feat(evals): add tool call formatter and integrate failure summaries (#28305)

Co-authored-by: David Pierce <davidapierce@google.com>

evals/hierarchical_memory.eval.ts

@@ -8,12 +8,10 @@ import { describe, expect } from 'vitest';
 import { evalTest, assertModelHasOutput } from './test-helper.js';
 
 describe('Hierarchical Memory', () => {
-  const conflictResolutionTest =
-    'Agent follows hierarchy for contradictory instructions';
   evalTest('ALWAYS_PASSES', {
     suiteName: 'default',
     suiteType: 'behavioral',
-    name: conflictResolutionTest,
+    name: 'Agent follows hierarchy for contradictory instructions',
     params: {
       settings: {
         security: {
@@ -47,11 +45,10 @@ What is my favorite fruit? Tell me just the name of the fruit.`,
     },
   });
 
-  const provenanceAwarenessTest = 'Agent is aware of memory provenance';
   evalTest('USUALLY_PASSES', {
     suiteName: 'default',
     suiteType: 'behavioral',
-    name: provenanceAwarenessTest,
+    name: 'Agent is aware of memory provenance',
     params: {
       settings: {
         security: {
@@ -88,11 +85,10 @@ Provide the answer as an XML block like this:
     },
   });
 
-  const extensionVsGlobalTest = 'Extension memory wins over Global memory';
   evalTest('ALWAYS_PASSES', {
     suiteName: 'default',
     suiteType: 'behavioral',
-    name: extensionVsGlobalTest,
+    name: 'Extension memory wins over Global memory',
     params: {
       settings: {
         security: {

evals/memory_persistence.eval.ts

@@ -74,12 +74,10 @@ async function waitForSessionScratchpad(
 }
 
 describe('memory persistence', () => {
-  const proactiveMemoryFromLongSession =
-    'Agent saves preference from earlier in conversation history';
   evalTest('USUALLY_PASSES', {
     suiteName: 'default',
     suiteType: 'behavioral',
-    name: proactiveMemoryFromLongSession,
+    name: 'Agent saves preference from earlier in conversation history',
     messages: [
       {
         id: 'msg-1',
@@ -195,12 +193,10 @@ describe('memory persistence', () => {
     },
   });
 
-  const memoryRoutesTeamConventionsToProjectGemini =
-    'Agent routes team-shared project conventions to ./GEMINI.md';
   evalTest('USUALLY_PASSES', {
     suiteName: 'default',
     suiteType: 'behavioral',
-    name: memoryRoutesTeamConventionsToProjectGemini,
+    name: 'Agent routes team-shared project conventions to ./GEMINI.md',
     messages: [
       {
         id: 'msg-1',
@@ -303,12 +299,10 @@ describe('memory persistence', () => {
     },
   });
 
-  const memorySessionScratchpad =
-    'Session summary persists memory scratchpad for memory-saving sessions';
   evalTest('USUALLY_PASSES', {
     suiteName: 'default',
     suiteType: 'behavioral',
-    name: memorySessionScratchpad,
+    name: 'Session summary persists memory scratchpad for memory-saving sessions',
     sessionId: 'memory-scratchpad-eval',
     messages: [
       {
@@ -395,12 +389,10 @@ describe('memory persistence', () => {
     },
   });
 
-  const memoryRoutesUserProject =
-    'Agent routes personal-to-user project notes to user-project memory';
   evalTest('USUALLY_PASSES', {
     suiteName: 'default',
     suiteType: 'behavioral',
-    name: memoryRoutesUserProject,
+    name: 'Agent routes personal-to-user project notes to user-project memory',
     prompt: `Please remember my personal local dev setup for THIS project's Postgres database. This is private to my machine — do NOT commit it to the repo.
 
 Connection details:
@@ -486,12 +478,10 @@ Quirks to remember:
     },
   });
 
-  const memoryRoutesCrossProjectToGlobal =
-    'Agent routes cross-project personal preferences to ~/.gemini/GEMINI.md';
   evalTest('USUALLY_PASSES', {
     suiteName: 'default',
     suiteType: 'behavioral',
-    name: memoryRoutesCrossProjectToGlobal,
+    name: 'Agent routes cross-project personal preferences to ~/.gemini/GEMINI.md',
     prompt:
       'Please remember this about me in general: across all my projects I always prefer Prettier with single quotes and trailing commas, and I always prefer tabs over spaces for indentation. These are my personal coding-style defaults that follow me into every workspace.',
     assert: async (rig, result) => {

evals/snapshot_fidelity.eval.ts

@@ -21,7 +21,7 @@ function snapshotEvalTest(policy: EvalPolicy, evalCase: ComponentEvalCase) {
 describe('snapshot_fidelity', () => {
   snapshotEvalTest('ALWAYS_PASSES', {
     suiteName: 'default',
-    suiteType: 'behavioral',
+    suiteType: 'component-level',
     name: 'SnapshotGenerator strictly retains specific empirical facts',
     assert: async (config) => {
       // 1. Construct a highly specific mock transcript containing 3 empirical facts we can test for:

evals/test-helper.test.ts

@@ -216,4 +216,109 @@ describe('evalTest reliability logic', () => {
       }
     }
   });
+
+  it('should append tool call chain to assertion failure error messages', async () => {
+    const mockRig = {
+      setup: vi.fn(),
+      run: vi.fn(),
+      cleanup: vi.fn(),
+      readToolLogs: vi.fn().mockReturnValue([]),
+      _lastRunStderr: '',
+    } as any;
+    (TestRig as any).mockReturnValue(mockRig);
+
+    mockRig.run.mockResolvedValue('Success');
+    mockRig.readToolLogs.mockReturnValue([
+      {
+        toolRequest: {
+          name: 'grep_search',
+          args: '{"query":"TODO"}',
+          success: true,
+          duration_ms: 42,
+        },
+      },
+      {
+        toolRequest: {
+          name: 'read_file',
+          args: '{"path":"/src/foo.ts"}',
+          success: false,
+          duration_ms: 15,
+          error: 'File not found',
+          error_type: 'ENOENT',
+        },
+      },
+    ]);
+
+    const assertionError = new Error('Expected tool to be called');
+
+    try {
+      await internalEvalTest({
+        suiteName: 'test',
+        suiteType: 'behavioral',
+        name: 'test-tool-chain',
+        prompt: 'do something',
+        assert: async () => {
+          throw assertionError;
+        },
+      });
+      expect.unreachable('Expected internalEvalTest to throw');
+    } catch (error: unknown) {
+      expect(error).toBeInstanceOf(Error);
+      const msg = (error as Error).message;
+      expect(msg).toContain('Expected tool to be called');
+      expect(msg).toContain('Tool Call Chain (2 calls)');
+      expect(msg).toContain('grep_search');
+      expect(msg).toContain('read_file');
+      expect(msg).toContain('[ENOENT] File not found');
+    }
+  });
+
+  it('should not crash when error.message is read-only (frozen error)', async () => {
+    const mockRig = {
+      setup: vi.fn(),
+      run: vi.fn(),
+      cleanup: vi.fn(),
+      readToolLogs: vi.fn(),
+      _lastRunStderr: '',
+    } as any;
+    (TestRig as any).mockReturnValue(mockRig);
+
+    mockRig.run.mockResolvedValue('Success');
+    mockRig.readToolLogs.mockReturnValue([
+      {
+        toolRequest: {
+          name: 'read_file',
+          args: '{"path":"/foo.ts"}',
+          success: true,
+          duration_ms: 10,
+        },
+      },
+    ]);
+
+    // Simulate a frozen error whose message property cannot be mutated
+    const frozenError = Object.freeze(new Error('Frozen assertion error'));
+
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+    try {
+      await expect(
+        internalEvalTest({
+          suiteName: 'test',
+          suiteType: 'behavioral',
+          name: 'test-frozen-error',
+          prompt: 'do something',
+          assert: async () => {
+            throw frozenError;
+          },
+        }),
+      ).rejects.toThrow('Frozen assertion error');
+
+      // Should have warned that the message could not be mutated
+      expect(warnSpy).toHaveBeenCalledWith(
+        expect.stringContaining('Could not append tool call chain'),
+      );
+    } finally {
+      warnSpy.mockRestore();
+    }
+  });
 });

evals/test-helper.ts

@@ -10,6 +10,7 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { execSync } from 'node:child_process';
 import { TestRig } from '@google/gemini-cli-test-utils';
+import { formatToolLogChain } from '../scripts/utils/tool-log-formatter.js';
 import {
   createUnauthorizedToolError,
   parseAgentMarkdown,
@@ -186,6 +187,23 @@ export async function internalEvalTest(evalCase: EvalCase) {
 
       await evalCase.assert(rig, result);
       isSuccess = true;
+    } catch (error: unknown) {
+      const toolLogs = rig.readToolLogs();
+      if (toolLogs && toolLogs.length > 0) {
+        const summary = formatToolLogChain(toolLogs);
+        if (error instanceof Error) {
+          try {
+            error.message = `${error.message}\n\nTool Call Chain (${toolLogs.length} calls):\n${summary}`;
+          } catch {
+            // Error object may be frozen or have a read-only message property.
+            // The original error is still re-thrown, so no failure is hidden.
+            console.warn(
+              `[eval] Could not append tool call chain to error message (${toolLogs.length} calls)`,
+            );
+          }
+        }
+      }
+      throw error;
     } finally {
       if (isSuccess) {
         await fs.promises.unlink(activityLogFile).catch((err) => {

evals/tsconfig.json

@@ -7,7 +7,7 @@
       "@google/gemini-cli": ["../packages/cli/index.ts"]
     }
   },
-  "include": ["**/*.ts"],
+  "include": ["**/*.ts", "../scripts/utils/tool-log-formatter.ts"],
   "exclude": ["logs"],
   "references": [{ "path": "../packages/core" }, { "path": "../packages/cli" }]
 }

package.json

@@ -32,6 +32,7 @@
     "schema:settings": "tsx ./scripts/generate-settings-schema.ts",
     "docs:settings": "tsx ./scripts/generate-settings-doc.ts",
     "docs:keybindings": "tsx ./scripts/generate-keybindings-doc.ts",
+    "eval:validate": "tsx ./scripts/eval-validate-cli.ts",
     "eval:inventory": "tsx ./scripts/eval-inventory-cli.ts",
     "eval:inventory:json": "tsx ./scripts/eval-inventory-cli.ts --json",
     "eval:report": "tsx ./scripts/eval-report-cli.ts",

packages/core/src/ide/ide-connection-utils.test.ts

@@ -31,6 +31,21 @@ vi.mock('node:fs', async (importOriginal) => {
       ...actual.promises,
       readFile: vi.fn(),
       readdir: vi.fn(),
+      realpath: vi.fn((p) => Promise.resolve(p)),
+      stat: vi.fn(() =>
+        Promise.resolve({ uid: process.getuid ? process.getuid() : 1000 }),
+      ),
+      open: vi.fn((filePath: string) =>
+        Promise.resolve({
+          stat: () => fs.promises.stat(filePath),
+          readFile: (options?: string | { encoding?: string }) =>
+            fs.promises.readFile(
+              filePath,
+              options as unknown as BufferEncoding | undefined,
+            ),
+          close: () => Promise.resolve(),
+        } as unknown as fs.promises.FileHandle),
+      ),
     },
     realpathSync: (p: string) => p,
     existsSync: vi.fn(() => false),
@@ -430,6 +445,141 @@ describe('ide-connection-utils', () => {
 
       expect(result).toEqual(config2);
     });
+
+    it('should NOT filter out config if all found config files are mismatched/invalid workspaces, returning the best sorted match so that the correct Directory Mismatch error is raised downstream', async () => {
+      const invalidConfig1 = {
+        port: '1111',
+        workspacePath: '/invalid/workspace1',
+      };
+      const invalidConfig2 = {
+        port: '2222',
+        workspacePath: '/invalid/workspace2',
+      };
+      vi.mocked(fs.promises.readFile).mockRejectedValueOnce(
+        new Error('not found'),
+      );
+      (
+        vi.mocked(fs.promises.readdir) as Mock<
+          (path: fs.PathLike) => Promise<string[]>
+        >
+      ).mockResolvedValue([
+        'gemini-ide-server-12345-111.json',
+        'gemini-ide-server-12345-222.json',
+      ]);
+      vi.mocked(fs.promises.readFile)
+        .mockResolvedValueOnce(JSON.stringify(invalidConfig1))
+        .mockResolvedValueOnce(JSON.stringify(invalidConfig2));
+
+      const result = await getConnectionConfigFromFile(12345);
+
+      expect(result).toEqual(invalidConfig1);
+    });
+
+    it('should prioritize the config matching the port from the environment variable when all found config files are mismatched/invalid workspaces', async () => {
+      vi.stubEnv('GEMINI_CLI_IDE_SERVER_PORT', '2222');
+      const invalidConfig1 = {
+        port: '1111',
+        workspacePath: '/invalid/workspace1',
+      };
+      const invalidConfig2 = {
+        port: '2222',
+        workspacePath: '/invalid/workspace2',
+      };
+      vi.mocked(fs.promises.readFile).mockRejectedValueOnce(
+        new Error('not found'),
+      );
+      (
+        vi.mocked(fs.promises.readdir) as Mock<
+          (path: fs.PathLike) => Promise<string[]>
+        >
+      ).mockResolvedValue([
+        'gemini-ide-server-12345-111.json',
+        'gemini-ide-server-12345-222.json',
+      ]);
+      vi.mocked(fs.promises.readFile)
+        .mockResolvedValueOnce(JSON.stringify(invalidConfig1))
+        .mockResolvedValueOnce(JSON.stringify(invalidConfig2));
+
+      const result = await getConnectionConfigFromFile(12345);
+
+      expect(result).toEqual(invalidConfig2);
+    });
+
+    it.runIf(process.getuid !== undefined)(
+      'should reject and ignore config files owned by a different user UID to prevent hijacking/information disclosure',
+      async () => {
+        const config1 = {
+          port: '1111',
+          workspacePath: '/test/workspace',
+        };
+        vi.mocked(fs.promises.readFile).mockRejectedValueOnce(
+          new Error('not found'),
+        );
+        (
+          vi.mocked(fs.promises.readdir) as Mock<
+            (path: fs.PathLike) => Promise<string[]>
+          >
+        ).mockResolvedValue(['gemini-ide-server-12345-111.json']);
+        vi.mocked(fs.promises.readFile).mockResolvedValueOnce(
+          JSON.stringify(config1),
+        );
+
+        const otherUid = (process.getuid ? process.getuid() : 1000) + 1;
+        vi.mocked(fs.promises.stat).mockResolvedValueOnce({
+          uid: otherUid,
+        } as unknown as fs.Stats);
+
+        const result = await getConnectionConfigFromFile(12345);
+
+        expect(result).toBeUndefined();
+      },
+    );
+
+    it('should accept and parse config files owned by the current user UID', async () => {
+      const config1 = {
+        port: '1111',
+        workspacePath: '/test/workspace',
+      };
+      vi.mocked(fs.promises.readFile).mockRejectedValueOnce(
+        new Error('not found'),
+      );
+      (
+        vi.mocked(fs.promises.readdir) as Mock<
+          (path: fs.PathLike) => Promise<string[]>
+        >
+      ).mockResolvedValue(['gemini-ide-server-12345-111.json']);
+      vi.mocked(fs.promises.readFile).mockResolvedValueOnce(
+        JSON.stringify(config1),
+      );
+
+      const currentUid = process.getuid ? process.getuid() : 1000;
+      vi.mocked(fs.promises.stat).mockResolvedValueOnce({
+        uid: currentUid,
+      } as unknown as fs.Stats);
+
+      const result = await getConnectionConfigFromFile(12345);
+
+      expect(result).toEqual(config1);
+    });
+
+    it('should reject and ignore config files if fs.promises.open throws an error', async () => {
+      vi.mocked(fs.promises.readFile).mockRejectedValueOnce(
+        new Error('not found'),
+      );
+      (
+        vi.mocked(fs.promises.readdir) as Mock<
+          (path: fs.PathLike) => Promise<string[]>
+        >
+      ).mockResolvedValue(['gemini-ide-server-12345-111.json']);
+
+      vi.mocked(fs.promises.open).mockRejectedValueOnce(
+        new Error('symlink loop / permission denied'),
+      );
+
+      const result = await getConnectionConfigFromFile(12345);
+
+      expect(result).toBeUndefined();
+    });
   });
 
   describe('validateWorkspacePath', () => {

packages/core/src/ide/ide-connection-utils.ts

@@ -109,6 +109,26 @@ export function getStdioConfigFromEnv(): StdioConfig | undefined {
 
 const IDE_SERVER_FILE_REGEX = /^gemini-ide-server-(\d+)-\d+\.json$/;
 
+async function verifyAndReadFile(
+  filePath: string,
+): Promise<string | undefined> {
+  let handle: fs.promises.FileHandle | undefined;
+  try {
+    handle = await fs.promises.open(filePath, 'r');
+    const stat = await handle.stat();
+    if (process.getuid && stat.uid !== process.getuid()) {
+      return undefined;
+    }
+    return await handle.readFile('utf8');
+  } catch {
+    return undefined;
+  } finally {
+    if (handle) {
+      await handle.close();
+    }
+  }
+}
+
 export async function getConnectionConfigFromFile(
   pid: number,
 ): Promise<
@@ -122,7 +142,10 @@ export async function getConnectionConfigFromFile(
       'ide',
       `gemini-ide-server-${pid}.json`,
     );
-    const portFileContents = await fs.promises.readFile(portFile, 'utf8');
+    const portFileContents = await verifyAndReadFile(portFile);
+    if (!portFileContents) {
+      throw new Error('Verification failed or file not found');
+    }
     const parsed: unknown = JSON.parse(portFileContents);
     type ConfigType = ConnectionConfig & {
       workspacePath?: string;
@@ -164,23 +187,21 @@ export async function getConnectionConfigFromFile(
 
   sortConnectionFiles(matchingFiles, pid);
 
-  let fileContents: string[];
-  try {
-    fileContents = await Promise.all(
-      matchingFiles.map((file) =>
-        fs.promises.readFile(path.join(portFileDir, file), 'utf8'),
-      ),
-    );
-  } catch (e) {
-    logger.debug('Failed to read IDE connection config file(s):', e);
-    return undefined;
-  }
+  const fileContents = await Promise.all(
+    matchingFiles.map((file) =>
+      verifyAndReadFile(path.join(portFileDir, file)),
+    ),
+  );
+
   const parsedContents = fileContents.map(
     (
       content,
     ):
       | (ConnectionConfig & { workspacePath?: string; ideInfo?: IdeInfo })
       | undefined => {
+      if (!content) {
+        return undefined;
+      }
       try {
         const parsed: unknown = JSON.parse(content);
         type ConfigType = ConnectionConfig & {
@@ -219,6 +240,31 @@ export async function getConnectionConfigFromFile(
   );
 
   if (validWorkspaces.length === 0) {
+    // If no workspace matches the current CWD, but we found and parsed
+    // valid connection config file(s), return the best-sorted config.
+    // This lets downstream connection logic raise a helpful, detailed
+    // "Directory mismatch" warning instead of a generic connection error.
+    let fileIndex = -1;
+    const portFromEnv = getPortFromEnv();
+    if (portFromEnv) {
+      fileIndex = parsedContents.findIndex(
+        (content) =>
+          !!content &&
+          content.port !== undefined &&
+          String(content.port) === portFromEnv,
+      );
+    }
+    if (fileIndex === -1) {
+      fileIndex = parsedContents.findIndex((content) => !!content);
+    }
+
+    if (fileIndex !== -1) {
+      const selected = parsedContents[fileIndex]!;
+      logger.debug(
+        `Selected best mismatched IDE connection file: ${matchingFiles[fileIndex]}`,
+      );
+      return selected;
+    }
     return undefined;
   }
 
@@ -234,7 +280,8 @@ export async function getConnectionConfigFromFile(
   const portFromEnv = getPortFromEnv();
   if (portFromEnv) {
     const matchingPortIndex = validWorkspaces.findIndex(
-      (content) => String(content.port) === portFromEnv,
+      (content) =>
+        content.port !== undefined && String(content.port) === portFromEnv,
     );
     if (matchingPortIndex !== -1) {
       const selected = validWorkspaces[matchingPortIndex];

packages/core/src/mcp/oauth-provider.test.ts

@@ -203,6 +203,7 @@ describe('MCPOAuthProvider', () => {
 
   afterEach(() => {
     vi.restoreAllMocks();
+    vi.unstubAllEnvs();
   });
 
   describe('authenticate', () => {
@@ -440,6 +441,100 @@ describe('MCPOAuthProvider', () => {
       );
     });
 
+    it('should perform dynamic client registration with Cloud Workstations proxy redirect URI when running in Google Cloud Workstations', async () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const configWithoutClient: MCPOAuthConfig = {
+        ...mockConfig,
+        registrationUrl: 'https://auth.example.com/register',
+      };
+      delete configWithoutClient.clientId;
+      delete configWithoutClient.redirectUri;
+
+      const mockRegistrationResponse: OAuthClientRegistrationResponse = {
+        client_id: 'dynamic_client_id',
+        client_secret: 'dynamic_client_secret',
+        redirect_uris: [
+          'https://7777-my-workstation.cluster.workstations.cloud.google.com/oauth/callback',
+        ],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+      };
+
+      mockFetch.mockResolvedValueOnce(
+        createMockResponse({
+          ok: true,
+          contentType: 'application/json',
+          text: JSON.stringify(mockRegistrationResponse),
+          json: mockRegistrationResponse,
+        }),
+      );
+
+      // Setup callback handler
+      let callbackHandler: unknown;
+      vi.mocked(http.createServer).mockImplementation((handler) => {
+        callbackHandler = handler;
+        return mockHttpServer as unknown as http.Server;
+      });
+
+      mockHttpServer.listen.mockImplementation((port, callback) => {
+        callback?.();
+        setTimeout(() => {
+          const mockReq = {
+            url: '/oauth/callback?code=auth_code_123&state=bW9ja19zdGF0ZV8xNl9ieXRlcw',
+          };
+          const mockRes = {
+            writeHead: vi.fn(),
+            end: vi.fn(),
+          };
+          (callbackHandler as (req: unknown, res: unknown) => void)(
+            mockReq,
+            mockRes,
+          );
+        }, 10);
+      });
+
+      // Mock token exchange
+      mockFetch.mockResolvedValueOnce(
+        createMockResponse({
+          ok: true,
+          contentType: 'application/json',
+          text: JSON.stringify(mockTokenResponse),
+          json: mockTokenResponse,
+        }),
+      );
+
+      const authProvider = new MCPOAuthProvider();
+      const result = await authProvider.authenticate(
+        'test-server',
+        configWithoutClient,
+      );
+
+      expect(result).toBeDefined();
+      expect(mockFetch).toHaveBeenCalledWith(
+        'https://auth.example.com/register',
+        expect.objectContaining({
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            client_name: 'Gemini CLI MCP Client',
+            redirect_uris: [
+              'https://7777-my-workstation.cluster.workstations.cloud.google.com/oauth/callback',
+            ],
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: 'none',
+            scope: 'read write',
+          }),
+        }),
+      );
+    });
+
     it('should perform OAuth discovery and dynamic client registration when no client ID or registration URL provided', async () => {
       const configWithoutClient: MCPOAuthConfig = { ...mockConfig };
       delete configWithoutClient.clientId;

packages/core/src/mcp/oauth-provider.ts

@@ -21,7 +21,7 @@ import {
   buildAuthorizationUrl,
   exchangeCodeForToken,
   refreshAccessToken as refreshAccessTokenShared,
-  REDIRECT_PATH,
+  getRedirectUri,
   type OAuthFlowConfig,
   type OAuthTokenResponse,
 } from '../utils/oauth-flow.js';
@@ -99,8 +99,7 @@ export class MCPOAuthProvider {
     config: MCPOAuthConfig,
     redirectPort: number,
   ): Promise<OAuthClientRegistrationResponse> {
-    const redirectUri =
-      config.redirectUri || `http://localhost:${redirectPort}${REDIRECT_PATH}`;
+    const redirectUri = getRedirectUri(config, redirectPort);
 
     const registrationRequest: OAuthClientRegistrationRequest = {
       client_name: 'Gemini CLI MCP Client',

packages/core/src/skills/builtin/antigravity-support/SKILL.md

@@ -1,34 +1,53 @@
 ---
 name: antigravity-support
-description: Use when the user asks questions, seeks help, or requests instructions related to installing, setting up, or migrating to Antigravity CLI. This skill provides the latest up to date details, requirements, and commands sourced from the official Antigravity CLI documentation.
+description:
+  Use when the user asks questions, seeks help, or requests instructions related
+  to installing, setting up, or migrating to Antigravity CLI. This skill
+  provides the latest up to date details, requirements, and commands sourced
+  from the official Antigravity CLI documentation.
 ---
 
 # Antigravity CLI Support
 
-This skill provides up-to-date information on how to install, configure, use, and migrate to Antigravity CLI, sourced from the official documentation at https://antigravity.google/docs/cli-getting-started.
+This skill provides up-to-date information on how to install, configure, use,
+and migrate to Antigravity CLI, sourced from the official documentation at
+https://antigravity.google/docs/cli-getting-started.
 
 ## What is Antigravity CLI?
 
-Antigravity CLI is a next-generation terminal interface for collaborating with autonomous agents on local codebases. It is designed to be highly interactive and agent-driven, launching a Terminal User Interface (TUI) to coordinate code generation, reasoning, and workspace tasks.
+Antigravity CLI is a next-generation terminal interface for collaborating with
+autonomous agents on local codebases. It is designed to be highly interactive
+and agent-driven, launching a Terminal User Interface (TUI) to coordinate code
+generation, reasoning, and workspace tasks.
 
 Key Features:
-- **Autonomous Agent Collaboration:** Work directly with agents within your terminal.
-- **Interactive TUI:** A full terminal user interface designed for agent workflows.
-- **Workspace Integration:** Deep understanding of your local workspace structure and context.
+
+- **Autonomous Agent Collaboration:** Work directly with agents within your
+  terminal.
+- **Interactive TUI:** A full terminal user interface designed for agent
+  workflows.
+- **Workspace Integration:** Deep understanding of your local workspace
+  structure and context.
 
 ## Installation
 
 To install the Antigravity CLI on your machine:
 
 ### macOS / Linux (Fast-Path Script)
+
 Run the following standard curl command in your terminal:
+
 ```bash
 curl -fsSL https://antigravity.google/cli/install.sh | bash
 ```
-This script downloads, verifies, and installs the latest version of Antigravity, and automatically registers the `agy` binary in your PATH.
+
+This script downloads, verifies, and installs the latest version of Antigravity,
+and automatically registers the `agy` binary in your PATH.
 
 ### Windows (PowerShell)
+
 For Windows environments, install via the official PowerShell setup command:
+
 ```powershell
 irm https://antigravity.google/cli/install.ps1 | iex
 ```
@@ -36,23 +55,41 @@ irm https://antigravity.google/cli/install.ps1 | iex
 ## Initial Setup & Configuration
 
 Once installed, navigate to any project or workspace directory and run:
+
 ```bash
 agy
 ```
-This command starts the Antigravity CLI. The first time you launch it, the interactive TUI will guide you through:
-1. **Workspace Trust Verification:** Confirming trust for the workspace folder to allow secure local command execution and file edits.
-2. **Visual Theme Configuration:** Setting up your preferred interactive terminal aesthetic and layout.
-3. **Rendering Modes:** Tailoring TUI performance and drawing behaviors to your terminal capabilities.
+
+This command starts the Antigravity CLI. The first time you launch it, the
+interactive TUI will guide you through:
+
+1. **Workspace Trust Verification:** Confirming trust for the workspace folder
+   to allow secure local command execution and file edits.
+2. **Visual Theme Configuration:** Setting up your preferred interactive
+   terminal aesthetic and layout.
+3. **Rendering Modes:** Tailoring TUI performance and drawing behaviors to your
+   terminal capabilities.
 
 ## How to Migrate to Antigravity CLI
 
-If you are transitioning or migrating from another tool (such as Gemini CLI) to Antigravity CLI, follow these steps:
-1. **Check Requirements:** Ensure your local environment meets standard requirements (e.g., node, git, shell access) and is running a compatible operating system (macOS, Linux, or Windows).
-2. **Install Antigravity:** Run the installation script above to make the `agy` command globally available.
-3. **Verify Installation:** Test the installation by running `agy --version` or launching `agy` in an empty or sample directory.
-4. **Transition Workspaces:** Run `agy` directly inside your project workspace root. The initial setup assistant will guide you to import or configure trust policies, similar to those you might have used previously.
+If you are transitioning or migrating from another tool (such as Gemini CLI) to
+Antigravity CLI, follow these steps:
+
+1. **Check Requirements:** Ensure your local environment meets standard
+   requirements (e.g., node, git, shell access) and is running a compatible
+   operating system (macOS, Linux, or Windows).
+2. **Install Antigravity:** Run the installation script above to make the `agy`
+   command globally available.
+3. **Verify Installation:** Test the installation by running `agy --version` or
+   launching `agy` in an empty or sample directory.
+4. **Transition Workspaces:** Run `agy` directly inside your project workspace
+   root. The initial setup assistant will guide you to import or configure trust
+   policies, similar to those you might have used previously.
 
 ## Official Resources and Learning More
 
-If you need more details or have advanced configuration/migration needs, please visit the official documentation:
-- **Official Documentation:** https://antigravity.google/docs/cli-getting-started
+If you need more details or have advanced configuration/migration needs, please
+visit the official documentation:
+
+- **Official Documentation:**
+  https://antigravity.google/docs/cli-getting-started

packages/core/src/skills/builtin/skill-creator/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: skill-creator
-description: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Gemini CLI's capabilities with specialized knowledge, workflows, or tool integrations.
+description:
+  Guide for creating effective skills. This skill should be used when users want
+  to create a new skill (or update an existing skill) that extends Gemini CLI's
+  capabilities with specialized knowledge, workflows, or tool integrations.
 ---
 
 # Skill Creator
@@ -9,22 +12,33 @@ This skill provides guidance for creating effective skills.
 
 ## About Skills
 
-Skills are modular, self-contained packages that extend Gemini CLI's capabilities by providing specialized knowledge, workflows, and tools. Think of them as "onboarding guides" for specific domains or tasks—they transform Gemini CLI from a general-purpose agent into a specialized agent equipped with procedural knowledge that no model can fully possess.
+Skills are modular, self-contained packages that extend Gemini CLI's
+capabilities by providing specialized knowledge, workflows, and tools. Think of
+them as "onboarding guides" for specific domains or tasks—they transform Gemini
+CLI from a general-purpose agent into a specialized agent equipped with
+procedural knowledge that no model can fully possess.
 
 ### What Skills Provide
 
 1. Specialized workflows - Multi-step procedures for specific domains
-2. Tool integrations - Instructions for working with specific file formats or APIs
+2. Tool integrations - Instructions for working with specific file formats or
+   APIs
 3. Domain expertise - Company-specific knowledge, schemas, business logic
-4. Bundled resources - Scripts, references, and assets for complex and repetitive tasks
+4. Bundled resources - Scripts, references, and assets for complex and
+   repetitive tasks
 
 ## Core Principles
 
 ### Concise is Key
 
-The context window is a public good. Skills share the context window with everything else Gemini CLI needs: system prompt, conversation history, other Skills' metadata, and the actual user request.
+The context window is a public good. Skills share the context window with
+everything else Gemini CLI needs: system prompt, conversation history, other
+Skills' metadata, and the actual user request.
 
-**Default assumption: Gemini CLI is already very smart.** Only add context Gemini CLI doesn't already have. Challenge each piece of information: "Does Gemini CLI really need this explanation?" and "Does this paragraph justify its token cost?"
+**Default assumption: Gemini CLI is already very smart.** Only add context
+Gemini CLI doesn't already have. Challenge each piece of information: "Does
+Gemini CLI really need this explanation?" and "Does this paragraph justify its
+token cost?"
 
 Prefer concise examples over verbose explanations.
 
@@ -32,13 +46,19 @@ Prefer concise examples over verbose explanations.
 
 Match the level of specificity to the task's fragility and variability:
 
-**High freedom (text-based instructions)**: Use when multiple approaches are valid, decisions depend on context, or heuristics guide the approach.
+**High freedom (text-based instructions)**: Use when multiple approaches are
+valid, decisions depend on context, or heuristics guide the approach.
 
-**Medium freedom (pseudocode or scripts with parameters)**: Use when a preferred pattern exists, some variation is acceptable, or configuration affects behavior.
+**Medium freedom (pseudocode or scripts with parameters)**: Use when a preferred
+pattern exists, some variation is acceptable, or configuration affects behavior.
 
-**Low freedom (specific scripts, few parameters)**: Use when operations are fragile and error-prone, consistency is critical, or a specific sequence must be followed.
+**Low freedom (specific scripts, few parameters)**: Use when operations are
+fragile and error-prone, consistency is critical, or a specific sequence must be
+followed.
 
-Think of Gemini CLI as exploring a path: a narrow bridge with cliffs needs specific guardrails (low freedom), while an open field allows many routes (high freedom).
+Think of Gemini CLI as exploring a path: a narrow bridge with cliffs needs
+specific guardrails (low freedom), while an open field allows many routes (high
+freedom).
 
 ### Anatomy of a Skill
 
@@ -61,45 +81,75 @@ skill-name/
 
 Every SKILL.md consists of:
 
-- **Frontmatter** (YAML): Contains `name` and `description` fields. These are the only fields that Gemini CLI reads to determine when the skill gets used, thus it is very important to be clear and comprehensive in describing what the skill is, and when it should be used.
-- **Body** (Markdown): Instructions and guidance for using the skill. Only loaded AFTER the skill triggers (if at all).
+- **Frontmatter** (YAML): Contains `name` and `description` fields. These are
+  the only fields that Gemini CLI reads to determine when the skill gets used,
+  thus it is very important to be clear and comprehensive in describing what the
+  skill is, and when it should be used.
+- **Body** (Markdown): Instructions and guidance for using the skill. Only
+  loaded AFTER the skill triggers (if at all).
 
 #### Bundled Resources (optional)
 
 ##### Scripts (`scripts/`)
 
-Executable code (Node.js/Python/Bash/etc.) for tasks that require deterministic reliability or are repeatedly rewritten.
+Executable code (Node.js/Python/Bash/etc.) for tasks that require deterministic
+reliability or are repeatedly rewritten.
 
-- **When to include**: When the same code is being rewritten repeatedly or deterministic reliability is needed
+- **When to include**: When the same code is being rewritten repeatedly or
+  deterministic reliability is needed
 - **Example**: `scripts/rotate_pdf.cjs` for PDF rotation tasks
-- **Benefits**: Token efficient, deterministic, may be executed without loading into context
-- **Agentic Ergonomics**: Scripts must output LLM-friendly stdout. Suppress standard tracebacks. Output clear, concise success/failure messages, and paginate or truncate outputs (e.g., "Success: First 50 lines of processed file...") to prevent context window overflow.
-- **Note**: Scripts may still need to be read by Gemini CLI for patching or environment-specific adjustments
+- **Benefits**: Token efficient, deterministic, may be executed without loading
+  into context
+- **Agentic Ergonomics**: Scripts must output LLM-friendly stdout. Suppress
+  standard tracebacks. Output clear, concise success/failure messages, and
+  paginate or truncate outputs (e.g., "Success: First 50 lines of processed
+  file...") to prevent context window overflow.
+- **Note**: Scripts may still need to be read by Gemini CLI for patching or
+  environment-specific adjustments
 
 ##### References (`references/`)
 
-Documentation and reference material intended to be loaded as needed into context to inform Gemini CLI's process and thinking.
+Documentation and reference material intended to be loaded as needed into
+context to inform Gemini CLI's process and thinking.
 
-- **When to include**: For documentation that Gemini CLI should reference while working
-- **Examples**: `references/finance.md` for financial schemas, `references/mnda.md` for company NDA template, `references/policies.md` for company policies, `references/api_docs.md` for API specifications
-- **Use cases**: Database schemas, API documentation, domain knowledge, company policies, detailed workflow guides
-- **Benefits**: Keeps SKILL.md lean, loaded only when Gemini CLI determines it's needed
-- **Best practice**: If files are large (>10k words), include grep search patterns in SKILL.md
+- **When to include**: For documentation that Gemini CLI should reference while
+  working
+- **Examples**: `references/finance.md` for financial schemas,
+  `references/mnda.md` for company NDA template, `references/policies.md` for
+  company policies, `references/api_docs.md` for API specifications
+- **Use cases**: Database schemas, API documentation, domain knowledge, company
+  policies, detailed workflow guides
+- **Benefits**: Keeps SKILL.md lean, loaded only when Gemini CLI determines it's
+  needed
+- **Best practice**: If files are large (>10k words), include grep search
+  patterns in SKILL.md
 - **Avoid duplication**: Information should live in either SKILL.md or
-  references files, not both. Prefer references files for detailed information unless it's truly core to the skill—this keeps SKILL.md lean while making information discoverable without hogging the context window. Keep only essential procedural instructions and workflow guidance in SKILL.md; move detailed reference material, schemas, and examples to references files.
+  references files, not both. Prefer references files for detailed information
+  unless it's truly core to the skill—this keeps SKILL.md lean while making
+  information discoverable without hogging the context window. Keep only
+  essential procedural instructions and workflow guidance in SKILL.md; move
+  detailed reference material, schemas, and examples to references files.
 
 ##### Assets (`assets/`)
 
-Files not intended to be loaded into context, but rather used within the output Gemini CLI produces.
+Files not intended to be loaded into context, but rather used within the output
+Gemini CLI produces.
 
-- **When to include**: When the skill needs files that will be used in the final output
-- **Examples**: `assets/logo.png` for brand assets, `assets/slides.pptx` for PowerPoint templates, `assets/frontend-template/` for HTML/React boilerplate, `assets/font.ttf` for typography
-- **Use cases**: Templates, images, icons, boilerplate code, fonts, sample documents that get copied or modified
-- **Benefits**: Separates output resources from documentation, enables Gemini CLI to use files without loading them into context
+- **When to include**: When the skill needs files that will be used in the final
+  output
+- **Examples**: `assets/logo.png` for brand assets, `assets/slides.pptx` for
+  PowerPoint templates, `assets/frontend-template/` for HTML/React boilerplate,
+  `assets/font.ttf` for typography
+- **Use cases**: Templates, images, icons, boilerplate code, fonts, sample
+  documents that get copied or modified
+- **Benefits**: Separates output resources from documentation, enables Gemini
+  CLI to use files without loading them into context
 
 #### What to Not Include in a Skill
 
-A skill should only contain essential files that directly support its functionality. Do NOT create extraneous documentation or auxiliary files, including:
+A skill should only contain essential files that directly support its
+functionality. Do NOT create extraneous documentation or auxiliary files,
+including:
 
 - README.md
 - INSTALLATION_GUIDE.md
@@ -107,7 +157,10 @@ A skill should only contain essential files that directly support its functional
 - CHANGELOG.md
 - etc.
 
-The skill should only contain the information needed for an AI agent to do the job at hand. It should not contain auxiliary context about the process that went into creating it, setup and testing procedures, user-facing documentation, etc. Creating additional documentation files just adds clutter and confusion.
+The skill should only contain the information needed for an AI agent to do the
+job at hand. It should not contain auxiliary context about the process that went
+into creating it, setup and testing procedures, user-facing documentation, etc.
+Creating additional documentation files just adds clutter and confusion.
 
 ### Progressive Disclosure Design Principle
 
@@ -115,13 +168,21 @@ Skills use a three-level loading system to manage context efficiently:
 
 1. **Metadata (name + description)** - Always in context (~100 words)
 2. **SKILL.md body** - When skill triggers (<5k words)
-3. **Bundled resources** - As needed by Gemini CLI (Unlimited because scripts can be executed without reading into context window)
+3. **Bundled resources** - As needed by Gemini CLI (Unlimited because scripts
+   can be executed without reading into context window)
 
 #### Progressive Disclosure Patterns
 
-Keep SKILL.md body to the essentials and under 500 lines to minimize context bloat. Split content into separate files when approaching this limit. When splitting out content into other files, it is very important to reference them from SKILL.md and describe clearly when to read them, to ensure the reader of the skill knows they exist and when to use them.
+Keep SKILL.md body to the essentials and under 500 lines to minimize context
+bloat. Split content into separate files when approaching this limit. When
+splitting out content into other files, it is very important to reference them
+from SKILL.md and describe clearly when to read them, to ensure the reader of
+the skill knows they exist and when to use them.
 
-**Key principle:** When a skill supports multiple variations, frameworks, or options, keep only the core workflow and selection guidance in SKILL.md. Move variant-specific details (patterns, examples, configuration) into separate reference files.
+**Key principle:** When a skill supports multiple variations, frameworks, or
+options, keep only the core workflow and selection guidance in SKILL.md. Move
+variant-specific details (patterns, examples, configuration) into separate
+reference files.
 
 **Pattern 1: High-level guide with references**
 
@@ -143,7 +204,8 @@ Gemini CLI loads FORMS.md, REFERENCE.md, or EXAMPLES.md only when needed.
 
 **Pattern 2: Domain-specific organization**
 
-For Skills with multiple domains, organize content by domain to avoid loading irrelevant context:
+For Skills with multiple domains, organize content by domain to avoid loading
+irrelevant context:
 
 ```
 bigquery-skill/
@@ -157,7 +219,8 @@ bigquery-skill/
 
 When a user asks about sales metrics, Gemini CLI only reads sales.md.
 
-Similarly, for skills supporting multiple frameworks or variants, organize by variant:
+Similarly, for skills supporting multiple frameworks or variants, organize by
+variant:
 
 ```
 cloud-deploy/
@@ -183,15 +246,20 @@ Use pandas for loading and basic queries. See [PANDAS.md](PANDAS.md).
 
 ## Advanced Operations
 
-For massive files that exceed memory, see [STREAMING.md](STREAMING.md). For timestamp normalization, see [TIMESTAMPS.md](TIMESTAMPS.md).
+For massive files that exceed memory, see [STREAMING.md](STREAMING.md). For
+timestamp normalization, see [TIMESTAMPS.md](TIMESTAMPS.md).
 
-Gemini CLI reads REDLINING.md or OOXML.md only when the user needs those features.
+Gemini CLI reads REDLINING.md or OOXML.md only when the user needs those
+features.
 ```
 
 **Important guidelines:**
 
-- **Avoid deeply nested references** - Keep references one level deep from SKILL.md. All reference files should link directly from SKILL.md.
-- **Structure longer reference files** - For files longer than 100 lines, include a table of contents at the top so Gemini CLI can see the full scope when previewing.
+- **Avoid deeply nested references** - Keep references one level deep from
+  SKILL.md. All reference files should link directly from SKILL.md.
+- **Structure longer reference files** - For files longer than 100 lines,
+  include a table of contents at the top so Gemini CLI can see the full scope
+  when previewing.
 
 ## Skill Creation Process
 
@@ -205,66 +273,93 @@ Skill creation involves these steps:
 6. Install and reload the skill
 7. Iterate based on real usage
 
-Follow these steps in order, skipping only if there is a clear reason why they are not applicable.
+Follow these steps in order, skipping only if there is a clear reason why they
+are not applicable.
 
 ### Skill Naming
 
-- Use lowercase letters, digits, and hyphens only; normalize user-provided titles to hyphen-case (e.g., "Plan Mode" -> `plan-mode`).
-- When generating names, generate a name under 64 characters (letters, digits, hyphens).
+- Use lowercase letters, digits, and hyphens only; normalize user-provided
+  titles to hyphen-case (e.g., "Plan Mode" -> `plan-mode`).
+- When generating names, generate a name under 64 characters (letters, digits,
+  hyphens).
 - Prefer short, verb-led phrases that describe the action.
-- Namespace by tool when it improves clarity or triggering (e.g., `gh-address-comments`, `linear-address-issue`).
+- Namespace by tool when it improves clarity or triggering (e.g.,
+  `gh-address-comments`, `linear-address-issue`).
 - Name the skill folder exactly after the skill name.
 
 ### Step 1: Understanding the Skill with Concrete Examples
 
-Skip this step only when the skill's usage patterns are already clearly understood. It remains valuable even when working with an existing skill.
+Skip this step only when the skill's usage patterns are already clearly
+understood. It remains valuable even when working with an existing skill.
 
-To create an effective skill, clearly understand concrete examples of how the skill will be used. This understanding can come from either direct user examples or generated examples that are validated with user feedback.
+To create an effective skill, clearly understand concrete examples of how the
+skill will be used. This understanding can come from either direct user examples
+or generated examples that are validated with user feedback.
 
 For example, when building an image-editor skill, relevant questions include:
 
-- "What functionality should the image-editor skill support? Editing, rotating, anything else?"
+- "What functionality should the image-editor skill support? Editing, rotating,
+  anything else?"
 - "Can you give some examples of how this skill would be used?"
-- "I can imagine users asking for things like 'Remove the red-eye from this image' or 'Rotate this image'. Are there other ways you imagine this skill being used?"
+- "I can imagine users asking for things like 'Remove the red-eye from this
+  image' or 'Rotate this image'. Are there other ways you imagine this skill
+  being used?"
 - "What would a user say that should trigger this skill?"
 
-**Avoid interrogation loops:** Do not ask more than one or two clarifying questions at a time. Bias toward action: propose a concrete list of features or examples based on your initial understanding, and ask the user to refine them.
+**Avoid interrogation loops:** Do not ask more than one or two clarifying
+questions at a time. Bias toward action: propose a concrete list of features or
+examples based on your initial understanding, and ask the user to refine them.
 
-Conclude this step when there is a clear sense of the functionality the skill should support.
+Conclude this step when there is a clear sense of the functionality the skill
+should support.
 
 ### Step 2: Planning the Reusable Skill Contents
 
 To turn concrete examples into an effective skill, analyze each example by:
 
 1. Considering how to execute on the example from scratch
-2. Identifying what scripts, references, and assets would be helpful when executing these workflows repeatedly
+2. Identifying what scripts, references, and assets would be helpful when
+   executing these workflows repeatedly
 
-Example: When building a `pdf-editor` skill to handle queries like "Help me rotate this PDF," the analysis shows:
+Example: When building a `pdf-editor` skill to handle queries like "Help me
+rotate this PDF," the analysis shows:
 
 1. Rotating a PDF requires re-writing the same code each time
 2. A `scripts/rotate_pdf.cjs` script would be helpful to store in the skill
 
-Example: When designing a `frontend-webapp-builder` skill for queries like "Build me a todo app" or "Build me a dashboard to track my steps," the analysis shows:
+Example: When designing a `frontend-webapp-builder` skill for queries like
+"Build me a todo app" or "Build me a dashboard to track my steps," the analysis
+shows:
 
 1. Writing a frontend webapp requires the same boilerplate HTML/React each time
-2. An `assets/hello-world/` template containing the boilerplate HTML/React project files would be helpful to store in the skill
+2. An `assets/hello-world/` template containing the boilerplate HTML/React
+   project files would be helpful to store in the skill
 
-Example: When building a `big-query` skill to handle queries like "How many users have logged in today?" the analysis shows:
+Example: When building a `big-query` skill to handle queries like "How many
+users have logged in today?" the analysis shows:
 
-1. Querying BigQuery requires re-discovering the table schemas and relationships each time
-2. A `references/schema.md` file documenting the table schemas would be helpful to store in the skill
+1. Querying BigQuery requires re-discovering the table schemas and relationships
+   each time
+2. A `references/schema.md` file documenting the table schemas would be helpful
+   to store in the skill
 
-To establish the skill's contents, analyze each concrete example to create a list of the reusable resources to include: scripts, references, and assets.
+To establish the skill's contents, analyze each concrete example to create a
+list of the reusable resources to include: scripts, references, and assets.
 
 ### Step 3: Initializing the Skill
 
 At this point, it is time to actually create the skill.
 
-Skip this step only if the skill being developed already exists, and iteration or packaging is needed. In this case, continue to the next step.
+Skip this step only if the skill being developed already exists, and iteration
+or packaging is needed. In this case, continue to the next step.
 
-When creating a new skill from scratch, always run the `init_skill.cjs` script. The script conveniently generates a new template skill directory that automatically includes everything a skill requires, making the skill creation process much more efficient and reliable.
+When creating a new skill from scratch, always run the `init_skill.cjs` script.
+The script conveniently generates a new template skill directory that
+automatically includes everything a skill requires, making the skill creation
+process much more efficient and reliable.
 
-**Note:** Use the absolute path to the script as provided in the `available_resources` section.
+**Note:** Use the absolute path to the script as provided in the
+`available_resources` section.
 
 Usage:
 
@@ -277,30 +372,48 @@ The script:
 - Creates the skill directory at the specified path
 - Generates a SKILL.md template with proper frontmatter and TODO placeholders
 - Creates example resource directories: `scripts/`, `references/`, and `assets/`
-- Adds example files (`scripts/example_script.cjs`, `references/example_reference.md`, `assets/example_asset.txt`) that can be customized or deleted
+- Adds example files (`scripts/example_script.cjs`,
+  `references/example_reference.md`, `assets/example_asset.txt`) that can be
+  customized or deleted
 
-After initialization, customize or remove the generated SKILL.md and example files as needed.
+After initialization, customize or remove the generated SKILL.md and example
+files as needed.
 
 ### Step 4: Edit the Skill
 
-When editing the (newly-generated or existing) skill, remember that the skill is being created for another instance of Gemini CLI to use. Include information that would be beneficial and non-obvious to Gemini CLI. Consider what procedural knowledge, domain-specific details, or reusable assets would help another Gemini CLI instance execute these tasks more effectively.
+When editing the (newly-generated or existing) skill, remember that the skill is
+being created for another instance of Gemini CLI to use. Include information
+that would be beneficial and non-obvious to Gemini CLI. Consider what procedural
+knowledge, domain-specific details, or reusable assets would help another Gemini
+CLI instance execute these tasks more effectively.
 
 #### Learn Proven Design Patterns
 
 Consult these helpful guides based on your skill's needs:
 
-- **Multi-step processes**: See references/workflows.md for sequential workflows and conditional logic
-- **Specific output formats or quality standards**: See references/output-patterns.md for template and example patterns
+- **Multi-step processes**: See references/workflows.md for sequential workflows
+  and conditional logic
+- **Specific output formats or quality standards**: See
+  references/output-patterns.md for template and example patterns
 
 These files contain established best practices for effective skill design.
 
 #### Start with Reusable Skill Contents
 
-To begin implementation, start with the reusable resources identified above: `scripts/`, `references/`, and `assets/` files. Note that this step may require user input. For example, when implementing a `brand-guidelines` skill, the user may need to provide brand assets or templates to store in `assets/`, or documentation to store in `references/`.
+To begin implementation, start with the reusable resources identified above:
+`scripts/`, `references/`, and `assets/` files. Note that this step may require
+user input. For example, when implementing a `brand-guidelines` skill, the user
+may need to provide brand assets or templates to store in `assets/`, or
+documentation to store in `references/`.
 
-Added scripts must be tested by actually running them to ensure there are no bugs and that the output matches what is expected. If there are many similar scripts, only a representative sample needs to be tested to ensure confidence that they all work while balancing time to completion.
+Added scripts must be tested by actually running them to ensure there are no
+bugs and that the output matches what is expected. If there are many similar
+scripts, only a representative sample needs to be tested to ensure confidence
+that they all work while balancing time to completion.
 
-Any example files and directories not needed for the skill should be deleted. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them.
+Any example files and directories not needed for the skill should be deleted.
+The initialization script creates example files in `scripts/`, `references/`,
+and `assets/` to demonstrate structure, but most skills won't need all of them.
 
 #### Update SKILL.md
 
@@ -311,11 +424,17 @@ Any example files and directories not needed for the skill should be deleted. Th
 Write the YAML frontmatter with `name` and `description`:
 
 - `name`: The skill name
-- `description`: This is the primary triggering mechanism for your skill, and helps Gemini CLI understand when to use the skill.
-  - Include both what the Skill does and specific triggers/contexts for when to use it.
-  - **Must be a single-line string** (e.g., `description: Data ingestion...`). Quotes are optional.
-  - Include all "when to use" information here - Not in the body. The body is only loaded after triggering, so "When to Use This Skill" sections in the body are not helpful to Gemini CLI.
-  - Example: `description: Data ingestion, cleaning, and transformation for tabular data. Use when Gemini CLI needs to work with CSV/TSV files to analyze large datasets, normalize schemas, or merge sources.`
+- `description`: This is the primary triggering mechanism for your skill, and
+  helps Gemini CLI understand when to use the skill.
+  - Include both what the Skill does and specific triggers/contexts for when to
+    use it.
+  - **Must be a single-line string** (e.g., `description: Data ingestion...`).
+    Quotes are optional.
+  - Include all "when to use" information here - Not in the body. The body is
+    only loaded after triggering, so "When to Use This Skill" sections in the
+    body are not helpful to Gemini CLI.
+  - Example:
+    `description: Data ingestion, cleaning, and transformation for tabular data. Use when Gemini CLI needs to work with CSV/TSV files to analyze large datasets, normalize schemas, or merge sources.`
 
 Do not include any other fields in YAML frontmatter.
 
@@ -325,9 +444,13 @@ Write instructions for using the skill and its bundled resources.
 
 ### Step 5: Packaging a Skill
 
-Once development of the skill is complete, it must be packaged into a distributable .skill file that gets shared with the user. The packaging process automatically validates the skill first (checking YAML and ensuring no TODOs remain) to ensure it meets all requirements:
+Once development of the skill is complete, it must be packaged into a
+distributable .skill file that gets shared with the user. The packaging process
+automatically validates the skill first (checking YAML and ensuring no TODOs
+remain) to ensure it meets all requirements:
 
-**Note:** Use the absolute path to the script as provided in the `available_resources` section.
+**Note:** Use the absolute path to the script as provided in the
+`available_resources` section.
 
 ```bash
 node <path-to-skill-creator>/scripts/package_skill.cjs <path/to/skill-folder>
@@ -342,20 +465,28 @@ node <path-to-skill-creator>/scripts/package_skill.cjs <path/to/skill-folder> ./
 The packaging script will:
 
 1. **Validate** the skill automatically, checking:
+
    - YAML frontmatter format and required fields
    - Skill naming conventions and directory structure
    - Description completeness and quality
    - File organization and resource references
 
-2. **Package** the skill if validation passes, creating a .skill file named after the skill (e.g., `my-skill.skill`) that includes all files and maintains the proper directory structure for distribution. The .skill file is a zip file with a .skill extension.
+2. **Package** the skill if validation passes, creating a .skill file named
+   after the skill (e.g., `my-skill.skill`) that includes all files and
+   maintains the proper directory structure for distribution. The .skill file is
+   a zip file with a .skill extension.
 
-If validation fails, the script will report the errors and exit without creating a package. Fix any validation errors and run the packaging command again.
+If validation fails, the script will report the errors and exit without creating
+a package. Fix any validation errors and run the packaging command again.
 
 ### Step 6: Installing and Reloading a Skill
 
-Once the skill is packaged into a `.skill` file, offer to install it for the user. Ask whether they would like to install it locally in the current folder (workspace scope) or at the user level (user scope).
+Once the skill is packaged into a `.skill` file, offer to install it for the
+user. Ask whether they would like to install it locally in the current folder
+(workspace scope) or at the user level (user scope).
 
-If the user agrees to an installation, perform it immediately using the `run_shell_command` tool:
+If the user agrees to an installation, perform it immediately using the
+`run_shell_command` tool:
 
 - **Locally (workspace scope)**:
   ```bash
@@ -366,13 +497,19 @@ If the user agrees to an installation, perform it immediately using the `run_she
   gemini skills install <path/to/skill-name.skill> --scope user
   ```
 
-**Important:** After the installation is complete, notify the user that they MUST manually execute the `/skills reload` command in their interactive Gemini CLI session to enable the new skill. They can then verify the installation by running `/skills list`.
+**Important:** After the installation is complete, notify the user that they
+MUST manually execute the `/skills reload` command in their interactive Gemini
+CLI session to enable the new skill. They can then verify the installation by
+running `/skills list`.
 
-Note: You (the agent) cannot execute the `/skills reload` command yourself; it must be done by the user in an interactive instance of Gemini CLI. Do not attempt to run it on their behalf.
+Note: You (the agent) cannot execute the `/skills reload` command yourself; it
+must be done by the user in an interactive instance of Gemini CLI. Do not
+attempt to run it on their behalf.
 
 ### Step 7: Iterate
 
-After testing the skill, users may request improvements. Often this happens right after using the skill, with fresh context of how the skill performed.
+After testing the skill, users may request improvements. Often this happens
+right after using the skill, with fresh context of how the skill performed.
 
 **Iteration workflow:**
 

packages/core/src/utils/oauth-flow.test.ts

@@ -209,6 +209,126 @@ describe('oauth-flow', () => {
       const parsed = new URL(url);
       expect(parsed.searchParams.has('resource')).toBe(false);
     });
+
+    it('should use the Cloud Workstations proxy callback URL when running inside Cloud Workstations', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const url = buildAuthorizationUrl(baseConfig, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        `https://3000-my-workstation.cluster.workstations.cloud.google.com${REDIRECT_PATH}`,
+      );
+    });
+
+    it('should convert explicitly configured localhost URL to Workstations proxy URL', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'http://localhost:8080/custom/callback',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        'https://3000-my-workstation.cluster.workstations.cloud.google.com/custom/callback',
+      );
+    });
+
+    it('should convert explicitly configured 127.0.0.1 URL to Workstations proxy URL', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'http://127.0.0.1:4000/oauth2callback',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        'https://3000-my-workstation.cluster.workstations.cloud.google.com/oauth2callback',
+      );
+    });
+
+    it('should convert explicitly configured [::1] IPv6 loopback URL to Workstations proxy URL', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'http://[::1]:9090/oauth2callback',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        'https://3000-my-workstation.cluster.workstations.cloud.google.com/oauth2callback',
+      );
+    });
+
+    it('should preserve query parameters and hashes from the configured redirectUri', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'http://localhost:5050/callback?tenant=123#token=abc',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        'https://3000-my-workstation.cluster.workstations.cloud.google.com/callback?tenant=123#token=abc',
+      );
+    });
+
+    it('should leave external explicitly configured redirect URIs untouched under Cloud Workstations', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'https://external-domain.com/callback',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe(
+        'https://external-domain.com/callback',
+      );
+    });
+
+    it('should handle invalid redirect URIs gracefully by returning them as-is', () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      const config: OAuthFlowConfig = {
+        ...baseConfig,
+        redirectUri: 'not-a-valid-url',
+      };
+      const url = buildAuthorizationUrl(config, basePkceParams, 3000);
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get('redirect_uri')).toBe('not-a-valid-url');
+    });
   });
 
   describe('startCallbackServer', () => {
@@ -493,6 +613,29 @@ describe('oauth-flow', () => {
       expect(body.get('redirect_uri')).toBe('https://custom.example.com/cb');
     });
 
+    it('should use the Cloud Workstations proxy callback URL when running inside Cloud Workstations', async () => {
+      vi.stubEnv('GOOGLE_CLOUD_WORKSTATIONS', 'true');
+      vi.stubEnv(
+        'WEB_HOST',
+        'my-workstation.cluster.workstations.cloud.google.com',
+      );
+
+      mockFetch.mockResolvedValueOnce(
+        createMockResponse(
+          JSON.stringify({ access_token: 'tok', token_type: 'Bearer' }),
+        ),
+      );
+
+      await exchangeCodeForToken(baseConfig, 'code', 'verifier', 3000);
+
+      const body = new URLSearchParams(
+        (mockFetch.mock.calls[0] as [string, RequestInit])[1].body as string,
+      );
+      expect(body.get('redirect_uri')).toBe(
+        `https://3000-my-workstation.cluster.workstations.cloud.google.com${REDIRECT_PATH}`,
+      );
+    });
+
     it('should default token_type to Bearer when missing from JSON response', async () => {
       mockFetch.mockResolvedValueOnce(
         createMockResponse(JSON.stringify({ access_token: 'tok' })),

packages/core/src/utils/oauth-flow.ts

@@ -70,6 +70,46 @@ export interface OAuthTokenResponse {
 /** The path the local callback server listens on. */
 export const REDIRECT_PATH = '/oauth/callback';
 
+/**
+ * Helper to determine the redirect URI, taking Google Cloud Workstations proxy into account.
+ */
+export function getRedirectUri(
+  config: { redirectUri?: string },
+  redirectPort: number,
+): string {
+  if (
+    process.env['GOOGLE_CLOUD_WORKSTATIONS'] === 'true' &&
+    process.env['WEB_HOST']
+  ) {
+    if (config.redirectUri) {
+      try {
+        const parsed = new URL(config.redirectUri);
+        if (
+          parsed.hostname === 'localhost' ||
+          parsed.hostname === '127.0.0.1' ||
+          parsed.hostname === '[::1]'
+        ) {
+          const port = String(redirectPort);
+          parsed.protocol = 'https:';
+          parsed.hostname = `${port}-${process.env['WEB_HOST']}`;
+          parsed.port = '';
+          return parsed.toString();
+        }
+      } catch {
+        // Fall back to returning config.redirectUri as-is if parsing fails
+      }
+      return config.redirectUri;
+    }
+
+    return `https://${redirectPort}-${process.env['WEB_HOST']}${REDIRECT_PATH}`;
+  }
+
+  if (config.redirectUri) {
+    return config.redirectUri;
+  }
+  return `http://localhost:${redirectPort}${REDIRECT_PATH}`;
+}
+
 const HTTP_OK = 200;
 
 /**
@@ -291,8 +331,7 @@ export function buildAuthorizationUrl(
   redirectPort: number,
   resource?: string,
 ): string {
-  const redirectUri =
-    config.redirectUri || `http://localhost:${redirectPort}${REDIRECT_PATH}`;
+  const redirectUri = getRedirectUri(config, redirectPort);
 
   const params = new URLSearchParams({
     client_id: config.clientId,
@@ -446,8 +485,7 @@ export async function exchangeCodeForToken(
   redirectPort: number,
   resource?: string,
 ): Promise<OAuthTokenResponse> {
-  const redirectUri =
-    config.redirectUri || `http://localhost:${redirectPort}${REDIRECT_PATH}`;
+  const redirectUri = getRedirectUri(config, redirectPort);
 
   const params = new URLSearchParams({
     grant_type: 'authorization_code',

scripts/eval-validate-cli.ts

@@ -0,0 +1,94 @@
+#!/usr/bin/env tsx
+
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @fileoverview CLI entry point for the eval validate command.
+ *
+ * Usage:
+ *   npm run eval:validate
+ *   npm run eval:validate -- --json
+ *   npm run eval:validate -- --root /path/to/repo
+ *   npm run eval:validate -- evals/some-file.eval.ts [--json]
+ */
+
+import path from 'node:path';
+import { collectInventory } from './utils/eval-inventory.js';
+import { buildToolRegistry } from './utils/tool-registry.js';
+import {
+  validateInventory,
+  formatValidationReport,
+  formatValidationJson,
+} from './utils/eval-validate.js';
+
+async function main() {
+  const args = process.argv.slice(2);
+
+  const rootFlagIndex = args.indexOf('--root');
+  let repoRoot: string | undefined;
+  if (rootFlagIndex !== -1) {
+    repoRoot = args[rootFlagIndex + 1];
+    if (repoRoot === undefined) {
+      console.error(
+        'Error: --root requires a directory path argument but none was provided.',
+      );
+      process.exit(1);
+    }
+    if (repoRoot.startsWith('--')) {
+      console.error(
+        `Error: --root value "${repoRoot}" looks like a flag. Provide a valid directory path.`,
+      );
+      process.exit(1);
+    }
+    args.splice(rootFlagIndex, 2);
+  }
+
+  const resolvedRoot = repoRoot ? path.resolve(repoRoot) : process.cwd();
+
+  const jsonFlagIndex = args.indexOf('--json');
+  const jsonMode = jsonFlagIndex !== -1;
+  if (jsonMode) args.splice(jsonFlagIndex, 1);
+
+  const filePaths = args.filter((a) => !a.startsWith('--'));
+
+  const inventory = await collectInventory(resolvedRoot);
+
+  if (inventory.totalFiles === 0) {
+    console.error('No eval files found under evals/.');
+    process.exit(1);
+  }
+
+  const registry = buildToolRegistry();
+  const result = validateInventory(inventory, registry, {
+    filePaths: filePaths.length > 0 ? filePaths : undefined,
+  });
+
+  if (result.unmatchedFilePaths && result.unmatchedFilePaths.length > 0) {
+    console.error(
+      'Error: The following requested file(s) were not found or did not contain any eval cases:',
+    );
+    for (const f of result.unmatchedFilePaths) {
+      console.error(`  - ${f}`);
+    }
+    process.exit(1);
+  }
+
+  if (jsonMode) {
+    console.log(formatValidationJson(result, resolvedRoot));
+  } else {
+    console.log(formatValidationReport(result, resolvedRoot));
+  }
+
+  if (result.totalViolations > 0) {
+    process.exit(1);
+  }
+}
+
+main().catch((error) => {
+  console.error('Fatal error:', error);
+  process.exit(1);
+});

scripts/tests/eval-validate.test.ts

@@ -0,0 +1,745 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import path from 'node:path';
+import { execSync } from 'node:child_process';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('node:child_process', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:child_process')>();
+  return {
+    ...actual,
+    execSync: vi.fn().mockReturnValue(''),
+  };
+});
+import {
+  validateInventory,
+  formatValidationReport,
+  formatValidationJson,
+  VALIDATION_RULES,
+  type ValidationJsonOutput,
+} from '../utils/eval-validate.js';
+import { buildToolRegistry } from '../utils/tool-registry.js';
+import { type InventoryResult } from '../utils/eval-inventory.js';
+import type {
+  EvalCaseRecord,
+  EvalFileAnalysis,
+  EvalAnalysisDiagnostic,
+} from '../utils/eval-analysis.js';
+
+function makeCase(overrides: Partial<EvalCaseRecord> = {}): EvalCaseRecord {
+  return {
+    filePath: '/repo/evals/test.eval.ts',
+    relativePath: 'evals/test.eval.ts',
+    helperName: 'evalTest',
+    baseHelperName: 'evalTest',
+    policy: 'USUALLY_PASSES',
+    name: 'test case',
+    suiteName: 'default',
+    suiteType: 'behavioral',
+    hasFiles: false,
+    hasSetup: false,
+    hasPrompt: true,
+    hasAssertBody: false,
+    prompt: 'Describe how the function works.',
+    toolReferences: ['grep_search'],
+    location: { line: 10, column: 3 },
+    ...overrides,
+  };
+}
+
+function makeFile(
+  cases: EvalCaseRecord[],
+  overrides: Partial<EvalFileAnalysis> = {},
+): EvalFileAnalysis {
+  const firstCase = cases[0];
+  return {
+    filePath: firstCase?.filePath ?? '/repo/evals/test.eval.ts',
+    relativePath: firstCase?.relativePath ?? 'evals/test.eval.ts',
+    helpers: { evalTest: 'evalTest' },
+    cases,
+    toolReferences: [],
+    diagnostics: [],
+    ...overrides,
+  };
+}
+
+function makeInventory(
+  files: EvalFileAnalysis[],
+  overrides: Partial<InventoryResult> = {},
+): InventoryResult {
+  const allCases = files.flatMap((f) => f.cases);
+  const allDiagnostics = files.flatMap((f) => [...f.diagnostics]);
+  return {
+    totalFiles: files.length,
+    totalCases: allCases.length,
+    repoRoot: '/repo',
+    files,
+    cases: allCases,
+    diagnostics: allDiagnostics,
+    ...overrides,
+  };
+}
+
+const FIXED_DATE = new Date('2026-07-05T00:00:00.000Z');
+
+describe('eval-validate', () => {
+  const registry = buildToolRegistry();
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  describe('VALIDATION_RULES', () => {
+    it('exports the expected nine rules', () => {
+      expect(VALIDATION_RULES).toHaveLength(9);
+      const ids = VALIDATION_RULES.map((r) => r.id);
+      expect(ids).toEqual([
+        'file-naming',
+        'valid-policy',
+        'suite-metadata',
+        'prompt-presence',
+        'case-name-static',
+        'invalid-tool-refs',
+        'positive-assertion',
+        'workspace-setup',
+        'new-evals-policy',
+      ]);
+    });
+
+    it('every rule has a non-empty description', () => {
+      for (const rule of VALIDATION_RULES) {
+        expect(rule.description.length).toBeGreaterThan(0);
+      }
+    });
+  });
+
+  describe('validateInventory', () => {
+    it('returns zero violations for a well-formed eval', () => {
+      const inventory = makeInventory([makeFile([makeCase()])]);
+      const result = validateInventory(inventory, registry);
+
+      expect(result.totalFiles).toBe(1);
+      expect(result.totalCases).toBe(1);
+      expect(result.totalViolations).toBe(0);
+      expect(result.validFiles).toBe(1);
+      expect(result.invalidFiles).toBe(0);
+      expect(result.violations).toEqual([]);
+    });
+
+    it('returns correct file summaries for clean inventory', () => {
+      const inventory = makeInventory([
+        makeFile([
+          makeCase({ name: 'case one' }),
+          makeCase({ name: 'case two' }),
+        ]),
+      ]);
+      const result = validateInventory(inventory, registry);
+
+      expect(result.fileSummaries).toEqual([
+        {
+          relativePath: 'evals/test.eval.ts',
+          totalCases: 2,
+          violationCount: 0,
+        },
+      ]);
+    });
+
+    it('flags file-naming violation for non-.eval.ts files', () => {
+      const c = makeCase({
+        filePath: '/repo/evals/bad-name.ts',
+        relativePath: 'evals/bad-name.ts',
+      });
+      const f = makeFile([c], {
+        filePath: '/repo/evals/bad-name.ts',
+        relativePath: 'evals/bad-name.ts',
+      });
+      const result = validateInventory(makeInventory([f]), registry);
+
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'file-naming',
+      );
+      expect(violations).toHaveLength(1);
+      expect(violations[0].message).toContain('bad-name.ts');
+    });
+
+    it('checks relativePath for file-naming when filePath differs', () => {
+      const c = makeCase({
+        filePath: '/repo/evals/good.eval.ts',
+        relativePath: 'evals/bad-name.ts',
+      });
+      const f = makeFile([c], {
+        filePath: '/repo/evals/good.eval.ts',
+        relativePath: 'evals/bad-name.ts',
+      });
+      const result = validateInventory(makeInventory([f]), registry);
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'file-naming',
+      );
+      expect(violations).toHaveLength(1);
+    });
+
+    it('accepts .eval.tsx files', () => {
+      const c = makeCase({
+        filePath: '/repo/evals/component.eval.tsx',
+        relativePath: 'evals/component.eval.tsx',
+      });
+      const f = makeFile([c], {
+        filePath: '/repo/evals/component.eval.tsx',
+        relativePath: 'evals/component.eval.tsx',
+      });
+      const result = validateInventory(makeInventory([f]), registry);
+      expect(
+        result.violations.filter((v) => v.ruleId === 'file-naming'),
+      ).toHaveLength(0);
+    });
+
+    it('flags valid-policy violation for unknown policy', () => {
+      const result = validateInventory(
+        makeInventory([makeFile([makeCase({ policy: 'unknown' })])]),
+        registry,
+      );
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'valid-policy',
+      );
+      expect(violations).toHaveLength(1);
+      expect(violations[0].message).toContain('"unknown"');
+    });
+
+    it('accepts all three valid policies', () => {
+      for (const policy of [
+        'ALWAYS_PASSES',
+        'USUALLY_PASSES',
+        'USUALLY_FAILS',
+      ] as const) {
+        const result = validateInventory(
+          makeInventory([makeFile([makeCase({ policy })])]),
+          registry,
+        );
+        expect(
+          result.violations.filter((v) => v.ruleId === 'valid-policy'),
+        ).toHaveLength(0);
+      }
+    });
+
+    it('flags missing suiteName', () => {
+      const result = validateInventory(
+        makeInventory([makeFile([makeCase({ suiteName: undefined })])]),
+        registry,
+      );
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'suite-metadata',
+      );
+      expect(violations).toHaveLength(1);
+      expect(violations[0].message).toContain('suiteName');
+    });
+
+    it('flags missing suiteType', () => {
+      const result = validateInventory(
+        makeInventory([makeFile([makeCase({ suiteType: undefined })])]),
+        registry,
+      );
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'suite-metadata',
+      );
+      expect(violations).toHaveLength(1);
+      expect(violations[0].message).toContain('suiteType');
+    });
+
+    it('flags both missing suiteName and suiteType', () => {
+      const result = validateInventory(
+        makeInventory([
+          makeFile([makeCase({ suiteName: undefined, suiteType: undefined })]),
+        ]),
+        registry,
+      );
+      expect(
+        result.violations.filter((v) => v.ruleId === 'suite-metadata'),
+      ).toHaveLength(2);
+    });
+
+    it('flags missing prompt', () => {
+      const result = validateInventory(
+        makeInventory([makeFile([makeCase({ hasPrompt: false })])]),
+        registry,
+      );
+      expect(
+        result.violations.filter((v) => v.ruleId === 'prompt-presence'),
+      ).toHaveLength(1);
+    });
+
+    it('flags case name that could not be statically resolved', () => {
+      const result = validateInventory(
+        makeInventory([makeFile([makeCase({ name: '<unknown>' })])]),
+        registry,
+      );
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'case-name-static',
+      );
+      expect(violations).toHaveLength(1);
+      expect(violations[0].message).toContain('static string literal');
+    });
+
+    it('does not flag a case literally named "unknown"', () => {
+      const result = validateInventory(
+        makeInventory([makeFile([makeCase({ name: 'unknown' })])]),
+        registry,
+      );
+      expect(
+        result.violations.filter((v) => v.ruleId === 'case-name-static'),
+      ).toHaveLength(0);
+    });
+
+    it('collects multiple violations from a single case', () => {
+      const result = validateInventory(
+        makeInventory([
+          makeFile([
+            makeCase({
+              policy: 'unknown',
+              suiteName: undefined,
+              suiteType: undefined,
+              hasPrompt: false,
+              name: '<unknown>',
+            }),
+          ]),
+        ]),
+        registry,
+      );
+      expect(result.totalViolations).toBe(5);
+      expect(result.invalidFiles).toBe(1);
+      expect(result.validFiles).toBe(0);
+    });
+
+    it('filters by relative file paths', () => {
+      const f1 = makeFile(
+        [
+          makeCase({
+            filePath: '/repo/evals/a.eval.ts',
+            relativePath: 'evals/a.eval.ts',
+            name: 'case a',
+          }),
+        ],
+        {
+          filePath: '/repo/evals/a.eval.ts',
+          relativePath: 'evals/a.eval.ts',
+        },
+      );
+      const f2 = makeFile(
+        [
+          makeCase({
+            filePath: '/repo/evals/b.eval.ts',
+            relativePath: 'evals/b.eval.ts',
+            name: 'case b',
+            policy: 'unknown',
+          }),
+        ],
+        {
+          filePath: '/repo/evals/b.eval.ts',
+          relativePath: 'evals/b.eval.ts',
+        },
+      );
+      const result = validateInventory(makeInventory([f1, f2]), registry, {
+        filePaths: ['evals/a.eval.ts'],
+      });
+      expect(result.totalFiles).toBe(1);
+      expect(result.totalViolations).toBe(0);
+    });
+
+    it('filters by absolute file paths', () => {
+      const f1 = makeFile(
+        [
+          makeCase({
+            filePath: '/repo/evals/a.eval.ts',
+            relativePath: 'evals/a.eval.ts',
+            name: 'case a',
+          }),
+        ],
+        {
+          filePath: '/repo/evals/a.eval.ts',
+          relativePath: 'evals/a.eval.ts',
+        },
+      );
+      const f2 = makeFile(
+        [
+          makeCase({
+            filePath: '/repo/evals/b.eval.ts',
+            relativePath: 'evals/b.eval.ts',
+            name: 'case b',
+            policy: 'unknown',
+          }),
+        ],
+        {
+          filePath: '/repo/evals/b.eval.ts',
+          relativePath: 'evals/b.eval.ts',
+        },
+      );
+      const result = validateInventory(makeInventory([f1, f2]), registry, {
+        filePaths: ['/repo/evals/b.eval.ts'],
+      });
+      expect(result.totalFiles).toBe(1);
+      expect(result.totalViolations).toBeGreaterThanOrEqual(1);
+    });
+
+    it('filters by relative file paths with dot-slash prefix (./)', () => {
+      const f1 = makeFile(
+        [
+          makeCase({
+            filePath: '/repo/evals/a.eval.ts',
+            relativePath: 'evals/a.eval.ts',
+            name: 'case a',
+          }),
+        ],
+        {
+          filePath: '/repo/evals/a.eval.ts',
+          relativePath: 'evals/a.eval.ts',
+        },
+      );
+      const result = validateInventory(makeInventory([f1]), registry, {
+        filePaths: ['./evals/a.eval.ts'],
+      });
+      expect(result.totalFiles).toBe(1);
+      expect(result.unmatchedFilePaths).toEqual([]);
+    });
+
+    it('tracks and returns unmatched file paths', () => {
+      const f1 = makeFile(
+        [
+          makeCase({
+            filePath: '/repo/evals/a.eval.ts',
+            relativePath: 'evals/a.eval.ts',
+            name: 'case a',
+          }),
+        ],
+        {
+          filePath: '/repo/evals/a.eval.ts',
+          relativePath: 'evals/a.eval.ts',
+        },
+      );
+      const result = validateInventory(makeInventory([f1]), registry, {
+        filePaths: ['./evals/a.eval.ts', 'evals/missing.eval.ts'],
+      });
+      expect(result.totalFiles).toBe(1);
+      expect(result.unmatchedFilePaths).toEqual(['evals/missing.eval.ts']);
+    });
+
+    it('forwards analyzer diagnostics in the result', () => {
+      const diag: EvalAnalysisDiagnostic = {
+        severity: 'warning',
+        message: 'Could not resolve wrapper helper',
+        filePath: '/repo/evals/test.eval.ts',
+        location: { line: 5, column: 1 },
+      };
+      const f = makeFile([makeCase()], { diagnostics: [diag] });
+      const result = validateInventory(makeInventory([f]), registry);
+      expect(result.analyzerDiagnostics).toHaveLength(1);
+      expect(result.analyzerDiagnostics[0].message).toBe(
+        'Could not resolve wrapper helper',
+      );
+    });
+
+    it('flags invalid-tool-refs when unrecognized tools are reported in diagnostics', () => {
+      const diag: EvalAnalysisDiagnostic = {
+        severity: 'warning',
+        message: 'Unrecognized tool name extracted: "bad_tool"',
+        filePath: '/repo/evals/test.eval.ts',
+        location: { line: 5, column: 1 },
+      };
+      const f = makeFile([makeCase()], { diagnostics: [diag] });
+      const result = validateInventory(makeInventory([f]), registry);
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'invalid-tool-refs',
+      );
+      expect(violations).toHaveLength(1);
+      expect(violations[0].message).toContain('bad_tool');
+    });
+
+    it('flags positive-assertion when standard test has no tool references', () => {
+      const c = makeCase({ toolReferences: [] });
+      const result = validateInventory(
+        makeInventory([makeFile([c])]),
+        registry,
+      );
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'positive-assertion',
+      );
+      expect(violations).toHaveLength(1);
+      expect(violations[0].message).toContain(
+        'assert function does not track any tool references',
+      );
+    });
+
+    it('does not flag positive-assertion for component-level tests', () => {
+      const c1 = makeCase({
+        baseHelperName: 'componentEvalTest',
+        toolReferences: [],
+      });
+      const c2 = makeCase({
+        suiteType: 'component-level',
+        toolReferences: [],
+      });
+      const result = validateInventory(
+        makeInventory([makeFile([c1, c2])]),
+        registry,
+      );
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'positive-assertion',
+      );
+      expect(violations).toHaveLength(0);
+    });
+
+    it('flags workspace-setup when workspace prompt has no files or setup config', () => {
+      const c = makeCase({
+        prompt: 'Please edit app.ts and fix the typo.',
+        suiteType: 'workspace',
+        hasFiles: false,
+        hasSetup: false,
+      });
+      const result = validateInventory(
+        makeInventory([makeFile([c])]),
+        registry,
+      );
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'workspace-setup',
+      );
+      expect(violations).toHaveLength(1);
+      expect(violations[0].message).toContain('suggests workspace interaction');
+    });
+
+    it('accepts workspace prompt if files or setup are provided', () => {
+      const c1 = makeCase({
+        prompt: 'Please edit app.ts and fix the typo.',
+        hasFiles: true,
+        hasSetup: false,
+      });
+      const c2 = makeCase({
+        prompt: 'Please edit app.ts and fix the typo.',
+        hasFiles: false,
+        hasSetup: true,
+      });
+      const result = validateInventory(
+        makeInventory([makeFile([c1, c2])]),
+        registry,
+      );
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'workspace-setup',
+      );
+      expect(violations).toHaveLength(0);
+    });
+
+    it('flags new-evals-policy when a new file has ALWAYS_PASSES policy', () => {
+      const c = makeCase({
+        filePath: '/repo/evals/untracked-test.eval.ts',
+        relativePath: 'evals/untracked-test.eval.ts',
+        policy: 'ALWAYS_PASSES',
+      });
+
+      // First call: git status --porcelain (working-tree additions)
+      vi.mocked(execSync).mockReturnValueOnce(
+        '?? evals/untracked-test.eval.ts\n',
+      );
+      // Subsequent calls for git merge-base can throw — addFromOutput won't add anything
+      vi.mocked(execSync).mockImplementationOnce(() => {
+        throw new Error('no merge base');
+      });
+
+      const result = validateInventory(
+        makeInventory([makeFile([c])]),
+        registry,
+      );
+      const violations = result.violations.filter(
+        (v) => v.ruleId === 'new-evals-policy',
+      );
+      expect(violations).toHaveLength(1);
+      expect(violations[0].message).toContain(
+        'not use ALWAYS_PASSES policy initially',
+      );
+    });
+
+    it('validates the real evals directory without any rule violations', async () => {
+      const { collectInventory } = await import('../utils/eval-inventory.js');
+      const repoRoot = path.resolve(import.meta.dirname, '../../');
+      const inventory = await collectInventory(repoRoot);
+      const result = validateInventory(inventory, registry);
+      expect(result.totalFiles).toBeGreaterThanOrEqual(1);
+      expect(result.totalViolations).toBe(0);
+      expect(result.violations).toEqual([]);
+    });
+  });
+
+  describe('formatValidationReport', () => {
+    it('shows success message when there are no violations', () => {
+      const result = validateInventory(
+        makeInventory([makeFile([makeCase()])]),
+        registry,
+      );
+      const report = formatValidationReport(result, '/repo');
+
+      expect(report).toContain('Eval Validation Report');
+      expect(report).toContain('1 files');
+      expect(report).toContain('0 violations');
+      expect(report).toContain('✓ All eval cases pass validation.');
+    });
+
+    it('shows violations grouped by file with rule IDs', () => {
+      const result = validateInventory(
+        makeInventory([
+          makeFile([makeCase({ policy: 'unknown', suiteName: undefined })]),
+        ]),
+        registry,
+      );
+      const report = formatValidationReport(result, '/repo');
+      expect(report).toContain('[valid-policy]');
+      expect(report).toContain('[suite-metadata]');
+      expect(report).toContain('Summary');
+      expect(report).toContain('violation(s) found');
+    });
+
+    it('converts absolute paths to relative in report', () => {
+      const result = validateInventory(
+        makeInventory([
+          makeFile([
+            makeCase({
+              filePath: '/repo/evals/test.eval.ts',
+              policy: 'unknown',
+            }),
+          ]),
+        ]),
+        registry,
+      );
+      const report = formatValidationReport(result, '/repo');
+      expect(report).toContain('evals/test.eval.ts');
+      expect(report).not.toContain('/repo/evals/test.eval.ts');
+    });
+
+    it('includes analyzer diagnostics section when present', () => {
+      const diag: EvalAnalysisDiagnostic = {
+        severity: 'warning',
+        message: 'Could not resolve wrapper',
+        filePath: '/repo/evals/test.eval.ts',
+        location: { line: 5, column: 1 },
+      };
+      const f = makeFile([makeCase({ policy: 'unknown' })], {
+        diagnostics: [diag],
+      });
+      const result = validateInventory(makeInventory([f]), registry);
+      const report = formatValidationReport(result, '/repo');
+      expect(report).toContain('Analyzer Diagnostics (1)');
+      expect(report).toContain('Could not resolve wrapper');
+    });
+  });
+
+  describe('formatValidationJson', () => {
+    it('returns valid JSON with the expected schema', () => {
+      const result = validateInventory(
+        makeInventory([makeFile([makeCase()])]),
+        registry,
+      );
+      const parsed: ValidationJsonOutput = JSON.parse(
+        formatValidationJson(result, '/repo', FIXED_DATE),
+      );
+
+      expect(parsed.version).toBe(1);
+      expect(parsed.generated).toBe('2026-07-05T00:00:00.000Z');
+      expect(parsed.summary.totalFiles).toBe(1);
+      expect(parsed.summary.totalCases).toBe(1);
+      expect(parsed.summary.totalViolations).toBe(0);
+      expect(parsed.summary.validFiles).toBe(1);
+      expect(parsed.summary.invalidFiles).toBe(0);
+      expect(parsed.violations).toEqual([]);
+    });
+
+    it('includes violations in the JSON output', () => {
+      const result = validateInventory(
+        makeInventory([
+          makeFile([makeCase({ policy: 'unknown', suiteName: undefined })]),
+        ]),
+        registry,
+      );
+      const parsed: ValidationJsonOutput = JSON.parse(
+        formatValidationJson(result, '/repo', FIXED_DATE),
+      );
+
+      expect(parsed.summary.totalViolations).toBeGreaterThanOrEqual(2);
+      expect(parsed.violations.length).toBe(parsed.summary.totalViolations);
+      for (const v of parsed.violations) {
+        expect(v).toHaveProperty('ruleId');
+        expect(v).toHaveProperty('message');
+        expect(v).toHaveProperty('filePath');
+        expect(v).toHaveProperty('location');
+        expect(typeof v.location.line).toBe('number');
+        expect(typeof v.location.column).toBe('number');
+      }
+    });
+
+    it('uses relative paths in JSON violations', () => {
+      const result = validateInventory(
+        makeInventory([
+          makeFile([
+            makeCase({
+              filePath: '/repo/evals/test.eval.ts',
+              policy: 'unknown',
+            }),
+          ]),
+        ]),
+        registry,
+      );
+      const parsed: ValidationJsonOutput = JSON.parse(
+        formatValidationJson(result, '/repo', FIXED_DATE),
+      );
+      for (const v of parsed.violations) {
+        expect(v.filePath).not.toMatch(/^\//);
+        expect(v.filePath).toContain('evals/test.eval.ts');
+      }
+    });
+
+    it('respects SOURCE_DATE_EPOCH for reproducible output', () => {
+      vi.stubEnv('SOURCE_DATE_EPOCH', '1000000000');
+      const result = validateInventory(
+        makeInventory([makeFile([makeCase()])]),
+        registry,
+      );
+      const parsed: ValidationJsonOutput = JSON.parse(
+        formatValidationJson(result, '/repo'),
+      );
+      expect(parsed.generated).toBe('2001-09-09T01:46:40.000Z');
+    });
+
+    it('respects EVAL_VALIDATE_STABLE_DATE for deterministic output', () => {
+      vi.stubEnv('EVAL_VALIDATE_STABLE_DATE', '1');
+      const result = validateInventory(
+        makeInventory([makeFile([makeCase()])]),
+        registry,
+      );
+      const parsed: ValidationJsonOutput = JSON.parse(
+        formatValidationJson(result, '/repo'),
+      );
+      expect(parsed.generated).toBe('1970-01-01T00:00:00.000Z');
+    });
+
+    it('JSON output schema is stable', () => {
+      const result = validateInventory(
+        makeInventory([makeFile([makeCase({ policy: 'unknown' })])]),
+        registry,
+      );
+      const parsed: ValidationJsonOutput = JSON.parse(
+        formatValidationJson(result, '/repo', FIXED_DATE),
+      );
+      expect(Object.keys(parsed).sort()).toEqual([
+        'generated',
+        'summary',
+        'version',
+        'violations',
+      ]);
+      expect(Object.keys(parsed.summary).sort()).toEqual([
+        'invalidFiles',
+        'totalCases',
+        'totalFiles',
+        'totalViolations',
+        'validFiles',
+      ]);
+    });
+  });
+});

scripts/tests/tool-log-formatter.test.ts

@@ -0,0 +1,194 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  formatToolLogChain,
+  type ToolLogEntry,
+} from '../utils/tool-log-formatter.js';
+
+function makeEntry(
+  overrides: Partial<ToolLogEntry['toolRequest']> = {},
+): ToolLogEntry {
+  return {
+    toolRequest: {
+      name: 'test_tool',
+      args: '{}',
+      success: true,
+      duration_ms: 100,
+      ...overrides,
+    },
+  };
+}
+
+describe('formatToolLogChain', () => {
+  it('returns empty string for empty log array', () => {
+    expect(formatToolLogChain([])).toBe('');
+  });
+
+  it('returns empty string for null/undefined input', () => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    expect(formatToolLogChain(null as any)).toBe('');
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    expect(formatToolLogChain(undefined as any)).toBe('');
+  });
+
+  it('formats a single successful tool call', () => {
+    const logs = [makeEntry({ name: 'grep_search', duration_ms: 42 })];
+    const result = formatToolLogChain(logs);
+    expect(result).toContain('1.');
+    expect(result).toContain('grep_search()');
+    expect(result).toContain('✓');
+    expect(result).toContain('42ms');
+  });
+
+  it('formats a single failed tool call with error details', () => {
+    const logs = [
+      makeEntry({
+        name: 'read_file',
+        args: '{"path":"/src/foo.ts"}',
+        success: false,
+        duration_ms: 80,
+        error: 'File not found',
+        error_type: 'ENOENT',
+      }),
+    ];
+    const result = formatToolLogChain(logs);
+    expect(result).toContain('read_file(');
+    expect(result).toContain('path="/src/foo.ts"');
+    expect(result).toContain('✗');
+    expect(result).toContain('80ms');
+    expect(result).toContain('↳ Error: [ENOENT] File not found');
+  });
+
+  it('formats arguments as key=value pairs', () => {
+    const logs = [
+      makeEntry({
+        name: 'grep_search',
+        args: '{"query":"TODO","path":"/src"}',
+      }),
+    ];
+    const result = formatToolLogChain(logs);
+    expect(result).toContain('query="TODO"');
+    expect(result).toContain('path="/src"');
+  });
+
+  it('truncates long argument values', () => {
+    const longValue = 'a'.repeat(100);
+    const logs = [
+      makeEntry({
+        name: 'write_file',
+        args: JSON.stringify({ content: longValue }),
+      }),
+    ];
+    const result = formatToolLogChain(logs);
+    expect(result).toContain('…');
+    expect(result).not.toContain(longValue);
+  });
+
+  it('handles invalid JSON in args gracefully', () => {
+    const logs = [
+      makeEntry({
+        name: 'shell',
+        args: 'not-json {{{',
+      }),
+    ];
+    const result = formatToolLogChain(logs);
+    expect(result).toContain('shell(');
+    expect(result).toContain('not-json');
+  });
+
+  it('handles JSON null args without crashing', () => {
+    // JSON.parse('null') returns null; Object.entries(null) would throw TypeError
+    const logs = [makeEntry({ name: 'some_tool', args: 'null' })];
+    const result = formatToolLogChain(logs);
+    expect(result).toContain('some_tool(');
+    expect(result).toContain('null');
+  });
+
+  it('handles JSON primitive string args without producing garbage output', () => {
+    // JSON.parse('"hello"') returns a string; Object.entries("hello") would produce char pairs
+    const logs = [makeEntry({ name: 'some_tool', args: '"hello"' })];
+    const result = formatToolLogChain(logs);
+    expect(result).toContain('some_tool(');
+    expect(result).toContain('hello');
+    // Should NOT produce character-index pairs like 0="h"
+    expect(result).not.toMatch(/0="h"/);
+  });
+
+  it('handles JSON array args without producing indexed output', () => {
+    // JSON.parse('[1,2,3]') returns an array; Object.entries([1,2,3]) would produce index pairs
+    const logs = [makeEntry({ name: 'some_tool', args: '[1, 2, 3]' })];
+    const result = formatToolLogChain(logs);
+    expect(result).toContain('some_tool(');
+    // Should NOT produce array-index pairs like 0="1"
+    expect(result).not.toMatch(/0="1"/);
+  });
+
+  it('formats multiple tool calls with correct numbering', () => {
+    const logs = [
+      makeEntry({ name: 'grep_search', duration_ms: 10 }),
+      makeEntry({ name: 'read_file', duration_ms: 20 }),
+      makeEntry({
+        name: 'write_file',
+        success: false,
+        duration_ms: 30,
+        error: 'Permission denied',
+      }),
+    ];
+    const result = formatToolLogChain(logs);
+    const lines = result.split('\n');
+    expect(lines[0]).toContain('1.');
+    expect(lines[0]).toContain('grep_search');
+    expect(lines[1]).toContain('2.');
+    expect(lines[1]).toContain('read_file');
+    expect(lines[2]).toContain('3.');
+    expect(lines[2]).toContain('write_file');
+    expect(lines[3]).toContain('↳ Error:');
+    expect(lines[3]).toContain('Permission denied');
+  });
+
+  it('pads step numbers for double-digit counts', () => {
+    const logs = Array.from({ length: 12 }, (_, i) =>
+      makeEntry({ name: `tool_${i + 1}`, duration_ms: i * 10 }),
+    );
+    const result = formatToolLogChain(logs);
+    const lines = result.split('\n');
+    expect(lines[0]).toMatch(/\s+1\./);
+    expect(lines[11]).toContain('12.');
+  });
+
+  it('shows failed call without error details when neither error nor error_type present', () => {
+    const logs = [
+      makeEntry({
+        name: 'run_shell',
+        success: false,
+        duration_ms: 50,
+      }),
+    ];
+    const result = formatToolLogChain(logs);
+    expect(result).toContain('✗');
+    expect(result).not.toContain('↳');
+  });
+
+  it('handles empty args string', () => {
+    const logs = [makeEntry({ name: 'list_dir', args: '' })];
+    const result = formatToolLogChain(logs);
+    expect(result).toContain('list_dir()');
+  });
+
+  it('formats non-string argument values correctly', () => {
+    const logs = [
+      makeEntry({
+        name: 'some_tool',
+        args: '{"count":42,"nested":{"a":1},"flag":true}',
+      }),
+    ];
+    const result = formatToolLogChain(logs);
+    expect(result).toContain('count="42"');
+    expect(result).toContain('flag="true"');
+  });
+});

scripts/utils/eval-analysis.ts

@@ -49,7 +49,10 @@ export interface EvalCaseRecord {
   suiteType?: string;
   timeout?: number;
   hasFiles: boolean;
+  hasSetup: boolean;
   hasPrompt: boolean;
+  hasAssertBody: boolean;
+  prompt?: string;
   toolReferences: readonly string[];
   location: EvalSourceLocation;
 }
@@ -161,7 +164,10 @@ export function analyzeEvalSource(
       suiteType: getStaticStringProperty(evalCase, 'suiteType'),
       timeout: getStaticNumberProperty(evalCase, 'timeout'),
       hasFiles: hasProperty(evalCase, 'files'),
+      hasSetup: hasProperty(evalCase, 'setup'),
       hasPrompt: hasProperty(evalCase, 'prompt'),
+      hasAssertBody: Boolean(assertBody),
+      prompt: getStaticStringProperty(evalCase, 'prompt'),
       toolReferences: Object.freeze([...new Set(toolRefs)].sort()),
       location: getLocation(sourceFile, callExpression),
     });
@@ -592,19 +598,32 @@ function extractFromWaitForToolCall(
   refs: { name: string; node: ts.Node }[],
 ) {
   const expr = call.expression;
+  let methodName: string | undefined;
+
+  if (ts.isPropertyAccessExpression(expr)) {
+    methodName = expr.name.text;
+  } else if (ts.isIdentifier(expr)) {
+    methodName = expr.text;
+  }
+
+  if (!methodName) return;
+
   if (
-    !ts.isPropertyAccessExpression(expr) ||
-    expr.name.text !== 'waitForToolCall'
+    methodName === 'waitForToolCall' ||
+    methodName === 'waitForPendingConfirmation'
   ) {
-    return;
-  }
-  const firstArg = call.arguments[0];
-  if (!firstArg) {
-    return;
-  }
-  const resolved = resolveStringValue(firstArg, importedConstants);
-  if (resolved) {
-    refs.push({ name: resolved, node: firstArg });
+    const firstArg = call.arguments[0];
+    if (firstArg) {
+      const resolved = resolveStringValue(firstArg, importedConstants);
+      if (resolved) {
+        refs.push({ name: resolved, node: firstArg });
+      }
+    }
+  } else if (
+    methodName === 'expectSubagentCall' ||
+    methodName === 'expectSubagent'
+  ) {
+    refs.push({ name: 'invoke_agent', node: call });
   }
 }
 

scripts/utils/eval-validate.ts

@@ -0,0 +1,642 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import path from 'node:path';
+import { execSync } from 'node:child_process';
+import type {
+  EvalCaseRecord,
+  EvalAnalysisDiagnostic,
+} from './eval-analysis.js';
+import type { InventoryResult } from './eval-inventory.js';
+import type { ToolRegistry } from './tool-registry.js';
+
+export interface ValidationRule {
+  id: string;
+  description: string;
+}
+
+export interface ValidationViolation {
+  ruleId: string;
+  message: string;
+  filePath: string;
+  location: { line: number; column: number };
+}
+
+export interface FileValidationSummary {
+  relativePath: string;
+  totalCases: number;
+  violationCount: number;
+}
+
+export interface ValidationResult {
+  totalFiles: number;
+  totalCases: number;
+  totalViolations: number;
+  invalidFiles: number;
+  validFiles: number;
+  violations: ValidationViolation[];
+  fileSummaries: FileValidationSummary[];
+  analyzerDiagnostics: readonly EvalAnalysisDiagnostic[];
+  unmatchedFilePaths?: string[];
+}
+
+export const VALIDATION_RULES: readonly ValidationRule[] = [
+  {
+    id: 'file-naming',
+    description:
+      'Eval file relativePath must match the *.eval.ts or *.eval.tsx naming convention.',
+  },
+  {
+    id: 'valid-policy',
+    description:
+      'Policy must be one of ALWAYS_PASSES, USUALLY_PASSES, or USUALLY_FAILS.',
+  },
+  {
+    id: 'suite-metadata',
+    description:
+      'Both suiteName and suiteType must be present as static string literals.',
+  },
+  {
+    id: 'prompt-presence',
+    description: 'The prompt property must be present in the eval case object.',
+  },
+  {
+    id: 'case-name-static',
+    description:
+      'The case name must be a static string literal, not a computed value.',
+  },
+  {
+    id: 'invalid-tool-refs',
+    description:
+      'All tools referenced in assertions must be valid, existing tools in the registry.',
+  },
+  {
+    id: 'positive-assertion',
+    description:
+      'Behavioral evaluation cases must assert on at least one tool call.',
+  },
+  {
+    id: 'workspace-setup',
+    description:
+      'Workspace behavior evaluations must provide files or a setup function.',
+  },
+  {
+    id: 'new-evals-policy',
+    description: 'New evaluations must not use ALWAYS_PASSES policy initially.',
+  },
+];
+
+const VALID_FILE_SUFFIXES = ['.eval.ts', '.eval.tsx'] as const;
+const VALID_POLICIES = new Set([
+  'ALWAYS_PASSES',
+  'USUALLY_PASSES',
+  'USUALLY_FAILS',
+]);
+
+function checkFileNaming(
+  evalCase: EvalCaseRecord,
+  filePath: string,
+): ValidationViolation | undefined {
+  // Check the relativePath because collectInventory's glob already filters by
+  // *.eval.{ts,tsx}. This rule catches cases from manually constructed
+  // inventories or future non-glob discovery paths.
+  const checkPath = evalCase.relativePath || filePath;
+  const base = path.basename(checkPath);
+  if (!VALID_FILE_SUFFIXES.some((suffix) => base.endsWith(suffix))) {
+    return {
+      ruleId: 'file-naming',
+      message: `File "${base}" does not match the required *.eval.ts or *.eval.tsx naming convention.`,
+      filePath,
+      location: evalCase.location,
+    };
+  }
+  return undefined;
+}
+
+function checkValidPolicy(
+  evalCase: EvalCaseRecord,
+  filePath: string,
+): ValidationViolation | undefined {
+  if (!VALID_POLICIES.has(evalCase.policy)) {
+    return {
+      ruleId: 'valid-policy',
+      message: `Policy "${evalCase.policy}" is not valid. Must be one of: ${[...VALID_POLICIES].join(', ')}.`,
+      filePath,
+      location: evalCase.location,
+    };
+  }
+  return undefined;
+}
+
+function checkSuiteMetadata(
+  evalCase: EvalCaseRecord,
+  filePath: string,
+): ValidationViolation[] {
+  const violations: ValidationViolation[] = [];
+  if (!evalCase.suiteName) {
+    violations.push({
+      ruleId: 'suite-metadata',
+      message:
+        'Missing suiteName. Add a static suiteName string to the eval case object.',
+      filePath,
+      location: evalCase.location,
+    });
+  }
+  if (!evalCase.suiteType) {
+    violations.push({
+      ruleId: 'suite-metadata',
+      message:
+        'Missing suiteType. Add a static suiteType string to the eval case object.',
+      filePath,
+      location: evalCase.location,
+    });
+  }
+  return violations;
+}
+
+function checkPromptPresence(
+  evalCase: EvalCaseRecord,
+  filePath: string,
+): ValidationViolation | undefined {
+  if (
+    evalCase.baseHelperName === 'componentEvalTest' ||
+    evalCase.suiteType === 'component-level'
+  ) {
+    return undefined;
+  }
+  if (!evalCase.hasPrompt) {
+    return {
+      ruleId: 'prompt-presence',
+      message:
+        'Eval case is missing a prompt property. Every case must include a prompt.',
+      filePath,
+      location: evalCase.location,
+    };
+  }
+  return undefined;
+}
+
+function checkCaseNameStatic(
+  evalCase: EvalCaseRecord,
+  filePath: string,
+): ValidationViolation | undefined {
+  // The analyzer stores unresolved names as '<unknown>' (eval-analysis.ts L159).
+  if (evalCase.name === '<unknown>') {
+    return {
+      ruleId: 'case-name-static',
+      message:
+        'Case name could not be resolved to a static string literal. Use a plain string, not a variable or template expression.',
+      filePath,
+      location: evalCase.location,
+    };
+  }
+  return undefined;
+}
+
+const EXEMPT_SUITE_TYPES = new Set([
+  'component-level',
+  'text',
+  'prose',
+  'steering',
+  'memory',
+]);
+
+function checkPositiveAssertion(
+  evalCase: EvalCaseRecord,
+  filePath: string,
+): ValidationViolation | undefined {
+  if (
+    evalCase.baseHelperName === 'componentEvalTest' ||
+    (evalCase.suiteType && EXEMPT_SUITE_TYPES.has(evalCase.suiteType))
+  ) {
+    return undefined;
+  }
+
+  // If case has tool references or has an assertion body (e.g. negative or custom assertions), pass
+  if (evalCase.toolReferences.length > 0 || evalCase.hasAssertBody) {
+    return undefined;
+  }
+
+  return {
+    ruleId: 'positive-assertion',
+    message:
+      'Eval case assert function does not track any tool references. Use at least one positive tool assertion.',
+    filePath,
+    location: evalCase.location,
+  };
+}
+
+function checkWorkspaceSetup(
+  evalCase: EvalCaseRecord,
+  filePath: string,
+): ValidationViolation | undefined {
+  if (
+    evalCase.baseHelperName === 'componentEvalTest' ||
+    (evalCase.suiteType && EXEMPT_SUITE_TYPES.has(evalCase.suiteType)) ||
+    evalCase.hasFiles ||
+    evalCase.hasSetup
+  ) {
+    return undefined;
+  }
+
+  if (
+    evalCase.suiteType === 'workspace' ||
+    evalCase.suiteType === 'file-system'
+  ) {
+    return {
+      ruleId: 'workspace-setup',
+      message:
+        'Eval case suggests workspace interaction (files/git), but neither "files" nor a "setup" hook is specified.',
+      filePath,
+      location: evalCase.location,
+    };
+  }
+
+  return undefined;
+}
+
+function getNewEvalFiles(repoRoot?: string): Set<string> {
+  const newFiles = new Set<string>();
+  const cwd = repoRoot || process.cwd();
+
+  function addFromOutput(output: string): void {
+    for (const line of output.split('\n')) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      // git status --porcelain: "A  path" or "?? path"
+      // git diff --name-only: bare path
+      let filePath: string;
+      if (trimmed.startsWith('A') || trimmed.startsWith('??')) {
+        filePath = trimmed.slice(2).trim();
+      } else {
+        filePath = trimmed;
+      }
+      if (filePath.startsWith('"') && filePath.endsWith('"')) {
+        filePath = filePath.slice(1, -1);
+      }
+      if (filePath) {
+        newFiles.add(path.resolve(cwd, filePath).replace(/\\/g, '/'));
+      }
+    }
+  }
+
+  try {
+    // Working-tree additions (useful locally)
+    const status = execSync('git status --porcelain', {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    addFromOutput(status);
+  } catch {
+    // Ignore
+  }
+
+  try {
+    // PR-level additions against the merge base (works in CI where working
+    // tree is clean). Try origin/main, fall back to main, then HEAD~1.
+    const bases = ['origin/main', 'main', 'HEAD~1'];
+    for (const base of bases) {
+      try {
+        const mergeBase = execSync(`git merge-base HEAD ${base}`, {
+          cwd,
+          encoding: 'utf8',
+          stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        if (mergeBase) {
+          const diff = execSync(
+            `git diff --diff-filter=A --name-only ${mergeBase}`,
+            {
+              cwd,
+              encoding: 'utf8',
+              stdio: ['ignore', 'pipe', 'ignore'],
+            },
+          );
+          addFromOutput(diff);
+          break; // succeeded, no need to try next base
+        }
+      } catch {
+        // Try next base
+      }
+    }
+  } catch {
+    // Ignore
+  }
+
+  return newFiles;
+}
+
+function checkNewEvalPolicy(
+  evalCase: EvalCaseRecord,
+  filePath: string,
+  newFiles: Set<string>,
+): ValidationViolation | undefined {
+  const normalizedPath = path.resolve(filePath).replace(/\\/g, '/');
+  if (newFiles.has(normalizedPath) && evalCase.policy === 'ALWAYS_PASSES') {
+    return {
+      ruleId: 'new-evals-policy',
+      message:
+        'New evaluations must not use ALWAYS_PASSES policy initially. Use USUALLY_PASSES.',
+      filePath,
+      location: evalCase.location,
+    };
+  }
+  return undefined;
+}
+
+/**
+ * Validates every eval case in the given inventory and returns a
+ * ValidationResult. Pass `options.filePaths` to restrict to a subset of
+ * files (absolute or relative to `inventory.repoRoot`).
+ *
+ * The `_registry` parameter is reserved for future tool-name validation rules.
+ */
+export function validateInventory(
+  inventory: InventoryResult,
+  _registry: ToolRegistry,
+  options: { filePaths?: string[] } = {},
+): ValidationResult {
+  const { filePaths: filterPaths } = options;
+
+  const matchedFilterSet = new Set<string>();
+  const filterMap = new Map<string, string>(); // maps normalized relative path -> original filter path
+
+  const filterSet: Set<string> | undefined = filterPaths
+    ? new Set(
+        filterPaths.map((p) => {
+          let abs: string;
+          if (path.isAbsolute(p)) {
+            abs = p;
+          } else {
+            abs = path.resolve(inventory.repoRoot || process.cwd(), p);
+          }
+          const rel = inventory.repoRoot
+            ? path.relative(inventory.repoRoot, abs)
+            : abs;
+          const normalized = rel.replace(/\\/g, '/');
+          filterMap.set(normalized, p);
+          return normalized;
+        }),
+      )
+    : undefined;
+
+  const fileSummaryMap = new Map<
+    string,
+    { totalCases: number; violationCount: number }
+  >();
+  const allViolations: ValidationViolation[] = [];
+  const newFiles = getNewEvalFiles(inventory.repoRoot);
+
+  for (const fileAnalysis of inventory.files) {
+    const relativePath = fileAnalysis.relativePath;
+    if (filterSet) {
+      if (!filterSet.has(relativePath)) {
+        continue;
+      }
+      matchedFilterSet.add(relativePath);
+    }
+
+    if (!fileSummaryMap.has(relativePath)) {
+      fileSummaryMap.set(relativePath, { totalCases: 0, violationCount: 0 });
+    }
+
+    for (const evalCase of fileAnalysis.cases) {
+      const summary = fileSummaryMap.get(relativePath)!;
+      summary.totalCases += 1;
+      const fp = evalCase.filePath;
+      const caseViolations: ValidationViolation[] = [];
+
+      const fn = checkFileNaming(evalCase, fp);
+      if (fn) caseViolations.push(fn);
+
+      const pol = checkValidPolicy(evalCase, fp);
+      if (pol) caseViolations.push(pol);
+
+      caseViolations.push(...checkSuiteMetadata(evalCase, fp));
+
+      const pr = checkPromptPresence(evalCase, fp);
+      if (pr) caseViolations.push(pr);
+
+      const ns = checkCaseNameStatic(evalCase, fp);
+      if (ns) caseViolations.push(ns);
+
+      const pos = checkPositiveAssertion(evalCase, fp);
+      if (pos) caseViolations.push(pos);
+
+      const ws = checkWorkspaceSetup(evalCase, fp);
+      if (ws) caseViolations.push(ws);
+
+      const nep = checkNewEvalPolicy(evalCase, fp, newFiles);
+      if (nep) caseViolations.push(nep);
+
+      allViolations.push(...caseViolations);
+      summary.violationCount += caseViolations.length;
+    }
+  }
+
+  // Elevate unrecognized tool warning diagnostics to validation violations
+  for (const d of inventory.diagnostics) {
+    if (d.message.startsWith('Unrecognized tool name extracted:')) {
+      const displayPath = resolveDisplayPath(d.filePath, inventory.repoRoot);
+      if (filterSet && !filterSet.has(displayPath)) {
+        continue;
+      }
+      allViolations.push({
+        ruleId: 'invalid-tool-refs',
+        message: d.message,
+        filePath: d.filePath,
+        location: d.location,
+      });
+
+      const summary = fileSummaryMap.get(displayPath);
+      if (summary) {
+        summary.violationCount += 1;
+      }
+    }
+  }
+
+  const fileSummaries: FileValidationSummary[] = [...fileSummaryMap.entries()]
+    .map(([relativePath, s]) => ({
+      relativePath,
+      totalCases: s.totalCases,
+      violationCount: s.violationCount,
+    }))
+    .sort((a, b) => a.relativePath.localeCompare(b.relativePath, 'en'));
+
+  const totalFiles = fileSummaries.length;
+  const totalCases = fileSummaries.reduce((sum, f) => sum + f.totalCases, 0);
+  const totalViolations = allViolations.length;
+  const invalidFiles = fileSummaries.filter((f) => f.violationCount > 0).length;
+
+  const unmatchedFilePaths: string[] = [];
+  if (filterSet) {
+    for (const f of filterSet) {
+      if (!matchedFilterSet.has(f)) {
+        const original = filterMap.get(f);
+        if (original !== undefined) {
+          unmatchedFilePaths.push(original);
+        }
+      }
+    }
+  }
+
+  return {
+    totalFiles,
+    totalCases,
+    totalViolations,
+    invalidFiles,
+    validFiles: totalFiles - invalidFiles,
+    violations: allViolations,
+    fileSummaries,
+    analyzerDiagnostics: inventory.diagnostics,
+    unmatchedFilePaths,
+  };
+}
+
+function resolveDisplayPath(filePath: string, repoRoot?: string): string {
+  if (filePath === '<inline>') return filePath;
+  if (repoRoot && path.isAbsolute(filePath)) {
+    return path.relative(repoRoot, filePath).replace(/\\/g, '/');
+  }
+  return filePath;
+}
+
+function appendAnalyzerDiagnostics(
+  lines: string[],
+  diagnostics: readonly EvalAnalysisDiagnostic[],
+  repoRoot?: string,
+): void {
+  lines.push(`Analyzer Diagnostics (${diagnostics.length})`);
+  lines.push('────────────────────────');
+  for (const d of diagnostics) {
+    const displayPath = resolveDisplayPath(d.filePath, repoRoot);
+    lines.push(
+      `⚠ ${displayPath}:${d.location.line}:${d.location.column} — ${d.message}`,
+    );
+  }
+  lines.push('');
+}
+
+export function formatValidationReport(
+  result: ValidationResult,
+  repoRoot?: string,
+): string {
+  const lines: string[] = [];
+
+  lines.push('Eval Validation Report');
+  lines.push('══════════════════════');
+  lines.push('');
+  lines.push(
+    `${result.totalFiles} files · ${result.totalCases} cases · ${result.totalViolations} violations`,
+  );
+
+  if (result.totalViolations === 0) {
+    lines.push('');
+    lines.push('✓ All eval cases pass validation.');
+    if (result.analyzerDiagnostics.length > 0) {
+      lines.push('');
+      appendAnalyzerDiagnostics(lines, result.analyzerDiagnostics, repoRoot);
+    }
+    return lines.join('\n');
+  }
+
+  lines.push('');
+
+  const byFile = new Map<string, ValidationViolation[]>();
+  for (const v of result.violations) {
+    const displayPath = resolveDisplayPath(v.filePath, repoRoot);
+    const existing = byFile.get(displayPath);
+    if (existing) {
+      existing.push(v);
+    } else {
+      byFile.set(displayPath, [v]);
+    }
+  }
+
+  for (const [displayPath, violations] of [...byFile.entries()].sort(
+    ([a], [b]) => a.localeCompare(b, 'en'),
+  )) {
+    lines.push(displayPath);
+    for (const v of violations) {
+      lines.push(
+        `  ✗ [${v.ruleId}] ${v.location.line}:${v.location.column} — ${v.message}`,
+      );
+    }
+    lines.push('');
+  }
+
+  lines.push('Summary');
+  lines.push('───────');
+  lines.push(`  ${result.validFiles} / ${result.totalFiles} files pass`);
+  lines.push(`  ${result.totalViolations} violation(s) found`);
+  lines.push('');
+
+  if (result.analyzerDiagnostics.length > 0) {
+    appendAnalyzerDiagnostics(lines, result.analyzerDiagnostics, repoRoot);
+  }
+
+  return lines.join('\n');
+}
+
+export interface ValidationJsonViolation {
+  ruleId: string;
+  message: string;
+  filePath: string;
+  location: { line: number; column: number };
+}
+
+export interface ValidationJsonOutput {
+  version: 1;
+  generated: string;
+  summary: {
+    totalFiles: number;
+    totalCases: number;
+    totalViolations: number;
+    validFiles: number;
+    invalidFiles: number;
+  };
+  violations: ValidationJsonViolation[];
+}
+
+export function formatValidationJson(
+  result: ValidationResult,
+  repoRoot?: string,
+  now?: Date,
+): string {
+  let generatedDate = now;
+  if (!generatedDate && process.env.SOURCE_DATE_EPOCH) {
+    const epoch = parseInt(process.env.SOURCE_DATE_EPOCH, 10);
+    if (!isNaN(epoch)) generatedDate = new Date(epoch * 1000);
+  }
+  if (
+    !generatedDate &&
+    (process.env.EVAL_VALIDATE_STABLE_DATE ||
+      process.env.EVAL_INVENTORY_DETERMINISTIC)
+  ) {
+    generatedDate = new Date(0);
+  }
+  if (!generatedDate) generatedDate = new Date();
+
+  const output: ValidationJsonOutput = {
+    version: 1,
+    generated: generatedDate.toISOString(),
+    summary: {
+      totalFiles: result.totalFiles,
+      totalCases: result.totalCases,
+      totalViolations: result.totalViolations,
+      validFiles: result.validFiles,
+      invalidFiles: result.invalidFiles,
+    },
+    violations: result.violations.map((v) => ({
+      ruleId: v.ruleId,
+      message: v.message,
+      filePath: resolveDisplayPath(v.filePath, repoRoot),
+      location: { line: v.location.line, column: v.location.column },
+    })),
+  };
+
+  return JSON.stringify(output, null, 2);
+}

scripts/utils/tool-log-formatter.ts

@@ -0,0 +1,84 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+export interface ToolLogEntry {
+  toolRequest: {
+    name: string;
+    args: string;
+    success: boolean;
+    duration_ms: number;
+    prompt_id?: string;
+    error?: string;
+    error_type?: string;
+  };
+}
+
+const MAX_ARG_VALUE_LENGTH = 60;
+
+function formatArgs(argsJson: string): string {
+  if (!argsJson || argsJson === '{}') {
+    return '';
+  }
+
+  let parsed: Record<string, unknown>;
+  try {
+    const val = JSON.parse(argsJson);
+    if (val === null || typeof val !== 'object' || Array.isArray(val)) {
+      return truncate(argsJson, MAX_ARG_VALUE_LENGTH);
+    }
+    parsed = val as Record<string, unknown>;
+  } catch {
+    return truncate(argsJson, MAX_ARG_VALUE_LENGTH);
+  }
+
+  const pairs: string[] = [];
+  for (const [key, value] of Object.entries(parsed)) {
+    const strValue = typeof value === 'string' ? value : JSON.stringify(value);
+    pairs.push(
+      `${key}=${JSON.stringify(truncate(String(strValue), MAX_ARG_VALUE_LENGTH))}`,
+    );
+  }
+
+  return pairs.join(', ');
+}
+
+function truncate(str: string, max: number): string {
+  if (str.length <= max) {
+    return str;
+  }
+  return str.slice(0, max - 1) + '…';
+}
+
+export function formatToolLogChain(logs: ToolLogEntry[]): string {
+  if (!logs || logs.length === 0) {
+    return '';
+  }
+
+  const lines: string[] = [];
+  const padWidth = String(logs.length).length;
+
+  for (let i = 0; i < logs.length; i++) {
+    const { toolRequest: t } = logs[i];
+    const idx = String(i + 1).padStart(padWidth, ' ');
+    const argsStr = formatArgs(t.args);
+    const call = argsStr ? `${t.name}(${argsStr})` : `${t.name}()`;
+
+    const status = t.success ? '✓' : '✗';
+    const duration = `${t.duration_ms}ms`;
+
+    lines.push(`  ${idx}. ${call} ── ${status} ${duration}`);
+
+    if (!t.success && (t.error || t.error_type)) {
+      const errorType = t.error_type ? `[${t.error_type}] ` : '';
+      const errorMsg = t.error ? truncate(t.error, 120) : 'Unknown error';
+      lines.push(
+        `  ${' '.repeat(padWidth)}   ↳ Error: ${errorType}${errorMsg}`,
+      );
+    }
+  }
+
+  return lines.join('\n');
+}

scripts/utils/tool-registry.ts

@@ -108,6 +108,32 @@ export function buildToolRegistry(): ToolRegistry {
     }
   }
 
+  const customTools: Array<[string, ToolCategory]> = [
+    ['read_background_output', 'shell'],
+    ['list_background_processes', 'shell'],
+    ['mutation-agent', 'agent'],
+    ['generalist', 'agent'],
+    ['generalist-agent', 'agent'],
+    ['coder-agent', 'agent'],
+    ['task-tracker-agent', 'agent'],
+  ];
+
+  for (const [name, category] of customTools) {
+    aliasLookup.set(name, name);
+    const entry: ToolRegistryEntry = {
+      name,
+      category,
+      aliases: Object.freeze([]),
+    };
+    tools.set(name, entry);
+    const group = categoryGroups.get(category);
+    if (group) {
+      group.push(entry);
+    } else {
+      categoryGroups.set(category, [entry]);
+    }
+  }
+
   const frozenCategories = new Map<
     ToolCategory,
     readonly ToolRegistryEntry[]