripts must output LLM-friendly stdout. Suppress
+  standard tracebacks. Output clear, concise success/failure messages, and
+  paginate or truncate outputs (e.g., "Success: First 50 lines of processed
+  file...") to prevent context window overflow.
+- **Note**: Scripts may still need to be read by Gemini CLI for patching or
+  environment-specific adjustments
 
 ##### References (`references/`)
 
-Documentation and reference material intended to be loaded as needed into context to inform Gemini CLI's process and thinking.
+Documentation and reference material intended to be loaded as needed into
+context to inform Gemini CLI's process and thinking.
 
-- **When to include**: For documentation that Gemini CLI should reference while working
-- **Examples**: `references/finance.md` for financial schemas, `references/mnda.md` for company NDA template, `references/policies.md` for company policies, `references/api_docs.md` for API specifications
-- **Use cases**: Database schemas, API documentation, domain knowledge, company policies, detailed workflow guides
-- **Benefits**: Keeps SKILL.md lean, loaded only when Gemini CLI determines it's needed
-- **Best practice**: If files are large (>10k words), include grep search patterns in SKILL.md
+- **When to include**: For documentation that Gemini CLI should reference while
+  working
+- **Examples**: `references/finance.md` for financial schemas,
+  `references/mnda.md` for company NDA template, `references/policies.md` for
+  company policies, `references/api_docs.md` for API specifications
+- **Use cases**: Database schemas, API documentation, domain knowledge, company
+  policies, detailed workflow guides
+- **Benefits**: Keeps SKILL.md lean, loaded only when Gemini CLI determines it's
+  needed
+- **Best practice**: If files are large (>10k words), include grep search
+  patterns in SKILL.md
 - **Avoid duplication**: Information should live in either SKILL.md or
-  references files, not both. Prefer references files for detailed information unless it's truly core to the skill—this keeps SKILL.md lean while making information discoverable without hogging the context window. Keep only essential procedural instructions and workflow guidance in SKILL.md; move detailed reference material, schemas, and examples to references files.
+  references files, not both. Prefer references files for detailed information
+  unless it's truly core to the skill—this keeps SKILL.md lean while making
+  information discoverable without hogging the context window. Keep only
+  essential procedural instructions and workflow guidance in SKILL.md; move
+  detailed reference material, schemas, and examples to references files.
 
 ##### Assets (`assets/`)
 
-Files not intended to be loaded into context, but rather used within the output Gemini CLI produces.
+Files not intended to be loaded into context, but rather used within the output
+Gemini CLI produces.
 
-- **When to include**: When the skill needs files that will be used in the final output
-- **Examples**: `assets/logo.png` for brand assets, `assets/slides.pptx` for PowerPoint templates, `assets/frontend-template/` for HTML/React boilerplate, `assets/font.ttf` for typography
-- **Use cases**: Templates, images, icons, boilerplate code, fonts, sample documents that get copied or modified
-- **Benefits**: Separates output resources from documentation, enables Gemini CLI to use files without loading them into context
+- **When to include**: When the skill needs files that will be used in the final
+  output
+- **Examples**: `assets/logo.png` for brand assets, `assets/slides.pptx` for
+  PowerPoint templates, `assets/frontend-template/` for HTML/React boilerplate,
+  `assets/font.ttf` for typography
+- **Use cases**: Templates, images, icons, boilerplate code, fonts, sample
+  documents that get copied or modified
+- **Benefits**: Separates output resources from documentation, enables Gemini
+  CLI to use files without loading them into context
 
 #### What to Not Include in a Skill
 
-A skill should only contain essential files that directly support its functionality. Do NOT create extraneous documentation or auxiliary files, including:
+A skill should only contain essential files that directly support its
+functionality. Do NOT create extraneous documentation or auxiliary files,
+including:
 
 - README.md
 - INSTALLATION_GUIDE.md
@@ -107,7 +157,10 @@ A skill should only contain essential files that directly support its functional
 - CHANGELOG.md
 - etc.
 
-The skill should only contain the information needed for an AI agent to do the job at hand. It should not contain auxiliary context about the process that went into creating it, setup and testing procedures, user-facing documentation, etc. Creating additional documentation files just adds clutter and confusion.
+The skill should only contain the information needed for an AI agent to do the
+job at hand. It should not contain auxiliary context about the process that went
+into creating it, setup and testing procedures, user-facing documentation, etc.
+Creating additional documentation files just adds clutter and confusion.
 
 ### Progressive Disclosure Design Principle
 
@@ -115,13 +168,21 @@ Skills use a three-level loading system to manage context efficiently:
 
 1. **Metadata (name + description)** - Always in context (~100 words)
 2. **SKILL.md body** - When skill triggers (<5k words)
-3. **Bundled resources** - As needed by Gemini CLI (Unlimited because scripts can be executed without reading into context window)
+3. **Bundled resources** - As needed by Gemini CLI (Unlimited because scripts
+   can be executed without reading into context window)
 
 #### Progressive Disclosure Patterns
 
-Keep SKILL.md body to the essentials and under 500 lines to minimize context bloat. Split content into separate files when approaching this limit. When splitting out content into other files, it is very important to reference them from SKILL.md and describe clearly when to read them, to ensure the reader of the skill knows they exist and when to use them.
+Keep SKILL.md body to the essentials and under 500 lines to minimize context
+bloat. Split content into separate files when approaching this limit. When
+splitting out content into other files, it is very important to reference them
+from SKILL.md and describe clearly when to read them, to ensure the reader of
+the skill knows they exist and when to use them.
 
-**Key principle:** When a skill supports multiple variations, frameworks, or options, keep only the core workflow and selection guidance in SKILL.md. Move variant-specific details (patterns, examples, configuration) into separate reference files.
+**Key principle:** When a skill supports multiple variations, frameworks, or
+options, keep only the core workflow and selection guidance in SKILL.md. Move
+variant-specific details (patterns, examples, configuration) into separate
+reference files.
 
 **Pattern 1: High-level guide with references**
 
@@ -143,7 +204,8 @@ Gemini CLI loads FORMS.md, REFERENCE.md, or EXAMPLES.md only when needed.
 
 **Pattern 2: Domain-specific organization**
 
-For Skills with multiple domains, organize content by domain to avoid loading irrelevant context:
+For Skills with multiple domains, organize content by domain to avoid loading
+irrelevant context:
 
 ```
 bigquery-skill/
@@ -157,7 +219,8 @@ bigquery-skill/
 
 When a user asks about sales metrics, Gemini CLI only reads sales.md.
 
-Similarly, for skills supporting multiple frameworks or variants, organize by variant:
+Similarly, for skills supporting multiple frameworks or variants, organize by
+variant:
 
 ```
 cloud-deploy/
@@ -183,15 +246,20 @@ Use pandas for loading and basic queries. See [PANDAS.md](PANDAS.md).
 
 ## Advanced Operations
 
-For massive files that exceed memory, see [STREAMING.md](STREAMING.md). For timestamp normalization, see [TIMESTAMPS.md](TIMESTAMPS.md).
+For massive files that exceed memory, see [STREAMING.md](STREAMING.md). For
+timestamp normalization, see [TIMESTAMPS.md](TIMESTAMPS.md).
 
-Gemini CLI reads REDLINING.md or OOXML.md only when the user needs those features.
+Gemini CLI reads REDLINING.md or OOXML.md only when the user needs those
+features.
 ```
 
 **Important guidelines:**
 
-- **Avoid deeply nested references** - Keep references one level deep from SKILL.md. All reference files should link directly from SKILL.md.
-- **Structure longer reference files** - For files longer than 100 lines, include a table of contents at the top so Gemini CLI can see the full scope when previewing.
+- **Avoid deeply nested references** - Keep references one level deep from
+  SKILL.md. All reference files should link directly from SKILL.md.
+- **Structure longer reference files** - For files longer than 100 lines,
+  include a table of contents at the top so Gemini CLI can see the full scope
+  when previewing.
 
 ## Skill Creation Process
 
@@ -205,66 +273,93 @@ Skill creation involves these steps:
 6. Install and reload the skill
 7. Iterate based on real usage
 
-Follow these steps in order, skipping only if there is a clear reason why they are not applicable.
+Follow these steps in order, skipping only if there is a clear reason why they
+are not applicable.
 
 ### Skill Naming
 
-- Use lowercase letters, digits, and hyphens only; normalize user-provided titles to hyphen-case (e.g., "Plan Mode" -> `plan-mode`).
-- When generating names, generate a name under 64 characters (letters, digits, hyphens).
+- Use lowercase letters, digits, and hyphens only; normalize user-provided
+  titles to hyphen-case (e.g., "Plan Mode" -> `plan-mode`).
+- When generating names, generate a name under 64 characters (letters, digits,
+  hyphens).
 - Prefer short, verb-led phrases that describe the action.
-- Namespace by tool when it improves clarity or triggering (e.g., `gh-address-comments`, `linear-address-issue`).
+- Namespace by tool when it improves clarity or triggering (e.g.,
+  `gh-address-comments`, `linear-address-issue`).
 - Name the skill folder exactly after the skill name.
 
 ### Step 1: Understanding the Skill with Concrete Examples
 
-Skip this step only when the skill's usage patterns are already clearly understood. It remains valuable even when working with an existing skill.
+Skip this step only when the skill's usage patterns are already clearly
+understood. It remains valuable even when working with an existing skill.
 
-To create an effective skill, clearly understand concrete examples of how the skill will be used. This understanding can come from either direct user examples or generated examples that are validated with user feedback.
+To create an effective skill, clearly understand concrete examples of how the
+skill will be used. This understanding can come from either direct user examples
+or generated examples that are validated with user feedback.
 
 For example, when building an image-editor skill, relevant questions include:
 
-- "What functionality should the image-editor skill support? Editing, rotating, anything else?"
+- "What functionality should the image-editor skill support? Editing, rotating,
+  anything else?"
 - "Can you give some examples of how this skill would be used?"
-- "I can imagine users asking for things like 'Remove the red-eye from this image' or 'Rotate this image'. Are there other ways you imagine this skill being used?"
+- "I can imagine users asking for things like 'Remove the red-eye from this
+  image' or 'Rotate this image'. Are there other ways you imagine this skill
+  being used?"
 - "What would a user say that should trigger this skill?"
 
-**Avoid interrogation loops:** Do not ask more than one or two clarifying questions at a time. Bias toward action: propose a concrete list of features or examples based on your initial understanding, and ask the user to refine them.
+**Avoid interrogation loops:** Do not ask more than one or two clarifying
+questions at a time. Bias toward action: propose a concrete list of features or
+examples based on your initial understanding, and ask the user to refine them.
 
-Conclude this step when there is a clear sense of the functionality the skill should support.
+Conclude this step when there is a clear sense of the functionality the skill
+should support.
 
 ### Step 2: Planning the Reusable Skill Contents
 
 To turn concrete examples into an effective skill, analyze each example by:
 
 1. Considering how to execute on the example from scratch
-2. Identifying what scripts, references, and assets would be helpful when executing these workflows repeatedly
+2. Identifying what scripts, references, and assets would be helpful when
+   executing these workflows repeatedly
 
-Example: When building a `pdf-editor` skill to handle queries like "Help me rotate this PDF," the analysis shows:
+Example: When building a `pdf-editor` skill to handle queries like "Help me
+rotate this PDF," the analysis shows:
 
 1. Rotating a PDF requires re-writing the same code each time
 2. A `scripts/rotate_pdf.cjs` script would be helpful to store in the skill
 
-Example: When designing a `frontend-webapp-builder` skill for queries like "Build me a todo app" or "Build me a dashboard to track my steps," the analysis shows:
+Example: When designing a `frontend-webapp-builder` skill for queries like
+"Build me a todo app" or "Build me a dashboard to track my steps," the analysis
+shows:
 
 1. Writing a frontend webapp requires the same boilerplate HTML/React each time
-2. An `assets/hello-world/` template containing the boilerplate HTML/React project files would be helpful to store in the skill
+2. An `assets/hello-world/` template containing the boilerplate HTML/React
+   project files would be helpful to store in the skill
 
-Example: When building a `big-query` skill to handle queries like "How many users have logged in today?" the analysis shows:
+Example: When building a `big-query` skill to handle queries like "How many
+users have logged in today?" the analysis shows:
 
-1. Querying BigQuery requires re-discovering the table schemas and relationships each time
-2. A `references/schema.md` file documenting the table schemas would be helpful to store in the skill
+1. Querying BigQuery requires re-discovering the table schemas and relationships
+   each time
+2. A `references/schema.md` file documenting the table schemas would be helpful
+   to store in the skill
 
-To establish the skill's contents, analyze each concrete example to create a list of the reusable resources to include: scripts, references, and assets.
+To establish the skill's contents, analyze each concrete example to create a
+list of the reusable resources to include: scripts, references, and assets.
 
 ### Step 3: Initializing the Skill
 
 At this point, it is time to actually create the skill.
 
-Skip this step only if the skill being developed already exists, and iteration or packaging is needed. In this case, continue to the next step.
+Skip this step only if the skill being developed already exists, and iteration
+or packaging is needed. In this case, continue to the next step.
 
-When creating a new skill from scratch, always run the `init_skill.cjs` script. The script conveniently generates a new template skill directory that automatically includes everything a skill requires, making the skill creation process much more efficient and reliable.
+When creating a new skill from scratch, always run the `init_skill.cjs` script.
+The script conveniently generates a new template skill directory that
+automatically includes everything a skill requires, making the skill creation
+process much more efficient and reliable.
 
-**Note:** Use the absolute path to the script as provided in the `available_resources` section.
+**Note:** Use the absolute path to the script as provided in the
+`available_resources` section.
 
 Usage:
 
@@ -277,30 +372,48 @@ The script:
 - Creates the skill directory at the specified path
 - Generates a SKILL.md template with proper frontmatter and TODO placeholders
 - Creates example resource directories: `scripts/`, `references/`, and `assets/`
-- Adds example files (`scripts/example_script.cjs`, `references/example_reference.md`, `assets/example_asset.txt`) that can be customized or deleted
+- Adds example files (`scripts/example_script.cjs`,
+  `references/example_reference.md`, `assets/example_asset.txt`) that can be
+  customized or deleted
 
-After initialization, customize or remove the generated SKILL.md and example files as needed.
+After initialization, customize or remove the generated SKILL.md and example
+files as needed.
 
 ### Step 4: Edit the Skill
 
-When editing the (newly-generated or existing) skill, remember that the skill is being created for another instance of Gemini CLI to use. Include information that would be beneficial and non-obvious to Gemini CLI. Consider what procedural knowledge, domain-specific details, or reusable assets would help another Gemini CLI instance execute these tasks more effectively.
+When editing the (newly-generated or existing) skill, remember that the skill is
+being created for another instance of Gemini CLI to use. Include information
+that would be beneficial and non-obvious to Gemini CLI. Consider what procedural
+knowledge, domain-specific details, or reusable assets would help another Gemini
+CLI instance execute these tasks more effectively.
 
 #### Learn Proven Design Patterns
 
 Consult these helpful guides based on your skill's needs:
 
-- **Multi-step processes**: See references/workflows.md for sequential workflows and conditional logic
-- **Specific output formats or quality standards**: See references/output-patterns.md for template and example patterns
+- **Multi-step processes**: See references/workflows.md for sequential workflows
+  and conditional logic
+- **Specific output formats or quality standards**: See
+  references/output-patterns.md for template and example patterns
 
 These files contain established best practices for effective skill design.
 
 #### Start with Reusable Skill Contents
 
-To begin implementation, start with the reusable resources identified above: `scripts/`, `references/`, and `assets/` files. Note that this step may require user input. For example, when implementing a `brand-guidelines` skill, the user may need to provide brand assets or templates to store in `assets/`, or documentation to store in `references/`.
+To begin implementation, start with the reusable resources identified above:
+`scripts/`, `references/`, and `assets/` files. Note that this step may require
+user input. For example, when implementing a `brand-guidelines` skill, the user
+may need to provide brand assets or templates to store in `assets/`, or
+documentation to store in `references/`.
 
-Added scripts must be tested by actually running them to ensure there are no bugs and that the output matches what is expected. If there are many similar scripts, only a representative sample needs to be tested to ensure confidence that they all work while balancing time to completion.
+Added scripts must be tested by actually running them to ensure there are no
+bugs and that the output matches what is expected. If there are many similar
+scripts, only a representative sample needs to be tested to ensure confidence
+that they all work while balancing time to completion.
 
-Any example files and directories not needed for the skill should be deleted. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them.
+Any example files and directories not needed for the skill should be deleted.
+The initialization script creates example files in `scripts/`, `references/`,
+and `assets/` to demonstrate structure, but most skills won't need all of them.
 
 #### Update SKILL.md
 
@@ -311,11 +424,17 @@ Any example files and directories not needed for the skill should be deleted. Th
 Write the YAML frontmatter with `name` and `description`:
 
 - `name`: The skill name
-- `description`: This is the primary triggering mechanism for your skill, and helps Gemini CLI understand when to use the skill.
-  - Include both what the Skill does and specific triggers/contexts for when to use it.
-  - **Must be a single-line string** (e.g., `description: Data ingestion...`). Quotes are optional.
-  - Include all "when to use" information here - Not in the body. The body is only loaded after triggering, so "When to Use This Skill" sections in the body are not helpful to Gemini CLI.
-  - Example: `description: Data ingestion, cleaning, and transformation for tabular data. Use when Gemini CLI needs to work with CSV/TSV files to analyze large datasets, normalize schemas, or merge sources.`
+- `description`: This is the primary triggering mechanism for your skill, and
+  helps Gemini CLI understand when to use the skill.
+  - Include both what the Skill does and specific triggers/contexts for when to
+    use it.
+  - **Must be a single-line string** (e.g., `description: Data ingestion...`).
+    Quotes are optional.
+  - Include all "when to use" information here - Not in the body. The body is
+    only loaded after triggering, so "When to Use This Skill" sections in the
+    body are not helpful to Gemini CLI.
+  - Example:
+    `description: Data ingestion, cleaning, and transformation for tabular data. Use when Gemini CLI needs to work with CSV/TSV files to analyze large datasets, normalize schemas, or merge sources.`
 
 Do not include any other fields in YAML frontmatter.
 
@@ -325,9 +444,13 @@ Write instructions for using the skill and its bundled resources.
 
 ### Step 5: Packaging a Skill
 
-Once development of the skill is complete, it must be packaged into a distributable .skill file that gets shared with the user. The packaging process automatically validates the skill first (checking YAML and ensuring no TODOs remain) to ensure it meets all requirements:
+Once development of the skill is complete, it must be packaged into a
+distributable .skill file that gets shared with the user. The packaging process
+automatically validates the skill first (checking YAML and ensuring no TODOs
+remain) to ensure it meets all requirements:
 
-**Note:** Use the absolute path to the script as provided in the `available_resources` section.
+**Note:** Use the absolute path to the script as provided in the
+`available_resources` section.
 
 ```bash
 node <path-to-skill-creator>/scripts/package_skill.cjs <path/to/skill-folder>
@@ -342,20 +465,28 @@ node <path-to-skill-creator>/scripts/package_skill.cjs <path/to/skill-folder> ./
 The packaging script will:
 
 1. **Validate** the skill automatically, checking:
+
    - YAML frontmatter format and required fields
    - Skill naming conventions and directory structure
    - Description completeness and quality
    - File organization and resource references
 
-2. **Package** the skill if validation passes, creating a .skill file named after the skill (e.g., `my-skill.skill`) that includes all files and maintains the proper directory structure for distribution. The .skill file is a zip file with a .skill extension.
+2. **Package** the skill if validation passes, creating a .skill file named
+   after the skill (e.g., `my-skill.skill`) that includes all files and
+   maintains the proper directory structure for distribution. The .skill file is
+   a zip file with a .skill extension.
 
-If validation fails, the script will report the errors and exit without creating a package. Fix any validation errors and run the packaging command again.
+If validation fails, the script will report the errors and exit without creating
+a package. Fix any validation errors and run the packaging command again.
 
 ### Step 6: Installing and Reloading a Skill
 
-Once the skill is packaged into a `.skill` file, offer to install it for the user. Ask whether they would like to install it locally in the current folder (workspace scope) or at the user level (user scope).
+Once the skill is packaged into a `.skill` file, offer to install it for the
+user. Ask whether they would like to install it locally in the current folder
+(workspace scope) or at the user level (user scope).
 
-If the user agrees to an installation, perform it immediately using the `run_shell_command` tool:
+If the user agrees to an installation, perform it immediately using the
+`run_shell_command` tool:
 
 - **Locally (workspace scope)**:
   ```bash
@@ -366,13 +497,19 @@ If the user agrees to an installation, perform it immediately using the `run_she
   gemini skills install <path/to/skill-name.skill> --scope user
   ```
 
-**Important:** After the installation is complete, notify the user that they MUST manually execute the `/skills reload` command in their interactive Gemini CLI session to enable the new skill. They can then verify the installation by running `/skills list`.
+**Important:** After the installation is complete, notify the user that they
+MUST manually execute the `/skills reload` command in their interactive Gemini
+CLI session to enable the new skill. They can then verify the installation by
+running `/skills list`.
 
-Note: You (the agent) cannot execute the `/skills reload` command yourself; it must be done by the user in an interactive instance of Gemini CLI. Do not attempt to run it on their behalf.
+Note: You (the agent) cannot execute the `/skills reload` command yourself; it
+must be done by the user in an interactive instance of Gemini CLI. Do not
+attempt to run it on their behalf.
 
 ### Step 7: Iterate
 
-After testing the skill, users may request improvements. Often this happens right after using the skill, with fresh context of how the skill performed.
+After testing the skill, users may request improvements. Often this happens
+right after using the skill, with fresh context of how the skill performed.
 
 **Iteration workflow:**
 

packages/core/src/telemetry/uiTelemetry.test.ts

@@ -173,6 +173,7 @@ describe('UiTelemetryService', () => {
           totalRequests: 1,
           totalErrors: 0,
           totalLatencyMs: 500,
+          errorsByType: {},
         },
         tokens: {
           input: 5,
@@ -229,6 +230,7 @@ describe('UiTelemetryService', () => {
           totalRequests: 2,
           totalErrors: 0,
           totalLatencyMs: 1100,
+          errorsByType: {},
         },
         tokens: {
           input: 10,
@@ -305,6 +307,9 @@ describe('UiTelemetryService', () => {
           totalRequests: 1,
           totalErrors: 1,
           totalLatencyMs: 300,
+          errorsByType: {
+            UNKNOWN: 1,
+          },
         },
         tokens: {
           input: 0,
@@ -319,6 +324,42 @@ describe('UiTelemetryService', () => {
       });
     });
 
+    it('should track errors by error_type distinctly', () => {
+      const event1 = {
+        'event.name': EVENT_API_ERROR,
+        model: 'gemini-2.5-pro',
+        duration_ms: 200,
+        error: 'Empty response',
+        error_type: 'NO_RESPONSE_TEXT',
+      } as unknown as ApiErrorEvent & { 'event.name': typeof EVENT_API_ERROR };
+
+      const event2 = {
+        'event.name': EVENT_API_ERROR,
+        model: 'gemini-2.5-pro',
+        duration_ms: 250,
+        error: 'Malformed JSON',
+        error_type: 'MALFORMED_FUNCTION_CALL',
+      } as unknown as ApiErrorEvent & { 'event.name': typeof EVENT_API_ERROR };
+
+      const event3 = {
+        'event.name': EVENT_API_ERROR,
+        model: 'gemini-2.5-pro',
+        duration_ms: 100,
+        error: 'Another empty response',
+        error_type: 'NO_RESPONSE_TEXT',
+      } as unknown as ApiErrorEvent & { 'event.name': typeof EVENT_API_ERROR };
+
+      service.addEvent(event1);
+      service.addEvent(event2);
+      service.addEvent(event3);
+
+      const metrics = service.getMetrics();
+      expect(metrics.models['gemini-2.5-pro'].api.errorsByType).toEqual({
+        NO_RESPONSE_TEXT: 2,
+        MALFORMED_FUNCTION_CALL: 1,
+      });
+    });
+
     it('should aggregate ApiErrorEvents and ApiResponseEvents', () => {
       const responseEvent = {
         'event.name': EVENT_API_RESPONSE,
@@ -351,6 +392,9 @@ describe('UiTelemetryService', () => {
           totalRequests: 2,
           totalErrors: 1,
           totalLatencyMs: 800,
+          errorsByType: {
+            UNKNOWN: 1,
+          },
         },
         tokens: {
           input: 5,

packages/core/src/telemetry/uiTelemetry.ts

@@ -56,6 +56,7 @@ export interface ModelMetrics {
     totalRequests: number;
     totalErrors: number;
     totalLatencyMs: number;
+    errorsByType?: Record<string, number>;
   };
   tokens: {
     input: number;
@@ -110,6 +111,7 @@ const createInitialModelMetrics = (): ModelMetrics => ({
     totalRequests: 0,
     totalErrors: 0,
     totalLatencyMs: 0,
+    errorsByType: {},
   },
   tokens: {
     input: 0,
@@ -170,6 +172,23 @@ export class UiTelemetryService extends EventEmitter {
     });
   }
 
+  recordSemanticValidationError(model: string, errorType: string): void {
+    const modelMetrics = this.getOrCreateModelMetrics(model);
+    modelMetrics.api.totalErrors++;
+
+    if (!modelMetrics.api.errorsByType) {
+      modelMetrics.api.errorsByType = {};
+    }
+    const type = errorType || 'INVALID_STREAM';
+    modelMetrics.api.errorsByType[type] =
+      (modelMetrics.api.errorsByType[type] || 0) + 1;
+
+    this.emit('update', {
+      metrics: this.#metrics,
+      lastPromptTokenCount: this.#lastPromptTokenCount,
+    });
+  }
+
   getMetrics(): SessionMetrics {
     return this.#metrics;
   }
@@ -326,6 +345,13 @@ export class UiTelemetryService extends EventEmitter {
     modelMetrics.api.totalErrors++;
     modelMetrics.api.totalLatencyMs += event.duration_ms;
 
+    if (!modelMetrics.api.errorsByType) {
+      modelMetrics.api.errorsByType = {};
+    }
+    const errorType = event.error_type || 'UNKNOWN';
+    modelMetrics.api.errorsByType[errorType] =
+      (modelMetrics.api.errorsByType[errorType] || 0) + 1;
+
     if (event.role) {
       if (!modelMetrics.roles[event.role]) {
         modelMetrics.roles[event.role] = createInitialRoleMetrics();

packages/core/src/utils/constants.ts

@@ -10,3 +10,24 @@ export const REFERENCE_CONTENT_END = '--- End of content ---';
 export const DEFAULT_MAX_LINES_TEXT_FILE = 2000;
 export const MAX_LINE_LENGTH_TEXT_FILE = 2000;
 export const MAX_FILE_SIZE_MB = 20;
+
+export const EMPTY_RESPONSE_COMPRESS_SUGGESTION =
+  'The model returned an empty text response. If your context window is near capacity, try using /compress.';
+
+export const THINKING_ONLY_COMPRESS_SUGGESTION =
+  'The model returned reasoning thoughts but no final response text. If your context window is near capacity, try using /compress.';
+
+export const MAX_TOKENS_EXCEEDED_SUGGESTION =
+  'Model response was truncated because it exceeded the token limit. Try using /compress to free up context space.';
+
+export const SAFETY_BLOCKED_MESSAGE =
+  'The model response was blocked due to safety settings.';
+
+export const RECITATION_BLOCKED_MESSAGE =
+  'The model response was blocked due to recitation/copyright filters.';
+
+export const OTHER_BLOCKED_MESSAGE =
+  'The model response was blocked due to other policy settings.';
+
+export const TRUE_EMPTY_RESPONSE_MESSAGE =
+  'The model returned an empty response with no text or thoughts. This may be a transient API issue; please try again.';

packages/core/src/utils/errorParsing.test.ts

@@ -109,6 +109,16 @@ describe('parseAndFormatApiError', () => {
     expect(result).toContain(vertexMessage);
   });
 
+  it('should format a StructuredError with status: undefined', () => {
+    const error: StructuredError = {
+      message: 'Rate limit exceeded (simulated 429 error, limit: 0)',
+      status: undefined,
+    };
+    const expected =
+      '[API Error: Rate limit exceeded (simulated 429 error, limit: 0)]';
+    expect(parseAndFormatApiError(error)).toBe(expected);
+  });
+
   it('should handle an unknown error type', () => {
     const error = 12345;
     const expected = '[API Error: An unknown error occurred.]';

packages/core/src/utils/flashFallback.test.ts

@@ -107,6 +107,36 @@ describe('Retry Utility Fallback Integration', () => {
     expect(mockApiCall).toHaveBeenCalledTimes(3);
   });
 
+  it('should call onPersistent429 immediately on attempt 1 when classifyGoogleError returns TerminalQuotaError', async () => {
+    const mockApiCall = vi
+      .fn()
+      .mockRejectedValue(
+        new TerminalQuotaError('Capacity exhausted', mockGoogleApiError),
+      );
+
+    const mockPersistent429Callback = vi.fn(
+      async () =>
+        // Return null to stop retrying after fallback attempt
+        null,
+    );
+
+    const promise = retryWithBackoff(mockApiCall, {
+      maxAttempts: 10, // High maxAttempts to prove we don't wait for max attempts
+      initialDelayMs: 1,
+      maxDelayMs: 10,
+      onPersistent429: mockPersistent429Callback,
+      authType: AuthType.LOGIN_WITH_GOOGLE,
+    });
+
+    await expect(promise).rejects.toThrow('Capacity exhausted');
+    expect(mockApiCall).toHaveBeenCalledTimes(1); // Only called once because it's terminal and fallback returned null
+    expect(mockPersistent429Callback).toHaveBeenCalledTimes(1);
+    expect(mockPersistent429Callback).toHaveBeenCalledWith(
+      AuthType.LOGIN_WITH_GOOGLE,
+      expect.any(TerminalQuotaError),
+    );
+  });
+
   it('should trigger onPersistent429 when HTTP 499 persists through all retry attempts', async () => {
     let fallbackCalled = false;
     const mockError: HttpError = new Error('Simulated 499 error');

packages/core/src/utils/googleErrors.test.ts

@@ -445,4 +445,113 @@ describe('parseGoogleApiError', () => {
     expect(parsed?.code).toBe(429);
     expect(parsed?.message).toBe('Quota exceeded');
   });
+
+  it('should parse an error wrapped inside cause.message by gaxios', () => {
+    const mockError = {
+      code: 429,
+      status: 429,
+      cause: {
+        message: JSON.stringify([
+          {
+            error: {
+              code: 429,
+              message:
+                'No capacity available for model gemini-3.1-pro-preview on the server',
+              details: [
+                {
+                  '@type': 'type.googleapis.com/google.rpc.ErrorInfo',
+                  reason: 'MODEL_CAPACITY_EXHAUSTED',
+                  domain: 'cloudcode-pa.googleapis.com',
+                  metadata: { model: 'gemini-3.1-pro-preview' },
+                },
+              ],
+            },
+          },
+        ]),
+        code: 429,
+        status: 'Too Many Requests',
+      },
+    };
+
+    const parsed = parseGoogleApiError(mockError);
+    expect(parsed).not.toBeNull();
+    expect(parsed?.code).toBe(429);
+    expect(parsed?.message).toBe(
+      'No capacity available for model gemini-3.1-pro-preview on the server',
+    );
+    expect(parsed?.details).toHaveLength(1);
+    expect(parsed?.details[0]['@type']).toBe(
+      'type.googleapis.com/google.rpc.ErrorInfo',
+    );
+  });
+
+  it('should parse an error where cause is a plain ErrorShape and propagate outer code', () => {
+    const mockError = {
+      code: 429,
+      cause: {
+        message: 'Quota exceeded on the server',
+      },
+    };
+
+    const parsed = parseGoogleApiError(mockError);
+    expect(parsed).not.toBeNull();
+    expect(parsed?.code).toBe(429);
+    expect(parsed?.message).toBe('Quota exceeded on the server');
+  });
+
+  it('should parse an error where cause is a standard Error object and propagate outer status', () => {
+    const mockError = {
+      status: 503,
+      cause: new Error('Service Unavailable'),
+    };
+
+    const parsed = parseGoogleApiError(mockError);
+    expect(parsed).not.toBeNull();
+    expect(parsed?.code).toBe(503);
+    expect(parsed?.message).toBe('Service Unavailable');
+  });
+
+  it('should defensively parse numeric string status codes from outer error', () => {
+    const mockError = {
+      status: '503',
+      cause: new Error('Service Unavailable'),
+    };
+
+    const parsed = parseGoogleApiError(mockError);
+    expect(parsed).not.toBeNull();
+    expect(parsed?.code).toBe(503);
+    expect(parsed?.message).toBe('Service Unavailable');
+  });
+
+  it('should return null for non-numeric string status codes from outer error', () => {
+    const mockError = {
+      status: 'Too Many Requests',
+      cause: new Error('Quota exceeded'),
+    };
+
+    const parsed = parseGoogleApiError(mockError);
+    expect(parsed).toBeNull();
+  });
+
+  it('should return null for empty or whitespace-only string status codes from outer error', () => {
+    const mockError = {
+      status: '   ',
+      cause: new Error('Quota exceeded'),
+    };
+
+    const parsed = parseGoogleApiError(mockError);
+    expect(parsed).toBeNull();
+  });
+
+  it('should parse an error where cause is a plain string and propagate outer status', () => {
+    const mockError = {
+      status: 429,
+      cause: 'Quota exceeded on the server',
+    };
+
+    const parsed = parseGoogleApiError(mockError);
+    expect(parsed).not.toBeNull();
+    expect(parsed?.code).toBe(429);
+    expect(parsed?.message).toBe('Quota exceeded on the server');
+  });
 });

packages/core/src/utils/googleErrors.ts

@@ -153,6 +153,18 @@ export function parseGoogleApiError(error: unknown): GoogleApiError | null {
     return null;
   }
 
+  // Skip parsing if the error is already a classified quota error
+  if (
+    typeof error === 'object' &&
+    error !== null &&
+    'name' in error &&
+    (error.name === 'TerminalQuotaError' ||
+      error.name === 'RetryableQuotaError' ||
+      error.name === 'ValidationRequiredError')
+  ) {
+    return null;
+  }
+
   let errorObj: unknown = error;
 
   // If error is a string, try to parse it.
@@ -174,7 +186,9 @@ export function parseGoogleApiError(error: unknown): GoogleApiError | null {
   }
 
   let currentError: ErrorShape | undefined =
-    fromGaxiosError(errorObj) ?? fromApiError(errorObj);
+    fromGaxiosError(errorObj) ??
+    fromApiError(errorObj) ??
+    fromCauseError(errorObj);
 
   let depth = 0;
   const maxDepth = 10;
@@ -371,3 +385,70 @@ function fromApiError(errorObj: object): ErrorShape | undefined {
   }
   return outerError;
 }
+
+function fromCauseError(errorObj: object): ErrorShape | undefined {
+  const err = errorObj as {
+    code?: unknown;
+    status?: unknown;
+    cause?: unknown;
+  };
+  if (!err.cause) return undefined;
+
+  const rawCode = err.code ?? err.status;
+  const fallbackCode =
+    typeof rawCode === 'number'
+      ? rawCode
+      : typeof rawCode === 'string' &&
+          rawCode.trim() !== '' &&
+          !isNaN(Number(rawCode))
+        ? Number(rawCode)
+        : undefined;
+
+  const resolveError = (
+    resolved: ErrorShape | undefined,
+  ): ErrorShape | undefined => {
+    if (!resolved) return undefined;
+    const message = resolved.message;
+    const details = resolved.details;
+    const code = resolved.code ?? fallbackCode;
+    return {
+      ...(message !== undefined ? { message } : {}),
+      ...(details !== undefined ? { details } : {}),
+      ...(code !== undefined ? { code } : {}),
+    };
+  };
+
+  if (typeof err.cause === 'object' && err.cause !== null) {
+    if (
+      'error' in err.cause &&
+      err.cause.error &&
+      isErrorShape(err.cause.error)
+    ) {
+      return resolveError(err.cause.error);
+    }
+    if ('message' in err.cause && err.cause.message) {
+      if (typeof err.cause.message === 'string') {
+        const parsed = fromApiError({ message: err.cause.message });
+        if (parsed) return resolveError(parsed);
+      } else if (
+        typeof err.cause.message === 'object' &&
+        err.cause.message !== null
+      ) {
+        const msgObj = err.cause.message as { error?: unknown };
+        if (msgObj.error && isErrorShape(msgObj.error)) {
+          return resolveError(msgObj.error);
+        }
+      }
+    }
+    if (isErrorShape(err.cause)) {
+      return resolveError(err.cause);
+    }
+  }
+  if (typeof err.cause === 'string' && err.cause.trim() !== '') {
+    const parsed = fromApiError({ message: err.cause }) ?? {
+      message: err.cause,
+    };
+    return resolveError(parsed);
+  }
+  return undefined;
+}

packages/core/src/utils/googleQuotaErrors.test.ts

@@ -81,7 +81,7 @@ describe('classifyGoogleError', () => {
     }
   });
 
-  it('should return RetryableQuotaError with delay for 503 Service Unavailable with RetryInfo', () => {
+  it('should return TerminalQuotaError for MODEL_CAPACITY_EXHAUSTED even with RetryInfo headers', () => {
     const apiError: GoogleApiError = {
       code: 503,
       message:
@@ -103,8 +103,82 @@ describe('classifyGoogleError', () => {
     };
     vi.spyOn(errorParser, 'parseGoogleApiError').mockReturnValue(apiError);
     const result = classifyGoogleError(new Error());
-    expect(result).toBeInstanceOf(RetryableQuotaError);
-    expect((result as RetryableQuotaError).retryDelayMs).toBe(9000);
+    expect(result).toBeInstanceOf(TerminalQuotaError);
+  });
+
+  it('should return TerminalQuotaError for MODEL_CAPACITY_EXHAUSTED when no retry delay is specified', () => {
+    const apiError: GoogleApiError = {
+      code: 429,
+      message:
+        'No capacity available for model gemini-3.1-pro-preview on the server',
+      details: [
+        {
+          '@type': 'type.googleapis.com/google.rpc.ErrorInfo',
+          reason: 'MODEL_CAPACITY_EXHAUSTED',
+          domain: 'cloudcode-pa.googleapis.com',
+          metadata: { model: 'gemini-3.1-pro-preview' },
+        },
+      ],
+    };
+    vi.spyOn(errorParser, 'parseGoogleApiError').mockReturnValue(apiError);
+    const result = classifyGoogleError(new Error());
+    expect(result).toBeInstanceOf(TerminalQuotaError);
+  });
+
+  it('should return TerminalQuotaError for structured error with details when message contains capacity exhaustion keywords', () => {
+    const apiError: GoogleApiError = {
+      code: 429,
+      message: 'You have exhausted your capacity on this model.',
+      details: [
+        {
+          '@type': 'type.googleapis.com/google.rpc.Help',
+          links: [
+            { description: 'Learn more', url: 'https://support.google.com' },
+          ],
+        },
+      ],
+    };
+    vi.spyOn(errorParser, 'parseGoogleApiError').mockReturnValue(apiError);
+    const result = classifyGoogleError(new Error());
+    expect(result).toBeInstanceOf(TerminalQuotaError);
+  });
+
+  it('should return TerminalQuotaError for MODEL_CAPACITY_EXHAUSTED even when the domain is not a Cloud Code domain (domain-agnostic)', () => {
+    const apiError: GoogleApiError = {
+      code: 429,
+      message:
+        'No capacity available for model gemini-3.1-pro-preview on the server',
+      details: [
+        {
+          '@type': 'type.googleapis.com/google.rpc.ErrorInfo',
+          reason: 'MODEL_CAPACITY_EXHAUSTED',
+          domain: 'other.googleapis.com',
+          metadata: { model: 'gemini-3.1-pro-preview' },
+        },
+      ],
+    };
+    vi.spyOn(errorParser, 'parseGoogleApiError').mockReturnValue(apiError);
+    const result = classifyGoogleError(new Error());
+    expect(result).toBeInstanceOf(TerminalQuotaError);
+  });
+
+  it('should return TerminalQuotaError for MODEL_CAPACITY_EXCEEDED when no retry delay is specified', () => {
+    const apiError: GoogleApiError = {
+      code: 429,
+      message:
+        'No capacity available for model gemini-3.1-pro-preview on the server',
+      details: [
+        {
+          '@type': 'type.googleapis.com/google.rpc.ErrorInfo',
+          reason: 'MODEL_CAPACITY_EXCEEDED',
+          domain: 'cloudcode-pa.googleapis.com',
+          metadata: { model: 'gemini-3.1-pro-preview' },
+        },
+      ],
+    };
+    vi.spyOn(errorParser, 'parseGoogleApiError').mockReturnValue(apiError);
+    const result = classifyGoogleError(new Error());
+    expect(result).toBeInstanceOf(TerminalQuotaError);
   });
 
   it('should return original error if code is not 429, 499 or 503', () => {
@@ -339,6 +413,28 @@ describe('classifyGoogleError', () => {
     expect((result as TerminalQuotaError).reason).toBe('RATE_LIMIT_EXCEEDED');
   });
 
+  it('should return TerminalQuotaError for Cloud Code RATE_LIMIT_EXCEEDED without a specified server delay', () => {
+    const apiError: GoogleApiError = {
+      code: 429,
+      message: 'Rate limit exceeded',
+      details: [
+        {
+          '@type': 'type.googleapis.com/google.rpc.ErrorInfo',
+          reason: 'RATE_LIMIT_EXCEEDED',
+          domain: 'cloudcode-pa.googleapis.com',
+          metadata: {
+            uiMessage: 'true',
+            model: 'gemini-2.5-pro',
+          },
+        },
+      ],
+    };
+    vi.spyOn(errorParser, 'parseGoogleApiError').mockReturnValue(apiError);
+    const result = classifyGoogleError(new Error());
+    expect(result).toBeInstanceOf(TerminalQuotaError);
+    expect((result as TerminalQuotaError).reason).toBe('RATE_LIMIT_EXCEEDED');
+  });
+
   it('should return TerminalQuotaError for Cloud Code QUOTA_EXHAUSTED', () => {
     const apiError: GoogleApiError = {
       code: 429,

packages/core/src/utils/googleQuotaErrors.ts

@@ -28,15 +28,17 @@ enum GoogleApiType {
 export class TerminalQuotaError extends Error {
   retryDelayMs?: number;
   reason?: string;
+  status?: number;
 
   constructor(
     message: string,
-    override readonly cause: GoogleApiError,
+    override readonly cause?: GoogleApiError,
     retryDelaySeconds?: number,
     reason?: string,
   ) {
     super(message);
     this.name = 'TerminalQuotaError';
+    this.status = cause?.code;
     this.retryDelayMs = retryDelaySeconds
       ? retryDelaySeconds * 1000
       : undefined;
@@ -53,14 +55,16 @@ export class TerminalQuotaError extends Error {
  */
 export class RetryableQuotaError extends Error {
   retryDelayMs?: number;
+  status?: number;
 
   constructor(
     message: string,
-    override readonly cause: GoogleApiError,
+    override readonly cause?: GoogleApiError,
     retryDelaySeconds?: number,
   ) {
     super(message);
     this.name = 'RetryableQuotaError';
+    this.status = cause?.code;
     this.retryDelayMs = retryDelaySeconds
       ? retryDelaySeconds * 1000
       : undefined;
@@ -217,6 +221,20 @@ function classifyValidationRequiredError(
  * @returns A classified error or the original `unknown` error.
  */
 export function classifyGoogleError(error: unknown): unknown {
+  if (
+    error instanceof TerminalQuotaError ||
+    error instanceof RetryableQuotaError ||
+    error instanceof ValidationRequiredError ||
+    (typeof error === 'object' &&
+      error !== null &&
+      'name' in error &&
+      (error.name === 'TerminalQuotaError' ||
+        error.name === 'RetryableQuotaError' ||
+        error.name === 'ValidationRequiredError'))
+  ) {
+    return error;
+  }
+
   const googleApiError = parseGoogleApiError(error);
   const status = googleApiError?.code ?? getErrorStatus(error);
   const errorMessage = googleApiError?.message || extractErrorMessage(error);
@@ -271,16 +289,23 @@ export function classifyGoogleError(error: unknown): unknown {
         return new RetryableQuotaError(errorMessage, cause, retryDelaySeconds);
       }
     } else if (status === 429 || status === 499 || status === 503) {
-      // Fallback: If it is a 429, 499, or 503 but doesn't have a specific "retry in" message,
-      // assume it is a temporary rate limit and retry.
-      return new RetryableQuotaError(
-        errorMessage,
-        googleApiError ?? {
-          code: status,
-          message: errorMessage,
-          details: [],
-        },
-      );
+      const cause = googleApiError ?? {
+        code: status,
+        message: errorMessage,
+        details: [],
+      };
+
+      // If the error message indicates capacity exhaustion, classify as TerminalQuotaError
+      if (
+        /exhausted your capacity|capacity exceeded|MODEL_CAPACITY_EXHAUSTED/i.test(
+          errorMessage,
+        )
+      ) {
+        return new TerminalQuotaError(errorMessage, cause);
+      }
+
+      // Fallback: assume it is a temporary rate limit and retry.
+      return new RetryableQuotaError(errorMessage, cause);
     }
 
     return error; // Not a retryable error we can handle with structured details or a parsable retry message.
@@ -320,6 +345,19 @@ export function classifyGoogleError(error: unknown): unknown {
   }
 
   if (errorInfo) {
+    // Always treat capacity exhaustion as terminal error to trigger immediate model fallback
+    if (
+      errorInfo.reason === 'MODEL_CAPACITY_EXHAUSTED' ||
+      errorInfo.reason === 'MODEL_CAPACITY_EXCEEDED'
+    ) {
+      return new TerminalQuotaError(
+        googleApiError.message,
+        googleApiError,
+        delaySeconds,
+        errorInfo.reason,
+      );
+    }
+
     // INSUFFICIENT_G1_CREDITS_BALANCE is always terminal, regardless of domain
     if (errorInfo.reason === 'INSUFFICIENT_G1_CREDITS_BALANCE') {
       return new TerminalQuotaError(
@@ -334,7 +372,15 @@ export function classifyGoogleError(error: unknown): unknown {
     if (errorInfo.domain) {
       if (isCloudCodeDomain(errorInfo.domain)) {
         if (errorInfo.reason === 'RATE_LIMIT_EXCEEDED') {
-          const effectiveDelay = delaySeconds ?? 10;
+          if (delaySeconds === undefined) {
+            return new TerminalQuotaError(
+              googleApiError.message,
+              googleApiError,
+              undefined,
+              errorInfo.reason,
+            );
+          }
+          const effectiveDelay = delaySeconds;
           if (effectiveDelay > MAX_RETRYABLE_DELAY_SECONDS) {
             return new TerminalQuotaError(
               googleApiError.message,
@@ -402,6 +448,15 @@ export function classifyGoogleError(error: unknown): unknown {
     }
   }
 
+  // If the error message indicates capacity exhaustion, classify as TerminalQuotaError
+  if (
+    /exhausted your capacity|capacity exceeded|MODEL_CAPACITY_EXHAUSTED/i.test(
+      errorMessage,
+    )
+  ) {
+    return new TerminalQuotaError(errorMessage, googleApiError);
+  }
+
   // If we reached this point, the status is 429, 499, or 503 and we have details,
   // but no specific violation was matched. We return a generic retryable error.
   return new RetryableQuotaError(errorMessage, googleApiError);

packages/core/src/utils/messageInspectors.test.ts

@@ -0,0 +1,167 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect } from 'vitest';
+import { isFunctionResponse, isFunctionCall } from './messageInspectors.js';
+
+describe('messageInspectors', () => {
+  describe('isFunctionResponse', () => {
+    it('should return false if content role is not user', () => {
+      const content = {
+        role: 'model',
+        parts: [
+          {
+            functionResponse: {
+              name: 'test_tool',
+              response: { success: true },
+            },
+          },
+        ],
+      };
+      expect(isFunctionResponse(content)).toBe(false);
+    });
+
+    it('should return false if content has no parts', () => {
+      const content = {
+        role: 'user',
+      };
+      expect(isFunctionResponse(content)).toBe(false);
+    });
+
+    it('should return false if parts are empty', () => {
+      const content = {
+        role: 'user',
+        parts: [],
+      };
+      expect(isFunctionResponse(content)).toBe(false);
+    });
+
+    it('should return false if none of the parts is a functionResponse', () => {
+      const content = {
+        role: 'user',
+        parts: [
+          {
+            text: 'Hello world',
+          },
+          {
+            fileData: {
+              mimeType: 'image/png',
+              fileUri: 'https://example.com/image.png',
+            },
+          },
+        ],
+      };
+      expect(isFunctionResponse(content)).toBe(false);
+    });
+
+    it('should return true if all parts are functionResponses', () => {
+      const content = {
+        role: 'user',
+        parts: [
+          {
+            functionResponse: {
+              name: 'test_tool_1',
+              response: { success: true },
+            },
+          },
+          {
+            functionResponse: {
+              name: 'test_tool_2',
+              response: { value: 42 },
+            },
+          },
+        ],
+      };
+      expect(isFunctionResponse(content)).toBe(true);
+    });
+
+    it('should return true if content is a mixed multimodal tool response containing functionResponse and sibling parts', () => {
+      const content = {
+        role: 'user',
+        parts: [
+          {
+            functionResponse: {
+              name: 'test_tool',
+              response: { success: true },
+            },
+          },
+          {
+            fileData: {
+              mimeType: 'image/png',
+              fileUri: 'https://example.com/image.png',
+            },
+          },
+        ],
+      };
+      expect(isFunctionResponse(content)).toBe(true);
+    });
+  });
+
+  describe('isFunctionCall', () => {
+    it('should return false if content role is not model', () => {
+      const content = {
+        role: 'user',
+        parts: [
+          {
+            functionCall: {
+              name: 'test_tool',
+              args: {},
+            },
+          },
+        ],
+      };
+      expect(isFunctionCall(content)).toBe(false);
+    });
+
+    it('should return false if content has no parts', () => {
+      const content = {
+        role: 'model',
+      };
+      expect(isFunctionCall(content)).toBe(false);
+    });
+
+    it('should return false if parts are empty', () => {
+      const content = {
+        role: 'model',
+        parts: [],
+      };
+      expect(isFunctionCall(content)).toBe(false);
+    });
+
+    it('should return false if none of the parts is a functionCall', () => {
+      const content = {
+        role: 'model',
+        parts: [
+          {
+            text: 'I am thinking...',
+          },
+        ],
+      };
+      expect(isFunctionCall(content)).toBe(false);
+    });
+
+    it('should return true if all parts are functionCalls', () => {
+      const content = {
+        role: 'model',
+        parts: [
+          {
+            functionCall: {
+              name: 'test_tool_1',
+              args: {},
+            },
+          },
+          {
+            functionCall: {
+              name: 'test_tool_2',
+              args: { query: 'foo' },
+            },
+          },
+        ],
+      };
+      expect(isFunctionCall(content)).toBe(true);
+    });
+  });
+});

packages/core/src/utils/messageInspectors.ts

@@ -10,7 +10,7 @@ export function isFunctionResponse(content: Content): boolean {
   return (
     content.role === 'user' &&
     !!content.parts &&
-    content.parts.every((part) => !!part.functionResponse)
+    content.parts.some((part) => !!part.functionResponse)
   );
 }
 
@@ -18,6 +18,7 @@ export function isFunctionCall(content: Content): boolean {
   return (
     content.role === 'model' &&
     !!content.parts &&
+    content.parts.length > 0 &&
     content.parts.every((part) => !!part.functionCall)
   );
 }

packages/core/src/utils/oauth-flow.test.ts

@@ -209,6 +209,126 @@ describe('oauth-flow', () => {
       const parsed = new URL(url);
       expect(parsed.searchParams.has('resource')).toBe(false);
     });
+
+    it('should use the Cloud Workstations proxy callback URL when running inside Cloud Workstations', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const url = buildAuthorizationUrl(baseConfig, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        `https://3000-my-workstation.cluster.workstations.cloud.google.com${REDIRECT_PATH}`,
+      );
+    });
+
+    it('should convert explicitly configured localhost URL to Workstations proxy URL', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'http://localhost:8080/custom/callback',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        'https://3000-my-workstation.cluster.workstations.cloud.google.com/custom/callback',
+      );
+    });
+
+    it('should convert explicitly configured 127.0.0.1 URL to Workstations proxy URL', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'http://127.0.0.1:4000/oauth2callback',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        'https://3000-my-workstation.cluster.workstations.cloud.google.com/oauth2callback',
+      );
+    });
+
+    it('should convert explicitly configured [::1] IPv6 loopback URL to Workstations proxy URL', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'http://[::1]:9090/oauth2callback',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        'https://3000-my-workstation.cluster.workstations.cloud.google.com/oauth2callback',
+      );
+    });
+
+    it('should preserve query parameters and hashes from the configured redirectUri', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'http://localhost:5050/callback?tenant=123#token=abc',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        'https://3000-my-workstation.cluster.workstations.cloud.google.com/callback?tenant=123#token=abc',
+      );
+    });
+
+    it('should leave external explicitly configured redirect URIs untouched under Cloud Workstations', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'https://external-domain.com/callback',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        'https://external-domain.com/callback',
+      );
+    });
+
+    it('should handle invalid redirect URIs gracefully by returning them as-is', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'not-a-valid-url',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe('not-a-valid-url');
+    });
   });
 
   describe('startCallbackServer', () => {
@@ -493,6 +613,29 @@ describe('oauth-flow', () => {
       expect(body.get('redirect_uri')).toBe('https://custom.example.com/cb');
     });
 
+    it('should use the Cloud Workstations proxy callback URL when running inside Cloud Workstations', async () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      mockFetch.mockResolvedValueOnce(
+        createMockResponse(
+          JSON.stringify({ access_token: 'tok', token_type: 'Bearer' }),
+        ),
+      );
+
+      await exchangeCodeForToken(baseConfig, 'code', 'verifier', 3000);
+
+      const body = new URLSearchParams(
+        (mockFetch.mock.calls[0] as [string, RequestInit])[1].body as string,
+      );
+      expect(body.get('redirect_uri')).toBe(
+        `https://3000-my-workstation.cluster.workstations.cloud.google.com${REDIRECT_PATH}`,
+      );
+    });
+
     it('should default token_type to Bearer when missing from JSON response', async () => {
       mockFetch.mockResolvedValueOnce(
         createMockResponse(JSON.stringify({ access_token: 'tok' })),

packages/core/src/utils/oauth-flow.ts

@@ -70,6 +70,46 @@ export interface OAuthTokenResponse {
 /** The path the local callback server listens on. */
 export const REDIRECT_PATH = '/oauth/callback';
 
+/**
+ * Helper to determine the redirect URI, taking Google Cloud Workstations proxy into account.
+ */
+export function getRedirectUri(
+  config: { redirectUri?: string },
+  redirectPort: number,
+): string {
+  if (
+    process.env['GOOGLE_CLOUD_WORKSTATIONS'] === 'true' &&
+    process.env['WEB_HOST']
+  ) {
+    if (config.redirectUri) {
+      try {
+        const parsed = new URL(config.redirectUri);
+        if (
+          parsed.hostname === 'localhost' ||
+          parsed.hostname === '127.0.0.1' ||
+          parsed.hostname === '[::1]'
+        ) {
+          const port = String(redirectPort);
+          parsed.protocol = 'https:';
+          parsed.hostname = `${port}-${process.env['WEB_HOST']}`;
+          parsed.port = '';
+          return parsed.toString();
+        }
+      } catch {
+        // Fall back to returning config.redirectUri as-is if parsing fails
+      }
+      return config.redirectUri;
+    }
+
+    return `https://${redirectPort}-${process.env['WEB_HOST']}${REDIRECT_PATH}`;
+  }
+
+  if (config.redirectUri) {
+    return config.redirectUri;
+  }
+  return `http://localhost:${redirectPort}${REDIRECT_PATH}`;
+}
+
 const HTTP_OK = 200;
 
 /**
@@ -291,8 +331,7 @@ export function buildAuthorizationUrl(
   redirectPort: number,
   resource?: string,
 ): string {
-  const redirectUri =
-    config.redirectUri || `http://localhost:${redirectPort}${REDIRECT_PATH}`;
+  const redirectUri = getRedirectUri(config, redirectPort);
 
   const params = new URLSearchParams({
     client_id: config.clientId,
@@ -446,8 +485,7 @@ export async function exchangeCodeForToken(
   redirectPort: number,
   resource?: string,
 ): Promise<OAuthTokenResponse> {
-  const redirectUri =
-    config.redirectUri || `http://localhost:${redirectPort}${REDIRECT_PATH}`;
+  const redirectUri = getRedirectUri(config, redirectPort);
 
   const params = new URLSearchParams({
     grant_type: 'authorization_code',

packages/core/src/utils/quotaErrorDetection.ts

@@ -41,7 +41,11 @@ export function isStructuredError(error: unknown): error is StructuredError {
   if (typeof error.message !== 'string') {
     return false;
   }
-  if ('status' in error && typeof error.status !== 'number') {
+  if (
+    'status' in error &&
+    error.status !== undefined &&
+    typeof error.status !== 'number'
+  ) {
     return false;
   }
   return true;

packages/devtools/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-devtools",
-  "version": "0.52.0-nightly.20260715.gfa975395b",
+  "version": "0.55.1",
   "license": "Apache-2.0",
   "type": "module",
   "main": "dist/src/index.js",

packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-sdk",
-  "version": "0.52.0-nightly.20260715.gfa975395b",
+  "version": "0.55.1",
   "description": "Gemini CLI SDK",
   "license": "Apache-2.0",
   "repository": {

packages/test-utils/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-test-utils",
-  "version": "0.52.0-nightly.20260715.gfa975395b",
+  "version": "0.55.1",
   "private": true,
   "main": "src/index.ts",
   "license": "Apache-2.0",

packages/vscode-ide-companion/package.json

@@ -2,7 +2,7 @@
   "name": "gemini-cli-vscode-ide-companion",
   "displayName": "Gemini CLI Companion",
   "description": "Enable Gemini CLI with direct access to your IDE workspace.",
-  "version": "0.52.0-nightly.20260715.gfa975395b",
+  "version": "0.55.1",
   "publisher": "google",
   "icon": "assets/icon.png",
   "repository": {

scripts/eval-report-cli.ts

@@ -0,0 +1,81 @@
+#!/usr/bin/env tsx
+
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @fileoverview CLI entry point to summarize eval report.json files.
+ *
+ * Scans a directory for report.json files, groups them by model name,
+ * and prints pass rate summaries. Integrates with static inventory data
+ * to display static policies.
+ *
+ * Usage:
+ *   npm run eval:report
+ *   npm run eval:report -- <reports-directory> [--json] [--root <repo-root>]
+ */
+
+import path from 'node:path';
+import fs from 'node:fs';
+import { collectInventory } from './utils/eval-inventory.js';
+import {
+  summarizeReports,
+  formatReportSummary,
+  formatReportSummaryJson,
+} from './utils/eval-report.js';
+
+async function main() {
+  const args = process.argv.slice(2);
+
+  const jsonFlagIndex = args.indexOf('--json');
+  const jsonMode = jsonFlagIndex !== -1;
+  if (jsonMode) args.splice(jsonFlagIndex, 1);
+
+  const rootFlagIndex = args.indexOf('--root');
+  let repoRoot: string | undefined;
+  if (rootFlagIndex !== -1) {
+    repoRoot = args[rootFlagIndex + 1];
+    if (repoRoot === undefined || repoRoot.startsWith('--')) {
+      console.error('Error: --root requires a valid directory path.');
+      process.exit(1);
+    }
+    args.splice(rootFlagIndex, 2);
+  }
+
+  const resolvedRoot = repoRoot ? path.resolve(repoRoot) : process.cwd();
+
+  // The first positional argument is the directory of reports
+  const reportsDirArg = args.find((a) => !a.startsWith('--'));
+  const reportsDir = reportsDirArg
+    ? path.resolve(reportsDirArg)
+    : path.join(resolvedRoot, 'evals', 'logs');
+
+  if (!fs.existsSync(reportsDir)) {
+    console.error(`Error: Reports directory does not exist: ${reportsDir}`);
+    process.exit(1);
+  }
+
+  // Try to load inventory if available to match policies
+  let inventory;
+  try {
+    inventory = await collectInventory(resolvedRoot);
+  } catch {
+    // If inventory fails to load (e.g. running outside repo), proceed without it
+  }
+
+  const summary = await summarizeReports(reportsDir, inventory);
+
+  if (jsonMode) {
+    console.log(formatReportSummaryJson(summary, resolvedRoot));
+  } else {
+    console.log(formatReportSummary(summary, resolvedRoot));
+  }
+}
+
+main().catch((error) => {
+  console.error('Fatal error:', error);
+  process.exit(1);
+});

scripts/tests/eval-report.test.ts

@@ -0,0 +1,378 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import path from 'node:path';
+import fs from 'node:fs';
+import os from 'node:os';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  findReportFiles,
+  getModelFromPath,
+  summarizeReports,
+  formatReportSummary,
+  formatReportSummaryJson,
+} from '../utils/eval-report.js';
+import type { InventoryResult } from '../utils/eval-inventory.js';
+
+describe('eval-report utility', () => {
+  let tmpDir: string;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gemini-eval-report-test-'));
+    vi.unstubAllEnvs();
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  describe('findReportFiles', () => {
+    it('returns an empty array if directory does not exist', () => {
+      const nonExistent = path.join(tmpDir, 'does-not-exist');
+      expect(findReportFiles(nonExistent)).toEqual([]);
+    });
+
+    it('recursively finds report.json files', () => {
+      const sub1 = path.join(tmpDir, 'sub1');
+      const sub2 = path.join(tmpDir, 'sub2');
+      fs.mkdirSync(sub1);
+      fs.mkdirSync(sub2);
+
+      fs.writeFileSync(path.join(sub1, 'report.json'), '{}');
+      fs.writeFileSync(path.join(sub2, 'report.json'), '{}');
+      fs.writeFileSync(path.join(tmpDir, 'other.txt'), '{}');
+
+      const found = findReportFiles(tmpDir).map((p) =>
+        path.basename(path.dirname(p)),
+      );
+      expect(found.sort()).toEqual(['sub1', 'sub2']);
+    });
+
+    it('returns the file itself if passed a direct path to a report.json file', () => {
+      const reportFile = path.join(tmpDir, 'report.json');
+      fs.writeFileSync(reportFile, '{}');
+      expect(findReportFiles(reportFile)).toEqual([reportFile]);
+    });
+
+    it('returns empty array if passed an invalid path string or non-report file', () => {
+      const otherFile = path.join(tmpDir, 'other.txt');
+      fs.writeFileSync(otherFile, '{}');
+      expect(findReportFiles(otherFile)).toEqual([]);
+      expect(findReportFiles('')).toEqual([]);
+      expect(findReportFiles('invalid\0path')).toEqual([]);
+    });
+  });
+
+  describe('getModelFromPath', () => {
+    it('extracts model name from eval-logs- prefix', () => {
+      const reportPath = path.join(
+        tmpDir,
+        'eval-logs-gemini-2.5-pro-12345',
+        'report.json',
+      );
+      expect(getModelFromPath(reportPath)).toBe('gemini-2.5-pro');
+    });
+
+    it('extracts model name from simple eval-logs- directory name without timestamp', () => {
+      const reportPath = path.join(
+        tmpDir,
+        'eval-logs-gemini-2.5-flash',
+        'report.json',
+      );
+      expect(getModelFromPath(reportPath)).toBe('gemini-2.5-flash');
+    });
+
+    it('falls back to GEMINI_MODEL env var if prefix is not matched', () => {
+      vi.stubEnv('GEMINI_MODEL', 'env-model');
+      const reportPath = path.join(tmpDir, 'some-other-folder', 'report.json');
+      expect(getModelFromPath(reportPath)).toBe('env-model');
+    });
+
+    it('falls back to unknown-model if no env var or folder match exists', () => {
+      const reportPath = path.join(tmpDir, 'some-other-folder', 'report.json');
+      expect(getModelFromPath(reportPath)).toBe('unknown-model');
+    });
+  });
+
+  describe('summarizeReports', () => {
+    it('correctly parses vitest JSON and aggregates pass rate metrics by model', async () => {
+      const modelDir = path.join(tmpDir, 'eval-logs-gemini-2.5-flash-999');
+      fs.mkdirSync(modelDir);
+
+      const dummyReport = {
+        testResults: [
+          {
+            name: '/repo/evals/test-one.eval.ts',
+            status: 'passed',
+            assertionResults: [
+              { title: 'should retrieve memory', status: 'passed' },
+              { title: 'should plan task', status: 'failed' },
+            ],
+          },
+        ],
+      };
+
+      fs.writeFileSync(
+        path.join(modelDir, 'report.json'),
+        JSON.stringify(dummyReport),
+      );
+
+      const mockInventory: InventoryResult = {
+        totalFiles: 1,
+        totalCases: 2,
+        repoRoot: '/repo',
+        files: [],
+        cases: [
+          {
+            filePath: '/repo/evals/test-one.eval.ts',
+            relativePath: 'evals/test-one.eval.ts',
+            helperName: 'evalTest',
+            baseHelperName: 'evalTest',
+            policy: 'ALWAYS_PASSES',
+            name: 'should retrieve memory',
+            hasFiles: false,
+            hasPrompt: true,
+            hasAssert: true,
+            toolReferences: [],
+            location: { line: 1, column: 1 },
+          },
+          {
+            filePath: '/repo/evals/test-one.eval.ts',
+            relativePath: 'evals/test-one.eval.ts',
+            helperName: 'evalTest',
+            baseHelperName: 'evalTest',
+            policy: 'USUALLY_PASSES',
+            name: 'should plan task',
+            hasFiles: false,
+            hasPrompt: true,
+            hasAssert: true,
+            toolReferences: [],
+            location: { line: 10, column: 1 },
+          },
+        ],
+        diagnostics: [],
+      };
+
+      const result = await summarizeReports(tmpDir, mockInventory);
+
+      expect(result.totalFiles).toBe(1);
+      expect(result.models).toHaveLength(1);
+      const modelSummary = result.models[0];
+      expect(modelSummary.modelName).toBe('gemini-2.5-flash');
+      expect(modelSummary.totalCases).toBe(2);
+      expect(modelSummary.totalRuns).toBe(2);
+      expect(modelSummary.passedRuns).toBe(1);
+      expect(modelSummary.overallPassRate).toBe(0.5);
+
+      const cases = modelSummary.cases;
+      expect(cases[0].name).toBe('should plan task');
+      expect(cases[0].policy).toBe('USUALLY_PASSES');
+      expect(cases[0].passed).toBe(0);
+      expect(cases[0].total).toBe(1);
+      expect(cases[0].passRate).toBe(0.0);
+
+      expect(cases[1].name).toBe('should retrieve memory');
+      expect(cases[1].policy).toBe('ALWAYS_PASSES');
+      expect(cases[1].passed).toBe(1);
+      expect(cases[1].total).toBe(1);
+      expect(cases[1].passRate).toBe(1.0);
+    });
+
+    it('safely ignores malformed or null file results and assertions', async () => {
+      const modelDir = path.join(tmpDir, 'eval-logs-gemini-2.5-flash-100');
+      fs.mkdirSync(modelDir);
+
+      const malformedReport = {
+        testResults: [
+          null,
+          { name: 123 },
+          { name: 'invalid\0path' },
+          {
+            name: '/repo/evals/test-valid.eval.ts',
+            assertionResults: [
+              null,
+              { title: 456 },
+              { title: 'valid test', status: 'passed' },
+            ],
+          },
+        ],
+      };
+
+      fs.writeFileSync(
+        path.join(modelDir, 'report.json'),
+        JSON.stringify(malformedReport),
+      );
+
+      const result = await summarizeReports(modelDir);
+      expect(result.models.length).toBe(1);
+      expect(result.models[0].cases.length).toBe(1);
+      expect(result.models[0].cases[0].name).toBe('valid test');
+    });
+
+    it('does not collide test cases with duplicate names in different files', async () => {
+      const modelDir = path.join(tmpDir, 'eval-logs-gemini-2.5-flash-999');
+      fs.mkdirSync(modelDir);
+
+      const dummyReport = {
+        testResults: [
+          {
+            name: '/repo/evals/test-one.eval.ts',
+            status: 'passed',
+            assertionResults: [{ title: 'duplicate case', status: 'passed' }],
+          },
+          {
+            name: '/repo/evals/test-two.eval.ts',
+            status: 'passed',
+            assertionResults: [{ title: 'duplicate case', status: 'failed' }],
+          },
+        ],
+      };
+
+      fs.writeFileSync(
+        path.join(modelDir, 'report.json'),
+        JSON.stringify(dummyReport),
+      );
+
+      const mockInventory: InventoryResult = {
+        totalFiles: 2,
+        totalCases: 2,
+        repoRoot: '/repo',
+        files: [],
+        cases: [
+          {
+            filePath: '/repo/evals/test-one.eval.ts',
+            relativePath: 'evals/test-one.eval.ts',
+            helperName: 'evalTest',
+            baseHelperName: 'evalTest',
+            policy: 'ALWAYS_PASSES',
+            name: 'duplicate case',
+            hasFiles: false,
+            hasPrompt: true,
+            hasAssert: true,
+            toolReferences: [],
+            location: { line: 1, column: 1 },
+          },
+          {
+            filePath: '/repo/evals/test-two.eval.ts',
+            relativePath: 'evals/test-two.eval.ts',
+            helperName: 'evalTest',
+            baseHelperName: 'evalTest',
+            policy: 'USUALLY_PASSES',
+            name: 'duplicate case',
+            hasFiles: false,
+            hasPrompt: true,
+            hasAssert: true,
+            toolReferences: [],
+            location: { line: 1, column: 1 },
+          },
+        ],
+        diagnostics: [],
+      };
+
+      const result = await summarizeReports(tmpDir, mockInventory);
+
+      expect(result.models).toHaveLength(1);
+      const modelSummary = result.models[0];
+      expect(modelSummary.totalCases).toBe(2);
+      expect(modelSummary.cases).toHaveLength(2);
+
+      const c1 = modelSummary.cases.find(
+        (c) => c.filePath === '/repo/evals/test-one.eval.ts',
+      )!;
+      expect(c1.name).toBe('duplicate case');
+      expect(c1.policy).toBe('ALWAYS_PASSES');
+      expect(c1.passed).toBe(1);
+      expect(c1.total).toBe(1);
+
+      const c2 = modelSummary.cases.find(
+        (c) => c.filePath === '/repo/evals/test-two.eval.ts',
+      )!;
+      expect(c2.name).toBe('duplicate case');
+      expect(c2.policy).toBe('USUALLY_PASSES');
+      expect(c2.passed).toBe(0);
+      expect(c2.total).toBe(1);
+    });
+  });
+
+  describe('formatReportSummary', () => {
+    it('handles empty results gracefully', () => {
+      const empty = { totalFiles: 0, models: [] };
+      const out = formatReportSummary(empty);
+      expect(out).toContain('No report data found.');
+    });
+
+    it('formats a report beautifully with correct details', () => {
+      const summary = {
+        totalFiles: 2,
+        models: [
+          {
+            modelName: 'test-model',
+            totalCases: 1,
+            passedCount: 1,
+            totalRuns: 1,
+            passedRuns: 1,
+            overallPassRate: 1.0,
+            cases: [
+              {
+                name: 'should work',
+                passed: 1,
+                total: 1,
+                passRate: 1.0,
+                policy: 'ALWAYS_PASSES',
+                filePath: '/repo/evals/test.eval.ts',
+              },
+            ],
+          },
+        ],
+      };
+
+      const formatted = formatReportSummary(summary, '/repo');
+      expect(formatted).toContain('Model: test-model');
+      expect(formatted).toContain(
+        '✓ [ALWAYS_PASSES] should work — 100.0% (1/1)',
+      );
+      expect(formatted).toContain('[evals/test.eval.ts]');
+    });
+  });
+
+  describe('formatReportSummaryJson', () => {
+    it('formats deterministic JSON output', () => {
+      const summary = {
+        totalFiles: 1,
+        models: [
+          {
+            modelName: 'test-model',
+            totalCases: 1,
+            passedCount: 1,
+            totalRuns: 1,
+            passedRuns: 1,
+            overallPassRate: 1.0,
+            cases: [
+              {
+                name: 'should work',
+                passed: 1,
+                total: 1,
+                passRate: 1.0,
+                policy: 'ALWAYS_PASSES',
+                filePath: '/repo/evals/test.eval.ts',
+              },
+            ],
+          },
+        ],
+      };
+
+      const fixedDate = new Date('2026-07-06T00:00:00.000Z');
+      const formatted = formatReportSummaryJson(summary, '/repo', fixedDate);
+      const parsed = JSON.parse(formatted);
+
+      expect(parsed.version).toBe(1);
+      expect(parsed.totalFiles).toBe(1);
+      expect(parsed.generated).toBe('2026-07-06T00:00:00.000Z');
+      expect(parsed.models[0].modelName).toBe('test-model');
+      expect(parsed.models[0].cases[0].filePath).toBe('evals/test.eval.ts');
+    });
+  });
+});

scripts/utils/eval-report.ts

@@ -0,0 +1,290 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import type { InventoryResult } from './eval-inventory.js';
+
+export interface ReportCaseSummary {
+  name: string;
+  passed: number;
+  total: number;
+  passRate: number;
+  policy: string;
+  filePath: string;
+}
+
+export interface ModelSummary {
+  modelName: string;
+  totalCases: number;
+  passedCount: number;
+  totalRuns: number;
+  passedRuns: number;
+  overallPassRate: number;
+  cases: ReportCaseSummary[];
+}
+
+export interface ReportSummaryResult {
+  totalFiles: number;
+  models: ModelSummary[];
+}
+
+/**
+ * Recursively scans a directory for report.json files.
+ */
+export function findReportFiles(dir: string): string[] {
+  const reports: string[] = [];
+  if (!dir || dir.includes('\0')) return reports;
+  if (!fs.existsSync(dir)) return reports;
+
+  try {
+    const stat = fs.statSync(dir);
+    if (stat.isFile()) {
+      if (path.basename(dir) === 'report.json') {
+        return [dir];
+      }
+      return reports;
+    }
+  } catch {
+    return reports;
+  }
+
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      reports.push(...findReportFiles(fullPath));
+    } else if (entry.isFile() && entry.name === 'report.json') {
+      reports.push(fullPath);
+    }
+  }
+  return reports;
+}
+
+/**
+ * Parses the model name from the directory path or defaults to env.
+ */
+export function getModelFromPath(reportPath: string): string {
+  const normalized = path.normalize(reportPath).replace(/\\/g, '/');
+  const parts = normalized.split('/');
+  const logDir = parts.find((p) => p.startsWith('eval-logs-'));
+  if (logDir) {
+    const match = logDir.match(/^eval-logs-(.+)-(\d+)$/);
+    if (match) return match[1];
+    const matchSimple = logDir.match(/^eval-logs-(.+)$/);
+    if (matchSimple) return matchSimple[1];
+  }
+  return process.env.GEMINI_MODEL || 'unknown-model';
+}
+
+/**
+ * Summarizes the pass rate stats by test case and model from report.json files.
+ */
+export async function summarizeReports(
+  reportsDir: string,
+  inventory?: InventoryResult,
+): Promise<ReportSummaryResult> {
+  const reportPaths = findReportFiles(reportsDir);
+  const modelSummariesMap = new Map<
+    string,
+    Map<
+      string,
+      { name: string; passed: number; total: number; filePath: string }
+    >
+  >();
+
+  for (const reportPath of reportPaths) {
+    try {
+      const model = getModelFromPath(reportPath);
+      if (!modelSummariesMap.has(model)) {
+        modelSummariesMap.set(model, new Map());
+      }
+      const testCasesMap = modelSummariesMap.get(model)!;
+
+      const data = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
+      if (data && Array.isArray(data.testResults)) {
+        for (const fileResult of data.testResults) {
+          if (!fileResult || typeof fileResult.name !== 'string') {
+            continue;
+          }
+          const filePath = fileResult.name;
+          if (filePath.includes('\0')) {
+            continue;
+          }
+          const normalizedPath = path.resolve(filePath).replace(/\\/g, '/');
+          if (Array.isArray(fileResult.assertionResults)) {
+            for (const assertion of fileResult.assertionResults) {
+              if (!assertion || typeof assertion.title !== 'string') {
+                continue;
+              }
+              const testName = assertion.title;
+              const compoundKey = `${normalizedPath}::${testName}`;
+              if (!testCasesMap.has(compoundKey)) {
+                testCasesMap.set(compoundKey, {
+                  name: testName,
+                  passed: 0,
+                  total: 0,
+                  filePath,
+                });
+              }
+              const stats = testCasesMap.get(compoundKey)!;
+              stats.total += 1;
+              if (assertion.status === 'passed') {
+                stats.passed += 1;
+              }
+            }
+          }
+        }
+      }
+    } catch (e: unknown) {
+      const msg = e instanceof Error ? e.message : String(e);
+      console.error(`Error reading or parsing report at ${reportPath}: ${msg}`);
+    }
+  }
+
+  const policyMap = new Map<string, string>();
+  if (inventory) {
+    for (const caseRec of inventory.cases) {
+      const normalizedCasePath = path
+        .resolve(caseRec.filePath)
+        .replace(/\\/g, '/');
+      const key = `${normalizedCasePath}::${caseRec.name}`;
+      policyMap.set(key, caseRec.policy);
+    }
+  }
+
+  const models: ModelSummary[] = [];
+  for (const [modelName, testCasesMap] of modelSummariesMap.entries()) {
+    const cases: ReportCaseSummary[] = [];
+    let totalRuns = 0;
+    let passedRuns = 0;
+
+    for (const stats of testCasesMap.values()) {
+      const normalizedPath = path.resolve(stats.filePath).replace(/\\/g, '/');
+      const key = `${normalizedPath}::${stats.name}`;
+      const policy = policyMap.get(key) || 'unknown';
+      const passRate = stats.total > 0 ? stats.passed / stats.total : 0;
+      cases.push({
+        name: stats.name,
+        passed: stats.passed,
+        total: stats.total,
+        passRate,
+        policy,
+        filePath: stats.filePath,
+      });
+      totalRuns += stats.total;
+      passedRuns += stats.passed;
+    }
+
+    cases.sort((a, b) => a.name.localeCompare(b.name, 'en'));
+
+    models.push({
+      modelName,
+      totalCases: testCasesMap.size,
+      passedCount: cases.filter((c) => c.passRate === 1.0).length,
+      totalRuns,
+      passedRuns,
+      overallPassRate: totalRuns > 0 ? passedRuns / totalRuns : 0,
+      cases,
+    });
+  }
+
+  models.sort((a, b) => a.modelName.localeCompare(b.modelName, 'en'));
+
+  return {
+    totalFiles: reportPaths.length,
+    models,
+  };
+}
+
+/**
+ * Formats report summary to human-readable string.
+ */
+export function formatReportSummary(
+  result: ReportSummaryResult,
+  repoRoot?: string,
+): string {
+  const lines: string[] = [];
+  lines.push('Eval Nightly Pass Rate Report');
+  lines.push('═════════════════════════════');
+  lines.push('');
+  lines.push(`Processed ${result.totalFiles} report(s).`);
+  lines.push('');
+
+  if (result.models.length === 0) {
+    lines.push('No report data found.');
+    return lines.join('\n');
+  }
+
+  for (const model of result.models) {
+    lines.push(`Model: ${model.modelName}`);
+    lines.push('───────────────────────');
+    lines.push(`  Unique cases: ${model.totalCases}`);
+    lines.push(
+      `  Total runs:   ${model.totalRuns} (Passed: ${model.passedRuns}, Failed: ${
+        model.totalRuns - model.passedRuns
+      })`,
+    );
+    lines.push(`  Pass rate:    ${(model.overallPassRate * 100).toFixed(1)}%`);
+    lines.push('');
+    lines.push('  Test Cases:');
+    for (const c of model.cases) {
+      const relPath =
+        repoRoot && path.isAbsolute(c.filePath)
+          ? path.relative(repoRoot, c.filePath).replace(/\\/g, '/')
+          : c.filePath;
+      const indicator =
+        c.passRate === 1.0 ? '✓' : c.passRate === 0 ? '✗' : '⚠';
+      lines.push(
+        `    ${indicator} [${c.policy}] ${c.name} — ${(
+          c.passRate * 100
+        ).toFixed(1)}% (${c.passed}/${c.total}) [${relPath}]`,
+      );
+    }
+    lines.push('');
+  }
+
+  return lines.join('\n');
+}
+
+/**
+ * Formats report summary to deterministic JSON.
+ */
+export function formatReportSummaryJson(
+  result: ReportSummaryResult,
+  repoRoot?: string,
+  now?: Date,
+): string {
+  let generatedDate = now || new Date();
+  if (process.env.EVAL_INVENTORY_DETERMINISTIC) {
+    generatedDate = new Date(0);
+  }
+  const output = {
+    version: 1,
+    generated: generatedDate.toISOString(),
+    totalFiles: result.totalFiles,
+    models: result.models.map((m) => ({
+      modelName: m.modelName,
+      totalCases: m.totalCases,
+      passedCount: m.passedCount,
+      totalRuns: m.totalRuns,
+      passedRuns: m.passedRuns,
+      overallPassRate: m.overallPassRate,
+      cases: m.cases.map((c) => ({
+        name: c.name,
+        passed: c.passed,
+        total: c.total,
+        passRate: c.passRate,
+        policy: c.policy,
+        filePath:
+          repoRoot && path.isAbsolute(c.filePath)
+            ? path.relative(repoRoot, c.filePath).replace(/\\/g, '/')
+            : c.filePath,
+      })),
+    })),
+  };
+  return JSON.stringify(output, null, 2);
+}

tools/caretaker-agent/Dockerfile

@@ -0,0 +1,28 @@
+# ==============================================================================
+# Caretaker Triage Evaluation Runner Container (Cloud Run Job)
+#
+# Placed at repository root to allow `gcloud run jobs deploy --source .` to:
+# 1. Automatically detect this Dockerfile without separate build steps.
+# 2. Access both /cloudrun/triage-worker and /evals inside the root build context.
+# ==============================================================================
+
+FROM python:3.13-slim
+WORKDIR /app
+ENV PYTHONUNBUFFERED=1
+
+RUN apt-get update && apt-get install -y git curl && rm -rf /var/lib/apt/lists/*
+
+# 1. Pre-bake target gemini-cli repo clone into container image
+RUN git clone https://github.com/google-gemini/gemini-cli.git /app/evals/triage/target_repo
+
+# 2. Copy living local application code from root build context
+COPY cloudrun/triage-worker /app/cloudrun/triage-worker
+COPY evals /app/evals
+
+RUN pip install --no-cache-dir -r /app/cloudrun/triage-worker/requirements.txt \
+    && pip install --no-cache-dir -r /app/evals/triage/requirements.txt
+
+WORKDIR /app/evals/triage
+ENV PYTHONPATH=/app
+
+CMD ["python3", "cloud_runner.py"]

tools/caretaker-agent/cloudrun/egress-service/package.json

@@ -22,6 +22,6 @@
     "supertest": "^7.1.4",
     "tsx": "^4.9.3",
     "typescript": "^5.4.5",
-    "vitest": "^1.6.0"
+    "vitest": "^3.2.4"
   }
 }

tools/caretaker-agent/cloudrun/egress-service/src/actions/github.test.ts

@@ -9,6 +9,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 const mockCreateComment = vi.fn();
 const mockAddLabels = vi.fn();
 const mockRemoveLabel = vi.fn();
+const mockCreateForIssueComment = vi.fn();
 
 vi.mock('@octokit/rest', () => ({
   Octokit: vi.fn().mockImplementation(() => ({
@@ -18,6 +19,9 @@ vi.mock('@octokit/rest', () => ({
         addLabels: mockAddLabels,
         removeLabel: mockRemoveLabel,
       },
+      reactions: {
+        createForIssueComment: mockCreateForIssueComment,
+      },
     },
   })),
 }));
@@ -150,6 +154,27 @@ describe('GitHub Actions Handler', () => {
     });
   });
 
+  it('should call createForIssueComment for REACTION action', async () => {
+    mockCreateForIssueComment.mockResolvedValueOnce({});
+    await handleEgressEvent({
+      action: 'REACTION',
+      payload: {
+        owner: 'google-gemini',
+        repo: 'gemini-cli',
+        issueNumber: 10,
+        commentId: 12345,
+        reaction: 'eyes',
+      },
+    });
+
+    expect(mockCreateForIssueComment).toHaveBeenCalledWith({
+      owner: 'google-gemini',
+      repo: 'gemini-cli',
+      comment_id: 12345,
+      content: 'eyes',
+    });
+  });
+
   it('should throw an error for unsupported PATCH action', async () => {
     await expect(
       handleEgressEvent({

tools/caretaker-agent/cloudrun/egress-service/src/actions/github.ts

@@ -104,6 +104,22 @@ export async function handleEgressEvent(event: EgressEvent): Promise<void> {
       }
       break;
 
+    case 'REACTION': {
+      if (typeof payload.commentId !== 'number') {
+        throw new Error('Missing or invalid commentId for REACTION action');
+      }
+      console.log(
+        `[EGRESS_GITHUB] Adding reaction '${payload.reaction}' to comment ${payload.commentId} on ${owner}/${repo}#${issueNumber}...`,
+      );
+      await octokit.rest.reactions.createForIssueComment({
+        owner,
+        repo,
+        comment_id: payload.commentId,
+        content: payload.reaction,
+      });
+      break;
+    }
+
     case 'PATCH':
       throw new Error('PATCH action is not yet implemented');
 

tools/caretaker-agent/cloudrun/egress-service/src/types.ts

@@ -39,11 +39,20 @@ export interface PatchEgressEvent {
   };
 }
 
+export interface ReactionEgressEvent {
+  action: 'REACTION';
+  payload: BaseEgressPayload & {
+    commentId: number;
+    reaction: 'eyes';
+  };
+}
+
 export type EgressEvent =
   | CommentEgressEvent
   | LabelEgressEvent
   | UnlabelEgressEvent
-  | PatchEgressEvent;
+  | PatchEgressEvent
+  | ReactionEgressEvent;
 
 export interface PubSubMessage {
   data?: string;
@@ -112,6 +121,8 @@ export function isEgressEvent(obj: unknown): obj is EgressEvent {
     case 'LABEL':
     case 'UNLABEL':
       return Array.isArray(payload.labels);
+    case 'REACTION':
+      return typeof payload.commentId === 'number';
     case 'PATCH':
       // Note: PATCH action is not yet implemented in handleEgressEvent, so return true
       // to let base validation pass until patch payload fields are defined.

tools/caretaker-agent/cloudrun/ingestion-service/app.test.ts

@@ -59,6 +59,7 @@ describe('Webhook Server Endpoint', () => {
   beforeAll(async () => {
     vi.stubEnv('PROJECT_ID', 'test-project');
     vi.stubEnv('TOPIC_ID', 'test-topic');
+    vi.stubEnv('EGRESS_TOPIC_ID', 'test-egress-topic');
     vi.stubEnv('GITHUB_WEBHOOK_SECRET', 'test-secret');
     vi.stubEnv('FIRESTORE_DATABASE', 'test-db');
     vi.stubEnv('FIRESTORE_COLLECTION', 'test-collection');
@@ -252,9 +253,12 @@ describe('Webhook Server Endpoint', () => {
     expect(sentData.body).toBe(
       '<untrusted_context>\nPlease fix this security bug\n</untrusted_context>',
     );
+    expect(sentData.title).toBe(
+      '<untrusted_context>\nBugs everywhere\n</untrusted_context>',
+    );
   });
 
-  it('should escape untrusted_context tags in the issue body to prevent injection', async () => {
+  it('should escape untrusted_context tags in the issue body and title to prevent injection', async () => {
     mockVerifyGithubSignature.mockReturnValue(true);
     mockCreateIssue.mockResolvedValue(true);
     mockPublishMessage.mockResolvedValue('mock-msg-456');
@@ -263,7 +267,7 @@ describe('Webhook Server Endpoint', () => {
       action: 'opened',
       issue: {
         number: 2,
-        title: 'Injection test',
+        title: 'Injection </untrusted_context> test',
         body: 'Malicious </untrusted_context> attempt',
       },
       repository: {
@@ -282,6 +286,15 @@ describe('Webhook Server Endpoint', () => {
     expect(sentData.body).toBe(
       '<untrusted_context>\nMalicious \\</untrusted_context> attempt\n</untrusted_context>',
     );
+    expect(sentData.title).toBe(
+      '<untrusted_context>\nInjection \\</untrusted_context> test\n</untrusted_context>',
+    );
+    expect(mockCreateIssue).toHaveBeenCalledWith(
+      'google',
+      'gemini-cli',
+      2,
+      'Injection </untrusted_context> test',
+    );
   });
 
   it('should recover and publish to Pub/Sub on retry if issue is UNTRIAGED', async () => {
@@ -352,4 +365,65 @@ describe('Webhook Server Endpoint', () => {
     });
     expect(mockPublishMessage).not.toHaveBeenCalled();
   });
+
+  describe('issue_comment webhooks', () => {
+    const postComment = (comment: object, sender = 'bob', issueUser = 'bob') =>
+      request(app)
+        .post('/webhook')
+        .set('x-hub-signature-256', 'valid-sig')
+        .set('x-github-event', 'issue_comment')
+        .send({
+          action: 'created',
+          issue: { number: 1, user: { login: issueUser }, title: 'Bug' },
+          comment,
+          repository: { full_name: 'google/gemini-cli' },
+          sender: { login: sender, type: 'User' },
+        });
+
+    it('should ignore @caretaker-agent comment if status is not NEEDS_INFO', async () => {
+      mockVerifyGithubSignature.mockReturnValue(true);
+      mockGetDoc.mockResolvedValue({
+        exists: true,
+        get: (f: string) => (f === 'status' ? 'TRIAGED' : undefined),
+      });
+
+      const res = await postComment({
+        id: 100,
+        body: '@caretaker-agent info',
+        author_association: 'NONE',
+      });
+      expect(res.status).toBe(200);
+      expect(res.body.status).toBe('ignored');
+      expect(mockPublishMessage).not.toHaveBeenCalled();
+    });
+
+    it('should accept valid @caretaker-agent comment or /caretaker triage command', async () => {
+      mockVerifyGithubSignature.mockReturnValue(true);
+      const mockUpdate = vi.fn().mockResolvedValue(undefined);
+      mockGetDoc.mockResolvedValue({
+        exists: true,
+        get: (f: string) => (f === 'status' ? 'NEEDS_INFO' : 'Bug'),
+      });
+      mockGetIssueRef.mockReturnValue({ get: mockGetDoc, update: mockUpdate });
+      mockPublishMessage.mockResolvedValue('msg-101');
+
+      // Test 1: @caretaker-agent mention
+      const resMention = await postComment({
+        id: 123,
+        body: '@caretaker-agent trace',
+        author_association: 'NONE',
+      });
+      expect(resMention.status).toBe(202);
+
+      // Test 2: /caretaker triage command
+      const resTriage = await postComment(
+        { id: 124, body: '/caretaker triage', author_association: 'MEMBER' },
+        'alice',
+      );
+      expect(resTriage.status).toBe(202);
+      expect(mockUpdate).toHaveBeenCalledWith(
+        expect.objectContaining({ status: 'UNTRIAGED' }),
+      );
+    });
+  });
 });

tools/caretaker-agent/cloudrun/ingestion-service/app.ts

@@ -30,12 +30,14 @@ function getRequiredEnvVar(name: string): string {
 
 const projectId = getRequiredEnvVar('PROJECT_ID');
 const topicId = getRequiredEnvVar('TOPIC_ID');
+const egressTopicId = getRequiredEnvVar('EGRESS_TOPIC_ID');
 const githubWebhookSecret = getRequiredEnvVar('GITHUB_WEBHOOK_SECRET');
 const databaseId = getRequiredEnvVar('FIRESTORE_DATABASE');
 const collectionName = getRequiredEnvVar('FIRESTORE_COLLECTION');
 
 const pubSubClient = new PubSub({ projectId });
 const topic = pubSubClient.topic(topicId);
+const egressTopic = pubSubClient.topic(egressTopicId);
 
 const db = new Firestore({ projectId, databaseId });
 const issuesStore = new IssuesStore(db, collectionName);
@@ -78,7 +80,7 @@ app.post('/webhook', limiter, async (req, res) => {
   }
 
   const eventType = req.headers['x-github-event'];
-  if (eventType !== 'issues') {
+  if (eventType !== 'issues' && eventType !== 'issue_comment') {
     return res.status(200).json({
       status: 'ignored',
       reason: `unsupported event type: ${eventType}`,
@@ -100,14 +102,15 @@ app.post('/webhook', limiter, async (req, res) => {
       .json({ status: 'error', message: 'Invalid JSON payload' });
   }
 
-  const action = payload.action;
-  if (action !== 'opened') {
+  // Discard automated bot events immediately
+  if (payload.sender?.type === 'Bot') {
     return res.status(200).json({
       status: 'ignored',
-      reason: `unsupported action: ${action}`,
+      reason: 'automated bot event',
     });
   }
 
+  const action = payload.action;
   const issueNumber = payload.issue.number;
   const repository = payload.repository.full_name;
 
@@ -119,44 +122,158 @@ app.post('/webhook', limiter, async (req, res) => {
   );
   const sanitizedBody = `<untrusted_context>\n${escapedBody}\n</untrusted_context>`;
 
+  const rawTitle = payload.issue.title || '';
+  const escapedTitle = rawTitle.replace(
+    /<\/untrusted_context>/g,
+    '\\</untrusted_context>',
+  );
+  const sanitizedTitle = `<untrusted_context>\n${escapedTitle}\n</untrusted_context>`;
+
   const processedData = {
     issue_number: issueNumber,
     repository,
     sender: payload.sender?.login,
     body: sanitizedBody,
-    title: payload.issue.title,
+    title: sanitizedTitle,
   };
 
   const [owner, repo] = repository.split('/');
-  const title = processedData.title || '';
+  const title = rawTitle;
 
   try {
-    const created = await issuesStore.createIssue(
-      owner,
-      repo,
-      issueNumber,
-      title,
-    );
+    // New Issue Event (issues.opened)
+    if (eventType === 'issues' && action === 'opened') {
+      const created = await issuesStore.createIssue(
+        owner,
+        repo,
+        issueNumber,
+        title,
+      );
 
-    if (!created) {
-      // If the Firestore document already exists, check its status.
-      // If it is 'UNTRIAGED', we continue to publish to Pub/Sub
-      // to recover from previous publish failures.
-      const issueRef = issuesStore.getIssueRef(owner, repo, issueNumber);
-      const snapshot = await issueRef.get();
-      if (snapshot.get('status') !== 'UNTRIAGED') {
-        return res.status(200).json({
-          status: 'ignored',
-          reason: `issue already exists: ${repository}#${issueNumber}`,
-        });
+      if (!created) {
+        // If the Firestore document already exists, check its status.
+        // If it is 'UNTRIAGED', we continue to publish to Pub/Sub
+        // to recover from previous publish failures.
+        const issueRef = issuesStore.getIssueRef(owner, repo, issueNumber);
+        const snapshot = await issueRef.get();
+        if (snapshot.get('status') !== 'UNTRIAGED') {
+          return res.status(200).json({
+            status: 'ignored',
+            reason: `issue already exists: ${repository}#${issueNumber}`,
+          });
+        }
       }
+
+      const dataBuffer = Buffer.from(JSON.stringify(processedData));
+      const messageId = await topic.publishMessage({ data: dataBuffer });
+
+      return res
+        .status(202)
+        .json({ status: 'accepted', message_id: messageId });
     }
 
-    // Publish to Pub/Sub
-    const dataBuffer = Buffer.from(JSON.stringify(processedData));
-    const messageId = await topic.publishMessage({ data: dataBuffer });
+    // Issue Comment Event (issue_comment.created)
+    if (eventType === 'issue_comment' && action === 'created') {
+      const commentText = payload.comment?.body || '';
+      const isTriage = commentText.trim().startsWith('/caretaker triage');
+      const isMention = commentText.includes('@caretaker-agent');
 
-    return res.status(202).json({ status: 'accepted', message_id: messageId });
+      if (!isTriage && !isMention) {
+        return res.status(200).json({
+          status: 'ignored',
+          reason: 'comment does not mention @caretaker-agent',
+        });
+      }
+
+      const isMaintainer = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(
+        payload.comment?.author_association || '',
+      );
+      const isReporter =
+        Boolean(payload.sender?.login) &&
+        Boolean(payload.issue.user?.login) &&
+        payload.sender?.login === payload.issue.user?.login;
+
+      // Only Maintainer OR (comment mention AND reporter) allowed
+      if (!isMaintainer && (isTriage || !isReporter)) {
+        return res.status(200).json({
+          status: 'ignored',
+          reason: 'unauthorized sender',
+        });
+      }
+
+      const issueRef = issuesStore.getIssueRef(owner, repo, issueNumber);
+      const snapshot = await issueRef.get();
+
+      let sanitizedComment = '';
+
+      // Mentions (@caretaker-agent) require NEEDS_INFO status.
+      if (isMention) {
+        if (!snapshot.exists || snapshot.get('status') !== 'NEEDS_INFO') {
+          return res.status(200).json({
+            status: 'ignored',
+            reason: `issue not found or status is not NEEDS_INFO: ${repository}#${issueNumber}`,
+          });
+        }
+        const rawComment = commentText;
+        const escapedComment = rawComment.replace(
+          /<\/untrusted_context>/g,
+          '\\</untrusted_context>',
+        );
+        sanitizedComment = `<untrusted_context>\n${escapedComment}\n</untrusted_context>`;
+      } else if (isTriage) {
+        // Slash commands (/caretaker triage) force re-triage based on original title/body.
+      }
+
+      if (snapshot.exists) {
+        await issueRef.update({
+          status: 'UNTRIAGED',
+          triage_attempts: 0,
+        });
+      } else {
+        // Onboard pre-existing GitHub issue into Firestore
+        await issuesStore.createIssue(owner, repo, issueNumber, title);
+      }
+
+      const commentData = {
+        issue_number: issueNumber,
+        repository,
+        sender: payload.sender?.login,
+        body: sanitizedBody,
+        comment: sanitizedComment,
+        title: sanitizedTitle,
+        event_type: 'issue_comment',
+      };
+
+      const messageId = await topic.publishMessage({
+        data: Buffer.from(JSON.stringify(commentData)),
+      });
+
+      if (payload.comment?.id) {
+        await egressTopic.publishMessage({
+          data: Buffer.from(
+            JSON.stringify({
+              action: 'REACTION',
+              payload: {
+                owner,
+                repo,
+                issueNumber,
+                commentId: payload.comment.id,
+                reaction: 'eyes',
+              },
+            }),
+          ),
+        });
+      }
+
+      return res
+        .status(202)
+        .json({ status: 'accepted', message_id: messageId });
+    }
+
+    return res.status(200).json({
+      status: 'ignored',
+      reason: `unsupported event type: ${eventType}`,
+    });
   } catch (error) {
     console.error('Error processing webhook:', error);
     const message = error instanceof Error ? error.message : 'Unknown error';

tools/caretaker-agent/cloudrun/ingestion-service/auth/github.ts

@@ -7,7 +7,7 @@
 import * as crypto from 'node:crypto';
 
 /**
- * Subset of the GitHub Webhook Payload for issues events.
+ * Subset of the GitHub Webhook Payload for issues and issue_comment events.
  * @see https://docs.github.com/en/webhooks/webhook-events-and-payloads#issues
  */
 export interface GitHubWebhookPayload {
@@ -16,6 +16,14 @@ export interface GitHubWebhookPayload {
     body?: string | null; // Can be null if description is empty
     number: number;
     title?: string;
+    user?: {
+      login?: string;
+    };
+  };
+  comment?: {
+    id: number;
+    body: string;
+    author_association: string;
   };
   repository: {
     /** Expected format: "owner/repo" (e.g. "google-gemini/gemini-cli") */
@@ -23,6 +31,7 @@ export interface GitHubWebhookPayload {
   };
   sender?: {
     login?: string;
+    type?: string;
   };
 }
 
@@ -109,7 +118,18 @@ export function isGitHubWebhookPayload(
     return false;
   }
 
-  // 3. Validate 'repository'
+  // 3. Validate 'comment' (if present for issue_comment events)
+  if (o.comment) {
+    if (
+      typeof o.comment.id !== 'number' ||
+      typeof o.comment.body !== 'string' ||
+      typeof o.comment.author_association !== 'string'
+    ) {
+      return false;
+    }
+  }
+
+  // 4. Validate 'repository'
   if (typeof o.repository !== 'object' || o.repository === null) {
     return false;
   }
@@ -120,7 +140,7 @@ export function isGitHubWebhookPayload(
     return false;
   }
 
-  // 4. Validate 'sender' (optional)
+  // 5. Validate 'sender' (optional)
   if (o.sender !== undefined) {
     if (typeof o.sender !== 'object' || o.sender === null) {
       return false;

tools/caretaker-agent/cloudrun/ingestion-service/db/issuesStore.test.ts

@@ -55,11 +55,13 @@ describe('IssuesStore', () => {
       expect.anything(),
       expect.objectContaining({
         status: 'UNTRIAGED',
+        error: null,
         github_metadata: expect.objectContaining({
           owner: 'google',
           repo: 'gemini-cli',
           issue_number: 123,
           title: 'Test Title',
+          pr_number: null,
         }),
       }),
     );

tools/caretaker-agent/cloudrun/ingestion-service/db/issuesStore.ts

@@ -18,10 +18,11 @@ export type IssueStatus =
   | 'NEEDS_INFO'
   | 'TRIAGED'
   | 'NEEDS_HUMAN'
-  | 'LOW_QUALITY';
+  | 'AUTO_CLOSE';
 
 export interface IssueDocument {
   status: IssueStatus;
+  error?: string | null;
   triage_attempts: number;
   // The ingestion layer does not enforce the schema of workable_spec
   workable_spec: Record<string, unknown>;
@@ -36,6 +37,7 @@ export interface IssueDocument {
     repo: string;
     issue_number: number;
     title: string;
+    pr_number?: number | null;
   };
 }
 
@@ -74,6 +76,7 @@ export class IssuesStore {
         if (!snapshot.exists) {
           const newIssue: IssueDocument = {
             status: 'UNTRIAGED',
+            error: null,
             triage_attempts: 0,
             workable_spec: {},
             lock: {
@@ -87,6 +90,7 @@ export class IssuesStore {
               repo,
               issue_number: issueNumber,
               title,
+              pr_number: null,
             },
           };