Added validation for model on start

Co-authored-by: Jack Wotherspoon <jackwoth@google.com>
Co-authored-by: Jenna Inouye <jinouye@google.com>

.dockerignore

@@ -0,0 +1,17 @@
+# Git history - not needed in build context
+.git
+
+# Root node_modules - reinstalled inside container via npm ci
+node_modules
+
+# Package-level node_modules - reinstalled inside container
+packages/*/node_modules
+
+# Development and IDE files
+.github
+.vscode
+npm-debug.log*
+
+# Misc
+.DS_Store
+*.tmp

.gcp/Dockerfile.development

@@ -0,0 +1,89 @@
+# --- STAGE 1: Base Runtime ---
+FROM docker.io/library/node:20-slim AS base
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  python3 \
+  python3-pip \
+  python3-venv \
+  curl \
+  dnsutils \
+  less \
+  jq \
+  ca-certificates \
+  git \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+# --- STAGE 2: Builder (Compile Main) ---
+FROM base AS builder
+WORKDIR /build
+COPY . .
+RUN npm ci --ignore-scripts
+RUN npm run bundle
+# Run the official release preparation script to move the bundle and assets into packages/cli
+RUN node scripts/prepare-npm-release.js
+
+# --- STAGE 3: Development Environment ---
+FROM base AS development
+
+WORKDIR /home/node/dev/main
+
+# Set up npm global package folder
+RUN mkdir -p /usr/local/share/npm-global \
+  && chown -R node:node /usr/local/share/npm-global
+ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
+ENV PATH=$PATH:/usr/local/share/npm-global/bin
+
+# Copy package.json to extract versions for global tools
+COPY package.json /tmp/package.json
+
+# Install Build Tools, Global Dev Tools (pinned), and Linters
+ARG ACTIONLINT_VER=1.7.7
+ARG SHELLCHECK_VER=0.11.0
+ARG YAMLLINT_VER=1.35.1
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  make \
+  g++ \
+  gh \
+  git \
+  unzip \
+  rsync \
+  ripgrep \
+  procps \
+  psmisc \
+  lsof \
+  socat \
+  tmux \
+  docker.io \
+  build-essential \
+  libsecret-1-dev \
+  libkrb5-dev \
+  file \
+  && curl -sSLo /tmp/actionlint.tar.gz https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VER}/actionlint_${ACTIONLINT_VER}_linux_amd64.tar.gz \
+  && tar -xzf /tmp/actionlint.tar.gz -C /usr/local/bin actionlint \
+  && curl -sSLo /tmp/shellcheck.tar.xz https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VER}/shellcheck-v${SHELLCHECK_VER}.linux.x86_64.tar.xz \
+  && tar -xf /tmp/shellcheck.tar.xz -C /usr/local/bin --strip-components=1 shellcheck-v${SHELLCHECK_VER}/shellcheck \
+  && pip3 install --break-system-packages yamllint==${YAMLLINT_VER} \
+  && export TSX_VER=$(node -p "require('/tmp/package.json').devDependencies.tsx") \
+  && export VITEST_VER=$(node -p "require('/tmp/package.json').devDependencies.vitest") \
+  && export PRETTIER_VER=$(node -p "require('/tmp/package.json').devDependencies.prettier") \
+  && export ESLINT_VER=$(node -p "require('/tmp/package.json').devDependencies.eslint") \
+  && export CROSS_ENV_VER=$(node -p "require('/tmp/package.json').devDependencies['cross-env']") \
+  && npm install -g tsx@$TSX_VER vitest@$VITEST_VER prettier@$PRETTIER_VER eslint@$ESLINT_VER cross-env@$CROSS_ENV_VER typescript@5.3.3 \
+  && npm install -g @google/gemini-cli@nightly && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-nightly \
+  && npm install -g @google/gemini-cli@preview && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-preview \
+  && npm install -g @google/gemini-cli@latest  && mv /usr/local/share/npm-global/bin/gemini /usr/local/share/npm-global/bin/g-stable \
+  && apt-get purge -y build-essential libsecret-1-dev libkrb5-dev \
+  && apt-get autoremove -y \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /tmp/* /root/.npm
+
+# Copy the bundled CLI package to a permanent location and install it
+# We MUST not delete this source folder as 'npm install -g <folder>' 
+# often symlinks to it for local folder installs.
+COPY --from=builder /build/packages/cli /usr/local/lib/gemini-cli
+RUN npm install -g /usr/local/lib/gemini-cli
+
+USER node
+CMD ["/bin/bash"]

.gcp/Dockerfile.development.dockerignore

@@ -0,0 +1,10 @@
+node_modules
+.git
+.gemini/workspaces
+dist
+!packages/*/dist/*.tgz
+bundle
+out
+*.log
+.env
+.DS_Store

.gcp/development-worker.yml

@@ -0,0 +1,58 @@
+substitutions:
+  _IMAGE_NAME: 'development'
+  _ARTIFACT_REGISTRY_REPO: 'us-docker.pkg.dev/gemini-code-dev/gemini-cli'
+
+steps:
+  # Step 1: Install root dependencies
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Install Dependencies'
+    entrypoint: 'npm'
+    args: ['install']
+
+  # Step 2: Authenticate for Docker
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Authenticate docker'
+    entrypoint: 'npm'
+    args: ['run', 'auth']
+
+  # Step 3: Build workspace packages
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build packages'
+    entrypoint: 'npm'
+    args: ['run', 'build:packages']
+
+  # Step 4: Build Development Image
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build Development Image'
+    entrypoint: 'bash'
+    env:
+      - 'RAW_BRANCH_VALUE=${BRANCH_NAME}'
+    args:
+      - '-c'
+      - |-
+        IMAGE_BASE="${_ARTIFACT_REGISTRY_REPO}/${_IMAGE_NAME}"
+
+        # Determine the primary tag (branch name or 'latest' for main)
+        # Use $$ for shell variables to avoid Cloud Build attempting premature substitution
+        RAW_BRANCH="$$RAW_BRANCH_VALUE"
+        if [ "$${RAW_BRANCH}" == "main" ]; then
+          TAG_PRIMARY="latest"
+        else
+          TAG_PRIMARY=$$(echo "$${RAW_BRANCH}" | sed 's/[^a-zA-Z0-9]/-/g' | tr '[:upper:]' '[:lower:]')
+        fi
+
+        # Use SHORT_SHA if available (Cloud Build) or fallback to latest-dev
+        TAG_SHA="$${SHORT_SHA:-latest-dev}"
+
+        echo "📦 Building Development Image for: $${RAW_BRANCH} -> $${TAG_PRIMARY} ($${TAG_SHA})"
+
+        docker build -f .gcp/Dockerfile.development \
+          -t "$${IMAGE_BASE}:$${TAG_SHA}" \
+          -t "$${IMAGE_BASE}:$${TAG_PRIMARY}" .
+
+        docker push "$${IMAGE_BASE}:$${TAG_SHA}"
+        docker push "$${IMAGE_BASE}:$${TAG_PRIMARY}"
+
+options:
+  defaultLogsBucketBehavior: 'REGIONAL_USER_OWNED_BUCKET'
+  dynamicSubstitutions: true

.gemini/commands/fix-behavioral-eval.toml

@@ -1,60 +0,0 @@
-description = "Check status of nightly evals, fix failures for key models, and re-run."
-prompt = """
-You are an expert at fixing behavioral evaluations.
-
-1. **Investigate**:
-   - Use 'gh' cli to fetch the results from the latest run from the main branch: https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml.
-   - DO NOT push any changes or start any runs. The rest of your evaluation will be local.
-   - Evals are in evals/ directory and are documented by evals/README.md.
-   - The test case trajectory logs will be logged to evals/logs.
-   - You should also enable and review the verbose agent logs by setting the GEMINI_DEBUG_LOG_FILE environment variable.
-   - Identify the relevant test. Confine your investigation and validation to just this test.
-   - Proactively add logging that will aid in gathering information or validating your hypotheses.
-
-2. **Fix**:
-   - If a relevant test is failing, locate the test file and the corresponding prompt/code.
-   - It's often helpful to make an extreme, brute force change to see if you are changing the right place to make an improvement and then scope it back iteratively.
-   - Your **final** change should be **minimal and targeted**.
-   - Keep in mind the following:
-     - The prompt has multiple configurations and pieces. Take care that your changes
-       end up in the final prompt for the selected model and configuration.
-     - The prompt chosen for the eval is intentional. It's often vague or indirect
-       to see how the agent performs with ambiguous instructions. Changing it should
-       be a last resort.
-     - When changing the test prompt, carefully consider whether the prompt still tests
-       the same scenario. We don't want to lose test fidelity by making the prompts too
-       direct (i.e.: easy).
-     - Your primary mechanism for improving the agent's behavior is to make changes to
-       tool instructions, system prompt (snippets.ts), and/or modules that contribute to the prompt.
-     - If prompt and description changes are unsuccessful, use logs and debugging to
-       confirm that everything is working as expected.
-    - If unable to fix the test, you can make recommendations for architecture changes
-      that might help stablize the test. Be sure to THINK DEEPLY if offering architecture guidance.
-      Some facts that might help with this are:
-      - Agents may be composed of one or more agent loops.
-      - AgentLoop == 'context + toolset + prompt'. Subagents are one type of agent loop.
-      - Agent loops perform better when:
-        - They have direct, unambiguous, and non-contradictory prompts.
-        - They have fewer irrelevant tools.
-        - They have fewer goals or steps to perform.
-        - They have less low value or irrelevant context.
-      - You may suggest compositions of existing primitives, like subagents, or
-        propose a new one.
-      - These recommendations should be high confidence and should be grounded
-        in observed deficient behaviors rather than just parroting the facts above.
-        Investigate as needed to ground your recommendations.
-
-3. **Verify**:
-   - Run just that one test if needed to validate that it is fixed. Be sure to run vitest in non-interactive mode.
-   - Running the tests can take a long time, so consider whether you can diagnose via other means or log diagnostics before committing the time. You must minimize the number of test runs needed to diagnose the failure.
-   - After the test completes, check whether it seems to have improved.
-   - You will need to run the test 3 times for Gemini 3.0, Gemini 3 flash, and Gemini 2.5 pro to ensure that it is truly stable. Run these runs in parallel, using scripts if needed.
-   - Some flakiness is expected; if it looks like a transient issue or the test is inherently unstable but passes 2/3 times, you might decide it cannot be improved.
-
-4. **Report**:
-   - Provide a summary of the test success rate for each of the tested models.
-   - Success rate is calculated based on 3 runs per model (e.g., 3/3 = 100%).
-   - If you couldn't fix it due to persistent flakiness, explain why.
-
-{{args}}
-"""

.gemini/commands/promote-behavioral-eval.toml

@@ -1,29 +0,0 @@
-description = "Promote behavioral evals that have a 100% success rate over the last 7 nightly runs."
-prompt = """
-You are an expert at analyzing and promoting behavioral evaluations.
-
-1. **Investigate**:
-   - Use 'gh' cli to fetch the results from the most recent run from the main branch: https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml.
-   - DO NOT push any changes or start any runs. The rest of your evaluation will be local.
-   - Evals are in evals/ directory and are documented by evals/README.md.
-   - Identify tests that have passed 100% of the time for ALL enabled models across the past 7 runs in a row.
-   - NOTE: the results summary from the most recent run contains the last 7 runs test results. 100% means the test passed 3/3 times for that model and run.
-   - If a test meets this criteria, it is a candidate for promotion.
-
-2. **Promote**:
-   - For each candidate test, locate the test file in the evals/ directory.
-   - Promote the test according to the project's standard promotion process (e.g., moving it to a stable suite, updating its tags, or removing skip/flaky annotations). 
-   - Ensure you follow any guidelines in evals/README.md for stable tests.
-   - Your **final** change should be **minimal and targeted** to just promoting the test status.
-
-3. **Verify**:
-   - Run the promoted tests locally to validate that they still execute correctly. Be sure to run vitest in non-interactive mode.
-   - Check that the test is now part of the expected standard or stable test suites.
-
-4. **Report**:
-   - Provide a summary of the tests that were promoted.
-   - Include the success rate evidence (7/7 runs passed for all models) for each promoted test.
-   - If no tests met the criteria for promotion, clearly state that and summarize the closest candidates.
-
-{{args}}
-"""

.gemini/commands/strict-development-rules.md

@@ -53,11 +53,27 @@ Gemini CLI project.
   overriding values. Refer to `text-buffer.ts` for a canonical example.
 - **Logging**: Do not leave `console.log`, `console.warn`, or `console.error` in
   the code.
-- **State & Effects**: Ensure state initialization is explicit (e.g., use
-  `undefined` rather than `true` as a default if the state is truly unknown).
-  Carefully manage `useEffect` dependencies. Prefer a reducer whenever
-  practical. NEVER disable `react-hooks/exhaustive-deps`; fix the code to
-  correctly declare dependencies instead.
+- **State**: Ensure state initialization is explicit (e.g., use `undefined`
+  rather than `true` as a default if the state is truly unknown). Prefer a
+  reducer whenever practical. NEVER disable `react-hooks/exhaustive-deps`; fix
+  the code to correctly declare dependencies instead. Evaluate all the React
+  states in a component and ensure that the `useState` calls are necessary and
+  not cases where values could be derived on render. Ensure there are no stale
+  closures that are relying on a value from a previous render. React Components
+  that modify Settings should effectively use the `useSettingsStore` pattern.
+  Components that configure application Settings (e.g settings.json) are the
+  only reasonable case for unsaved changes to drive UX; in these cases, the
+  Settings store should only be written to on save. If the user experience does
+  not utilize unsaved changes because there is no option to exit without saving
+  or reverting the unsaved changes, then the component should directly read from
+  and write to the Settings store without holding pending changes in component
+  level UI state.
+- **Effect**: `useEffect` should not be used to synchronize React states, it
+  should only be used for genuine side effects that occur outside of React.
+  Contributors should be able to strongly justify the need for an effect.
+  Consider whether the effect should instead be inside an event handler, or
+  whether it is better off being computed on render. Carefully manage
+  `useEffect` dependencies.
 - **Context & Props**: Avoid excessive property drilling. Leverage existing
   providers, extend them, or propose a new one if necessary. Only use providers
   for properties that are consistent across the entire application.

.gemini/settings.json

@@ -1,8 +1,13 @@
 {
   "experimental": {
-    "plan": true,
     "extensionReloading": true,
-    "modelSteering": true
+    "modelSteering": true,
+    "autoMemory": true,
+    "topicUpdateNarration": true,
+    "voiceMode": true,
+    "adk": {
+      "agentSessionNoninteractiveEnabled": true
+    }
   },
   "general": {
     "devtools": true

.gemini/skills/async-pr-review/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: async-pr-review
+description: Trigger this skill when the user wants to start an asynchronous PR review, run background checks on a PR, or check the status of a previously started async PR review.
+---
+
+# Async PR Review
+
+This skill provides a set of tools to asynchronously review a Pull Request. It will create a background job to run the project's preflight checks, execute Gemini-powered test plans, and perform a comprehensive code review using custom prompts.
+
+This skill is designed to showcase an advanced "Agentic Asynchronous Pattern":
+1.  **Native Background Shells vs Headless Inference**: While Gemini CLI can natively spawn and detach background shell commands (using the `run_shell_command` tool with `is_background: true`), a standard bash background job cannot perform LLM inference. To conduct AI-driven code reviews and test generation in the background, the shell script *must* invoke the `gemini` executable headlessly using `-p`. This offloads the AI tasks to independent worker agents.
+2.  **Dynamic Git Scoping**: The review scripts avoid hardcoded paths. They use `git rev-parse --show-toplevel` to automatically resolve the root of the user's current project.
+3.  **Ephemeral Worktrees**: Instead of checking out branches in the user's main workspace, the skill provisions temporary git worktrees in `.gemini/tmp/async-reviews/pr-<number>`. This prevents git lock conflicts and namespace pollution.
+4.  **Agentic Evaluation (`check-async-review.sh`)**: The check script outputs clean JSON/text statuses for the main agent to parse. The interactive agent itself synthesizes the final assessment dynamically from the generated log files.
+
+## Workflow
+
+1.  **Determine Action**: Establish whether the user wants to start a new async review or check the status of an existing one.
+    *   If the user says "start an async review for PR #123" or similar, proceed to **Start Review**.
+    *   If the user says "check the status of my async review for PR #123" or similar, proceed to **Check Status**.
+
+### Start Review
+
+If the user wants to start a new async PR review:
+
+1.  Ask the user for the PR number if they haven't provided it.
+2.  Execute the `async-review.sh` script, passing the PR number as the first argument. Be sure to run it with the `is_background` flag set to true to ensure it immediately detaches.
+    ```bash
+    .gemini/skills/async-pr-review/scripts/async-review.sh <PR_NUMBER>
+    ```
+3.  Inform the user that the tasks have started successfully and they can check the status later.
+
+### Check Status
+
+If the user wants to check the status or view the final assessment of a previously started async review:
+
+1.  Ask the user for the PR number if they haven't provided it.
+2.  Execute the `check-async-review.sh` script, passing the PR number as the first argument:
+    ```bash
+    .gemini/skills/async-pr-review/scripts/check-async-review.sh <PR_NUMBER>
+    ```
+3.  **Evaluate Output**: Read the output from the script.
+    *   If the output contains `STATUS: IN_PROGRESS`, tell the user which tasks are still running.
+    *   If the output contains `STATUS: COMPLETE`, use your file reading tools (`read_file`) to retrieve the contents of `final-assessment.md`, `review.md`, `pr-diff.diff`, `npm-test.log`, and `test-execution.log` files from the `LOG_DIR` specified in the output.
+    *   **Final Assessment**: Read those files, synthesize their results, and give the user a concise recommendation on whether the PR builds successfully, passes tests, and if you recommend they approve it based on the review.

.gemini/skills/async-pr-review/policy.toml

@@ -0,0 +1,148 @@
+# --- CORE TOOLS ---
+[[rule]]
+toolName = "read_file"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "write_file"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "grep_search"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "glob"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "list_directory"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "codebase_investigator"
+decision = "allow"
+priority = 100
+
+# --- SHELL COMMANDS ---
+
+# Git (Safe/Read-only)
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = [
+  "git blame",
+  "git show",
+  "git grep",
+  "git show-ref",
+  "git ls-tree",
+  "git ls-remote",
+  "git reflog",
+  "git remote -v",
+  "git diff",
+  "git rev-list",
+  "git rev-parse",
+  "git merge-base",
+  "git cherry",
+  "git fetch",
+  "git status",
+  "git st",
+  "git branch",
+  "git br",
+  "git log",
+  "git --version"
+]
+decision = "allow"
+priority = 100
+
+# GitHub CLI (Read-only)
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = [
+  "gh workflow list",
+  "gh auth status",
+  "gh checkout view",
+  "gh run view",
+  "gh run job view",
+  "gh run list",
+  "gh run --help",
+  "gh issue view",
+  "gh issue list",
+  "gh label list",
+  "gh pr diff",
+  "gh pr check",
+  "gh pr checks",
+  "gh pr view",
+  "gh pr list",
+  "gh pr status",
+  "gh repo view",
+  "gh job view",
+  "gh api",
+  "gh log"
+]
+decision = "allow"
+priority = 100
+
+# Node.js/NPM (Generic Tests, Checks, and Build)
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = [
+  "npm run start",
+  "npm install",
+  "npm run",
+  "npm test",
+  "npm ci",
+  "npm list",
+  "npm --version"
+]
+decision = "allow"
+priority = 100
+
+# Core Utilities (Safe)
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = [
+  "sleep",
+  "env",
+  "break",
+  "xargs",
+  "base64",
+  "uniq",
+  "sort",
+  "echo",
+  "which",
+  "ls",
+  "find",
+  "tail",
+  "head",
+  "cat",
+  "cd",
+  "grep",
+  "ps",
+  "pwd",
+  "wc",
+  "file",
+  "stat",
+  "diff",
+  "lsof",
+  "date",
+  "whoami",
+  "uname",
+  "du",
+  "cut",
+  "true",
+  "false",
+  "readlink",
+  "awk",
+  "jq",
+  "rg",
+  "less",
+  "more",
+  "tree"
+]
+decision = "allow"
+priority = 100

.gemini/skills/async-pr-review/scripts/async-review.sh

@@ -0,0 +1,245 @@
+#!/bin/bash
+
+notify() {
+  local title="${1}"
+  local message="${2}"
+  local pr="${3}"
+  # Terminal escape sequence
+  printf "\e]9;%s | PR #%s | %s\a" "${title}" "${pr}" "${message}"
+  # Native macOS notification
+  os_type="$(uname || true)"
+  if [[ "${os_type}" == "Darwin" ]]; then
+    osascript -e "display notification \"${message}\" with title \"${title}\" subtitle \"PR #${pr}\""
+  fi
+}
+
+pr_number="${1}"
+if [[ -z "${pr_number}" ]]; then
+  echo "Usage: async-review <pr_number>"
+  exit 1
+fi
+
+base_dir="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+if [[ -z "${base_dir}" ]]; then
+  echo "❌ Must be run from within a git repository."
+  exit 1
+fi
+
+# Use the repository's local .gemini/tmp directory for ephemeral worktrees and logs
+pr_dir="${base_dir}/.gemini/tmp/async-reviews/pr-${pr_number}"
+target_dir="${pr_dir}/worktree"
+log_dir="${pr_dir}/logs"
+
+cd "${base_dir}" || exit 1
+
+mkdir -p "${log_dir}"
+rm -f "${log_dir}/setup.exit" "${log_dir}/final-assessment.exit" "${log_dir}/final-assessment.md"
+
+echo "🧹 Cleaning up previous worktree if it exists..." | tee -a "${log_dir}/setup.log"
+git worktree remove -f "${target_dir}" >> "${log_dir}/setup.log" 2>&1 || true
+git branch -D "gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1 || true
+git worktree prune >> "${log_dir}/setup.log" 2>&1 || true
+
+echo "📡 Fetching PR #${pr_number}..." | tee -a "${log_dir}/setup.log"
+if ! git fetch origin -f "pull/${pr_number}/head:gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1; then
+  echo 1 > "${log_dir}/setup.exit"
+  echo "❌ Fetch failed. Check ${log_dir}/setup.log"
+  notify "Async Review Failed" "Fetch failed." "${pr_number}"
+  exit 1
+fi
+
+if [[ ! -d "${target_dir}" ]]; then
+  echo "🧹 Pruning missing worktrees..." | tee -a "${log_dir}/setup.log"
+  git worktree prune >> "${log_dir}/setup.log" 2>&1
+  echo "🌿 Creating worktree in ${target_dir}..." | tee -a "${log_dir}/setup.log"
+  if ! git worktree add "${target_dir}" "gemini-async-pr-${pr_number}" >> "${log_dir}/setup.log" 2>&1; then
+    echo 1 > "${log_dir}/setup.exit"
+    echo "❌ Worktree creation failed. Check ${log_dir}/setup.log"
+    notify "Async Review Failed" "Worktree creation failed." "${pr_number}"
+    exit 1
+  fi
+else
+  echo "🌿 Worktree already exists." | tee -a "${log_dir}/setup.log"
+fi
+echo 0 > "${log_dir}/setup.exit"
+
+cd "${target_dir}" || exit 1
+
+echo "🚀 Launching background tasks. Logs saving to: ${log_dir}"
+
+echo "  ↳ [1/5] Grabbing PR diff..."
+rm -f "${log_dir}/pr-diff.exit"
+{ gh pr diff "${pr_number}" > "${log_dir}/pr-diff.diff" 2>&1; echo $? > "${log_dir}/pr-diff.exit"; } &
+
+echo "  ↳ [2/5] Starting build and lint..."
+rm -f "${log_dir}/build-and-lint.exit"
+{ { npm run clean && npm ci && npm run format && npm run build && npm run lint:ci && npm run typecheck; } > "${log_dir}/build-and-lint.log" 2>&1; echo $? > "${log_dir}/build-and-lint.exit"; } &
+
+# Dynamically resolve gemini binary (fallback to your nightly path)
+GEMINI_CMD="$(command -v gemini || echo "${HOME}/.gcli/nightly/node_modules/.bin/gemini")"
+# shellcheck disable=SC2312
+POLICY_PATH="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/policy.toml"
+
+echo "  ↳ [3/5] Starting Gemini code review..."
+rm -f "${log_dir}/review.exit"
+{ "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "/review-frontend ${pr_number}" > "${log_dir}/review.md" 2>&1; echo $? > "${log_dir}/review.exit"; } &
+
+echo "  ↳ [4/5] Starting automated tests (waiting for build and lint)..."
+rm -f "${log_dir}/npm-test.exit"
+{ 
+  while [[ ! -f "${log_dir}/build-and-lint.exit" ]]; do sleep 1; done
+  read -r build_exit < "${log_dir}/build-and-lint.exit" || build_exit=""
+  if [[ "${build_exit}" == "0" ]]; then
+    gh pr checks "${pr_number}" > "${log_dir}/ci-checks.log" 2>&1
+    ci_status=$?
+    
+    if [[ "${ci_status}" -eq 0 ]]; then
+      echo "CI checks passed. Skipping local npm tests." > "${log_dir}/npm-test.log"
+      echo 0 > "${log_dir}/npm-test.exit"
+    elif [[ "${ci_status}" -eq 8 ]]; then
+      echo "CI checks are still pending. Skipping local npm tests to avoid duplicate work. Please check GitHub for final results." > "${log_dir}/npm-test.log"
+      echo 0 > "${log_dir}/npm-test.exit"
+    else
+      echo "CI checks failed. Failing checks:" > "${log_dir}/npm-test.log"
+      gh pr checks "${pr_number}" --json name,bucket -q '.[] | select(.bucket=="fail") | .name' >> "${log_dir}/npm-test.log" 2>&1
+      
+      echo "Attempting to extract failing test files from CI logs..." >> "${log_dir}/npm-test.log"
+      pr_branch="$(gh pr view "${pr_number}" --json headRefName -q '.headRefName' 2>/dev/null || true)"
+      run_id="$(gh run list --branch "${pr_branch}" --workflow ci.yml --json databaseId -q '.[0].databaseId' 2>/dev/null || true)"
+      
+      failed_files=""
+      if [[ -n "${run_id}" ]]; then
+        failed_files="$(gh run view "${run_id}" --log-failed 2>/dev/null | grep -o -E '(packages/[a-zA-Z0-9_-]+|integration-tests|evals)/[a-zA-Z0-9_/-]+\.test\.ts(x)?' | sort | uniq || true)"
+      fi
+      
+      if [[ -n "${failed_files}" ]]; then
+        echo "Found failing test files from CI:" >> "${log_dir}/npm-test.log"
+        for f in ${failed_files}; do echo "  - ${f}" >> "${log_dir}/npm-test.log"; done
+        echo "Running ONLY failing tests locally..." >> "${log_dir}/npm-test.log"
+        
+        exit_code=0
+        for file in ${failed_files}; do
+           if [[ "${file}" == packages/* ]]; then
+             ws_dir="$(echo "${file}" | cut -d'/' -f1,2)"
+           else
+             ws_dir="$(echo "${file}" | cut -d'/' -f1)"
+           fi
+           rel_file="${file#"${ws_dir}"/}"
+           
+           echo "--- Running ${rel_file} in workspace ${ws_dir} ---" >> "${log_dir}/npm-test.log"
+           if ! npm run test:ci -w "${ws_dir}" -- "${rel_file}" >> "${log_dir}/npm-test.log" 2>&1; then
+             exit_code=1
+           fi
+        done
+        echo "${exit_code}" > "${log_dir}/npm-test.exit"
+      else
+        echo "Could not extract specific failing files. Skipping full local test suite as it takes too long. Please check CI logs manually." >> "${log_dir}/npm-test.log"
+        echo 1 > "${log_dir}/npm-test.exit"
+      fi
+    fi
+  else
+    echo "Skipped due to build-and-lint failure" > "${log_dir}/npm-test.log"
+    echo 1 > "${log_dir}/npm-test.exit"
+  fi
+} &
+
+echo "  ↳ [5/5] Starting Gemini test execution (waiting for build and lint)..."
+rm -f "${log_dir}/test-execution.exit"
+{ 
+  while [[ ! -f "${log_dir}/build-and-lint.exit" ]]; do sleep 1; done
+  read -r build_exit < "${log_dir}/build-and-lint.exit" || build_exit=""
+  if [[ "${build_exit}" == "0" ]]; then
+    "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "Analyze the diff for PR ${pr_number} using 'gh pr diff ${pr_number}'. Instead of running the project's automated test suite (like 'npm test'), physically exercise the newly changed code in the terminal (e.g., by writing a temporary script to call the new functions, or testing the CLI command directly). Verify the feature's behavior works as expected. IMPORTANT: Do NOT modify any source code to fix errors. Just exercise the code and log the results, reporting any failures clearly. Do not ask for user confirmation." > "${log_dir}/test-execution.log" 2>&1; echo $? > "${log_dir}/test-execution.exit"
+  else
+    echo "Skipped due to build-and-lint failure" > "${log_dir}/test-execution.log"
+    echo 1 > "${log_dir}/test-execution.exit"
+  fi
+} &
+
+echo "✅ All tasks dispatched!"
+echo "You can monitor progress with: tail -f ${log_dir}/*.log"
+echo "Read your review later at: ${log_dir}/review.md"
+
+# Polling loop to wait for all background tasks to finish
+tasks=("pr-diff" "build-and-lint" "review" "npm-test" "test-execution")
+log_files=("pr-diff.diff" "build-and-lint.log" "review.md" "npm-test.log" "test-execution.log")
+
+declare -A task_done
+for t in "${tasks[@]}"; do task_done[${t}]=0; done
+
+all_done=0
+while [[ "${all_done}" -eq 0 ]]; do
+  clear
+  echo "=================================================="
+  echo "🚀 Async PR Review Status for PR #${pr_number}"
+  echo "=================================================="
+  echo ""
+  
+  all_done=1
+  for i in "${!tasks[@]}"; do
+    t="${tasks[${i}]}"
+    
+    if [[ -f "${log_dir}/${t}.exit" ]]; then
+      read -r task_exit < "${log_dir}/${t}.exit" || task_exit=""
+      if [[ "${task_exit}" == "0" ]]; then
+        echo "  ✅ ${t}: SUCCESS"
+      else
+        echo "  ❌ ${t}: FAILED (exit code ${task_exit})"
+      fi
+      task_done[${t}]=1
+    else
+      echo "  ⏳ ${t}: RUNNING"
+      all_done=0
+    fi
+  done
+  
+  echo ""
+  echo "=================================================="
+  echo "📝 Live Logs (Last 5 lines of running tasks)"
+  echo "=================================================="
+  
+  for i in "${!tasks[@]}"; do
+    t="${tasks[${i}]}"
+    log_file="${log_files[${i}]}"
+    
+    if [[ "${task_done[${t}]}" -eq 0 ]]; then
+      if [[ -f "${log_dir}/${log_file}" ]]; then
+        echo ""
+        echo "--- ${t} ---"
+        tail -n 5 "${log_dir}/${log_file}"
+      fi
+    fi
+  done
+  
+  if [[ "${all_done}" -eq 0 ]]; then
+    sleep 3
+  fi
+done
+
+clear
+echo "=================================================="
+echo "🚀 Async PR Review Status for PR #${pr_number}"
+echo "=================================================="
+echo ""
+for t in "${tasks[@]}"; do
+  read -r task_exit < "${log_dir}/${t}.exit" || task_exit=""
+  if [[ "${task_exit}" == "0" ]]; then
+    echo "  ✅ ${t}: SUCCESS"
+  else
+    echo "  ❌ ${t}: FAILED (exit code ${task_exit})"
+  fi
+done
+echo ""
+
+echo "⏳ Tasks complete! Synthesizing final assessment..."
+if ! "${GEMINI_CMD}" --policy "${POLICY_PATH}" -p "Read the review at ${log_dir}/review.md, the automated test logs at ${log_dir}/npm-test.log, and the manual test execution logs at ${log_dir}/test-execution.log. Summarize the results, state whether the build and tests passed based on ${log_dir}/build-and-lint.exit and ${log_dir}/npm-test.exit, and give a final recommendation for PR ${pr_number}." > "${log_dir}/final-assessment.md" 2>&1; then
+  echo $? > "${log_dir}/final-assessment.exit"
+  echo "❌ Final assessment synthesis failed!"
+  echo "Check ${log_dir}/final-assessment.md for details."
+  notify "Async Review Failed" "Final assessment synthesis failed." "${pr_number}"
+  exit 1
+fi
+
+echo 0 > "${log_dir}/final-assessment.exit"
+echo "✅ Final assessment complete! Check ${log_dir}/final-assessment.md"
+notify "Async Review Complete" "Review and test execution finished successfully." "${pr_number}"

.gemini/skills/async-pr-review/scripts/check-async-review.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+pr_number="${1}"
+
+if [[ -z "${pr_number}" ]]; then
+  echo "Usage: check-async-review <pr_number>"
+  exit 1
+fi
+
+base_dir="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+if [[ -z "${base_dir}" ]]; then
+  echo "❌ Must be run from within a git repository."
+  exit 1
+fi
+
+log_dir="${base_dir}/.gemini/tmp/async-reviews/pr-${pr_number}/logs"
+
+if [[ ! -d "${log_dir}" ]]; then
+  echo "STATUS: NOT_FOUND"
+  echo "❌ No logs found for PR #${pr_number} in ${log_dir}"
+  exit 0
+fi
+
+tasks=(
+  "setup|setup.log"
+  "pr-diff|pr-diff.diff"
+  "build-and-lint|build-and-lint.log"
+  "review|review.md"
+  "npm-test|npm-test.log"
+  "test-execution|test-execution.log"
+  "final-assessment|final-assessment.md"
+)
+
+all_done=true
+echo "STATUS: CHECKING"
+
+for task_info in "${tasks[@]}"; do
+  IFS="|" read -r task_name log_file <<< "${task_info}"
+  
+  file_path="${log_dir}/${log_file}"
+  exit_file="${log_dir}/${task_name}.exit"
+
+  if [[ -f "${exit_file}" ]]; then
+    read -r exit_code < "${exit_file}" || exit_code=""
+    if [[ "${exit_code}" == "0" ]]; then
+      echo "✅ ${task_name}: SUCCESS"
+    else
+      echo "❌ ${task_name}: FAILED (exit code ${exit_code})"
+      echo "   Last lines of ${file_path}:"
+      tail -n 3 "${file_path}" | sed 's/^/      /' || true
+    fi
+  elif [[ -f "${file_path}" ]]; then
+    echo "⏳ ${task_name}: RUNNING"
+    all_done=false
+  else
+    echo "➖ ${task_name}: NOT STARTED"
+    all_done=false
+  fi
+done
+
+if [[ "${all_done}" == "true" ]]; then
+  echo "STATUS: COMPLETE"
+  echo "LOG_DIR: ${log_dir}"
+else
+  echo "STATUS: IN_PROGRESS"
+fi

.gemini/skills/behavioral-evals/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: behavioral-evals
+description: Guidance for creating, running, fixing, and promoting behavioral evaluations. Use when verifying agent decision logic, debugging failures, debugging prompt steering, or adding workspace regression tests.
+---
+
+# Behavioral Evals
+
+## Overview
+
+Behavioral evaluations (evals) are tests that validate the **agent's decision-making** (e.g., tool choice) rather than pure functionality. They are critical for verifying prompt changes, debugging steerability, and preventing regressions.
+
+> [!NOTE]
+> **Single Source of Truth**: For core concepts, policies, running tests, and general best practices, always refer to **[evals/README.md](file:///Users/abhipatel/code/gemini-cli/docs/evals/README.md)**.
+
+---
+
+## 🔄 Workflow Decision Tree
+
+1.  **Does a prompt/tool change need validation?**
+    *   *No* -> Normal integration tests.
+    *   *Yes* -> Continue below.
+2.  **Is it UI/Interaction heavy?**
+    *   *Yes* -> Use `appEvalTest` (`AppRig`). See **[creating.md](references/creating.md)**.
+    *   *No* -> Use `evalTest` (`TestRig`). See **[creating.md](references/creating.md)**.
+3.  **Is it a new test?**
+    *   *Yes* -> Set policy to `USUALLY_PASSES`.
+    *   *No* -> `ALWAYS_PASSES` (locks in regression).
+4.  **Are you fixing a failure or promoting a test?**
+    *   *Fixing* -> See **[fixing.md](references/fixing.md)**.
+    *   *Promoting* -> See **[promoting.md](references/promoting.md)**.
+
+---
+
+## 📋 Quick Checklist
+
+### 1. Setup Workspace
+Seed the workspace with necessary files using the `files` object to simulate a realistic scenario (e.g., NodeJS project with `package.json`).
+*   *Details in **[creating.md](references/creating.md)***
+
+### 2. Write Assertions
+Audit agent decisions using `rig.setBreakpoint()` (AppRig only) or index verification on `rig.readToolLogs()`.
+*   *Details in **[creating.md](references/creating.md)***
+
+### 3. Verify
+Run single tests locally with Vitest. Confirm stability locally before relying on CI workflows.
+*   *See **[evals/README.md](file:///Users/abhipatel/code/gemini-cli/docs/evals/README.md)** for running commands.*
+
+---
+
+## 📦 Bundled Resources
+
+Detailed procedural guides:
+*   **[creating.md](references/creating.md)**: Assertion strategies, Rig selection, Mock MCPs.
+*   **[fixing.md](references/fixing.md)**: Step-by-step automated investigation, architecture diagnosis guidelines.
+*   **[promoting.md](references/promoting.md)**: Candidate identification criteria and threshold guidelines.
+

.gemini/skills/behavioral-evals/assets/interactive_eval.ts.txt

@@ -0,0 +1,27 @@
+import { describe, expect } from 'vitest';
+import { appEvalTest } from './app-test-helper.js';
+
+describe('interactive_feature', () => {
+  // New tests MUST start as USUALLY_PASSES
+  appEvalTest('USUALLY_PASSES', {
+    name: 'should pause for user confirmation',
+    files: {
+      'package.json': JSON.stringify({ name: 'app' })
+    },
+    prompt: 'Task description here requiring approval',
+    timeout: 60000, 
+    setup: async (rig) => {
+      // ⚠️ Breakpoints are ONLY safe in appEvalTest
+      rig.setBreakpoint(['ask_user']);
+    },
+    assert: async (rig) => {
+      // 1. Wait for the breakpoint to trigger
+      const confirmation = await rig.waitForPendingConfirmation('ask_user');
+      expect(confirmation).toBeDefined();
+
+      // 2. Resolve it so the test can finish
+      await rig.resolveTool(confirmation);
+      await rig.waitForIdle();
+    },
+  });
+});

.gemini/skills/behavioral-evals/assets/standard_eval.ts.txt

@@ -0,0 +1,30 @@
+import { describe, expect } from 'vitest';
+import { evalTest } from './test-helper.js';
+
+describe('core_feature', () => {
+  // New tests MUST start as USUALLY_PASSES
+  evalTest('USUALLY_PASSES', {
+    name: 'should perform expected agent action',
+    setup: async (rig) => {
+      // For mocking offline MCP:
+      // rig.addMockMcpServer('workspace-server', 'google-workspace');
+    },
+    files: {
+      'src/app.ts': '// some code',
+    },
+    prompt: 'Task description here',
+    timeout: 60000, // 1 minute safety limit
+    assert: async (rig, result) => {
+      // 1. Audit the trajectory (Safe for standard evalTest)
+      const logs = rig.readToolLogs();
+      const hasTool = logs.some((l) => l.toolRequest.name === 'read_file');
+      expect(hasTool, 'Agent should have read the file').toBe(true);
+
+      // 2. Assert efficiency (Cost/Turn)
+      expect(logs.length).toBeLessThan(5);
+
+      // 3. Assert final output
+      expect(result).toContain('Expected Keyword');
+    },
+  });
+});

.gemini/skills/behavioral-evals/references/creating.md

@@ -0,0 +1,151 @@
+# Creating Behavioral Evals
+
+## 🔬 Rig Selection
+
+| Rig Type          | Import From            | Architecture                                                         | Use When                                                                                              |
+| :---------------- | :--------------------- | :------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------- |
+| **`evalTest`**    | `./test-helper.js`     | **Subprocess**. Runs the CLI in a separate process + waits for exit. | Standard workspace tests. **Do not use `setBreakpoint`**; auditing history (`readToolLogs`) is safer. |
+| **`appEvalTest`** | `./app-test-helper.js` | **In-Process**. Runs directly inside the runner loop.                | UI/Ink rendering. Safe for `setBreakpoint` triggers.                                                  |
+
+---
+
+## 🏗️ Scenario Design
+
+Evals must simulate realistic agent environments to effectively test
+decision-making.
+
+- **Workspace State**: Seed with standard project anchors if testing general
+  capabilities:
+  - `package.json` for NodeJS environments.
+  - Minimal configuration files (`tsconfig.json`, `GEMINI.md`).
+- **Structural Complexity**: Provide enough files to force the agent to _search_
+  or _navigate_, rather than giving the answer directly. Avoid trivial one-file
+  tests unless testing exact prompt steering.
+
+---
+
+## ❌ Fail First Principle
+
+Before asserting a new capability or locking in a fix, **verify that the test
+fails first**.
+
+- It is easy to accidentally write an eval that asserts behaviors that are
+  already met or pass by default.
+- **Process**: reproduce failure with test -> apply fix (prompt/tool) -> verify
+  test passes.
+
+---
+
+## ✋ Testing Patterns
+
+### 1. Breakpoints
+
+Verifies the agent _intends_ to use a tool BEFORE executing it. Useful for
+interactive prompts or safety checks.
+
+```typescript
+// ⚠️ Only works with appEvalTest (AppRig)
+setup: async (rig) => {
+  rig.setBreakpoint(['ask_user']);
+},
+assert: async (rig) => {
+  const confirmation = await rig.waitForPendingConfirmation('ask_user');
+  expect(confirmation).toBeDefined();
+}
+```
+
+### 2. Tool Confirmation Race
+
+When asserting multiple triggers (e.g., "enters plan mode then asks question"):
+
+```typescript
+assert: async (rig) => {
+  let confirmation = await rig.waitForPendingConfirmation([
+    'enter_plan_mode',
+    'ask_user',
+  ]);
+
+  if (confirmation?.name === 'enter_plan_mode') {
+    rig.acceptConfirmation('enter_plan_mode');
+    confirmation = await rig.waitForPendingConfirmation('ask_user');
+  }
+  expect(confirmation?.toolName).toBe('ask_user');
+};
+```
+
+### 3. Audit Tool Logs
+
+Audit exact operations to ensure efficiency (e.g., no redundant reads).
+
+```typescript
+assert: async (rig, result) => {
+  await rig.waitForTelemetryReady();
+  const toolLogs = rig.readToolLogs();
+
+  const writeCall = toolLogs.find(
+    (log) => log.toolRequest.name === 'write_file',
+  );
+  expect(writeCall).toBeDefined();
+};
+```
+
+### 4. Mock MCP Facades
+
+To evaluate tools connected via MCP without hitting live endpoints, load a mock
+server configuration in the `setup` hook.
+
+```typescript
+setup: async (rig) => {
+  rig.addMockMcpServer('workspace-server', 'google-workspace');
+},
+assert: async (rig) => {
+  await rig.waitForTelemetryReady();
+  const toolLogs = rig.readToolLogs();
+  const workspaceCall = toolLogs.find(
+    (log) => log.toolRequest.name === 'mcp_workspace-server_docs.getText'
+  );
+  expect(workspaceCall).toBeDefined();
+};
+```
+
+---
+
+## ⚠️ Safety & Efficiency Guardrails
+
+### 1. Breakpoint Deadlocks
+
+Breakpoints (`setBreakpoint`) pause execution. In standard `evalTest`,
+`rig.run()` waits for the process to exit _before_ assertions run. **This will
+hang indefinitely.**
+
+- **Use Breakpoints** for `appEvalTest` or interactive simulations.
+- **Use Audit Tool Logs** (above) for standard trajectory tests.
+
+### 2. Runaway Timeout
+
+Always set a budget boundary in the `EvalCase` to prevent runaway loops on
+quota:
+
+```typescript
+evalTest('USUALLY_PASSES', {
+  name: '...',
+  timeout: 60000, // 1 minute safety limit
+  // ...
+});
+```
+
+### 3. Efficiency Assertion (Turn limits)
+
+Check if a tool is called _early_ using index checks:
+
+```typescript
+assert: async (rig) => {
+  const toolLogs = rig.readToolLogs();
+  const toolCallIndex = toolLogs.findIndex(
+    (log) => log.toolRequest.name === 'cli_help',
+  );
+
+  expect(toolCallIndex).toBeGreaterThan(-1);
+  expect(toolCallIndex).toBeLessThan(5); // Called within first 5 turns
+};
+```

.gemini/skills/behavioral-evals/references/fixing.md

@@ -0,0 +1,100 @@
+# Fixing Behavioral Evals
+
+Use this guide when asked to debug, troubleshoot, or fix a failing behavioral
+evaluation.
+
+---
+
+## 1. 🔍 Investigate
+
+1.  **Fetch Nightly Results**: Use the `gh` CLI to inspect the latest run from
+    `evals-nightly.yml` if applicable.
+    - _Example view URL_:
+      `https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml`
+2.  **Isolate**: DO NOT push changes or start remote runs. Confine investigation
+    to the local workspace.
+3.  **Read Logs**:
+    - Eval logs live in `evals/logs/<test_name>.log`.
+    - Enable verbose debugging via `export GEMINI_DEBUG_LOG_FILE="debug.log"`.
+4.  **Diagnose**: Audit tool logs and telemetry. Note if due to setup/assert.
+    - **Tip**: Proactively add custom logging/diagnostics to check hypotheses.
+
+---
+
+## 2. 🛠️ Fix Strategy
+
+1.  **Targeted Location**: Locate the test case and the corresponding
+    prompt/code.
+2.  **Iterative Scope**: Make extreme change first to verify scope, then refine
+    to a minimal, targeted change.
+3.  **Assertion Fidelity**:
+    - Changing the test prompt is a **last resort** (prompts are often vague by
+      design).
+    - **Warning**: Do not lose test fidelity by making prompts too direct/easy.
+    - **Primary Fix Trigger**: Adjust tool descriptions, system prompts
+      (`snippets.ts`), or **modules that contribute to the prompt template**.
+    - Fixes should generally try to improve the prompt
+      `@packages/core/src/prompts/snippets.ts` first.
+    - **Instructional Generality**: Changes to the system prompt should aim to
+      be as general as possible while still accomplishing the goal. Specificity
+      should be added only as needed.
+      - **Principle**: Instead of creating "forbidden lists" for specific syntax
+        (e.g., "Don't use `Object.create()`"), formulate a broader engineering
+        principle that covers the underlying issue (e.g., "Prioritize explicit
+        composition over hidden prototype manipulation"). This improves
+        steerability across a wider range of similar scenarios.
+      - _Low Specificity_: "Follow ecosystem best practices"
+      - _Medium Specificity_: "Utilize OOP and functional best practices, as
+        applicable"
+      - _High Specificity_: Provide ecosystem-specific hints as examples of a
+        broader principle rather than direct instructions. e.g., "NEVER use
+        hacks like bypassing the type system or employing 'hidden' logic (e.g.:
+        reflection, prototype manipulation). Instead, use explicit and idiomatic
+        language features (e.g.: type guards, explicit class instantiation, or
+        object spread) that maintain structural integrity."
+    - **Prompt Simplification**: Once the test is passing, use `ask_user` to
+      determine if prompt simplification is desired.
+      - **Criteria**: Simplification should be attempted only if there are
+        related clauses that can be de-duplicated or reparented under a single
+        heading.
+      - **Verification**: As part of simplification, you MUST identify and run
+        any behavioral eval tests that might be affected by the changes to
+        ensure no regressions are introduced.
+    - Test fixes should not "cheat" by changing a test's `GEMINI.md` file or by
+      updating the test's prompt to instruct it to not repro the bug.
+    - **Warning**: Prompts have multiple configurations; ensure your fix targets
+      the correct config for the model in question.
+4.  **Architecture Options**: If prompt or instruction tuning triggers no
+    improvement, analyze loop composition.
+    - **AgentLoop**: Defined by `context + toolset + prompt`.
+    - **Enhancements**: Loops perform best with direct prompts, fewer irrelevant
+      tools, low goal density, and minimal low-value/irrelevant context.
+    - **Modifications**: Compose subagents or isolate tools. Ground in observed
+      traces.
+    - **Warning**: Think deeply before offering recommendations; avoid parroting
+      abstract design guidelines.
+
+---
+
+## 3. ✅ Verify
+
+1.  **Run Local**: Run Vitest in non-interactive mode on just the file.
+2.  **Log Audit**: Prioritize diagnosing failures via log comparison before
+    triggering heavy test runs.
+3.  **Stability Limit**: Run the test **3 times** locally on key models (can use
+    scripts to run in parallel for speed):
+    - **Gemini 3.0**
+    - **Gemini 3 Flash**
+    - **Gemini 2.5 Pro**
+4.  **Flakiness Rule**: If it passes 2/3 times, it may be inherent noise
+    difficult to improve without a structural split.
+
+---
+
+## 4. 📊 Report
+
+Provide a summary of:
+
+- Test success rate for each tested model (e.g., 3/3 = 100%).
+- Root cause identification and fix explanation.
+- If unfixed, provide high-confidence architecture recommendations.

.gemini/skills/behavioral-evals/references/promoting.md

@@ -0,0 +1,55 @@
+# Promoting Behavioral Evals
+
+Use this guide when asked to analyze nightly results and promote incubated tests
+to stable suites.
+
+---
+
+## 1. 🔍 Investigate candidates
+
+1.  **Audit Nightly Logs**: Use the `gh` CLI to fetch results from
+    `evals-nightly.yml` (Direct URL:
+    `https://github.com/google-gemini/gemini-cli/actions/workflows/evals-nightly.yml`).
+    - **Tip**: The aggregate summary from the most recent run integrates the
+      last 7 runs of history automatically.
+    - **Safety**: DO NOT push changes or start remote runs. All verification is
+      local.
+2.  **Assess Stability**: Identify tests that pass **100% of the time** across
+    ALL enabled models over the **last 7 nightly runs** in a row.
+    - _100% means the test passed 3/3 times for every model and run._
+3.  **Promotion Targets**: Tests meeting this criteria are candidates for
+    promotion from `USUALLY_PASSES` to `ALWAYS_PASSES`.
+
+---
+
+## 2. 🚥 Promotion Steps
+
+1.  **Locate File**: Locate the eval file in the `evals/` directory.
+2.  **Update Policy**: Modify the policy argument to `ALWAYS_PASSES`.
+    ```typescript
+    evalTest('ALWAYS_PASSES', { ... })
+    ```
+3.  **Targeting**: Follow guidelines in `evals/README.md` regarding stable suite
+    organization.
+4.  **Constraint**: Your final change must be **minimal and targeted** strictly
+    to promoting the test status. Do not refactor the test or setup fixtures.
+
+---
+
+## 3. ✅ Verify
+
+1.  **Run Prompted Tests**: Run the promoted test locally using non-interactive
+    Vitest to confirm structure validity.
+2.  **Verify Suite Inclusion**: Check that the test is successfully picked up by
+    standard runnable ranges.
+
+---
+
+## 4. 📊 Report
+
+Provide a summary of:
+
+- Which tests were promoted.
+- Provide the success rate evidence (e.g., 7/7 runs passed for all models).
+- If no candidates qualified, list the next closest candidates and their current
+  pass rate.

.gemini/skills/behavioral-evals/references/running.md

@@ -0,0 +1,95 @@
+# Running & Promoting Evals
+
+## 🛠️ Prerequisites
+
+Behavioral evals run against the compiled binary. You **must** build and bundle
+the project first after making changes:
+
+```bash
+npm run build && npm run bundle
+```
+
+---
+
+## 🏃‍♂️ Running Tests
+
+### 1. Configure Environment Variables
+
+Evals require a standard API key. If your `.env` file has multiple keys or
+comments, use this precise extraction setup:
+
+```bash
+export GEMINI_API_KEY=$(grep '^GEMINI_API_KEY=' .env | cut -d '=' -f2) && RUN_EVALS=1 npx vitest run --config evals/vitest.config.ts <file_name>
+```
+
+### 2. Commands
+
+| Command                             | Scope           | Description                                        |
+| :---------------------------------- | :-------------- | :------------------------------------------------- |
+| `npm run test:always_passing_evals` | `ALWAYS_PASSES` | Fast feedback, runs in CI.                         |
+| `npm run test:all_evals`            | All             | Runs nightly incubation tests. Sets `RUN_EVALS=1`. |
+
+### Target Specific File
+
+_Note: `RUN_EVALS=1` is required for incubated (`USUALLY_PASSES`) tests._
+
+```bash
+RUN_EVALS=1 npx vitest run --config evals/vitest.config.ts my_feature.eval.ts
+```
+
+---
+
+## 🐞 Debugging and Logs
+
+If a test fails, verify:
+
+- **Tool Trajectory Logs**:序列 of calls in `evals/logs/<test_name>.log`.
+- **Verbose Reasoning**: Capture raw buffer traces by setting
+  `GEMINI_DEBUG_LOG_FILE`:
+  ```bash
+  export GEMINI_DEBUG_LOG_FILE="debug.log"
+  ```
+
+---
+
+### 🎯 Verify Model Targeting
+
+- **Tip:** Standard evals benchmark against model variations. If a test passes
+  on Flash but fails on Pro (or vice versa), the issue is usually in the **tool
+  description**, not the prompt definition. Flash is sensitive to "instruction
+  bloat," while Pro is sensitive to "ambiguous intent."
+
+---
+
+## 🚥 deflaking & Promotion
+
+To maintain CI stability, all new evals follow a strict incubation period.
+
+### 1. Incubation (`USUALLY_PASSES`)
+
+New tests must be created with the `USUALLY_PASSES` policy.
+
+```typescript
+evalTest('USUALLY_PASSES', { ... })
+```
+
+They run in **Evals: Nightly** workflows and do not block PR merges.
+
+### 2. Investigate Failures
+
+If a nightly eval regresses, investigate via agent:
+
+```bash
+gemini /fix-behavioral-eval [optional-run-uri]
+```
+
+### 3. Promotion (`ALWAYS_PASSES`)
+
+Once a test scores 100% consistency over multiple nightly cycles:
+
+```bash
+gemini /promote-behavioral-eval
+```
+
+_Do not promote manually._ The command verifies trajectory logs before updating
+the file policy.

.gemini/skills/ci/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: ci
+description:
+  A specialized skill for Gemini CLI that provides high-performance, fail-fast
+  monitoring of GitHub Actions workflows and automated local verification of CI
+  failures. It handles run discovery automatically—simply provide the branch name.
+---
+
+# CI Replicate & Status
+
+This skill enables the agent to efficiently monitor GitHub Actions, triage
+failures, and bridge remote CI errors to local development. It defaults to
+**automatic replication** of failures to streamline the fix cycle.
+
+## Core Capabilities
+
+- **Automatic Replication**: Automatically monitors CI and immediately executes 
+  suggested test or lint commands locally upon failure.
+- **Real-time Monitoring**: Aggregated status line for all concurrent workflows
+  on the current branch.
+- **Fail-Fast Triage**: Immediately stops on the first job failure to provide a
+  structured report.
+
+## Workflow
+
+### 1. CI Replicate (`replicate`) - DEFAULT
+Use this as the primary path to monitor CI and **automatically** replicate 
+failures locally for immediate triage and fixing.
+- **Behavior**: When this workflow is triggered, the agent will monitor the CI
+  and **immediately and automatically execute** all suggested test or lint
+  commands (marked with 🚀) as soon as a failure is detected. 
+- **Tool**: `node .gemini/skills/ci/scripts/ci.mjs [branch]`
+- **Discovery**: The script **automatically** finds the latest active or recent
+  run for the branch. Do NOT manually search for run IDs.
+- **Goal**: Reproduce the failure locally without manual intervention, then
+  proceed to analyze and fix the code.
+
+### 1. CI Status (`status`)
+Use this when you have pushed changes and need to monitor the CI and reproduce
+any failures locally.
+- **Tool**: `node .gemini/skills/ci/scripts/ci.mjs [branch] [run_id]`
+- **Discovery**: The script **automatically** finds the latest active or recent
+  run for the branch. You should NOT manually search for \`run_id\` using \`gh run list\`
+  unless a specific historical run is requested. Simply provide the branch name.
+- **Step 1 (Monitor)**: Execute the tool with the branch name.
+- **Step 2 (Extract)**: Extract suggested \`npm test\` or \`npm run lint\` commands
+  from the output (marked with 🚀).
+- **Step 3 (Reproduce)**: Execute those commands locally to confirm the failure.
+- **Behavior**: It will poll every 15 seconds. If it detects a failure, it will
+  exit with a structured report and provide the exact commands to run locally.
+
+## Failure Categories & Actions
+
+- **Test Failures**: Agent should run the specific `npm test -w <pkg> -- <path>`
+  command suggested.
+- **Lint Errors**: Agent should run `npm run lint:all` or the specific package
+  lint command.
+- **Build Errors**: Agent should check `tsc` output or build logs to resolve
+  compilation issues.
+- **Job Errors**: Investigate `gh run view --job <job_id> --log` for
+  infrastructure or setup failures.
+
+## Noise Filtering
+The underlying scripts automatically filter noise (Git logs, NPM warnings, stack
+trace overhead). The agent should focus on the "Structured Failure Report"
+provided by the tool.

.gemini/skills/ci/scripts/ci.mjs

@@ -0,0 +1,281 @@
+#!/usr/bin/env node
+
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { execSync } from 'node:child_process';
+
+const BRANCH =
+  process.argv[2] || execSync('git branch --show-current').toString().trim();
+const RUN_ID_OVERRIDE = process.argv[3];
+
+let REPO;
+try {
+  const remoteUrl = execSync('git remote get-url origin').toString().trim();
+  REPO = remoteUrl
+    .replace(/.*github\.com[\/:]/, '')
+    .replace(/\.git$/, '')
+    .trim();
+} catch (e) {
+  REPO = 'google-gemini/gemini-cli';
+}
+
+const FAILED_FILES = new Set();
+
+function runGh(args) {
+  try {
+    return execSync(`gh ${args}`, {
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).toString();
+  } catch (e) {
+    return null;
+  }
+}
+
+function fetchFailuresViaApi(jobId) {
+  try {
+    const cmd = `gh api repos/${REPO}/actions/jobs/${jobId}/logs | grep -iE " FAIL |❌|ERROR|Lint failed|Build failed|Exception|failed with exit code"`;
+    return execSync(cmd, {
+      stdio: ['ignore', 'pipe', 'ignore'],
+      maxBuffer: 10 * 1024 * 1024,
+    }).toString();
+  } catch (e) {
+    return '';
+  }
+}
+
+function isNoise(line) {
+  const lower = line.toLowerCase();
+  return (
+    lower.includes('* [new branch]') ||
+    lower.includes('npm warn') ||
+    lower.includes('fetching updates') ||
+    lower.includes('node:internal/errors') ||
+    lower.includes('at ') || // Stack traces
+    lower.includes('checkexecsyncerror') ||
+    lower.includes('node_modules')
+  );
+}
+
+function extractTestFile(failureText) {
+  const cleanLine = failureText
+    .replace(/[|#\[\]()]/g, ' ')
+    .replace(/<[^>]*>/g, ' ')
+    .trim();
+  const fileMatch = cleanLine.match(/([\w\/._-]+\.test\.[jt]sx?)/);
+  if (fileMatch) return fileMatch[1];
+  return null;
+}
+
+function generateTestCommand(failedFilesMap) {
+  const workspaceToFiles = new Map();
+  for (const [file, info] of failedFilesMap.entries()) {
+    if (
+      ['Job Error', 'Unknown File', 'Build Error', 'Lint Error'].includes(file)
+    )
+      continue;
+    let workspace = '@google/gemini-cli';
+    let relPath = file;
+    if (file.startsWith('packages/core/')) {
+      workspace = '@google/gemini-cli-core';
+      relPath = file.replace('packages/core/', '');
+    } else if (file.startsWith('packages/cli/')) {
+      workspace = '@google/gemini-cli';
+      relPath = file.replace('packages/cli/', '');
+    }
+    relPath = relPath.replace(/^.*packages\/[^\/]+\//, '');
+    if (!workspaceToFiles.has(workspace))
+      workspaceToFiles.set(workspace, new Set());
+    workspaceToFiles.get(workspace).add(relPath);
+  }
+  const commands = [];
+  for (const [workspace, files] of workspaceToFiles.entries()) {
+    commands.push(`npm test -w ${workspace} -- ${Array.from(files).join(' ')}`);
+  }
+  return commands.join(' && ');
+}
+
+async function monitor() {
+  let targetRunIds = [];
+  if (RUN_ID_OVERRIDE) {
+    targetRunIds = [RUN_ID_OVERRIDE];
+  } else {
+    // 1. Get runs directly associated with the branch
+    const runListOutput = runGh(
+      `run list --branch "${BRANCH}" --limit 10 --json databaseId,status,workflowName,createdAt`,
+    );
+    if (runListOutput) {
+      const runs = JSON.parse(runListOutput);
+      const activeRuns = runs.filter((r) => r.status !== 'completed');
+      if (activeRuns.length > 0) {
+        targetRunIds = activeRuns.map((r) => r.databaseId);
+      } else if (runs.length > 0) {
+        const latestTime = new Date(runs[0].createdAt).getTime();
+        targetRunIds = runs
+          .filter((r) => latestTime - new Date(r.createdAt).getTime() < 60000)
+          .map((r) => r.databaseId);
+      }
+    }
+
+    // 2. Get runs associated with commit statuses (handles chained/indirect runs)
+    try {
+      const headSha = execSync(`git rev-parse "${BRANCH}"`).toString().trim();
+      const statusOutput = runGh(
+        `api repos/${REPO}/commits/${headSha}/status -q '.statuses[] | select(.target_url | contains("actions/runs/")) | .target_url'`,
+      );
+      if (statusOutput) {
+        const statusRunIds = statusOutput
+          .split('\n')
+          .filter(Boolean)
+          .map((url) => {
+            const match = url.match(/actions\/runs\/(\d+)/);
+            return match ? parseInt(match[1], 10) : null;
+          })
+          .filter(Boolean);
+
+        for (const runId of statusRunIds) {
+          if (!targetRunIds.includes(runId)) {
+            targetRunIds.push(runId);
+          }
+        }
+      }
+    } catch (e) {
+      // Ignore if branch/SHA not found or API fails
+    }
+
+    if (targetRunIds.length > 0) {
+      const runNames = [];
+      for (const runId of targetRunIds) {
+        const runInfo = runGh(`run view "${runId}" --json workflowName`);
+        if (runInfo) {
+          runNames.push(JSON.parse(runInfo).workflowName);
+        }
+      }
+      console.log(`Monitoring workflows: ${[...new Set(runNames)].join(', ')}`);
+    }
+  }
+
+  if (targetRunIds.length === 0) {
+    console.log(`No runs found for branch ${BRANCH}.`);
+    process.exit(0);
+  }
+
+  while (true) {
+    let allPassed = 0,
+      allFailed = 0,
+      allRunning = 0,
+      allQueued = 0,
+      totalJobs = 0;
+    let anyRunInProgress = false;
+    const fileToTests = new Map();
+    let failuresFoundInLoop = false;
+
+    for (const runId of targetRunIds) {
+      const runOutput = runGh(
+        `run view "${runId}" --json databaseId,status,conclusion,workflowName`,
+      );
+      if (!runOutput) continue;
+      const run = JSON.parse(runOutput);
+      if (run.status !== 'completed') anyRunInProgress = true;
+
+      const jobsOutput = runGh(`run view "${runId}" --json jobs`);
+      if (jobsOutput) {
+        const { jobs } = JSON.parse(jobsOutput);
+        totalJobs += jobs.length;
+        const failedJobs = jobs.filter((j) => j.conclusion === 'failure');
+        if (failedJobs.length > 0) {
+          failuresFoundInLoop = true;
+          for (const job of failedJobs) {
+            const failures = fetchFailuresViaApi(job.databaseId);
+            if (failures.trim()) {
+              failures.split('\n').forEach((line) => {
+                if (!line.trim() || isNoise(line)) return;
+                const file = extractTestFile(line);
+                const filePath =
+                  file ||
+                  (line.toLowerCase().includes('lint')
+                    ? 'Lint Error'
+                    : line.toLowerCase().includes('build')
+                      ? 'Build Error'
+                      : 'Unknown File');
+                let testName = line;
+                if (line.includes(' > ')) {
+                  testName = line.split(' > ').slice(1).join(' > ').trim();
+                }
+                if (!fileToTests.has(filePath))
+                  fileToTests.set(filePath, new Set());
+                fileToTests.get(filePath).add(testName);
+              });
+            } else {
+              const step =
+                job.steps?.find((s) => s.conclusion === 'failure')?.name ||
+                'unknown';
+              const category = step.toLowerCase().includes('lint')
+                ? 'Lint Error'
+                : step.toLowerCase().includes('build')
+                  ? 'Build Error'
+                  : 'Job Error';
+              if (!fileToTests.has(category))
+                fileToTests.set(category, new Set());
+              fileToTests
+                .get(category)
+                .add(`${job.name}: Failed at step "${step}"`);
+            }
+          }
+        }
+        for (const job of jobs) {
+          if (job.status === 'in_progress') allRunning++;
+          else if (job.status === 'queued') allQueued++;
+          else if (job.conclusion === 'success') allPassed++;
+          else if (job.conclusion === 'failure') allFailed++;
+        }
+      }
+    }
+
+    if (failuresFoundInLoop) {
+      console.log(
+        `\n\n❌ Failures detected across ${allFailed} job(s). Stopping monitor...`,
+      );
+      console.log('\n--- Structured Failure Report (Noise Filtered) ---');
+      for (const [file, tests] of fileToTests.entries()) {
+        console.log(`\nCategory/File: ${file}`);
+        // Limit output per file if it's too large
+        const testsArr = Array.from(tests).map((t) =>
+          t.length > 500 ? t.substring(0, 500) + '... [TRUNCATED]' : t,
+        );
+        testsArr.slice(0, 10).forEach((t) => console.log(`  - ${t}`));
+        if (testsArr.length > 10)
+          console.log(`  ... and ${testsArr.length - 10} more`);
+      }
+      const testCmd = generateTestCommand(fileToTests);
+      if (testCmd) {
+        console.log('\n🚀 Run this to verify fixes:');
+        console.log(testCmd);
+      } else if (
+        Array.from(fileToTests.keys()).some((k) => k.includes('Lint'))
+      ) {
+        console.log('\n🚀 Run this to verify lint fixes:\nnpm run lint:all');
+      }
+      console.log('---------------------------------');
+      process.exit(1);
+    }
+
+    const completed = allPassed + allFailed;
+    process.stdout.write(
+      `\r⏳ Monitoring ${targetRunIds.length} runs... ${completed}/${totalJobs} jobs (${allPassed} passed, ${allFailed} failed, ${allRunning} running, ${allQueued} queued)          `,
+    );
+    if (!anyRunInProgress) {
+      console.log('\n✅ All workflows passed!');
+      process.exit(0);
+    }
+    await new Promise((r) => setTimeout(r, 15000));
+  }
+}
+
+monitor().catch((err) => {
+  console.error('\nMonitor error:', err.message);
+  process.exit(1);
+});

.gemini/skills/docs-changelog/SKILL.md

@@ -162,5 +162,7 @@ instructions for the other section.
 
 ## Finalize
 
-- After making changes, run `npm run format` ONLY to ensure consistency.
+- After making changes, if `npm run format` fails, it may be necessary to run
+  `npm install` first to ensure all formatting dependencies are available.
+  Then, run `npm run format` to ensure consistency.
 - Delete any temporary files created during the process.

.gemini/skills/docs-writer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docs-writer
 description:
-  Always use this skill when the task involves writing, reviewing, or editing 
+  Always use this skill when the task involves writing, reviewing, or editing
   files in the `/docs` directory or any `.md` files in the repository.
 ---
 
@@ -24,7 +24,7 @@ approach.
 
 - **Perspective and tense:** Address the reader as "you." Use active voice and
   present tense (e.g., "The API returns...").
-- **Tone:** Professional, friendly, and direct. 
+- **Tone:** Professional, friendly, and direct.
 - **Clarity:** Use simple vocabulary. Avoid jargon, slang, and marketing hype.
 - **Global Audience:** Write in standard US English. Avoid idioms and cultural
   references.
@@ -47,8 +47,8 @@ Write precisely to ensure your instructions are unambiguous.
   "foo" or "bar."
 - **Quota and limit terminology:** For any content involving resource capacity
   or using the word "quota" or "limit", strictly adhere to the guidelines in
-  the `quota-limit-style-guide.md` resource file. Generally, Use "quota" for the
-  administrative bucket and "limit" for the numerical ceiling.
+  the `quota-limit-style-guide.md` resource file. Generally, Use "quota" for
+  the administrative bucket and "limit" for the numerical ceiling.
 
 ### Formatting and syntax
 Apply consistent formatting to make documentation visually organized and
@@ -65,35 +65,85 @@ accessible.
 - **UI and code:** Use **bold** for UI elements and `code font` for filenames,
   snippets, commands, and API elements. Focus on the task when discussing
   interaction.
-- **Links:** Use descriptive anchor text; avoid "click here." Ensure the link
-  makes sense out of context.
 - **Accessibility:** Use semantic HTML elements correctly (headings, lists, 
   tables).
 - **Media:** Use lowercase hyphenated filenames. Provide descriptive alt text
   for all images.
+- **Details section:** Use the `<details>` tag to create a collapsible section.
+  This is useful for supplementary or data-heavy information that isn't critical
+  to the main flow.
+
+  Example:
+
+  <details>
+  <summary>Title</summary>
+
+  - First entry
+  - Second entry
+
+  </details>
+
+- **Callouts**: Use GitHub-flavored markdown alerts to highlight important
+  information. To ensure the formatting is preserved by `npm run format`, place
+  an empty line, then a prettier ignore comment directly before the callout
+  block. Use `<!-- prettier-ignore -->` for standard Markdown files (`.md`) and
+  `{/* prettier-ignore */}` for MDX files (`.mdx`). The callout type (`[!TYPE]`)
+  should be on the first line, followed by a newline, and then the content, with
+  each subsequent line of content starting with `>`. Available types are `NOTE`,
+  `TIP`, `IMPORTANT`, `WARNING`, and `CAUTION`.
+
+  Example (.md):
+
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is an example of a multi-line note that will be preserved
+> by Prettier.
+
+  Example (.mdx):
+
+{/* prettier-ignore */}
+> [!NOTE]
+> This is an example of a multi-line note that will be preserved
+> by Prettier.
+
+### Links
+- **Accessibility:** Use descriptive anchor text; avoid "click here." Ensure the
+  link makes sense out of context, such as when being read by a screen reader.
+- **Use relative links in docs:** Use relative links in documentation (`/docs/`)
+  to ensure portability. Use paths relative to the current file's directory
+  (for example, `../tools/` from `docs/cli/`). Do not include the `/docs/`
+  section of a path, but do verify that the resulting relative link exists. This
+  does not apply to meta files such as README.MD and CONTRIBUTING.MD.
+- **When changing headings, check for deep links:** If a user is changing a
+  heading, check for deep links to that heading in other pages and update
+  accordingly.
 
 ### Structure
 - **BLUF:** Start with an introduction explaining what to expect.
 - **Experimental features:** If a feature is clearly noted as experimental,
-add the following note immediately after the introductory paragraph:
-  `> **Note:** This is a preview feature currently under active development.`
+  add the following note immediately after the introductory paragraph:
+
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is an experimental feature currently under active development.
+(Note: Use `{/* prettier-ignore */}` if editing an `.mdx` file.)
+
 - **Headings:** Use hierarchical headings to support the user journey.
-- **Procedures:** 
+- **Procedures:**
   - Introduce lists of steps with a complete sentence.
   - Start each step with an imperative verb.
   - Number sequential steps; use bullets for non-sequential lists.
   - Put conditions before instructions (e.g., "On the Settings page, click...").
   - Provide clear context for where the action takes place.
   - Indicate optional steps clearly (e.g., "Optional: ...").
-- **Elements:** Use bullet lists, tables, notes (`> **Note:**`), and warnings 
-  (`> **Warning:**`).
+- **Elements:** Use bullet lists, tables, details, and callouts.
 - **Avoid using a table of contents:** If a table of contents is present, remove
   it.
 - **Next steps:** Conclude with a "Next steps" section if applicable.
 
 ## Phase 2: Preparation
 Before modifying any documentation, thoroughly investigate the request and the
-surrounding context. 
+surrounding context.
 
 1.  **Clarify:** Understand the core request. Differentiate between writing new
     content and editing existing content. If the request is ambiguous (e.g.,
@@ -104,6 +154,8 @@ surrounding context.
 4.  **Connect:** Identify all referencing pages if changing behavior. Check if
     `docs/sidebar.json` needs updates.
 5.  **Plan:** Create a step-by-step plan before making changes.
+6.  **Audit Docset:** If asked to audit the documentation, follow the procedural
+    guide in [docs-auditing.md](./references/docs-auditing.md).
 
 ## Phase 3: Execution
 Implement your plan by either updating existing files or creating new ones
@@ -116,7 +168,7 @@ documentation.
 
 - **Gaps:** Identify areas where the documentation is incomplete or no longer
   reflects existing code.
-- **Structure:** Apply "Structure (New Docs)" rules (BLUF, headings, etc.) when 
+- **Structure:** Apply "Structure (New Docs)" rules (BLUF, headings, etc.) when
   adding new sections to existing pages.
 - **Headers**: If you change a header, you must check for links that lead to
   that header and update them.
@@ -126,17 +178,17 @@ documentation.
 - **Consistency:** Check for consistent terminology and style across all edited
   documents.
 
-
 ## Phase 4: Verification and finalization
-Perform a final quality check to ensure that all changes are correctly formatted
-and that all links are functional.
+Perform a final quality check to ensure that all changes are correctly
+formatted and that all links are functional.
 
 1.  **Accuracy:** Ensure content accurately reflects the implementation and
   technical behavior.
 2.  **Self-review:** Re-read changes for formatting, correctness, and flow.
-3.  **Link check:** Verify all new and existing links leading to or from modified
-    pages. If you changed a header, ensure that any links that lead to it are
-    updated.
-4.  **Format:** Once all changes are complete, ask to execute `npm run format`
-    to ensure consistent formatting across the project. If the user confirms,
-    execute the command.
+3.  **Link check:** Verify all new and existing links leading to or from
+    modified pages. If you changed a header, ensure that any links that lead to
+    it are updated.
+4.  **Format:** If `npm run format` fails, it may be necessary to run `npm
+    install` first to ensure all formatting dependencies are available. Once all
+    changes are complete, ask to execute `npm run format` to ensure consistent
+    formatting across the project. If the user confirms, execute the command.

.gemini/skills/docs-writer/references/docs-auditing.md

@@ -0,0 +1,195 @@
+# Procedural Guide: Auditing the Docset
+
+This guide outlines the process for auditing the Gemini CLI documentation for
+correctness and adherence to style guidelines. This process involves both an
+"Editor" and "Technical Writer" phase.
+
+## Objective
+
+To ensure all public-facing documentation is accurate, up-to-date, adheres to
+the Gemini CLI documentation style guide, and reflects the current state of the
+codebase.
+
+## Phase 1: Editor Audit
+
+**Role:** The editor is responsible for identifying potential issues based on
+style guide violations and technical inaccuracies.
+
+### Steps
+
+1.  **Identify Documentation Scope:**
+    - Read `docs/sidebar.json` to get a list of all viewable documentation
+      pages.
+    - For each entry with a `slug`, convert it into a file path (e.g., `docs` ->
+      `docs/index.md`, `docs/get-started` -> `docs/get-started.md`). Ignore
+      entries with `link` properties.
+
+2.  **Prepare Audit Results File:**
+    - Create a new Markdown file named `audit-results-[YYYY-MM-DD].md` (e.g.,
+      `audit-results-2026-03-13.md`). This file will contain all identified
+      violations and recommendations.
+
+3.  **Retrieve Style Guidelines:**
+    - Familiarize yourself with the `docs-writer` skill instructions and the
+      included style guidelines.
+
+4.  **Audit Each Document:**
+    - For each documentation file identified in Step 1, read its content.
+    - **Review against Style Guide:**
+      - **Voice and Tone Violations:**
+        - **Unprofessional Tone:** Identify phrasing that is overly casual,
+          defensive, or lacks a professional and friendly demeanor.
+        - **Indirectness or Vagueness:** Identify sentences that are
+          unnecessarily wordy or fail to be concise and direct.
+        - **Incorrect Pronoun:** Identify any use of third-person pronouns
+          (e.g., "we," "they," "the user") when referring to the reader, instead
+          of the second-person pronoun **"you"**.
+        - **Passive Voice:** Identify sentences written in the passive voice.
+        - **Incorrect Tense:** Identify the use of past or future tense verbs,
+          instead of the **present tense**.
+        - **Poor Vocabulary:** Identify the use of jargon, slang, or overly
+          informal language.
+      - **Language and Grammar Violations:**
+        - **Lack of Conciseness:** Identify unnecessarily long phrases or
+          sentences.
+        - **Punctuation Errors:** Identify incorrect or missing punctuation.
+        - **Ambiguous Dates:** Identify dates that could be misinterpreted
+          (e.g., "next Monday" instead of "April 15, 2026").
+        - **Abbreviation Usage:** Identify the use of abbreviations that should
+          be spelled out (e.g., "e.g." instead of "for example").
+        - **Terminology:** Check for incorrect or inconsistent use of
+          product-specific terms (e.g., "quota" vs. "limit").
+      - **Formatting and Syntax Violations:**
+        - **Missing Overview:** Check for the absence of a brief overview
+          paragraph at the start of the document.
+        - **Line Length:** Identify any lines of text that exceed **80
+          characters** (text wrap violation).
+        - **Casing:** Identify incorrect casing for headings, titles, or named
+          entities (e.g., product names like `Gemini CLI`).
+        - **List Formatting:** Identify incorrectly formatted lists (e.g.,
+          inconsistent indentation or numbering).
+        - **Incorrect Emphasis:** Identify incorrect use of bold text (should
+          only be used for UI elements) or code font (should be used for code,
+          file names, or command-line input).
+        - **Link Quality:** Identify links with non-descriptive anchor text
+          (e.g., "click here").
+        - **Image Alt Text:** Identify images with missing or poor-quality
+          (non-descriptive) alt text.
+      - **Structure Violations:**
+        - **Missing BLUF:** Check for the absence of a "Bottom Line Up Front"
+          summary at the start of complex sections or documents.
+        - **Experimental Feature Notes:** Identify experimental features that
+          are not clearly labeled with a standard note.
+        - **Heading Hierarchy:** Check for skipped heading levels (e.g., going
+          from `##` to `####`).
+        - **Procedure Clarity:** Check for procedural steps that do not start
+          with an imperative verb or where a condition is placed _after_ the
+          instruction.
+        - **Element Misuse:** Identify the incorrect or inappropriate use of
+          special elements (e.g., Notes, Warnings, Cautions).
+        - **Table of Contents:** Identify the presence of a dynamically
+          generated or manually included table of contents.
+        - **Missing Next Steps:** Check for procedural documents that lack a
+          "Next steps" section (if applicable).
+    - **Verify Code Accuracy (if applicable):**
+      - If the document contains code snippets (e.g., shell commands, API calls,
+        file paths, Docker image versions), use `grep_search` and `read_file`
+        within the `packages/` directory (or other relevant parts of the
+        codebase) to ensure the code is still accurate and up-to-date. Pay close
+        attention to version numbers, package names, and command syntax.
+    - **Record Findings:** For each **violation** or inaccuracy found:
+      - Note the file path.
+      - Describe the violation (e.g., "Violation (Language and Grammar): Uses
+        'e.g.'").
+      - Provide a clear and actionable recommendation to correct the issue.
+        (e.g., "Recommendation: Replace 'e.g.' with 'for example'." or
+        "Recommendation: Replace '...' with '...' in active voice.).
+      - Append these findings to `audit-results-[YYYY-MM-DD].md`.
+
+## Phase 2: Software Engineer Audit
+
+**Role:** The software engineer is responsible for finding undocumented features
+by auditing the codebase and recent changelogs, and passing these findings to
+the technical writer.
+
+### Steps
+
+1.  **Proactive Codebase Audit:**
+    - Audit high-signal areas of the codebase to identify undocumented features.
+      You MUST review:
+      - `packages/cli/src/commands/`
+      - `packages/core/src/tools/`
+      - `packages/cli/src/config/settings.ts`
+
+2.  **Review Recent Updates:**
+    - Check recent changelogs in stable and announcements within the
+      documentation to see if newly introduced features are documented properly.
+
+3.  **Evaluate and Record Findings:**
+    - Determine if these features are adequately covered in the docs. They do
+      not need to be documented word for word, but major features that customers
+      should care about probably should have an article.
+    - Append your findings to the `audit-results-[YYYY-MM-DD].md` file,
+      providing a brief description of the feature and where it should be
+      documented.
+
+## Phase 3: Technical Writer Implementation
+
+**Role:** The technical writer handles input from both the editor and the
+software engineer, makes appropriate decisions about what to change, and
+implements the approved changes.
+
+### Steps
+
+1.  **Review Audit Results:**
+    - Read `audit-results-[YYYY-MM-DD].md` to understand all identified issues,
+      undocumented features, and recommendations from both the Editor and
+      Software Engineer phases.
+
+2.  **Make Decisions and Log Reasoning:**
+    - Create or update an implementation log (e.g.,
+      `audit-implementation-log-[YYYY-MM-DD].md`).
+    - Make sure the logs are updated for all steps, documenting your reasoning
+      for each recommendation (why it was accepted, modified, or rejected). This
+      is required for a final check by a human in the PR.
+
+3.  **Implement Changes:**
+    - For each approved recommendation:
+      - Read the target documentation file.
+      - Apply the recommended change using the `replace` tool. Pay close
+        attention to `old_string` for exact matches, including whitespace and
+        newlines. For multiple occurrences of the same simple string (e.g.,
+        "e.g."), use `allow_multiple: true`.
+      - **String replacement safeguards:** When applying these fixes across the
+        docset, you must verify the following:
+        - **Preserve Code Blocks:** Explicitly verify that no code blocks,
+          inline code snippets, terminal commands, or file paths have been
+          erroneously capitalized or modified.
+        - **Preserve Literal Strings:** Never alter the wording of literal error
+          messages, UI quotes, or system logs. For example, if a style rule says
+          to remove the word "please", you must NOT remove it if it appears
+          inside a quoted error message (e.g.,
+          `Error: Please contact your administrator`).
+        - **Verify Sentence Casing:** When removing filler words (like "please")
+          from the beginning of a sentence or list item, always verify that the
+          new first word of the sentence is properly capitalized.
+      - For structural changes (e.g., adding an overview paragraph), use
+        `replace` or `write_file` as appropriate.
+      - For broken links, determine the correct new path or update the link
+        text.
+      - For creating new files (e.g., `docs/get-started.md` to fix a broken
+        link, or a new feature article), use `write_file`.
+
+4.  **Execute Auto-Generation Scripts:**
+    - Some documentation pages are auto-generated from the codebase and should
+      be updated using npm scripts rather than manual edits. After implementing
+      manual changes (especially if you edited settings or configurations based
+      on SWE recommendations), ensure you run:
+      - `npm run docs:settings` to generate/update the configuration reference.
+      - `npm run docs:keybindings` to generate/update the keybindings reference.
+
+5.  **Format Code:**
+    - **Dependencies:** If `npm run format` fails, it may be necessary to run
+      `npm install` first to ensure all formatting dependencies are available.
+    - After all changes have been implemented, run `npm run format` to ensure
+      consistent formatting across the project.

.gemini/skills/review-duplication/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: review-duplication
+description: Use this skill during code reviews to proactively investigate the codebase for duplicated functionality, reinvented wheels, or failure to reuse existing project best practices and shared utilities.
+---
+
+# Review Duplication
+
+## Overview
+
+This skill provides a structured workflow for investigating a codebase during a code review to identify duplicated logic, reinvented utilities, and missed opportunities to reuse established patterns. By executing this workflow, you ensure that new code integrates seamlessly with the existing project architecture.
+
+## Workflow: Investigating for Duplication
+
+When reviewing code, perform the following steps before finalizing your review:
+
+### 1. Extract Core Logic
+Analyze the new code to identify the core algorithms, utility functions, generic data structures, or UI components being introduced. Look beyond the specific business logic to see the underlying mechanics.
+
+### 2. Hypothesize Existing Locations & Trace Dependencies
+Think about where this type of code *would* live if it already existed in the project. Provide absolute paths from the repo root to disambiguate.
+- **Utilities:** `packages/core/src/utils/`, `packages/cli/src/utils/`
+- **UI Components:** `packages/cli/src/ui/components/`, `packages/cli/src/ui/`
+- **Services:** `packages/core/src/services/`, `packages/cli/src/services/`
+- **Configuration:** `packages/core/src/config/`, `packages/cli/src/config/`
+- **Core Logic:** Call out `packages/core/` if functionality does not appear React UI specific.
+
+**Trace Third-Party Dependencies:** If the PR introduces a new import for a utility library (e.g., `lodash.merge`, `date-fns`), trace how and where the project currently uses that library. There is likely an existing wrapper or shared utility.
+
+**Check Package Files:** Before flagging a custom implementation of a complex algorithm, check `package.json` to see if a standard library (like `lodash` or `uuid`) is already installed that provides this functionality.
+
+### 3. Investigate the Codebase (Sub-Agent Delegation)
+Delegate the heavy lifting of codebase investigation to specialized sub-agents. They are optimized to perform deep searches and semantic mapping without bloating your session history.
+
+To ensure a comprehensive review, you MUST formulate highly specific objectives for the sub-agents, providing them with the "scents" you discovered in Step 1.
+
+- **Codebase Investigator:** Use the `codebase_investigator` as your primary researcher. When delegating, formulate an objective that asks specific, investigative questions about the codebase, explicitly including these search vectors:
+  - **Structural Similarity:** Ask if existing code uses the same underlying APIs (e.g., "Does any existing code use `Intl.DateTimeFormat` or `setTimeout` for similar purposes?").
+  - **Naming Conventions:** Ask if there are existing symbols with similar naming patterns (e.g., "Are there existing symbols with naming patterns like `*Format*` or `*Debounce*`?").
+  - **Comments & Documentation:** Ask if keywords from the PR's comments or JSDoc exist in describing similar behavior elsewhere.
+  - **Architectural Fit:** Ask where this type of logic is currently centralized (e.g., "Where is centralized date formatting logic located?").
+  - **Refactoring Guidance:** Crucially, ask the sub-agent to explain *how* the new code could be refactored to use any existing logic it finds.
+- **Generalist Agent:** Use the `generalist` for detailed, turn-intensive comparisons. For example: "Review the implementation of `MyNewComponent` in the PR and compare it semantically against all components in `packages/ui/src`. Are there any existing components that could be extended or used instead?"
+- **Retain Fast Path for Simple Searches:** For extremely simple, unambiguous checks (e.g., "Does `package.json` include `lodash`?"), perform a direct search to save time. Default to delegation for any open-ended "investigations."
+
+### 4. Evaluate Best Practices
+Check if the new code aligns with the project's established conventions.
+- **Error Handling:** Does it use the project's standard error classes or logging mechanisms?
+- **State Management:** Does it bypass established stores or contexts?
+- **Styling:** Does it hardcode colors or spacing instead of using theme variables?
+If the PR introduces a new pattern, compare it against the documented standards and explicitly confirm if an existing project pattern should have been used instead.
+
+### 5. Formulate Constructive Feedback
+If you discover that the PR duplicates existing functionality or ignores a best practice:
+- Provide a clear review comment.
+- **Identify the Source:** Explicitly mention the absolute or project-relative file path and the specific symbol (function, component, class) that should be reused.
+- **Implementation Guidance:** Provide a brief code snippet or a clear explanation showing **how** to integrate the existing code to fulfill the task's requirements.
+- **Explain the Value:** Briefly explain why reusing the existing code is beneficial (e.g., maintainability, consistency, built-in edge case handling).
+
+Example comment:
+> "It looks like this PR introduces a new `formatDate` utility. We already have a robust, tested `formatDate` function in `src/utils/dateHelpers.ts`. 
+>
+> You can replace your implementation by importing it like this:
+> ```typescript
+> import { formatDate } from '../utils/dateHelpers';
+> 
+> // Then use it here:
+> const displayDate = formatDate(userDate, 'MMM Do, YYYY');
+> ```
+> Reusing this ensures that the date formatting remains consistent with the rest of the application and handles timezone conversions correctly."

.geminiignore

@@ -0,0 +1 @@
+packages/core/src/services/scripts/*.exe

.github/ISSUE_TEMPLATE/website_issue.yml

@@ -1,7 +1,9 @@
 name: 'Website issue'
 description: 'Report an issue with the Gemini CLI Website and Gemini CLI Extensions Gallery'
+title: 'GeminiCLI.com Feedback: [ISSUE]'
 labels:
   - 'area/extensions'
+  - 'area/documentation'
 body:
   - type: 'markdown'
     attributes:

.github/actions/download-mac-binaries/action.yml

@@ -0,0 +1,23 @@
+name: 'Download Mac Binaries'
+description: 'Downloads the unsigned macOS binaries (x64 and arm64)'
+inputs:
+  path:
+    description: 'The base path to download the binaries to'
+    required: true
+    default: 'dist'
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Download macOS arm64 binary'
+      uses: 'actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806' # ratchet:actions/download-artifact@v4
+      continue-on-error: true
+      with:
+        name: 'gemini-darwin-arm64-unsigned'
+        path: '${{ inputs.path }}/darwin-arm64'
+
+    - name: 'Download macOS x64 binary'
+      uses: 'actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806' # ratchet:actions/download-artifact@v4
+      continue-on-error: true
+      with:
+        name: 'gemini-darwin-x64-unsigned'
+        path: '${{ inputs.path }}/darwin-x64'

.github/actions/publish-release/action.yml

@@ -114,13 +114,14 @@ runs:
         BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
         DRY_RUN: '${{ inputs.dry-run }}'
         RELEASE_TAG: '${{ inputs.release-tag }}'
+        GIT_PUSH_TOKEN: '${{ inputs.github-release-token || inputs.github-token }}'
       run: |-
         set -e
         git add package.json package-lock.json packages/*/package.json
         git commit -m "chore(release): ${RELEASE_TAG}"
         if [[ "${DRY_RUN}" == "false" ]]; then
           echo "Pushing release branch to remote..."
-          git push --set-upstream origin "${BRANCH_NAME}" --follow-tags
+          git push "https://x-access-token:${GIT_PUSH_TOKEN}@github.com/${{ github.repository }}.git" "HEAD:${BRANCH_NAME}" --follow-tags
         else
           echo "Dry run enabled. Skipping push."
         fi
@@ -174,8 +175,10 @@ runs:
         npm publish \
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_CORE_PACKAGE_NAME}" \
-          --no-tag
-        npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} false --silent
+          --tag staging-tmp
+        if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+          npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} staging-tmp
+        fi
 
     - name: '🔗 Install latest core package'
       working-directory: '${{ inputs.working-directory }}'
@@ -193,7 +196,7 @@ runs:
         INPUTS_A2A_PACKAGE_NAME: '${{ inputs.a2a-package-name }}'
 
     - name: '📦 Prepare bundled CLI for npm release'
-      if: "inputs.npm-registry-url != 'https://npm.pkg.github.com/' && inputs.npm-tag != 'latest'"
+      if: "inputs.npm-registry-url != 'https://npm.pkg.github.com/'"
       working-directory: '${{ inputs.working-directory }}'
       shell: 'bash'
       run: |
@@ -220,8 +223,10 @@ runs:
         npm publish \
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_CLI_PACKAGE_NAME}" \
-          --no-tag
-        npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} false --silent
+          --tag staging-tmp
+        if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+          npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} staging-tmp
+        fi
 
     - name: 'Get a2a-server Token'
       uses: './.github/actions/npm-auth-token'
@@ -245,8 +250,10 @@ runs:
         npm publish \
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_A2A_PACKAGE_NAME}" \
-          --no-tag
-        npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} false --silent
+          --tag staging-tmp
+          if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
+            npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} staging-tmp
+          fi
 
     - name: '🔬 Verify NPM release by version'
       uses: './.github/actions/verify-release'
@@ -285,8 +292,38 @@ runs:
         INPUTS_PREVIOUS_TAG: '${{ inputs.previous-tag }}'
       shell: 'bash'
       run: |
+        rm -f gemini-cli-bundle.zip
+        (cd bundle && chmod +x gemini.js && zip -r ../gemini-cli-bundle.zip .)
+
+        echo "Testing the generated bundle archive..."
+        rm -rf test-bundle
+        mkdir -p test-bundle
+        unzip -q gemini-cli-bundle.zip -d test-bundle
+
+        # Verify it runs and outputs a version
+        BUNDLE_VERSION=$(node test-bundle/gemini.js --version | xargs)
+        echo "Bundle version output: ${BUNDLE_VERSION}"
+        if [[ -z "${BUNDLE_VERSION}" ]]; then
+          echo "Error: Bundle failed to execute or return version."
+          exit 1
+        fi
+        rm -rf test-bundle
+
+        RELEASE_ASSETS=("gemini-cli-bundle.zip")
+
+        # Check for and prepare macOS binaries if they exist
+        for arch in arm64 x64; do
+          BINARY_PATH="dist/darwin-${arch}/gemini"
+          if [[ -f "$BINARY_PATH" ]]; then
+            chmod +x "$BINARY_PATH"
+            ZIP_NAME="gemini-darwin-${arch}-unsigned.zip"
+            zip -j "$ZIP_NAME" "$BINARY_PATH"
+            RELEASE_ASSETS+=("$ZIP_NAME")
+          fi
+        done
+
         gh release create "${INPUTS_RELEASE_TAG}" \
-          bundle/gemini.js \
+          "${RELEASE_ASSETS[@]}" \
           --target "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}" \
           --title "Release ${INPUTS_RELEASE_TAG}" \
           --notes-start-tag "${INPUTS_PREVIOUS_TAG}" \
@@ -300,7 +337,8 @@ runs:
       shell: 'bash'
       run: |
         echo "Cleaning up release branch ${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}..."
-        git push origin --delete "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}"
+        git push "https://x-access-token:${GIT_PUSH_TOKEN}@github.com/${{ github.repository }}.git" --delete "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}"
 
       env:
+        GIT_PUSH_TOKEN: '${{ inputs.github-release-token || inputs.github-token }}'
         STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'

.github/actions/push-sandbox/action.yml

@@ -34,7 +34,7 @@ runs:
         JSON_INPUTS: '${{ toJSON(inputs) }}'
       run: 'echo "$JSON_INPUTS"'
     - name: 'Checkout'
-      uses: 'actions/checkout@v4'
+      uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
       with:
         ref: '${{ inputs.github-sha }}'
         fetch-depth: 0
@@ -45,11 +45,11 @@ runs:
       shell: 'bash'
       run: 'npm run build'
     - name: 'Set up QEMU'
-      uses: 'docker/setup-qemu-action@v3'
+      uses: 'docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130' # ratchet:docker/setup-qemu-action@v3
     - name: 'Set up Docker Buildx'
-      uses: 'docker/setup-buildx-action@v3'
+      uses: 'docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f' # ratchet:docker/setup-buildx-action@v3
     - name: 'Log in to GitHub Container Registry'
-      uses: 'docker/login-action@v3'
+      uses: 'docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9' # ratchet:docker/login-action@v3
       with:
         registry: 'docker.io'
         username: '${{ inputs.dockerhub-username }}'

.github/actions/run-tests/action.yml

@@ -18,9 +18,17 @@ runs:
       env:
         JSON_INPUTS: '${{ toJSON(inputs) }}'
       run: 'echo "$JSON_INPUTS"'
+    - name: 'Install system dependencies'
+      if: "runner.os == 'Linux'"
+      run: |
+        sudo apt-get update -qq && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq bubblewrap
+        # Ubuntu 24.04+ requires this to allow bwrap to function in CI
+        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+      shell: 'bash'
     - name: 'Run Tests'
       env:
         GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'
+        GEMINI_CLI_TRUST_WORKSPACE: true
       working-directory: '${{ inputs.working-directory }}'
       run: |-
         echo "::group::Build"

.github/actions/verify-release/action.yml

@@ -36,7 +36,7 @@ runs:
       run: 'echo "$JSON_INPUTS"'
 
     - name: 'setup node'
-      uses: 'actions/setup-node@v4'
+      uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
       with:
         node-version: '20'
 
@@ -98,6 +98,7 @@ runs:
       working-directory: '${{ inputs.working-directory }}'
       env:
         GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'
+        GEMINI_CLI_TRUST_WORKSPACE: true
         INTEGRATION_TEST_USE_INSTALLED_GEMINI: 'true'
         # We must diable CI mode here because it interferes with interactive tests.
         # See https://github.com/google-gemini/gemini-cli/issues/10517

.github/scripts/apply-issue-labels.cjs

@@ -0,0 +1,244 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+module.exports = async ({ github, context, core }) => {
+  const rawLabels = process.env.LABELS_OUTPUT;
+  core.info(`Raw labels JSON: ${rawLabels}`);
+  let parsedLabels;
+  try {
+    // First, try to parse the raw output as JSON.
+    parsedLabels = JSON.parse(rawLabels);
+  } catch (jsonError) {
+    // If that fails, check for a markdown code block.
+    core.warning(
+      `Direct JSON parsing failed: ${jsonError.message}. Trying to extract from a markdown block.`,
+    );
+    const jsonMatch = rawLabels.match(/```json\s*([\s\S]*?)\s*```/);
+    if (jsonMatch && jsonMatch[1]) {
+      try {
+        parsedLabels = JSON.parse(jsonMatch[1].trim());
+      } catch (markdownError) {
+        core.setFailed(
+          `Failed to parse JSON even after extracting from markdown block: ${markdownError.message}\nRaw output: ${rawLabels}`,
+        );
+        return;
+      }
+    } else {
+      // If no markdown block, try to find a raw JSON array in the output.
+      // The CLI may include debug/log lines (e.g. telemetry init, YOLO mode)
+      // before the actual JSON response.
+      const jsonArrayMatch = rawLabels.match(
+        /\[\s*\{\s*"issue_number"[\s\S]*\}\s*\]/,
+      );
+      if (jsonArrayMatch) {
+        try {
+          parsedLabels = JSON.parse(jsonArrayMatch[0]);
+        } catch (extractError) {
+          // It's possible the regex matched from a `[STARTUP]` log all the way to the end
+          // of the JSON array. We need to be more aggressive and find the FIRST `[ { "issue_number"`
+          core.warning(
+            `Strict array match failed: ${extractError.message}. Attempting to clean leading noisy brackets.`,
+          );
+          const fallbackMatch = rawLabels.match(
+            /(\[\s*\{\s*"issue_number"[\s\S]*)/,
+          );
+          if (fallbackMatch) {
+            try {
+              // We might have grabbed trailing noise too, so we find the last closing bracket
+              const cleaned = fallbackMatch[0].substring(
+                0,
+                fallbackMatch[0].lastIndexOf(']') + 1,
+              );
+              parsedLabels = JSON.parse(cleaned);
+            } catch (fallbackError) {
+              core.setFailed(
+                `Found JSON-like content but failed to parse: ${fallbackError.message}\nRaw output: ${rawLabels}`,
+              );
+              return;
+            }
+          } else {
+            core.setFailed(
+              `Found JSON-like content but failed to parse: ${extractError.message}\nRaw output: ${rawLabels}`,
+            );
+            return;
+          }
+        }
+      } else {
+        core.setFailed(
+          `Output is not valid JSON and does not contain extractable JSON.\nRaw output: ${rawLabels}`,
+        );
+        return;
+      }
+    }
+  }
+  core.info(`Parsed labels JSON: ${JSON.stringify(parsedLabels)}`);
+
+  for (const entry of parsedLabels) {
+    const issueNumber = entry.issue_number;
+    if (!issueNumber) {
+      core.info(
+        `Skipping entry with no issue number: ${JSON.stringify(entry)}`,
+      );
+      continue;
+    }
+
+    let labelsToAdd = entry.labels_to_add || [];
+    let labelsToRemove = entry.labels_to_remove || [];
+
+    labelsToRemove.push('status/need-triage');
+
+    if (labelsToAdd.includes('status/manual-triage')) {
+      // If the AI flagged it for manual triage, remove bot-triaged if it exists
+      labelsToRemove.push('status/bot-triaged');
+      // Ensure we don't accidentally try to add bot-triaged if the AI returned it
+      labelsToAdd = labelsToAdd.filter((l) => l !== 'status/bot-triaged');
+    } else {
+      // Standard successful bot triage
+      labelsToAdd.push('status/bot-triaged');
+    }
+
+    // Deduplicate arrays
+    labelsToAdd = [...new Set(labelsToAdd)];
+    labelsToRemove = [...new Set(labelsToRemove)];
+
+    // Fetch existing labels to auto-resolve conflicts
+    try {
+      const { data: issueData } = await github.rest.issues.get({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        issue_number: issueNumber,
+      });
+      const existingLabels = issueData.labels.map((l) =>
+        typeof l === 'string' ? l : l.name,
+      );
+
+      const hasNewArea = labelsToAdd.some((l) => l.startsWith('area/'));
+      if (hasNewArea) {
+        const existingAreas = existingLabels.filter((l) =>
+          l.startsWith('area/'),
+        );
+        labelsToRemove.push(...existingAreas);
+      }
+
+      const hasNewPriority = labelsToAdd.some((l) => l.startsWith('priority/'));
+      if (hasNewPriority) {
+        const existingPriorities = existingLabels.filter((l) =>
+          l.startsWith('priority/'),
+        );
+        labelsToRemove.push(...existingPriorities);
+      }
+
+      const hasNewKind = labelsToAdd.some((l) => l.startsWith('kind/'));
+      if (hasNewKind) {
+        const existingKinds = existingLabels.filter((l) =>
+          l.startsWith('kind/'),
+        );
+        labelsToRemove.push(...existingKinds);
+      }
+
+      // Re-deduplicate and filter out labels we are trying to add
+      labelsToRemove = [...new Set(labelsToRemove)].filter(
+        (l) => !labelsToAdd.includes(l),
+      );
+    } catch (e) {
+      core.warning(
+        `Failed to fetch existing labels for #${issueNumber}: ${e.message}`,
+      );
+    }
+
+    // Enforce mutually exclusive area labels
+    const areaLabelsToAdd = labelsToAdd.filter((l) => l.startsWith('area/'));
+    if (areaLabelsToAdd.length > 1) {
+      core.warning(
+        `Issue #${issueNumber} has multiple area labels to add: ${areaLabelsToAdd.join(', ')}. Keeping only the first one.`,
+      );
+      const firstArea = areaLabelsToAdd[0];
+      labelsToAdd = labelsToAdd.filter(
+        (l) => !l.startsWith('area/') || l === firstArea,
+      );
+    }
+
+    // Enforce mutually exclusive priority labels
+    const priorityLabelsToAdd = labelsToAdd.filter((l) =>
+      l.startsWith('priority/'),
+    );
+    if (priorityLabelsToAdd.length > 1) {
+      core.warning(
+        `Issue #${issueNumber} has multiple priority labels to add: ${priorityLabelsToAdd.join(', ')}. Keeping only the first one.`,
+      );
+      const firstPriority = priorityLabelsToAdd[0];
+      labelsToAdd = labelsToAdd.filter(
+        (l) => !l.startsWith('priority/') || l === firstPriority,
+      );
+    }
+
+    if (labelsToAdd.length > 0) {
+      await github.rest.issues.addLabels({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        issue_number: issueNumber,
+        labels: labelsToAdd,
+      });
+
+      const explanation = entry.explanation ? ` - ${entry.explanation}` : '';
+      core.info(
+        `Successfully added labels for #${issueNumber}: ${labelsToAdd.join(', ')}${explanation}`,
+      );
+    }
+
+    if (labelsToRemove.length > 0) {
+      for (const label of labelsToRemove) {
+        try {
+          await github.rest.issues.removeLabel({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            issue_number: issueNumber,
+            name: label,
+          });
+        } catch (e) {
+          if (e.status !== 404) {
+            core.warning(
+              `Failed to remove label ${label} from #${issueNumber}: ${e.message}`,
+            );
+          }
+        }
+      }
+      core.info(
+        `Successfully removed labels for #${issueNumber}: ${labelsToRemove.join(', ')}`,
+      );
+    }
+
+    if (
+      (entry.explanation && process.env.SUPPRESS_COMMENT !== 'true') ||
+      entry.effort_analysis
+    ) {
+      let commentBody = '';
+      if (entry.explanation && process.env.SUPPRESS_COMMENT !== 'true') {
+        commentBody += entry.explanation;
+      }
+      if (entry.effort_analysis) {
+        if (commentBody) commentBody += '\n\n';
+        commentBody += `**Effort Analysis:**\n${entry.effort_analysis}`;
+      }
+
+      await github.rest.issues.createComment({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        issue_number: issueNumber,
+        body: commentBody,
+      });
+    }
+
+    if (
+      (!entry.labels_to_add || entry.labels_to_add.length === 0) &&
+      (!entry.labels_to_remove || entry.labels_to_remove.length === 0)
+    ) {
+      core.info(
+        `No labels to add or remove for #${issueNumber}, leaving as is`,
+      );
+    }
+  }
+};

.github/scripts/cleanup-triage-labels.cjs

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const fs = require('node:fs');
+
+module.exports = async ({ github, context, core }) => {
+  let issuesToCleanup = [];
+  try {
+    const fileContent = fs.readFileSync('issues_to_cleanup.json', 'utf8');
+    issuesToCleanup = JSON.parse(fileContent);
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      core.info('No issues found to clean up.');
+      return;
+    }
+    core.setFailed(`Failed to read issues_to_cleanup.json: ${error.message}`);
+    return;
+  }
+
+  for (const issue of issuesToCleanup) {
+    try {
+      await github.rest.issues.removeLabel({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        issue_number: issue.number,
+        name: 'status/need-triage',
+      });
+      core.info(
+        `Successfully removed status/need-triage from #${issue.number}`,
+      );
+    } catch (error) {
+      if (error.status === 404) {
+        core.info(
+          `Label status/need-triage not found on #${issue.number}, skipping.`,
+        );
+      } else {
+        core.warning(
+          `Failed to remove label from #${issue.number}: ${error.message}`,
+        );
+      }
+    }
+  }
+
+  core.info(
+    `Cleaned up status/need-triage from ${issuesToCleanup.length} issues.`,
+  );
+};

.github/scripts/find-conflicting-labels.cjs

@@ -0,0 +1,60 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const fs = require('node:fs');
+
+module.exports = async ({ github, context, core }) => {
+  core.info('Fetching open issues to check for conflicting labels...');
+
+  const issues = await github.paginate(github.rest.issues.listForRepo, {
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    state: 'open',
+    per_page: 100,
+  });
+
+  const conflictingLabelIssues = [];
+
+  for (const issue of issues) {
+    if (issue.pull_request) continue;
+
+    const areaLabels = issue.labels
+      .filter((l) => l.name && l.name.startsWith('area/'))
+      .map((l) => l.name);
+
+    const priorityLabels = issue.labels
+      .filter((l) => l.name && l.name.startsWith('priority/'))
+      .map((l) => l.name);
+
+    if (areaLabels.length > 1 || priorityLabels.length > 1) {
+      let message = `Issue #${issue.number} has conflicting labels:`;
+      if (areaLabels.length > 1)
+        message += ` multiple areas (${areaLabels.join(', ')}).`;
+      if (priorityLabels.length > 1)
+        message += ` multiple priorities (${priorityLabels.join(', ')}).`;
+
+      core.info(message);
+
+      conflictingLabelIssues.push({
+        number: issue.number,
+        title: issue.title,
+        body: issue.body || '',
+      });
+    }
+  }
+
+  // Limit to 50 to avoid overwhelming the AI in a single run
+  const issuesToProcess = conflictingLabelIssues.slice(0, 50);
+
+  fs.writeFileSync(
+    'conflicting_labels_issues.json',
+    JSON.stringify(issuesToProcess, null, 2),
+  );
+
+  core.info(
+    `Found ${conflictingLabelIssues.length} issues with conflicting labels. Wrote ${issuesToProcess.length} to conflicting_labels_issues.json`,
+  );
+};

.github/scripts/gemini-lifecycle-manager.cjs

@@ -0,0 +1,268 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Gemini Scheduled Lifecycle Manager Script
+ * @param {object} param0
+ * @param {import('@octokit/rest').Octokit} param0.github
+ * @param {import('@actions/github/lib/context').Context} param0.context
+ * @param {import('@actions/core')} param0.core
+ */
+module.exports = async ({ github, context, core }) => {
+  const dryRun = process.env.DRY_RUN === 'true';
+  const owner = context.repo.owner;
+  const repo = context.repo.repo;
+
+  const STALE_LABEL = 'stale';
+  const NEED_INFO_LABEL = 'status/need-information';
+  const EXEMPT_LABELS = [
+    'pinned',
+    'security',
+    '🔒 maintainer only',
+    'help wanted',
+    '🗓️ Public Roadmap',
+  ];
+
+  const STALE_DAYS = 60;
+  const CLOSE_DAYS = 14;
+  const NO_RESPONSE_DAYS = 14;
+
+  const now = new Date();
+  const staleThreshold = new Date(
+    now.getTime() - STALE_DAYS * 24 * 60 * 60 * 1000,
+  );
+  const closeThreshold = new Date(
+    now.getTime() - CLOSE_DAYS * 24 * 60 * 60 * 1000,
+  );
+  const noResponseThreshold = new Date(
+    now.getTime() - NO_RESPONSE_DAYS * 24 * 60 * 60 * 1000,
+  );
+
+  const maintainerCache = new Map();
+  async function isMaintainer(user, association) {
+    if (user?.type === 'Bot') return true;
+    if (['OWNER', 'MEMBER', 'COLLABORATOR'].includes(association)) return true;
+
+    const username = user?.login;
+    if (!username) return false;
+
+    if (maintainerCache.has(username)) {
+      return maintainerCache.get(username);
+    }
+
+    try {
+      const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+        owner,
+        repo,
+        username,
+      });
+      // Permission can be admin, write, read, none.
+      // Roles like 'maintain' or 'triage' often map to 'write' or 'read' in the top-level field.
+      const isM =
+        ['admin', 'write'].includes(data.permission) ||
+        ['admin', 'maintain', 'write'].includes(data.role_name);
+
+      maintainerCache.set(username, isM);
+      return isM;
+    } catch (err) {
+      core.warning(
+        `Could not check permissions for ${username}: ${err.message}`,
+      );
+      maintainerCache.set(username, false);
+      return false;
+    }
+  }
+
+  async function processItems(query, callback) {
+    core.info(`Searching: ${query}`);
+    try {
+      const response = await github.rest.search.issuesAndPullRequests({
+        q: query,
+        per_page: 100,
+        sort: 'updated',
+        order: 'asc',
+      });
+      const items = response.data.items;
+      core.info(`Found ${items.length} items (batch limited).`);
+      for (const item of items) {
+        try {
+          await callback(item);
+        } catch (err) {
+          core.error(`Error processing #${item.number}: ${err.message}`);
+        }
+      }
+    } catch (err) {
+      core.error(`Search failed: ${err.message}`);
+    }
+  }
+
+  // 1. Handle No-Response (status/need-information)
+  // Removal: Check issues updated in the last 48h that have the label
+  const twoDaysAgo = new Date(now.getTime() - 2 * 24 * 60 * 60 * 1000);
+  await processItems(
+    `repo:${owner}/${repo} is:open label:"${NEED_INFO_LABEL}" updated:>${twoDaysAgo.toISOString()}`,
+    async (item) => {
+      const { data: comments } = await github.rest.issues.listComments({
+        owner,
+        repo,
+        issue_number: item.number,
+        sort: 'created',
+        direction: 'desc',
+        per_page: 5,
+      });
+
+      // Check if the last comment is from a non-maintainer
+      const lastComment = comments[0];
+      if (
+        lastComment &&
+        !(await isMaintainer(lastComment.user, lastComment.author_association))
+      ) {
+        core.info(
+          `Removing ${NEED_INFO_LABEL} from #${item.number} due to contributor response.`,
+        );
+        if (!dryRun) {
+          await github.rest.issues
+            .removeLabel({
+              owner,
+              repo,
+              issue_number: item.number,
+              name: NEED_INFO_LABEL,
+            })
+            .catch(() => {});
+        }
+      }
+    },
+  );
+
+  // Closure: Check issues with the label that haven't been updated in 14 days
+  await processItems(
+    `repo:${owner}/${repo} is:open label:"${NEED_INFO_LABEL}" updated:<${noResponseThreshold.toISOString()}`,
+    async (item) => {
+      core.info(
+        `Closing #${item.number} due to no response for ${NO_RESPONSE_DAYS} days.`,
+      );
+      if (!dryRun) {
+        await github.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: item.number,
+          body: `This item was marked as needing more information and has not received a response in ${NO_RESPONSE_DAYS} days. Closing it for now. If you still face this problem, feel free to reopen with more details. Thank you!`,
+        });
+        await github.rest.issues.update({
+          owner,
+          repo,
+          issue_number: item.number,
+          state: 'closed',
+        });
+      }
+    },
+  );
+
+  // 2. Handle Stale Mark (60 days inactivity, no stale label)
+  const exemptQuery = EXEMPT_LABELS.map((l) => `-label:"${l}"`).join(' ');
+  await processItems(
+    `repo:${owner}/${repo} is:open -label:"${STALE_LABEL}" ${exemptQuery} updated:<${staleThreshold.toISOString()}`,
+    async (item) => {
+      core.info(`Marking #${item.number} as stale.`);
+      if (!dryRun) {
+        await github.rest.issues.addLabels({
+          owner,
+          repo,
+          issue_number: item.number,
+          labels: [STALE_LABEL],
+        });
+        await github.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: item.number,
+          body: `This item has been automatically marked as stale due to ${STALE_DAYS} days of inactivity. It will be closed in ${CLOSE_DAYS} days if no further activity occurs. Thank you!`,
+        });
+      }
+    },
+  );
+
+  // 3. Handle Stale Close (14 days with stale label)
+  await processItems(
+    `repo:${owner}/${repo} is:open label:"${STALE_LABEL}" ${exemptQuery} updated:<${closeThreshold.toISOString()}`,
+    async (item) => {
+      core.info(`Closing stale item #${item.number}.`);
+      if (!dryRun) {
+        await github.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: item.number,
+          body: `This item has been closed due to ${CLOSE_DAYS} additional days of inactivity after being marked as stale. If you believe this is still relevant, feel free to comment or reopen. Thank you!`,
+        });
+        await github.rest.issues.update({
+          owner,
+          repo,
+          issue_number: item.number,
+          state: 'closed',
+        });
+      }
+    },
+  );
+
+  // 4. Handle PR Contribution Policy (Nudge at 7d, Close at 14d)
+  const PR_NUDGE_DAYS = 7;
+  const PR_CLOSE_DAYS = 14;
+  const nudgeThreshold = new Date(
+    now.getTime() - PR_NUDGE_DAYS * 24 * 60 * 60 * 1000,
+  );
+  const prCloseThreshold = new Date(
+    now.getTime() - PR_CLOSE_DAYS * 24 * 60 * 60 * 1000,
+  );
+
+  // Nudge
+  await processItems(
+    `repo:${owner}/${repo} is:open is:pr -label:"help wanted" -label:"🔒 maintainer only" -label:"status/pr-nudge-sent" created:${prCloseThreshold.toISOString()}..${nudgeThreshold.toISOString()}`,
+    async (pr) => {
+      if (await isMaintainer(pr.user, pr.author_association)) return;
+
+      core.info(`Nudging PR #${pr.number} for contribution policy.`);
+      if (!dryRun) {
+        await github.rest.issues.addLabels({
+          owner,
+          repo,
+          issue_number: pr.number,
+          labels: ['status/pr-nudge-sent'],
+        });
+        await github.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: pr.number,
+          body: "Hi there! Thank you for your interest in contributing to Gemini CLI. \n\nTo ensure we maintain high code quality and focus on our prioritized roadmap, we only guarantee review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'. \n\nThis PR will be closed in 7 days if it remains without that designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.",
+        });
+      }
+    },
+  );
+
+  // Close
+  await processItems(
+    `repo:${owner}/${repo} is:open is:pr -label:"help wanted" -label:"🔒 maintainer only" created:<${prCloseThreshold.toISOString()}`,
+    async (pr) => {
+      if (await isMaintainer(pr.user, pr.author_association)) return;
+
+      core.info(
+        `Closing PR #${pr.number} per contribution policy (no 'help wanted').`,
+      );
+      if (!dryRun) {
+        await github.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: pr.number,
+          body: "This pull request is being closed as it has been open for 14 days without a 'help wanted' designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.",
+        });
+        await github.rest.pulls.update({
+          owner,
+          repo,
+          pull_number: pr.number,
+          state: 'closed',
+        });
+      }
+    },
+  );
+};

.github/scripts/sync-issue-types.cjs

@@ -0,0 +1,99 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const fs = require('node:fs');
+
+module.exports = async ({ github, context, core }) => {
+  const query = `
+    query($owner: String!, $repo: String!) {
+      repository(owner: $owner, name: $repo) {
+        issues(first: 50, states: OPEN, orderBy: {field: UPDATED_AT, direction: DESC}) {
+          nodes {
+            id
+            number
+            title
+            body
+            issueType {
+              name
+            }
+            labels(first: 20) {
+              nodes {
+                name
+              }
+            }
+          }
+        }
+      }
+    }
+  `;
+
+  try {
+    const result = await github.graphql(query, {
+      owner: context.repo.owner,
+      repo: context.repo.repo,
+    });
+
+    const issues = result.repository.issues.nodes;
+    const issuesNeedingAnalysis = [];
+    let syncedCount = 0;
+
+    for (const issue of issues) {
+      if (issue.issueType === null) {
+        const labelNames = issue.labels.nodes.map((l) => l.name);
+        const hasBug = labelNames.includes('kind/bug');
+        const hasFeature =
+          labelNames.includes('kind/feature') ||
+          labelNames.includes('kind/enhancement');
+
+        let issueTypeId = null;
+        if (hasBug) {
+          issueTypeId = 'IT_kwDOCaSVvs4BR7vP'; // Bug
+        } else if (hasFeature) {
+          issueTypeId = 'IT_kwDOCaSVvs4BR7vQ'; // Feature
+        }
+
+        if (issueTypeId) {
+          await github.graphql(
+            `
+            mutation($issueId: ID!, $issueTypeId: ID!) {
+              updateIssue(input: {id: $issueId, issueTypeId: $issueTypeId}) {
+                issue {
+                  id
+                }
+              }
+            }
+          `,
+            {
+              issueId: issue.id,
+              issueTypeId: issueTypeId,
+            },
+          );
+          core.info(`Successfully synced Issue Type for #${issue.number}`);
+          syncedCount++;
+        } else {
+          // Needs analysis to determine kind/type
+          issuesNeedingAnalysis.push({
+            number: issue.number,
+            title: issue.title,
+            body: issue.body,
+          });
+        }
+      }
+    }
+
+    // Write issues needing analysis to a file so the AI can process them
+    fs.writeFileSync(
+      'no_type_issues.json',
+      JSON.stringify(issuesNeedingAnalysis),
+    );
+    core.info(`Synced ${syncedCount} issues from labels.`);
+    core.info(
+      `Found ${issuesNeedingAnalysis.length} issues missing both type and kind label to be analyzed.`,
+    );
+  } catch (error) {
+    core.setFailed(`Failed to sync issue types: ${error.message}`);
+  }
+};

.github/scripts/sync-maintainer-labels.cjs

@@ -347,6 +347,36 @@ async function run() {
           });
         }
       }
+
+      // Remove status/need-triage from maintainer-only issues since they
+      // don't need community triage. We always attempt removal rather than
+      // checking the (potentially stale) label snapshot, because the
+      // issue-opened-labeler workflow runs concurrently and may add the
+      // label after our snapshot was taken.
+      if (isDryRun) {
+        console.log(
+          `[DRY RUN] Would remove status/need-triage from ${issueKey}`,
+        );
+      } else {
+        try {
+          await octokit.rest.issues.removeLabel({
+            owner: issueInfo.owner,
+            repo: issueInfo.repo,
+            issue_number: issueInfo.number,
+            name: 'status/need-triage',
+          });
+          console.log(`Removed status/need-triage from ${issueKey}`);
+        } catch (removeError) {
+          // 404 means the label wasn't present — that's fine.
+          if (removeError.status === 404) {
+            console.log(
+              `status/need-triage not present on ${issueKey}, skipping.`,
+            );
+          } else {
+            throw removeError;
+          }
+        }
+      }
     } catch (error) {
       console.error(`Error processing label for ${issueKey}: ${error.message}`);
     }

.github/workflows/agent-session-drift-check.yml

@@ -0,0 +1,132 @@
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+
+name: 'Agent Session Drift Check'
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+      - 'release/**'
+    paths:
+      - 'packages/cli/src/nonInteractiveCli.ts'
+      - 'packages/cli/src/nonInteractiveCliAgentSession.ts'
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  check-drift:
+    name: 'Check Agent Session Drift'
+    runs-on: 'ubuntu-latest'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    permissions:
+      contents: 'read'
+      pull-requests: 'write'
+    steps:
+      - name: 'Detect drift and comment'
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v8
+        with:
+          script: |-
+            // === Pair configuration — append here to cover more pairs ===
+            const PAIRS = [
+              {
+                legacy: 'packages/cli/src/nonInteractiveCli.ts',
+                session: 'packages/cli/src/nonInteractiveCliAgentSession.ts',
+                label: 'non-interactive CLI',
+              },
+              // Future pairs can be added here. Remember to also add both
+              // paths to the `paths:` filter at the top of this workflow.
+              // Example:
+              // {
+              //   legacy: 'packages/core/src/agents/local-invocation.ts',
+              //   session: 'packages/core/src/agents/local-session-invocation.ts',
+              //   label: 'local subagent invocation',
+              // },
+            ];
+            // ============================================================
+
+            const prNumber = context.payload.pull_request.number;
+            const { owner, repo } = context.repo;
+
+            // Use the API to list changed files — no checkout/git diff needed.
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner,
+              repo,
+              pull_number: prNumber,
+              per_page: 100,
+            });
+            const changed = new Set(files.map((f) => f.filename));
+
+            const warnings = [];
+            for (const { legacy, session, label } of PAIRS) {
+              const legacyChanged = changed.has(legacy);
+              const sessionChanged = changed.has(session);
+              if (legacyChanged && !sessionChanged) {
+                warnings.push(
+                  `**${label}**: \`${legacy}\` was modified but \`${session}\` was not.`,
+                );
+              } else if (!legacyChanged && sessionChanged) {
+                warnings.push(
+                  `**${label}**: \`${session}\` was modified but \`${legacy}\` was not.`,
+                );
+              }
+            }
+
+            const MARKER = '<!-- agent-session-drift-check -->';
+
+            // Look up our existing drift comment (for upsert/cleanup).
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner,
+              repo,
+              issue_number: prNumber,
+              per_page: 100,
+            });
+            const existing = comments.find(
+              (c) => c.user?.type === 'Bot' && c.body?.includes(MARKER),
+            );
+
+            if (warnings.length === 0) {
+              core.info('No drift detected.');
+              // If drift was previously flagged and is now resolved, remove the comment.
+              if (existing) {
+                await github.rest.issues.deleteComment({
+                  owner,
+                  repo,
+                  comment_id: existing.id,
+                });
+                core.info(`Deleted stale drift comment ${existing.id}.`);
+              }
+              return;
+            }
+
+            const body = [
+              MARKER,
+              '### ⚠️ Invocation Drift Warning',
+              '',
+              'The following file pairs should generally be kept in sync during the AgentSession migration:',
+              '',
+              ...warnings.map((w) => `- ${w}`),
+              '',
+              'If this is intentional (e.g., a bug fix specific to one implementation), you can ignore this comment.',
+              '',
+              '_This check will be removed once the legacy implementations are deleted._',
+            ].join('\n');
+
+            if (existing) {
+              core.info(`Updating existing drift comment ${existing.id}.`);
+              await github.rest.issues.updateComment({
+                owner,
+                repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              core.info('Creating new drift comment.');
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: prNumber,
+                body,
+              });
+            }

.github/workflows/build-unsigned-mac-binaries.yml

@@ -0,0 +1,65 @@
+name: 'Build Unsigned Mac Binaries'
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      ref:
+        description: 'The branch, tag, or SHA to build from.'
+        required: true
+        type: 'string'
+
+permissions:
+  contents: 'read'
+
+defaults:
+  run:
+    shell: 'bash'
+
+jobs:
+  build-mac:
+    name: 'Build Unsigned (${{ matrix.arch }})'
+    runs-on: 'macos-latest'
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: ['x64', 'arm64']
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        with:
+          ref: '${{ inputs.ref || github.ref }}'
+          persist-credentials: false
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          architecture: '${{ matrix.arch }}'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build Binary'
+        env:
+          SKIP_SIGNING: 'true'
+        run: 'npm run build:binary'
+
+      - name: 'Verify Output Exists'
+        run: |
+          if [ -f "dist/darwin-${{ matrix.arch }}/gemini" ]; then
+            echo "Binary found at dist/darwin-${{ matrix.arch }}/gemini"
+          else
+            echo "Error: Binary not found in dist/darwin-${{ matrix.arch }}/"
+            ls -R dist/
+            exit 1
+          fi
+
+      - name: 'Upload Artifact'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'gemini-darwin-${{ matrix.arch }}-unsigned'
+          path: 'dist/darwin-${{ matrix.arch }}/gemini'
+          retention-days: 14

.github/workflows/chained_e2e.yml

@@ -148,6 +148,7 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -167,6 +168,7 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           VERBOSE: 'true'
           BUILD_SANDBOX_FLAGS: '--cache-from type=gha --cache-to type=gha,mode=max'
@@ -183,7 +185,7 @@ jobs:
     needs:
       - 'merge_queue_skipper'
       - 'parse_run_context'
-    runs-on: 'macos-latest'
+    runs-on: 'macos-latest-large'
     if: |
       github.repository == 'google-gemini/gemini-cli' && always() && (needs.merge_queue_skipper.result !='success' || needs.merge_queue_skipper.outputs.skip != 'true')
     steps:
@@ -192,6 +194,7 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -212,6 +215,7 @@ jobs:
         if: "${{runner.os != 'Windows'}}"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           SANDBOX: 'sandbox:none'
           VERBOSE: 'true'
@@ -231,6 +235,7 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -288,6 +293,7 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           SANDBOX: 'sandbox:none'
           VERBOSE: 'true'
@@ -311,6 +317,7 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
+          persist-credentials: false
           fetch-depth: 0
 
       - name: 'Set up Node.js 20.x'
@@ -334,8 +341,23 @@ jobs:
         if: "${{ steps.check_evals.outputs.should_run == 'true' }}"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
+          GEMINI_MODEL: 'gemini-3-pro-preview'
+          # Only run always passes behavioral tests.
+          EVAL_SUITE_TYPE: 'behavioral'
+          # Disable Vitest internal retries to avoid double-retrying;
+          # custom retry logic is handled in evals/test-helper.ts
+          VITEST_RETRY: 0
         run: 'npm run test:always_passing_evals'
 
+      - name: 'Upload Reliability Logs'
+        if: "always() && steps.check_evals.outputs.should_run == 'true'"
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'eval-logs-${{ github.run_id }}-${{ github.run_attempt }}'
+          path: 'evals/logs/api-reliability.jsonl'
+          retention-days: 7
+
   e2e:
     name: 'E2E'
     if: |

.github/workflows/ci.yml

@@ -57,6 +57,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
           fetch-depth: 0
 
@@ -67,7 +68,7 @@ jobs:
           cache: 'npm'
 
       - name: 'Cache Linters'
-        uses: 'actions/cache@v4'
+        uses: 'actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830' # ratchet:actions/cache@v4
         with:
           path: '${{ env.GEMINI_LINT_TEMP_DIR }}'
           key: "${{ runner.os }}-${{ runner.arch }}-linters-${{ hashFiles('scripts/lint.js') }}"
@@ -76,7 +77,7 @@ jobs:
         run: 'npm ci'
 
       - name: 'Cache ESLint'
-        uses: 'actions/cache@v4'
+        uses: 'actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830' # ratchet:actions/cache@v4
         with:
           path: '.eslintcache'
           key: "${{ runner.os }}-eslint-${{ hashFiles('package-lock.json', 'eslint.config.js') }}"
@@ -102,6 +103,12 @@ jobs:
       - name: 'Run yamllint'
         run: 'node scripts/lint.js --yamllint'
 
+      - name: 'Build project for typecheck'
+        run: 'npm run build'
+
+      - name: 'Run typecheck'
+        run: 'npm run typecheck'
+
       - name: 'Run Prettier'
         run: 'node scripts/lint.js --prettier'
 
@@ -114,6 +121,9 @@ jobs:
       - name: 'Run sensitive keyword linter'
         run: 'node scripts/lint.js --sensitive-keywords'
 
+      - name: 'Run GitHub Actions pinning linter'
+        run: 'node scripts/lint.js --check-github-actions-pinning'
+
   link_checker:
     name: 'Link Checker'
     runs-on: 'ubuntu-latest'
@@ -121,6 +131,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: 'Link Checker'
         uses: 'lycheeverse/lychee-action@885c65f3dc543b57c898c8099f4e08c8afd178a2' # ratchet: lycheeverse/lychee-action@v2.6.1
         with:
@@ -148,6 +160,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
@@ -158,18 +172,25 @@ jobs:
       - name: 'Build project'
         run: 'npm run build'
 
+      - name: 'Install system dependencies'
+        run: |
+          sudo apt-get update -qq && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq bubblewrap
+          # Ubuntu 24.04+ requires this to allow bwrap to function in CI
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+
       - name: 'Install dependencies for testing'
         run: 'npm ci'
 
       - name: 'Run tests and generate reports'
         env:
           NO_COLOR: true
+          GEMINI_CLI_TRUST_WORKSPACE: true
         run: |
           if [[ "${{ matrix.shard }}" == "cli" ]]; then
-            npm run test:ci --workspace @google/gemini-cli
+            npm run test:ci --workspace "@google/gemini-cli"
           else
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
             npm run test:scripts
           fi
 
@@ -215,7 +236,7 @@ jobs:
 
   test_mac:
     name: 'Test (Mac) - ${{ matrix.node-version }}, ${{ matrix.shard }}'
-    runs-on: 'macos-latest'
+    runs-on: 'macos-latest-large'
     needs:
       - 'merge_queue_skipper'
     if: "github.repository == 'google-gemini/gemini-cli' && needs.merge_queue_skipper.outputs.skip == 'false'"
@@ -236,6 +257,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
@@ -252,12 +275,13 @@ jobs:
       - name: 'Run tests and generate reports'
         env:
           NO_COLOR: true
+          GEMINI_CLI_TRUST_WORKSPACE: true
         run: |
           if [[ "${{ matrix.shard }}" == "cli" ]]; then
-            npm run test:ci --workspace @google/gemini-cli -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli" -- --coverage.enabled=false
           else
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
             npm run test:scripts
           fi
 
@@ -322,6 +346,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
 
       - name: 'Initialize CodeQL'
@@ -346,6 +371,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
           fetch-depth: 1
 
@@ -373,6 +399,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
 
       - name: 'Set up Node.js 20.x'
@@ -415,16 +442,20 @@ jobs:
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
           NO_COLOR: true
+          GEMINI_CLI_TRUST_WORKSPACE: true
           NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
           UV_THREADPOOL_SIZE: '32'
           NODE_ENV: 'test'
         run: |
           if ("${{ matrix.shard }}" -eq "cli") {
-            npm run test:ci --workspace @google/gemini-cli -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli" -- --coverage.enabled=false
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           } else {
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
             npm run test:scripts
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
         shell: 'pwsh'
 

.github/workflows/deflake.yml

@@ -43,6 +43,7 @@ jobs:
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -62,6 +63,7 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           IS_DOCKER: "${{ matrix.sandbox == 'sandbox:docker' }}"
           KEEP_OUTPUT: 'true'
           RUNS: '${{ github.event.inputs.runs }}'
@@ -77,7 +79,7 @@ jobs:
 
   deflake_e2e_mac:
     name: 'E2E Test (macOS)'
-    runs-on: 'macos-latest'
+    runs-on: 'macos-latest-large'
     if: "github.repository == 'google-gemini/gemini-cli'"
     steps:
       - name: 'Checkout'
@@ -85,6 +87,7 @@ jobs:
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -105,6 +108,7 @@ jobs:
         if: "runner.os != 'Windows'"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           RUNS: '${{ github.event.inputs.runs }}'
           SANDBOX: 'sandbox:none'
@@ -123,6 +127,7 @@ jobs:
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
+          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -159,6 +164,7 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           SANDBOX: 'sandbox:none'
           VERBOSE: 'true'

.github/workflows/docs-audit.yml

@@ -0,0 +1,65 @@
+name: 'Automated Documentation Audit'
+
+on:
+  schedule:
+    # Runs every Monday at 00:00 UTC
+    - cron: '0 0 * * MON'
+  workflow_dispatch:
+
+jobs:
+  audit-docs:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+
+    steps:
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
+        with:
+          fetch-depth: 0
+          ref: 'main'
+          persist-credentials: false
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version: '20'
+
+      - name: 'Run Docs Audit with Gemini'
+        id: 'run_gemini'
+        uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31'
+        env:
+          GEMINI_CLI_TRUST_WORKSPACE: true
+        with:
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          prompt: |
+            Activate the 'docs-writer' skill.
+
+            **Task:** Execute the docs audit procedure, as defined in your 'docs-auditing.md' reference.
+            Provide a detailed summary of the changes you make.
+
+      - name: 'Get current date'
+        id: 'date'
+        run: |
+          echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
+
+      - name: 'Create Pull Request with Audit Results'
+        uses: 'peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c'
+        with:
+          token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          commit-message: 'docs: weekly audit results for ${{ github.run_id }}'
+          title: 'Docs audit: ${{ steps.date.outputs.date }}'
+          body: |
+            This PR contains the auto-generated documentation audit for the week. It includes a new `audit-results-*.md` file with findings and any direct fixes applied by the agent.
+
+            ### Audit Summary:
+            ${{ steps.run_gemini.outputs.summary || 'No summary provided.' }}
+
+            Please review the suggestions and merge.
+
+            Related to #25152
+          branch: 'docs-audit-${{ github.run_id }}'
+          base: 'main'
+          team-reviewers: 'gemini-cli-docs, gemini-cli-maintainers'
+          delete-branch: true

.github/workflows/docs-page-action.yml

@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Setup Pages'
         uses: 'actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b' # ratchet:actions/configure-pages@v5

.github/workflows/eval-pr.yml

@@ -0,0 +1,211 @@
+name: 'Evals: PR Evaluation & Regression'
+
+on:
+  pull_request_target:
+    types: ['opened', 'synchronize', 'reopened', 'ready_for_review']
+    paths:
+      - 'packages/core/src/prompts/**'
+      - 'packages/core/src/tools/**'
+      - 'packages/core/src/agents/**'
+      - 'evals/**'
+      - '!**/*.test.ts'
+      - '!**/*.test.tsx'
+  workflow_dispatch:
+
+# Prevents multiple runs for the same PR simultaneously (saves tokens)
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: 'write'
+  contents: 'read'
+  actions: 'read'
+
+jobs:
+  detect-changes:
+    name: 'Detect Steering Changes'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    # Security: pull_request_target allows secrets, so we must gate carefully.
+    # Detection should not run code from the fork.
+    if: "github.repository == 'google-gemini/gemini-cli' && github.event.pull_request.draft == false"
+    outputs:
+      SHOULD_RUN: '${{ steps.detect.outputs.SHOULD_RUN }}'
+      STEERING_DETECTED: '${{ steps.detect.outputs.STEERING_DETECTED }}'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          # Check out the trusted code from main for detection
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: 'Detect Steering Changes'
+        id: 'detect'
+        env:
+          # Use the PR's head SHA for comparison without checking it out
+          PR_HEAD_SHA: '${{ github.event.pull_request.head.sha }}'
+        run: |
+          # Fetch the fork's PR branch for analysis
+          git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-head
+
+          # Run the trusted script from main
+          SHOULD_RUN=$(node scripts/changed_prompt.js)
+          STEERING_DETECTED=$(node scripts/changed_prompt.js --steering-only)
+          echo "SHOULD_RUN=$SHOULD_RUN" >> "$GITHUB_OUTPUT"
+          echo "STEERING_DETECTED=$STEERING_DETECTED" >> "$GITHUB_OUTPUT"
+
+      - name: 'Notify Approval Required'
+        if: "steps.detect.outputs.SHOULD_RUN == 'true'"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          COMMENT_BODY="### 🛑 Action Required: Evaluation Approval
+
+          Steering changes have been detected in this PR. To prevent regressions, a maintainer must approve the evaluation run before this PR can be merged.
+
+          **Maintainers:**
+          1. Go to the [**Workflow Run Summary**]($RUN_URL).
+          2. Click the yellow **'Review deployments'** button.
+          3. Select the **'eval-gate'** environment and click **'Approve'**.
+
+          Once approved, the evaluation results will be posted here automatically.
+
+          <!-- eval-approval-notification -->"
+
+          # Check if comment already exists to avoid spamming
+          COMMENT_ID=$(gh pr view ${{ github.event.pull_request.number }} --json comments --jq '.comments[] | select(.body | contains("<!-- eval-approval-notification -->")) | .url' | grep -oE "[0-9]+$" | head -n 1)
+
+          if [ -z "$COMMENT_ID" ]; then
+            gh pr comment ${{ github.event.pull_request.number }} --body "$COMMENT_BODY"
+          else
+            echo "Updating existing notification comment $COMMENT_ID..."
+            gh api -X PATCH "repos/${{ github.repository }}/issues/comments/$COMMENT_ID" -F body="$COMMENT_BODY"
+          fi
+
+  pr-evaluation:
+    name: 'Evaluate Steering & Regressions'
+    needs: 'detect-changes'
+    if: "needs.detect-changes.outputs.SHOULD_RUN == 'true'"
+    # Manual approval gate via environment
+    environment: 'eval-gate'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    env:
+      # CENTRALIZED MODEL LIST
+      MODEL_LIST: 'gemini-3-flash-preview'
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        with:
+          # Check out the fork's PR code for the actual evaluation
+          # This only runs AFTER manual approval
+          ref: '${{ github.event.pull_request.head.sha }}'
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: 'Remove Approval Notification'
+        # Run even if other steps fail, to ensure we clean up the "Action Required" message
+        if: 'always()'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          PR_NUMBER: '${{ github.event.pull_request.number }}'
+        run: |
+          echo "Debug: PR_NUMBER is '$PR_NUMBER'"
+          # Search for the notification comment by its hidden tag
+          COMMENT_ID=$(gh pr view "$PR_NUMBER" --json comments --jq '.comments[] | select(.body | contains("<!-- eval-approval-notification -->")) | .url' | grep -oE "[0-9]+$" | head -n 1)
+          if [ -n "$COMMENT_ID" ]; then
+            echo "Removing notification comment $COMMENT_ID now that run is approved..."
+            gh api -X DELETE "repos/${{ github.repository }}/issues/comments/$COMMENT_ID"
+          fi
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4.4.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Analyze PR Content (Guidance)'
+        if: "needs.detect-changes.outputs.STEERING_DETECTED == 'true'"
+        id: 'analysis'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          # Check for behavioral eval changes
+          EVAL_CHANGES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep "^evals/" || true)
+          if [ -z "$EVAL_CHANGES" ]; then
+            echo "MISSING_EVALS=true" >> "$GITHUB_OUTPUT"
+          fi
+
+          # Check if user is a maintainer
+          USER_PERMISSION=$(gh api repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission --jq '.permission')
+          if [[ "$USER_PERMISSION" == "admin" || "$USER_PERMISSION" == "write" ]]; then
+            echo "IS_MAINTAINER=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: 'Execute Regression Check'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          MODEL_LIST: '${{ env.MODEL_LIST }}'
+        run: |
+          # Run the regression check loop. The script saves the report to a file.
+          node scripts/run_eval_regression.js
+
+          # Use the generated report file if it exists
+          if [[ -f eval_regression_report.md ]]; then
+            echo "REPORT_FILE=eval_regression_report.md" >> "$GITHUB_ENV"
+          fi
+
+      - name: 'Post or Update PR Comment'
+        if: "always() && (needs.detect-changes.outputs.STEERING_DETECTED == 'true' || env.REPORT_FILE != '')"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          # 1. Build the full comment body
+          {
+            if [[ -f eval_regression_report.md ]]; then
+              cat eval_regression_report.md
+              echo ""
+            fi
+
+            if [[ "${{ needs.detect-changes.outputs.STEERING_DETECTED }}" == "true" ]]; then
+              echo "### 🧠 Model Steering Guidance"
+              echo ""
+              echo "This PR modifies files that affect the model's behavior (prompts, tools, or instructions)."
+              echo ""
+
+              if [[ "${{ steps.analysis.outputs.MISSING_EVALS }}" == "true" ]]; then
+                echo "- ⚠️ **Consider adding Evals:** No behavioral evaluations (\`evals/*.eval.ts\`) were added or updated in this PR. Consider [adding a test case](https://github.com/google-gemini/gemini-cli/blob/main/evals/README.md#creating-an-evaluation) to verify the new behavior and prevent regressions."
+              fi
+
+              if [[ "${{ steps.analysis.outputs.IS_MAINTAINER }}" == "true" ]]; then
+                echo "- 🚀 **Maintainer Reminder:** Please ensure that these changes do not regress results on benchmark evals before merging."
+              fi
+            fi
+
+            echo ""
+            echo "---"
+            echo "*This is an automated guidance message triggered by steering logic signatures.*"
+            echo "<!-- eval-pr-report -->"
+          } > full_comment.md
+
+          # 2. Find if a comment with our unique tag already exists
+          # We extract the numeric ID from the URL to ensure compatibility with the REST API
+          COMMENT_ID=$(gh pr view ${{ github.event.pull_request.number }} --json comments --jq '.comments[] | select(.body | contains("<!-- eval-pr-report -->")) | .url' | grep -oE "[0-9]+$" | head -n 1)
+
+          # 3. Update or Create the comment
+          if [ -n "$COMMENT_ID" ]; then
+            echo "Updating existing comment $COMMENT_ID via API..."
+            gh api -X PATCH "repos/${{ github.repository }}/issues/comments/$COMMENT_ID" -F body=@full_comment.md
+          else
+            echo "Creating new PR comment..."
+            gh pr comment ${{ github.event.pull_request.number }} --body-file full_comment.md
+          fi

.github/workflows/evals-nightly.yml

@@ -5,10 +5,18 @@ on:
     - cron: '0 1 * * *' # Runs at 1 AM every day
   workflow_dispatch:
     inputs:
-      run_all:
-        description: 'Run all evaluations (including usually passing)'
-        type: 'boolean'
-        default: true
+      suite_type:
+        description: 'Suite type to run'
+        type: 'choice'
+        options:
+          - 'behavioral'
+          - 'component-level'
+          - 'hero-scenario'
+        default: 'behavioral'
+      suite_name:
+        description: 'Specific suite name to run'
+        required: false
+        type: 'string'
       test_name_pattern:
         description: 'Test name pattern or file name'
         required: false
@@ -38,6 +46,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Set up Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
@@ -58,9 +68,15 @@ jobs:
         continue-on-error: true
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
           GEMINI_MODEL: '${{ matrix.model }}'
-          RUN_EVALS: "${{ github.event.inputs.run_all != 'false' }}"
+          RUN_EVALS: 'true'
+          EVAL_SUITE_TYPE: "${{ github.event.inputs.suite_type || 'behavioral' }}"
+          EVAL_SUITE_NAME: '${{ github.event.inputs.suite_name }}'
           TEST_NAME_PATTERN: '${{ github.event.inputs.test_name_pattern }}'
+          # Disable Vitest internal retries to avoid double-retrying;
+          # custom retry logic is handled in evals/test-helper.ts
+          VITEST_RETRY: 0
         run: |
           CMD="npm run test:all_evals"
           PATTERN="${TEST_NAME_PATTERN}"
@@ -91,6 +107,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Download Logs'
         uses: 'actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806' # ratchet:actions/download-artifact@v4

.github/workflows/gemini-automated-issue-dedup.yml

@@ -48,6 +48,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Log in to GitHub Container Registry'
         uses: 'docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1' # ratchet:docker/login-action@v3

.github/workflows/gemini-automated-issue-triage.yml

@@ -90,6 +90,8 @@ jobs:
 
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Generate GitHub App Token'
         id: 'generate_token'
@@ -129,19 +131,29 @@ jobs:
             core.info(`Found ${labelNames.length} labels: ${labelNames.join(', ')}`);
             return labelNames;
 
+      - name: 'Prepare Issue Data'
+        id: 'prepare_issue_data'
+        env:
+          ISSUE_TITLE: >-
+            ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.title || github.event.issue.title }}
+          ISSUE_BODY: >-
+            ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.body || github.event.issue.body }}
+        run: |
+          set -euo pipefail
+          echo "Title: ${ISSUE_TITLE}" > issue_context.md
+          echo "Body:" >> issue_context.md
+          echo "${ISSUE_BODY}" >> issue_context.md
+
       - name: 'Run Gemini Issue Analysis'
         uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
         id: 'gemini_issue_analysis'
         env:
           GITHUB_TOKEN: '' # Do not pass any auth token here since this runs on untrusted inputs
-          ISSUE_TITLE: >-
-            ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.title || github.event.issue.title }}
-          ISSUE_BODY: >-
-            ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.body || github.event.issue.body }}
           ISSUE_NUMBER: >-
             ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.issue_number || inputs.issue_number) || github.event.issue.number }}
           REPOSITORY: '${{ github.repository }}'
           AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
+          GEMINI_CLI_TRUST_WORKSPACE: 'true'
         with:
           gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
@@ -158,7 +170,8 @@ jobs:
                 "target": "gcp"
               },
               "coreTools": [
-                "run_shell_command(echo)"
+                "run_shell_command(echo)",
+                "read_file"
               ]
             }
           prompt: |-
@@ -167,7 +180,7 @@ jobs:
             You are an issue triage assistant. Your role is to analyze a GitHub issue and determine the single most appropriate area/ label based on the definitions provided.
 
             ## Steps
-            1. Review the issue title and body: ${{ env.ISSUE_TITLE }} and ${{ env.ISSUE_BODY }}.
+            1. Use the read_file tool to read the file "issue_context.md" which contains the issue title and body.
             2. Review the available labels: ${{ env.AVAILABLE_LABELS }}.
             3. Select exactly one area/ label that best matches the issue based on Reference 1: Area Definitions.
             4. Fallback Logic:

.github/workflows/gemini-cli-bot-brain.yml

@@ -0,0 +1,350 @@
+name: '🧠 Gemini CLI Bot: Brain'
+
+on:
+  schedule:
+    - cron: '0 0 * * *' # Every 24 hours
+  issue_comment:
+    types: ['created']
+  workflow_dispatch:
+    inputs:
+      run_interactive:
+        description: 'Run interactive flow (requires issue_number)'
+        type: 'boolean'
+        default: false
+      issue_number:
+        description: 'Issue/PR number to simulate context from'
+        type: 'string'
+        required: false
+      comment_id:
+        description: 'Specific comment ID to simulate'
+        type: 'string'
+        required: false
+      clear_memory:
+        description: 'Clear memory (drops learnings from previous runs)'
+        type: 'boolean'
+        default: false
+      enable_prs:
+        description: 'Enable PRs (automatically promote changes to PRs)'
+        type: 'boolean'
+        default: false
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.event.issue.number || github.event.inputs.issue_number || github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  reasoning:
+    name: 'Brain (Reasoning Layer)'
+    runs-on: 'ubuntu-latest'
+    if: |
+      github.repository == 'google-gemini/gemini-cli' && (
+        github.event_name == 'schedule' ||
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.run_interactive != 'true') ||
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.run_interactive == 'true') ||
+        (github.event_name == 'issue_comment' && github.event.comment.user.login != 'gemini-cli[bot]' && contains(github.event.comment.body, '@gemini-cli') && contains(fromJSON('["COLLABORATOR", "MEMBER", "OWNER"]'), github.event.comment.author_association))
+      )
+    # The reasoning phase is strictly readonly.
+    permissions:
+      contents: 'read'
+      issues: 'read'
+      actions: 'read'
+    env:
+      GEMINI_CLI_TRUST_WORKSPACE: 'true'
+    steps:
+      - name: 'Determine Checkout Ref'
+        id: 'determine_ref'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
+        run: |
+          REF="${{ github.ref }}"
+          if [ -n "$ISSUE_NUMBER" ]; then
+            PR_HEAD=$(gh pr view "$ISSUE_NUMBER" --repo "${{ github.repository }}" --json headRefName --jq .headRefName 2>/dev/null || echo "")
+            if [ -n "$PR_HEAD" ]; then
+              REF="$PR_HEAD"
+            fi
+          fi
+          echo "ref=$REF" >> "$GITHUB_OUTPUT"
+
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ steps.determine_ref.outputs.ref }}'
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build Gemini CLI'
+        run: 'npm run bundle'
+
+      - name: 'Download Previous State'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          if [ "${{ github.event.inputs.clear_memory }}" = "true" ]; then
+            echo "Memory clear requested. Skipping previous state download."
+            exit 0
+          fi
+
+          # Find the last successful run of this workflow
+          LAST_RUN_ID=$(gh run list --workflow "${{ github.workflow }}" --status success --limit 1 --json databaseId --jq '.[0].databaseId')
+
+          if [ -n "$LAST_RUN_ID" ]; then
+            echo "Found previous successful run: $LAST_RUN_ID"
+
+            # Download brain memory to a temp dir so we can selectively restore only persistent state
+            mkdir -p .temp_brain_data
+            gh run download "$LAST_RUN_ID" -n brain-data -D .temp_brain_data || echo "brain-data not found"
+
+            # Restore only persistent memory files
+            cp .temp_brain_data/tools/gemini-cli-bot/lessons-learned.md tools/gemini-cli-bot/lessons-learned.md 2>/dev/null || true
+            mkdir -p tools/gemini-cli-bot/history/
+            cp .temp_brain_data/tools/gemini-cli-bot/history/*.csv tools/gemini-cli-bot/history/ 2>/dev/null || true
+            rm -rf .temp_brain_data
+          else
+            echo "No previous successful run found."
+          fi
+
+      - name: 'Collect Current Metrics'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: 'npx tsx tools/gemini-cli-bot/metrics/index.ts'
+
+      - name: 'Run Brain Phases'
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GEMINI_MODEL: 'gemini-3-flash-preview'
+          GEMINI_CLI_HOME: 'tools/gemini-cli-bot'
+          ENABLE_PRS: "${{ github.event.inputs.enable_prs || 'false' }}"
+          TRIGGER_ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
+          TRIGGER_COMMENT_ID: '${{ github.event.comment.id || github.event.inputs.comment_id }}'
+        run: |
+          PROMPT_PATH="tools/gemini-cli-bot/brain/scheduled.md"
+          if [ "${{ github.event_name }}" = "issue_comment" ] || [ "${{ github.event.inputs.run_interactive }}" = "true" ]; then
+            PROMPT_PATH="tools/gemini-cli-bot/brain/interactive.md"
+            export ENABLE_PRS="true"
+          fi
+
+          touch trigger_context.md
+          if [ -n "$TRIGGER_ISSUE_NUMBER" ]; then
+            echo "<untrusted_context>" > trigger_context.md
+            echo "# Interactive Trigger Context" >> trigger_context.md
+            echo "You were invoked by a user in issue/PR #$TRIGGER_ISSUE_NUMBER." >> trigger_context.md
+
+            if [ -n "$TRIGGER_COMMENT_ID" ]; then
+              echo "## User Comment" >> trigger_context.md
+              gh api "repos/${{ github.repository }}/issues/comments/$TRIGGER_COMMENT_ID" -q '.body' >> trigger_context.md 2>/dev/null || gh api "repos/${{ github.repository }}/pulls/comments/$TRIGGER_COMMENT_ID" -q '.body' >> trigger_context.md
+              echo "" >> trigger_context.md
+            fi
+
+            echo "## Issue/PR Context" >> trigger_context.md
+            gh issue view "$TRIGGER_ISSUE_NUMBER" >> trigger_context.md 2>/dev/null || gh pr view "$TRIGGER_ISSUE_NUMBER" >> trigger_context.md
+            echo "</untrusted_context>" >> trigger_context.md
+          fi
+
+          if [ "$ENABLE_PRS" = "true" ]; then
+            echo "**System Directive**: PR creation is ENABLED for this run. You MUST activate the **'prs' skill** to stage your changes and generate a \`pr-description.md\` file if you are proposing fixes." >> trigger_context.md
+            echo "**CRITICAL System Directive**: You MUST ONLY propose and implement a **SINGLE** improvement or fix per run. Bundling unrelated changes (e.g., a documentation update and a script fix, or a metrics update and a logic fix) into a single PR is STRICTLY FORBIDDEN and will result in immediate rejection during the critique phase. If you identify multiple issues, pick the most impactful one and ignore the others for now." >> trigger_context.md
+          else
+            echo "**System Directive**: PR creation is DISABLED for this run. You MUST NOT stage files or attempt to create a PR description." >> trigger_context.md
+          fi
+          echo "" >> trigger_context.md
+
+          cat trigger_context.md "$PROMPT_PATH" > combined_prompt.md
+          node bundle/gemini.js --policy tools/gemini-cli-bot/ci-policy.toml --prompt="$(cat combined_prompt.md)"
+
+          if [ -n "$TRIGGER_ISSUE_NUMBER" ] && [ ! -s "issue-comment.md" ] && [ ! -s "pr-comment.md" ]; then
+            echo "Agent failed to respond. Generating fallback error message."
+            echo "⚠️ **Gemini CLI Bot failed to generate a response.**" > "issue-comment.md"
+            echo "" >> "issue-comment.md"
+            echo "I encountered an error or failed to generate a complete response to your request. You can check the [GitHub Actions Run Log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details on what went wrong." >> "issue-comment.md"
+          fi
+
+      - name: 'Run Critique Phase'
+        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
+        env:
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GEMINI_MODEL: 'gemini-3-flash-preview'
+          GEMINI_CLI_HOME: 'tools/gemini-cli-bot'
+        run: |
+          if git diff --staged --quiet; then
+             echo "No changes staged. Skipping critique."
+             echo "[APPROVED]" > critique_result.txt
+          else
+             node bundle/gemini.js --policy tools/gemini-cli-bot/ci-policy.toml --prompt="$(cat tools/gemini-cli-bot/.gemini/skills/critique/SKILL.md)" 2>&1 | tee critique_output.log
+
+             if [ "${PIPESTATUS[0]}" -eq 0 ] && grep -q "\[APPROVED\]" critique_output.log && ! grep -q "\[REJECTED\]" critique_output.log; then
+               echo "[APPROVED]" > critique_result.txt
+             else
+               echo "Critique failed, rejected, or did not explicitly approve changes. Skipping PR creation."
+               echo "[REJECTED]" > critique_result.txt
+             fi
+          fi
+
+      - name: 'Generate Patch'
+        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
+        run: |
+          touch bot-changes.patch
+          touch pr-description.md
+          if [ -f critique_result.txt ] && grep -q "\[APPROVED\]" critique_result.txt && ! grep -q "\[REJECTED\]" critique_result.txt; then
+             git diff --staged > bot-changes.patch
+          else
+             echo "Critique did not approve. Skipping patch generation."
+          fi
+
+      - name: 'Archive Brain Data'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
+        with:
+          name: 'brain-data'
+          path: |
+            tools/gemini-cli-bot/lessons-learned.md
+            tools/gemini-cli-bot/history/*.csv
+            bot-changes.patch
+            pr-description.md
+            branch-name.txt
+            pr-comment.md
+            pr-number.txt
+            issue-comment.md
+          retention-days: 90
+
+  publish:
+    name: 'Publish Artifacts (Archive Layer)'
+    needs: 'reasoning'
+    runs-on: 'ubuntu-latest'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    # The publish phase is for archiving artifacts and optionally creating PRs.
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+      actions: 'write'
+    steps:
+      - name: 'Generate GitHub App Token 🔑'
+        id: 'generate_token'
+        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
+        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # ratchet:actions/create-github-app-token@v2
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+          owner: '${{ github.repository_owner }}'
+          repositories: '${{ github.event.repository.name }}'
+          permission-contents: 'write'
+          permission-pull-requests: 'write'
+          permission-issues: 'write'
+
+      - name: 'Determine Checkout Ref'
+        id: 'determine_ref'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
+        run: |
+          REF="main"
+          if [ -n "$ISSUE_NUMBER" ]; then
+            PR_HEAD=$(gh pr view "$ISSUE_NUMBER" --repo "${{ github.repository }}" --json headRefName --jq .headRefName 2>/dev/null || echo "")
+            if [ -n "$PR_HEAD" ]; then
+              REF="$PR_HEAD"
+            fi
+          fi
+          echo "ref=$REF" >> "$GITHUB_OUTPUT"
+
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          ref: '${{ steps.determine_ref.outputs.ref }}'
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: 'Download Brain Data'
+        uses: 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093' # ratchet:actions/download-artifact@v4
+        with:
+          name: 'brain-data'
+          path: '${{ runner.temp }}/brain-data/'
+
+      - name: 'Create or Update PR'
+        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
+        env:
+          GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
+          FALLBACK_PAT: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+        run: |
+          if [ -s "${{ runner.temp }}/brain-data/bot-changes.patch" ]; then
+            git config user.name "gemini-cli[bot]"
+            git config user.email "gemini-cli[bot]@users.noreply.github.com"
+            git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
+
+            BRANCH_NAME="bot/productivity-updates-$(date +'%Y%m%d%H%M%S')-${{ github.run_id }}"
+            if [ -f "${{ runner.temp }}/brain-data/branch-name.txt" ]; then
+              BRANCH_NAME=$(cat "${{ runner.temp }}/brain-data/branch-name.txt")
+            fi
+
+            if [[ ! "$BRANCH_NAME" =~ ^bot/ ]]; then
+              echo "Error: Branch name '$BRANCH_NAME' does not start with 'bot/'. Safety abort."
+              exit 1
+            fi
+
+            git checkout -B "$BRANCH_NAME"
+            git apply "${{ runner.temp }}/brain-data/bot-changes.patch"
+            git add .
+
+            if [ -s "${{ runner.temp }}/brain-data/pr-description.md" ]; then
+              git commit -F "${{ runner.temp }}/brain-data/pr-description.md"
+            else
+              git commit -m "🤖 Gemini Bot Productivity Optimizations"
+            fi
+
+            PR_TITLE="🤖 Gemini Bot Productivity Optimizations"
+            if [ -s "${{ runner.temp }}/brain-data/pr-description.md" ]; then
+              PR_TITLE=$(head -n 1 "${{ runner.temp }}/brain-data/pr-description.md")
+            fi
+
+            if ! git push origin "$BRANCH_NAME" --force; then
+              echo "Push failed. Retrying with FALLBACK_PAT..."
+              export GH_TOKEN="$FALLBACK_PAT"
+              git remote set-url origin "https://x-access-token:${FALLBACK_PAT}@github.com/${{ github.repository }}.git"
+              git push origin "$BRANCH_NAME" --force
+            fi
+
+            if ! gh pr view "$BRANCH_NAME" > /dev/null 2>&1; then
+              gh pr create --draft --title "$PR_TITLE" --body-file "${{ runner.temp }}/brain-data/pr-description.md" --head "$BRANCH_NAME" --base main || \
+              gh pr create --draft --title "🤖 Gemini Bot Productivity Optimizations" --body "Automated changes generated by Gemini CLI Bot." --head "$BRANCH_NAME" --base main
+            else
+              PR_STATE=$(gh pr view "$BRANCH_NAME" --json state --jq .state)
+              if [ "$PR_STATE" = "CLOSED" ]; then
+                NEW_BRANCH_NAME="${BRANCH_NAME}-retry-${{ github.run_id }}"
+                git checkout -b "$NEW_BRANCH_NAME"
+                git push origin "$NEW_BRANCH_NAME" --force
+                gh pr create --draft --title "$PR_TITLE" --body-file "${{ runner.temp }}/brain-data/pr-description.md" --head "$NEW_BRANCH_NAME" --base main || \
+                gh pr create --draft --title "🤖 Gemini Bot Productivity Optimizations" --body "Automated changes generated by Gemini CLI Bot." --head "$NEW_BRANCH_NAME" --base main
+              fi
+            fi
+          fi
+
+      - name: 'Post PR/Issue Comment'
+        env:
+          GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
+          TRIGGER_ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
+        run: |
+          if [ -s "${{ runner.temp }}/brain-data/issue-comment.md" ] && [ -n "$TRIGGER_ISSUE_NUMBER" ]; then
+            echo "Posting comment to triggering issue #$TRIGGER_ISSUE_NUMBER"
+            # Use REST API (gh api) instead of GraphQL (gh issue comment) to ensure robot identity
+            # while avoiding potential GraphQL-specific authorization hurdles with PATs.
+            gh api "repos/${{ github.repository }}/issues/$TRIGGER_ISSUE_NUMBER/comments" -F body=@"${{ runner.temp }}/brain-data/issue-comment.md"
+          fi
+
+          if [ -s "${{ runner.temp }}/brain-data/pr-comment.md" ] && [ -f "${{ runner.temp }}/brain-data/pr-number.txt" ]; then
+            PR_NUM=$(cat "${{ runner.temp }}/brain-data/pr-number.txt")
+
+            # Using GitHub App, so author check is no longer valid against gemini-cli-robot
+            # Skipping author validation here to let the app post.
+
+            # Use REST API (gh api) for consistency and robot identity
+            gh api "repos/${{ github.repository }}/issues/$PR_NUM/comments" -F body=@"${{ runner.temp }}/brain-data/pr-comment.md"
+          fi

.github/workflows/gemini-cli-bot-pulse.yml

@@ -0,0 +1,49 @@
+name: '🔄 Gemini CLI Bot: Pulse'
+
+on:
+  schedule:
+    - cron: '*/30 * * * *' # Every 30 minutes
+  workflow_dispatch:
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.ref }}'
+  cancel-in-progress: true
+
+permissions:
+  contents: 'write'
+  issues: 'write'
+  pull-requests: 'write'
+
+jobs:
+  pulse:
+    name: 'Pulse (Reflex Layer)'
+    runs-on: 'ubuntu-latest'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Run Reflex Processes'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          if [ -d "tools/gemini-cli-bot/reflexes/scripts" ] && [ "$(ls -A tools/gemini-cli-bot/reflexes/scripts)" ]; then
+            for script in tools/gemini-cli-bot/reflexes/scripts/*.ts; do
+              echo "Running reflex script: $script"
+              npx tsx "$script"
+            done
+          else
+            echo "No reflex scripts found."
+          fi

.github/workflows/gemini-lifecycle-manager.yml

@@ -0,0 +1,47 @@
+name: '🔄 Gemini Scheduled Lifecycle Manager'
+
+on:
+  schedule:
+    - cron: '30 1 * * *' # Once a day
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run in dry-run mode (no changes applied)'
+        required: false
+        default: false
+        type: 'boolean'
+
+concurrency:
+  group: '${{ github.workflow }}'
+  cancel-in-progress: true
+
+permissions:
+  issues: 'write'
+  pull-requests: 'write'
+
+jobs:
+  manage-lifecycle:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: 'Lifecycle Management'
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        env:
+          DRY_RUN: '${{ inputs.dry_run }}'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |
+            const script = require('./.github/scripts/gemini-lifecycle-manager.cjs');
+            await script({github, context, core});

.github/workflows/gemini-scheduled-issue-dedup.yml

@@ -28,6 +28,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Log in to GitHub Container Registry'
         uses: 'docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1' # ratchet:docker/login-action@v3

.github/workflows/gemini-scheduled-issue-triage.yml

@@ -1,10 +1,6 @@
 name: '📋 Gemini Scheduled Issue Triage'
 
 on:
-  issues:
-    types:
-      - 'opened'
-      - 'reopened'
   schedule:
     - cron: '0 * * * *' # Runs every hour
   workflow_dispatch:
@@ -23,13 +19,15 @@ permissions:
 
 jobs:
   triage-issues:
-    timeout-minutes: 10
+    timeout-minutes: 60
     if: |-
       ${{ github.repository == 'google-gemini/gemini-cli' }}
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Generate GitHub App Token'
         id: 'generate_token'
@@ -47,10 +45,30 @@ jobs:
           ISSUE_EVENT: '${{ toJSON(github.event.issue) }}'
         run: |
           set -euo pipefail
-          ISSUE_JSON=$(echo "$ISSUE_EVENT" | jq -c '[{number: .number, title: .title, body: .body}]')
-          echo "issues_to_triage=${ISSUE_JSON}" >> "${GITHUB_OUTPUT}"
+          echo "$ISSUE_EVENT" | jq -c '[{number: .number, title: .title, body: .body}]' > issues_to_triage.json
+          echo "has_issues=true" >> "${GITHUB_OUTPUT}"
           echo "✅ Found issue #${{ github.event.issue.number }} from event to triage! 🎯"
 
+      - name: 'Sync Issue Types'
+        if: |-
+          ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |-
+            const syncIssueTypes = require('./.github/scripts/sync-issue-types.cjs');
+            await syncIssueTypes({ github, context, core });
+
+      - name: 'Find Issues with Conflicting Labels'
+        if: |-
+          ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |-
+            const findConflictingLabels = require('./.github/scripts/find-conflicting-labels.cjs');
+            await findConflictingLabels({ github, context, core });
+
       - name: 'Find untriaged issues'
         if: |-
           ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
@@ -62,25 +80,56 @@ jobs:
           set -euo pipefail
 
           echo '🔍 Finding issues missing area labels...'
-          NO_AREA_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue -label:area/core -label:area/agent -label:area/enterprise -label:area/non-interactive -label:area/security -label:area/platform -label:area/extensions -label:area/documentation -label:area/unknown' --limit 100 --json number,title,body)"
+          gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:status/bot-triaged -label:area/core -label:area/agent -label:area/enterprise -label:area/non-interactive -label:area/security -label:area/platform -label:area/extensions -label:area/documentation -label:area/unknown' --limit 50 --json number,title,body > no_area_issues.json
 
           echo '🔍 Finding issues missing kind labels...'
-          NO_KIND_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue -label:kind/bug -label:kind/enhancement -label:kind/customer-issue -label:kind/question' --limit 100 --json number,title,body)"
+          gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:status/bot-triaged -label:kind/bug -label:kind/enhancement -label:kind/customer-issue -label:kind/question' --limit 50 --json number,title,body > no_kind_issues.json
 
           echo '🏷️ Finding issues missing priority labels...'
-          NO_PRIORITY_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue -label:priority/p0 -label:priority/p1 -label:priority/p2 -label:priority/p3 -label:priority/unknown' --limit 100 --json number,title,body)"
+          gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:priority/p0 -label:priority/p1 -label:priority/p2 -label:priority/p3 -label:priority/unknown' --limit 50 --json number,title,body > no_priority_issues.json
 
-          echo '🔄 Merging and deduplicating issues...'
-          ISSUES="$(echo "${NO_AREA_ISSUES}" "${NO_KIND_ISSUES}" "${NO_PRIORITY_ISSUES}" | jq -c -s 'add | unique_by(.number)')"
+          echo '📏 Finding issues missing effort labels...'
+          gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:effort/small -label:effort/medium -label:effort/large label:area/core,area/extensions,area/site,area/non-interactive' --limit 5 --json number,title,body > no_effort_issues.json
 
-          echo '📝 Setting output for GitHub Actions...'
-          echo "issues_to_triage=${ISSUES}" >> "${GITHUB_OUTPUT}"
+          echo '🔄 Merging and deduplicating standard triage issues...'
+          if [ ! -f conflicting_labels_issues.json ]; then echo "[]" > conflicting_labels_issues.json; fi
+          jq -c -s 'add | unique_by(.number)' no_area_issues.json no_kind_issues.json no_priority_issues.json conflicting_labels_issues.json > standard_issues_to_triage.json
 
-          ISSUE_COUNT="$(echo "${ISSUES}" | jq 'length')"
-          echo "✅ Found ${ISSUE_COUNT} unique issues to triage! 🎯"
+          echo '📏 Deduplicating effort issues...'
+          jq -c -s 'add | unique_by(.number)' no_effort_issues.json > effort_issues_to_triage.json
+
+          STANDARD_COUNT="$(jq 'length' standard_issues_to_triage.json)"
+          EFFORT_COUNT="$(jq 'length' effort_issues_to_triage.json)"
+          if [ "$STANDARD_COUNT" -gt 0 ] || [ "$EFFORT_COUNT" -gt 0 ]; then
+            echo "has_issues=true" >> "${GITHUB_OUTPUT}"
+            echo "has_standard_issues=$([ "$STANDARD_COUNT" -gt 0 ] && echo 'true' || echo 'false')" >> "${GITHUB_OUTPUT}"
+            echo "has_effort_issues=$([ "$EFFORT_COUNT" -gt 0 ] && echo 'true' || echo 'false')" >> "${GITHUB_OUTPUT}"
+          else
+            echo "has_issues=false" >> "${GITHUB_OUTPUT}"
+            echo "has_standard_issues=false" >> "${GITHUB_OUTPUT}"
+            echo "has_effort_issues=false" >> "${GITHUB_OUTPUT}"
+          fi
+          echo "✅ Found ${STANDARD_COUNT} standard issues and ${EFFORT_COUNT} effort issues to triage! 🎯"
+
+      - name: 'Create Gemini CLI Experiments Override'
+        if: |-
+          steps.get_issue_from_event.outputs.has_issues == 'true' || steps.find_issues.outputs.has_issues == 'true'
+        run: |
+          cat << 'EOF' > gemini_exp.json
+          {
+            "flags": [
+              {
+                "flagId": 45750526,
+                "boolValue": false
+              }
+            ],
+            "experimentIds": []
+          }
+          EOF
 
       - name: 'Get Repository Labels'
         id: 'get_labels'
@@ -97,17 +146,18 @@ jobs:
             core.info(`Found ${labelNames.length} labels: ${labelNames.join(', ')}`);
             return labelNames;
 
-      - name: 'Run Gemini Issue Analysis'
+      - name: 'Run Standard Triage Analysis'
         if: |-
-          (steps.get_issue_from_event.outputs.issues_to_triage != '' && steps.get_issue_from_event.outputs.issues_to_triage != '[]') ||
-          (steps.find_issues.outputs.issues_to_triage != '' && steps.find_issues.outputs.issues_to_triage != '[]')
+          steps.get_issue_from_event.outputs.has_issues == 'true' || steps.find_issues.outputs.has_standard_issues == 'true'
         uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
-        id: 'gemini_issue_analysis'
+        id: 'gemini_standard_issue_analysis'
         env:
           GITHUB_TOKEN: '' # Do not pass any auth token here since this runs on untrusted inputs
-          ISSUES_TO_TRIAGE: '${{ steps.get_issue_from_event.outputs.issues_to_triage || steps.find_issues.outputs.issues_to_triage }}'
           REPOSITORY: '${{ github.repository }}'
           AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
+          GEMINI_CLI_TRUST_WORKSPACE: 'true'
+          GEMINI_EXP: 'gemini_exp.json'
+          GEMINI_STRICT_TELEMETRY_LIMITS: 'true'
         with:
           gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
@@ -120,7 +170,8 @@ jobs:
             {
               "maxSessionTurns": 25,
               "coreTools": [
-                "run_shell_command(echo)"
+                "run_shell_command(echo)",
+                "read_file"
               ],
               "telemetry": {
                 "enabled": true,
@@ -136,14 +187,16 @@ jobs:
 
             ## Steps
 
-            1. You are only able to use the echo command. Review the available labels in the environment variable: "${AVAILABLE_LABELS}".
-            2. Check environment variable for issues to triage: $ISSUES_TO_TRIAGE (JSON array of issues)
-            3. Review the issue title, body and any comments provided in the environment variables.
-            4. Identify the most relevant labels from the existing labels, specifically focusing on area/*, kind/* and priority/*.
+            1. You are only able to use the echo and read_file commands. Review the available labels in the environment variable: "${AVAILABLE_LABELS}".
+            2. Use the read_file tool to read the file "standard_issues_to_triage.json" which contains the JSON array of issues to triage.
+            3. Review the issue title, body and any comments provided in the JSON file.
+            4. Identify the most relevant labels from the existing labels, specifically focusing on area/*, kind/*, and priority/*.
             5. Label Policy:
                - If the issue already has a kind/ label, do not change it.
-               - If the issue already has a priority/ label, do not change it.
-               - If the issue already has an area/ label, do not change it.
+               - If the issue has exactly ONE priority/ label, do not change it.
+               - If the issue is missing a priority/ label, OR if the issue currently has MULTIPLE priority/ labels, you must evaluate the issue's impact to determine exactly ONE priority level (priority/p0, priority/p1, priority/p2, priority/p3, or priority/unknown) based the guidelines. If you are fixing an issue with multiple priority/ labels, put the correct one in `labels_to_add` and put all the incorrect ones in `labels_to_remove`.
+               - If the issue has exactly ONE area/ label, do not change it.
+               - If the issue is missing an area/ label, OR if the issue currently has MULTIPLE area/ labels, select exactly ONE area/ label that best fits the issue. Issues MUST NOT have multiple area/ labels. If you are fixing an issue with multiple area/ labels, put the correct one in `labels_to_add` and put all the incorrect ones in `labels_to_remove`.
                - If any of these are missing, select exactly ONE appropriate label for the missing category.
             6. Identify other applicable labels based on the issue content, such as status/*, help wanted, good first issue, etc.
             7. Give me a single short explanation about why you are selecting each label in the process.
@@ -174,11 +227,121 @@ jobs:
               - Do not add comments or modify the issue content.
               - Do not remove the following labels maintainer, help wanted or good first issue.
               - Triage only the current issue.
-              - Identify only one area/ label.
+              - Identify exactly ONE area/ label. Do NOT assign multiple area/ labels to a single issue.
               - Identify only one kind/ label (Do not apply kind/duplicate or kind/parent-issue)
-              - Identify only one priority/ label.
+              - Identify exactly ONE priority/ label. Do NOT assign multiple priority/ labels to a single issue.
               - Once you categorize the issue if it needs information bump down the priority by 1 eg.. a p0 would become a p1 a p1 would become a p2. P2 and P3 can stay as is in this scenario.
 
+            Categorization Guidelines (Priority):
+            P0 - Urgent Blocking Issues:
+              - Definition: Critical failures breaking core functionality for a large portion of users. Examples: CLI fails to launch globally, core commands (gemini run) crash on valid input, unhandled promise rejections on boot, critical security vulnerability.
+              - Note: You must apply status/manual-triage instead of priority/p0.
+            P1 - Critical but Workable:
+              - Definition: Severe issues without a reasonable workaround, significantly degrading the developer experience but not globally blocking. Examples: Specific tools failing consistently (e.g., `web_search` returns 500s), persistent PTY streaming hangs, memory leaks leading to OOM after short use.
+            P2 - Significant Issues:
+              - Definition: Affect some workflows but a clear workaround exists, or non-critical bugs. Examples: Theme flickering, confusing error messages, minor UI misalignment, failing to read deeply nested config files correctly.
+            P3 - Minor/Enhancements:
+              - Definition: Trivial bugs, typos, documentation requests, or feature requests.
+
+            Categorization Guidelines (Kind):
+            kind/bug: The issue is describing an unexpected behavior or failure in the application.
+            kind/enhancement: The issue is describing a feature request or an improvement to an existing feature.
+            kind/question: The issue is asking a question about how to use the CLI or about a specific feature.
+
+            Categorization Guidelines (Area):
+            area/agent: The "brain" of the CLI. Core agent logic, model quality, tool/function calling, memory, web search, generated code quality, sub-agents.
+            area/core: The fundamental CLI app. UI/UX, installation, OS compatibility, performance, command parsing, theming, flickering.
+            area/documentation: Website docs, READMEs, inline help text.
+            area/enterprise: Telemetry, Policy, Quota / Licensing
+            area/extensions: Gemini CLI extensions capability
+            area/non-interactive: GitHub Actions, SDK, 3P Integrations, Shell Scripting, Command line automation
+            area/platform: Platform specific behavior
+            area/security: Authentication, authorization, privacy, data leaks, credential storage.
+
+      - name: 'Stop Telemetry Collector'
+        if: |-
+          steps.find_issues.outputs.has_effort_issues == 'true'
+        run: 'docker rm -f gemini-telemetry-collector || true'
+
+      - name: 'Run Effort Triage Analysis'
+        if: |-
+          steps.find_issues.outputs.has_effort_issues == 'true'
+        uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
+        id: 'gemini_effort_issue_analysis'
+        env:
+          GITHUB_TOKEN: '' # Do not pass any auth token here since this runs on untrusted inputs
+          REPOSITORY: '${{ github.repository }}'
+          AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
+          GEMINI_CLI_TRUST_WORKSPACE: 'true'
+          GEMINI_EXP: 'gemini_exp.json'
+          GEMINI_STRICT_TELEMETRY_LIMITS: 'true'
+        with:
+          gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
+          gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
+          gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
+          gcp_service_account: '${{ vars.SERVICE_ACCOUNT_EMAIL }}'
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          use_vertex_ai: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
+          use_gemini_code_assist: '${{ vars.GOOGLE_GENAI_USE_GCA }}'
+          settings: |-
+            {
+              "maxSessionTurns": 25,
+              "coreTools": [
+                "run_shell_command(echo)",
+                "grep_search",
+                "glob",
+                "read_file"
+              ],
+              "telemetry": {
+                "enabled": true,
+                "target": "gcp"
+              }
+            }
+          prompt: |-
+            ## Role
+
+            You are an expert software architect. Analyze the provided GitHub issues and assign the correct `effort/*` label based on the codebase complexity.
+
+            ## Steps
+
+            1. Use the read_file tool to read "effort_issues_to_triage.json".
+            2. For each issue in the array:
+               - You must evaluate the architectural complexity to determine the effort level. You MUST NOT guess the root cause. You MUST actively use your codebase search tools (grep_search and glob) to search for keywords from the issue and explore the codebase. You must identify the specific files and components involved before deciding the effort.
+            3. Output a JSON array of objects, each containing the issue number and the effort label to add, along with an explanation and an effort_analysis field. This effort_analysis must be highly detailed, technical, and empirical. It MUST NOT contain vague guesses (e.g., avoid words like "likely points to" or "possibly"). You must explicitly cite the specific file paths and architectural mechanisms you discovered using your search tools, explain the root cause, and then explicitly state how that complexity maps to the chosen effort level guidelines. For example:
+               ```
+               [
+                 {
+                   "issue_number": 123,
+                   "labels_to_add": ["effort/small"],
+                   "explanation": "This is a simple logic fix.",
+                   "effort_analysis": "The `vscode-ide-companion` extension indiscriminately tracks active text editors via `vscode.window.onDidChangeActiveTextEditor` in `open-files-manager.ts`. When a user opens `.vscode/settings.json`, its content is sent to the CLI's context. The fix is highly localized to the VS Code companion extension's event listener. It involves adding a simple conditional check to exclude specific configuration files from the active editor tracking logic, which is a trivial logic adjustment with a clear root cause."
+                 }
+               ]
+               ```
+
+            ## Guidelines
+
+            - Output only valid JSON format
+            - Do not include any explanation or additional text, just the JSON
+            - Triage only the current issue.
+
+            Categorization Guidelines (Effort):
+            effort/small (1 day or less):
+              - Trivial Logic & Config: Schema updates (Zod), feature flag toggles, adding missing fields to package.json or settings.json.
+              - UI/Aesthetic Adjustments: Fixing minor layout bugs in Ink components (e.g., adding flexShrink, correcting padding in a single Box), text color changes.
+              - Documentation & Strings: Typos, log message updates, CLI argument descriptions.
+              - Localized Bug Fixes: Single-file logic errors, straightforward promise rejections (e.g., wrapping a known failure in a try/catch), simple regex or string parsing fixes.
+            effort/medium (2-3 days):
+              - React/Ink State Management: Debugging useState/useEffect/useReducer bugs, component lifecycle issues (memory leaks in the UI), terminal redraw flickering, or state synchronization between the CLI's internal input buffer and the interactive React components.
+              - Asynchronous Flow & Integration: Resolving complex Promise chains, ERR_STREAM_PREMATURE_CLOSE, debugging IDE companion extensions (VS Code, Android Studio) or resolving hanging HTTP requests/IPC between the CLI and external plugins, timeouts in non-interactive/ACP modes.
+              - Tooling & Output Parsers: Modifying how tools parse streaming stdout/stderr buffers, adding new built-in tools that don't require native bindings.
+              - Cross-Component Refactors: Changes that span across packages/cli and packages/core to pass new data models or telemetry state.
+            effort/large (3+ days):
+              - Platform-Specific Complexities (PTY/Signals): Any issue involving node-pty, child_process.spawn, OS-level shell behavior (Windows vs Linux vs macOS), pseudo-terminal exhaustion (ENXIO), raw mode terminal desyncs, or POSIX signal forwarding (SIGINT/SIGTERM).
+              - Core Architecture & Protocols: Refactoring the Scheduler, Agent-to-Agent (A2A) protocol implementation, low-level MCP (Model Context Protocol) transport mechanisms.
+              - Performance & Memory: Diagnosing massive disk/memory leaks, severe boot time regressions, high-throughput streaming optimizations (e.g., voice streaming pipelines).
+            Note: Any bug that is described as intermittent, flickering, difficult to reproduce, platform-specific, or requiring cross-environment setups (e.g., involving the VS Code IDE companion, GCA plugin, or Android Studio) MUST NOT be rated as effort/small because of the increased overhead of testing and reproducing.
+
             Categorization Guidelines (Priority):
             P0 - Urgent Blocking Issues:
               - DO NOT APPLY THIS LABEL AUTOMATICALLY. Use status/manual-triage instead.
@@ -216,64 +379,65 @@ jobs:
             - This product is designed to use different models eg.. using pro, downgrading to flash etc.
             - When users report that they dont expect the model to change those would be categorized as feature requests.
 
-      - name: 'Apply Labels to Issues'
+      - name: 'Apply Standard Labels to Issues'
         if: |-
-          ${{ steps.gemini_issue_analysis.outcome == 'success' &&
-              steps.gemini_issue_analysis.outputs.summary != '[]' }}
+          ${{ steps.gemini_standard_issue_analysis.outcome == 'success' &&
+              steps.gemini_standard_issue_analysis.outputs.summary != '[]' &&
+              steps.gemini_standard_issue_analysis.outputs.summary != '' }}
         env:
           REPOSITORY: '${{ github.repository }}'
-          LABELS_OUTPUT: '${{ steps.gemini_issue_analysis.outputs.summary }}'
+          LABELS_OUTPUT: '${{ steps.gemini_standard_issue_analysis.outputs.summary }}'
+          SUPPRESS_COMMENT: 'true'
         uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
         with:
           github-token: '${{ steps.generate_token.outputs.token }}'
           script: |-
-            const rawLabels = process.env.LABELS_OUTPUT;
-            core.info(`Raw labels JSON: ${rawLabels}`);
-            let parsedLabels;
-            try {
-              const jsonMatch = rawLabels.match(/```json\s*([\s\S]*?)\s*```/);
-              if (!jsonMatch || !jsonMatch[1]) {
-                throw new Error("Could not find a ```json ... ``` block in the output.");
-              }
-              const jsonString = jsonMatch[1].trim();
-              parsedLabels = JSON.parse(jsonString);
-              core.info(`Parsed labels JSON: ${JSON.stringify(parsedLabels)}`);
-            } catch (err) {
-              core.setFailed(`Failed to parse labels JSON from Gemini output: ${err.message}\nRaw output: ${rawLabels}`);
-              return;
-            }
+            const applyLabels = require('./.github/scripts/apply-issue-labels.cjs');
+            await applyLabels({ github, context, core });
 
-            for (const entry of parsedLabels) {
-              const issueNumber = entry.issue_number;
-              if (!issueNumber) {
-                core.info(`Skipping entry with no issue number: ${JSON.stringify(entry)}`);
-                continue;
-              }
+      - name: 'Apply Effort Labels to Issues'
+        if: |-
+          ${{ steps.gemini_effort_issue_analysis.outcome == 'success' &&
+              steps.gemini_effort_issue_analysis.outputs.summary != '[]' &&
+              steps.gemini_effort_issue_analysis.outputs.summary != '' }}
+        env:
+          REPOSITORY: '${{ github.repository }}'
+          LABELS_OUTPUT: '${{ steps.gemini_effort_issue_analysis.outputs.summary }}'
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |-
+            const applyLabels = require('./.github/scripts/apply-issue-labels.cjs');
+            await applyLabels({ github, context, core });
 
-              const labelsToAdd = entry.labels_to_add || [];
-              labelsToAdd.push('status/bot-triaged');
+      - name: 'Sync Issue Types (Post-Analysis)'
+        if: |-
+          always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |-
+            const syncIssueTypes = require('./.github/scripts/sync-issue-types.cjs');
+            await syncIssueTypes({ github, context, core });
 
-              if (labelsToAdd.length > 0) {
-                await github.rest.issues.addLabels({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: issueNumber,
-                  labels: labelsToAdd
-                });
-                const explanation = entry.explanation ? ` - ${entry.explanation}` : '';
-                core.info(`Successfully added labels for #${issueNumber}: ${labelsToAdd.join(', ')}${explanation}`);
-              }
+      - name: 'Find Triaged Issues to Clean Up'
+        if: |-
+          always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        env:
+          GITHUB_TOKEN: '${{ steps.generate_token.outputs.token }}'
+          GITHUB_REPOSITORY: '${{ github.repository }}'
+        run: |-
+          set -euo pipefail
+          echo '🧹 Finding issues that have both bot-triaged and need-triage labels...'
+          gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue label:status/bot-triaged label:status/need-triage' --limit 50 --json number > issues_to_cleanup.json
 
-              if (entry.explanation) {
-                await github.rest.issues.createComment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: issueNumber,
-                  body: entry.explanation,
-                });
-              }
-
-              if ((!entry.labels_to_add || entry.labels_to_add.length === 0) && (!entry.labels_to_remove || entry.labels_to_remove.length === 0)) {
-                core.info(`No labels to add or remove for #${issueNumber}, leaving as is`);
-              }
-            }
+      - name: 'Clean Up Triage Labels'
+        if: |-
+          always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |-
+            const cleanupLabels = require('./.github/scripts/cleanup-triage-labels.cjs');
+            await cleanupLabels({ github, context, core });

.github/workflows/gemini-scheduled-pr-triage.yml

@@ -21,6 +21,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Generate GitHub App Token'
         id: 'generate_token'

.github/workflows/gemini-scheduled-stale-issue-closer.yml

@@ -1,159 +0,0 @@
-name: '🔒 Gemini Scheduled Stale Issue Closer'
-
-on:
-  schedule:
-    - cron: '0 0 * * 0' # Every Sunday at midnight UTC
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Run in dry-run mode (no changes applied)'
-        required: false
-        default: false
-        type: 'boolean'
-
-concurrency:
-  group: '${{ github.workflow }}'
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: 'bash'
-
-jobs:
-  close-stale-issues:
-    if: "github.repository == 'google-gemini/gemini-cli'"
-    runs-on: 'ubuntu-latest'
-    permissions:
-      issues: 'write'
-    steps:
-      - name: 'Generate GitHub App Token'
-        id: 'generate_token'
-        uses: 'actions/create-github-app-token@v2'
-        with:
-          app-id: '${{ secrets.APP_ID }}'
-          private-key: '${{ secrets.PRIVATE_KEY }}'
-          permission-issues: 'write'
-
-      - name: 'Process Stale Issues'
-        uses: 'actions/github-script@v7'
-        env:
-          DRY_RUN: '${{ inputs.dry_run }}'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token }}'
-          script: |
-            const dryRun = process.env.DRY_RUN === 'true';
-            if (dryRun) {
-              core.info('DRY RUN MODE ENABLED: No changes will be applied.');
-            }
-            const batchLabel = 'Stale';
-
-            const threeMonthsAgo = new Date();
-            threeMonthsAgo.setMonth(threeMonthsAgo.getMonth() - 3);
-
-            const tenDaysAgo = new Date();
-            tenDaysAgo.setDate(tenDaysAgo.getDate() - 10);
-
-            core.info(`Cutoff date for creation: ${threeMonthsAgo.toISOString()}`);
-            core.info(`Cutoff date for updates: ${tenDaysAgo.toISOString()}`);
-
-            const query = `repo:${context.repo.owner}/${context.repo.repo} is:issue is:open created:<${threeMonthsAgo.toISOString()}`;
-            core.info(`Searching with query: ${query}`);
-
-            const itemsToCheck = await github.paginate(github.rest.search.issuesAndPullRequests, {
-              q: query,
-              sort: 'created',
-              order: 'asc',
-              per_page: 100
-            });
-
-            core.info(`Found ${itemsToCheck.length} open issues to check.`);
-
-            let processedCount = 0;
-
-            for (const issue of itemsToCheck) {
-              const createdAt = new Date(issue.created_at);
-              const updatedAt = new Date(issue.updated_at);
-              const reactionCount = issue.reactions.total_count;
-
-              // Basic thresholds
-              if (reactionCount >= 5) {
-                continue;
-              }
-
-              // Skip if it has a maintainer, help wanted, or Public Roadmap label
-              const rawLabels = issue.labels.map((l) => l.name);
-              const lowercaseLabels = rawLabels.map((l) => l.toLowerCase());
-              if (
-                lowercaseLabels.some((l) => l.includes('maintainer')) ||
-                lowercaseLabels.includes('help wanted') ||
-                rawLabels.includes('🗓️ Public Roadmap')
-              ) {
-                continue;
-              }
-
-              let isStale = updatedAt < tenDaysAgo;
-
-              // If apparently active, check if it's only bot activity
-              if (!isStale) {
-                try {
-                  const comments = await github.rest.issues.listComments({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: issue.number,
-                    per_page: 100,
-                    sort: 'created',
-                    direction: 'desc'
-                  });
-
-                  const lastHumanComment = comments.data.find(comment => comment.user.type !== 'Bot');
-                  if (lastHumanComment) {
-                    isStale = new Date(lastHumanComment.created_at) < tenDaysAgo;
-                  } else {
-                    // No human comments. Check if creator is human.
-                    if (issue.user.type !== 'Bot') {
-                       isStale = createdAt < tenDaysAgo;
-                    } else {
-                       isStale = true; // Bot created, only bot comments
-                    }
-                  }
-                } catch (error) {
-                  core.warning(`Failed to fetch comments for issue #${issue.number}: ${error.message}`);
-                  continue;
-                }
-              }
-
-              if (isStale) {
-                processedCount++;
-                const message = `Closing stale issue #${issue.number}: "${issue.title}" (${issue.html_url})`;
-                core.info(message);
-
-                if (!dryRun) {
-                  // Add label
-                  await github.rest.issues.addLabels({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: issue.number,
-                    labels: [batchLabel]
-                  });
-
-                  // Add comment
-                  await github.rest.issues.createComment({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: issue.number,
-                    body: 'Hello! As part of our effort to keep our backlog manageable and focus on the most active issues, we are tidying up older reports.\n\nIt looks like this issue hasn\'t been active for a while, so we are closing it for now. However, if you are still experiencing this bug on the latest stable build, please feel free to comment on this issue or create a new one with updated details.\n\nThank you for your contribution!'
-                  });
-
-                  // Close issue
-                  await github.rest.issues.update({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: issue.number,
-                    state: 'closed',
-                    state_reason: 'not_planned'
-                  });
-                }
-              }
-            }
-
-            core.info(`\nTotal issues processed: ${processedCount}`);

.github/workflows/gemini-scheduled-stale-pr-closer.yml

@@ -1,258 +0,0 @@
-name: 'Gemini Scheduled Stale PR Closer'
-
-on:
-  schedule:
-    - cron: '0 2 * * *' # Every day at 2 AM UTC
-  pull_request:
-    types: ['opened', 'edited']
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Run in dry-run mode'
-        required: false
-        default: false
-        type: 'boolean'
-
-jobs:
-  close-stale-prs:
-    if: "github.repository == 'google-gemini/gemini-cli'"
-    runs-on: 'ubuntu-latest'
-    permissions:
-      pull-requests: 'write'
-      issues: 'write'
-    steps:
-      - name: 'Generate GitHub App Token'
-        id: 'generate_token'
-        env:
-          APP_ID: '${{ secrets.APP_ID }}'
-        if: |-
-          ${{ env.APP_ID != '' }}
-        uses: 'actions/create-github-app-token@v2'
-        with:
-          app-id: '${{ secrets.APP_ID }}'
-          private-key: '${{ secrets.PRIVATE_KEY }}'
-
-      - name: 'Process Stale PRs'
-        uses: 'actions/github-script@v7'
-        env:
-          DRY_RUN: '${{ inputs.dry_run }}'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
-          script: |
-            const dryRun = process.env.DRY_RUN === 'true';
-            const thirtyDaysAgo = new Date();
-            thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
-
-            // 1. Fetch maintainers for verification
-            let maintainerLogins = new Set();
-            const teams = ['gemini-cli-maintainers', 'gemini-cli-askmode-approvers', 'gemini-cli-docs'];
-
-            for (const team_slug of teams) {
-              try {
-                const members = await github.paginate(github.rest.teams.listMembersInOrg, {
-                  org: context.repo.owner,
-                  team_slug: team_slug
-                });
-                for (const m of members) maintainerLogins.add(m.login.toLowerCase());
-                core.info(`Successfully fetched ${members.length} team members from ${team_slug}`);
-              } catch (e) {
-                core.warning(`Failed to fetch team members from ${team_slug}: ${e.message}`);
-              }
-            }
-
-            const isGooglerCache = new Map();
-            const isGoogler = async (login) => {
-              if (isGooglerCache.has(login)) return isGooglerCache.get(login);
-
-              try {
-                // Check membership in 'googlers' or 'google' orgs
-                const orgs = ['googlers', 'google'];
-                for (const org of orgs) {
-                  try {
-                    await github.rest.orgs.checkMembershipForUser({
-                      org: org,
-                      username: login
-                    });
-                    core.info(`User ${login} is a member of ${org} organization.`);
-                    isGooglerCache.set(login, true);
-                    return true;
-                  } catch (e) {
-                    // 404 just means they aren't a member, which is fine
-                    if (e.status !== 404) throw e;
-                  }
-                }
-              } catch (e) {
-                core.warning(`Failed to check org membership for ${login}: ${e.message}`);
-              }
-
-              isGooglerCache.set(login, false);
-              return false;
-            };
-
-            const isMaintainer = async (login, assoc) => {
-              const isTeamMember = maintainerLogins.has(login.toLowerCase());
-              const isRepoMaintainer = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(assoc);
-              if (isTeamMember || isRepoMaintainer) return true;
-
-              return await isGoogler(login);
-            };
-
-            // 2. Determine which PRs to check
-            let prs = [];
-            if (context.eventName === 'pull_request') {
-              const { data: pr } = await github.rest.pulls.get({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                pull_number: context.payload.pull_request.number
-              });
-              prs = [pr];
-            } else {
-              prs = await github.paginate(github.rest.pulls.list, {
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                state: 'open',
-                per_page: 100
-              });
-            }
-
-            for (const pr of prs) {
-              const maintainerPr = await isMaintainer(pr.user.login, pr.author_association);
-              const isBot = pr.user.type === 'Bot' || pr.user.login.endsWith('[bot]');
-
-              // Detection Logic for Linked Issues
-              // Check 1: Official GitHub "Closing Issue" link (GraphQL)
-              const linkedIssueQuery = `query($owner:String!, $repo:String!, $number:Int!) {
-                repository(owner:$owner, name:$repo) {
-                  pullRequest(number:$number) {
-                    closingIssuesReferences(first: 1) { totalCount }
-                  }
-                }
-              }`;
-
-              let hasClosingLink = false;
-              try {
-                const res = await github.graphql(linkedIssueQuery, {
-                  owner: context.repo.owner, repo: context.repo.repo, number: pr.number
-                });
-                hasClosingLink = res.repository.pullRequest.closingIssuesReferences.totalCount > 0;
-              } catch (e) {}
-
-              // Check 2: Regex for mentions (e.g., "Related to #123", "Part of #123", "#123")
-              // We check for # followed by numbers or direct URLs to issues.
-              const body = pr.body || '';
-              const mentionRegex = /(?:#|https:\/\/github\.com\/[^\/]+\/[^\/]+\/issues\/)(\d+)/i;
-              const hasMentionLink = mentionRegex.test(body);
-
-              const hasLinkedIssue = hasClosingLink || hasMentionLink;
-
-              // Logic for Closed PRs (Auto-Reopen)
-              if (pr.state === 'closed' && context.eventName === 'pull_request' && context.payload.action === 'edited') {
-                if (hasLinkedIssue) {
-                  core.info(`PR #${pr.number} now has a linked issue. Reopening.`);
-                  if (!dryRun) {
-                    await github.rest.pulls.update({
-                      owner: context.repo.owner,
-                      repo: context.repo.repo,
-                      pull_number: pr.number,
-                      state: 'open'
-                    });
-                    await github.rest.issues.createComment({
-                      owner: context.repo.owner,
-                      repo: context.repo.repo,
-                      issue_number: pr.number,
-                      body: "Thank you for linking an issue! This pull request has been automatically reopened."
-                    });
-                  }
-                }
-                continue;
-              }
-
-              // Logic for Open PRs (Immediate Closure)
-              if (pr.state === 'open' && !maintainerPr && !hasLinkedIssue && !isBot) {
-                core.info(`PR #${pr.number} is missing a linked issue. Closing.`);
-                if (!dryRun) {
-                  await github.rest.issues.createComment({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: pr.number,
-                    body: "Hi there! Thank you for your contribution to Gemini CLI. \n\nTo improve our contribution process and better track changes, we now require all pull requests to be associated with an existing issue, as announced in our [recent discussion](https://github.com/google-gemini/gemini-cli/discussions/16706) and as detailed in our [CONTRIBUTING.md](https://github.com/google-gemini/gemini-cli/blob/main/CONTRIBUTING.md#1-link-to-an-existing-issue).\n\nThis pull request is being closed because it is not currently linked to an issue. **Once you have updated the description of this PR to link an issue (e.g., by adding `Fixes #123` or `Related to #123`), it will be automatically reopened.**\n\n**How to link an issue:**\nAdd a keyword followed by the issue number (e.g., `Fixes #123`) in the description of your pull request. For more details on supported keywords and how linking works, please refer to the [GitHub Documentation on linking pull requests to issues](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue).\n\nThank you for your understanding and for being a part of our community!"
-                  });
-                  await github.rest.pulls.update({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    pull_number: pr.number,
-                    state: 'closed'
-                  });
-                }
-                continue;
-              }
-
-              // Staleness check (Scheduled runs only)
-              if (pr.state === 'open' && context.eventName !== 'pull_request') {
-                const labels = pr.labels.map(l => l.name.toLowerCase());
-                if (labels.includes('help wanted') || labels.includes('🔒 maintainer only')) continue;
-
-                // Skip PRs that were created less than 30 days ago - they cannot be stale yet
-                const prCreatedAt = new Date(pr.created_at);
-                if (prCreatedAt > thirtyDaysAgo) {
-                  const daysOld = Math.floor((Date.now() - prCreatedAt.getTime()) / (1000 * 60 * 60 * 24));
-                  core.info(`PR #${pr.number} was created ${daysOld} days ago. Skipping staleness check.`);
-                  continue;
-                }
-
-                // Initialize lastActivity to PR creation date (not epoch) as a safety baseline.
-                // This ensures we never incorrectly mark a PR as stale due to failed activity lookups.
-                let lastActivity = new Date(pr.created_at);
-                try {
-                  const reviews = await github.paginate(github.rest.pulls.listReviews, {
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    pull_number: pr.number
-                  });
-                  for (const r of reviews) {
-                    if (await isMaintainer(r.user.login, r.author_association)) {
-                      const d = new Date(r.submitted_at || r.updated_at);
-                      if (d > lastActivity) lastActivity = d;
-                    }
-                  }
-                  const comments = await github.paginate(github.rest.issues.listComments, {
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: pr.number
-                  });
-                  for (const c of comments) {
-                    if (await isMaintainer(c.user.login, c.author_association)) {
-                      const d = new Date(c.updated_at);
-                      if (d > lastActivity) lastActivity = d;
-                    }
-                  }
-                } catch (e) {
-                  core.warning(`Failed to fetch reviews/comments for PR #${pr.number}: ${e.message}`);
-                }
-
-                // For maintainer PRs, the PR creation itself counts as maintainer activity.
-                // (Now redundant since we initialize to pr.created_at, but kept for clarity)
-                if (maintainerPr) {
-                  const d = new Date(pr.created_at);
-                  if (d > lastActivity) lastActivity = d;
-                }
-
-                if (lastActivity < thirtyDaysAgo) {
-                  core.info(`PR #${pr.number} is stale.`);
-                  if (!dryRun) {
-                    await github.rest.issues.createComment({
-                      owner: context.repo.owner,
-                      repo: context.repo.repo,
-                      issue_number: pr.number,
-                      body: "Hi there! Thank you for your contribution to Gemini CLI. We really appreciate the time and effort you've put into this pull request.\n\nTo keep our backlog manageable and ensure we're focusing on current priorities, we are closing pull requests that haven't seen maintainer activity for 30 days. Currently, the team is prioritizing work associated with **🔒 maintainer only** or **help wanted** issues.\n\nIf you believe this change is still critical, please feel free to comment with updated details. Otherwise, we encourage contributors to focus on open issues labeled as **help wanted**. Thank you for your understanding!"
-                    });
-                    await github.rest.pulls.update({
-                      owner: context.repo.owner,
-                      repo: context.repo.repo,
-                      pull_number: pr.number,
-                      state: 'closed'
-                    });
-                  }
-                }
-              }
-            }

.github/workflows/label-backlog-child-issues.yml

@@ -18,10 +18,12 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Setup Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version: '20'
           cache: 'npm'
@@ -40,10 +42,12 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Setup Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version: '20'
           cache: 'npm'

.github/workflows/label-workstream-rollup.yml

@@ -15,7 +15,7 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Check for Parent Workstream and Apply Label'
-        uses: 'actions/github-script@v7'
+        uses: 'actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' # ratchet:actions/github-script@v7
         with:
           script: |
             const labelToAdd = 'workstream-rollup';

.github/workflows/links.yml

@@ -17,6 +17,8 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: 'Link Checker'
         id: 'lychee'

.github/workflows/memory-nightly.yml

@@ -0,0 +1,35 @@
+name: 'Memory Tests: Nightly'
+
+on:
+  schedule:
+    - cron: '0 2 * * *' # Runs at 2 AM every day
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: 'read'
+
+jobs:
+  memory-test:
+    name: 'Run Memory Usage Tests'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Run Memory Tests'
+        run: 'npm run test:memory'

.github/workflows/no-response.yml

@@ -1,33 +0,0 @@
-name: 'No Response'
-
-# Run as a daily cron at 1:45 AM
-on:
-  schedule:
-    - cron: '45 1 * * *'
-  workflow_dispatch:
-
-jobs:
-  no-response:
-    runs-on: 'ubuntu-latest'
-    if: |-
-      ${{ github.repository == 'google-gemini/gemini-cli' }}
-    permissions:
-      issues: 'write'
-      pull-requests: 'write'
-    concurrency:
-      group: '${{ github.workflow }}-no-response'
-      cancel-in-progress: true
-    steps:
-      - uses: 'actions/stale@5bef64f19d7facfb25b37b414482c7164d639639' # ratchet:actions/stale@v9
-        with:
-          repo-token: '${{ secrets.GITHUB_TOKEN }}'
-          days-before-stale: -1
-          days-before-close: 14
-          stale-issue-label: 'status/need-information'
-          close-issue-message: >-
-            This issue was marked as needing more information and has not received a response in 14 days.
-            Closing it for now. If you still face this problem, feel free to reopen with more details. Thank you!
-          stale-pr-label: 'status/need-information'
-          close-pr-message: >-
-            This pull request was marked as needing more information and has had no updates in 14 days.
-            Closing it for now. You are welcome to reopen with the required info. Thanks for contributing!

.github/workflows/perf-nightly.yml

@@ -0,0 +1,35 @@
+name: 'Performance Tests: Nightly'
+
+on:
+  schedule:
+    - cron: '0 3 * * *' # Runs at 3 AM every day
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: 'read'
+
+jobs:
+  perf-test:
+    name: 'Run Performance Usage Tests'
+    runs-on: 'gemini-cli-ubuntu-16-core'
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Run Performance Tests'
+        run: 'npm run test:perf'

.github/workflows/pr-contribution-guidelines-notifier.yml

@@ -1,133 +0,0 @@
-name: '🏷️ PR Contribution Guidelines Notifier'
-
-on:
-  pull_request:
-    types:
-      - 'opened'
-
-jobs:
-  notify-process-change:
-    runs-on: 'ubuntu-latest'
-    if: |-
-      github.repository == 'google-gemini/gemini-cli' || github.repository == 'google-gemini/maintainers-gemini-cli'
-    permissions:
-      pull-requests: 'write'
-    steps:
-      - name: 'Generate GitHub App Token'
-        id: 'generate_token'
-        env:
-          APP_ID: '${{ secrets.APP_ID }}'
-        if: |-
-          ${{ env.APP_ID != '' }}
-        uses: 'actions/create-github-app-token@v2'
-        with:
-          app-id: '${{ secrets.APP_ID }}'
-          private-key: '${{ secrets.PRIVATE_KEY }}'
-
-      - name: 'Check membership and post comment'
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
-          script: |-
-            const org = context.repo.owner;
-            const repo = context.repo.repo;
-            const username = context.payload.pull_request.user.login;
-            const pr_number = context.payload.pull_request.number;
-
-            // 1. Check if the PR author is a maintainer
-            // Check team membership (most reliable for private org members)
-            let isTeamMember = false;
-            const teams = ['gemini-cli-maintainers', 'gemini-cli-askmode-approvers', 'gemini-cli-docs'];
-            for (const team_slug of teams) {
-              try {
-                const members = await github.paginate(github.rest.teams.listMembersInOrg, {
-                  org: org,
-                  team_slug: team_slug
-                });
-                if (members.some(m => m.login.toLowerCase() === username.toLowerCase())) {
-                  isTeamMember = true;
-                  core.info(`${username} is a member of ${team_slug}. No notification needed.`);
-                  break;
-                }
-              } catch (e) {
-                core.warning(`Failed to fetch team members from ${team_slug}: ${e.message}`);
-              }
-            }
-
-            if (isTeamMember) return;
-
-            // Check author_association from webhook payload
-            const authorAssociation = context.payload.pull_request.author_association;
-            const isRepoMaintainer = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(authorAssociation);
-
-            if (isRepoMaintainer) {
-              core.info(`${username} is a maintainer (author_association: ${authorAssociation}). No notification needed.`);
-              return;
-            }
-
-            // Check if author is a Googler
-            const isGoogler = async (login) => {
-              try {
-                const orgs = ['googlers', 'google'];
-                for (const org of orgs) {
-                  try {
-                    await github.rest.orgs.checkMembershipForUser({
-                      org: org,
-                      username: login
-                    });
-                    return true;
-                  } catch (e) {
-                    if (e.status !== 404) throw e;
-                  }
-                }
-              } catch (e) {
-                core.warning(`Failed to check org membership for ${login}: ${e.message}`);
-              }
-              return false;
-            };
-
-            if (await isGoogler(username)) {
-              core.info(`${username} is a Googler. No notification needed.`);
-              return;
-            }
-
-            // 2. Check if the PR is already associated with an issue
-            const query = `
-              query($owner:String!, $repo:String!, $number:Int!) {
-                repository(owner:$owner, name:$repo) {
-                  pullRequest(number:$number) {
-                    closingIssuesReferences(first: 1) {
-                      totalCount
-                    }
-                  }
-                }
-              }
-            `;
-            const variables = { owner: org, repo: repo, number: pr_number };
-            const result = await github.graphql(query, variables);
-            const issueCount = result.repository.pullRequest.closingIssuesReferences.totalCount;
-
-            if (issueCount > 0) {
-              core.info(`PR #${pr_number} is already associated with an issue. No notification needed.`);
-              return;
-            }
-
-            // 3. Post the notification comment
-            core.info(`${username} is not a maintainer and PR #${pr_number} has no linked issue. Posting notification.`);
-
-            const comment = `
-            Hi @${username}, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this.
-
-            We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: [Improving Our Contribution Process & Introducing New Guidelines](https://github.com/google-gemini/gemini-cli/discussions/16706).
-
-            Key Update: Starting **January 26, 2026**, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed.
-
-            Thank you for your understanding and for being a part of our community!
-            `.trim().replace(/^[ ]+/gm, '');
-
-            await github.rest.issues.createComment({
-              owner: org,
-              repo: repo,
-              issue_number: pr_number,
-              body: comment
-            });

.github/workflows/release-change-tags.yml

@@ -40,10 +40,11 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
         with:
           ref: '${{ github.ref }}'
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 'Setup Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'

.github/workflows/release-manual.yml

@@ -46,8 +46,15 @@ on:
         default: 'prod'
 
 jobs:
+  build-mac:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    uses: './.github/workflows/build-unsigned-mac-binaries.yml'
+    with:
+      ref: '${{ github.event.inputs.ref }}'
+
   release:
     if: "github.repository == 'google-gemini/gemini-cli'"
+    needs: ['build-mac']
     runs-on: 'ubuntu-latest'
     environment: "${{ github.event.inputs.environment || 'prod' }}"
     permissions:
@@ -58,11 +65,13 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: 'Checkout Release Code'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
           path: 'release'
           fetch-depth: 0
@@ -83,6 +92,11 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
+      - name: 'Download macOS Binaries'
+        uses: './.github/actions/download-mac-binaries'
+        with:
+          path: 'release/dist'
+
       - name: 'Prepare Release Info'
         id: 'release_info'
         working-directory: './release'

.github/workflows/release-nightly.yml

@@ -30,8 +30,15 @@ on:
         default: 'prod'
 
 jobs:
+  build-mac:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    uses: './.github/workflows/build-unsigned-mac-binaries.yml'
+    with:
+      ref: '${{ github.event.inputs.ref }}'
+
   release:
     if: "github.repository == 'google-gemini/gemini-cli'"
+    needs: ['build-mac']
     environment: "${{ github.event.inputs.environment || 'prod' }}"
     runs-on: 'ubuntu-latest'
     permissions:
@@ -43,11 +50,13 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: 'Checkout Release Code'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
           path: 'release'
           fetch-depth: 0
@@ -62,6 +71,11 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
+      - name: 'Download macOS Binaries'
+        uses: './.github/actions/download-mac-binaries'
+        with:
+          path: 'release/dist'
+
       - name: 'Print Inputs'
         shell: 'bash'
         env:

.github/workflows/release-notes.yml

@@ -29,14 +29,15 @@ jobs:
       pull-requests: 'write'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
         with:
+          persist-credentials: false
           # The user-level skills need to be available to the workflow
           fetch-depth: 0
           ref: 'main'
 
       - name: 'Set up Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version: '20'
 
@@ -70,6 +71,8 @@ jobs:
       - name: 'Generate Changelog with Gemini'
         if: "steps.validate_version.outputs.CONTINUE == 'true'"
         uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
+        env:
+          GEMINI_CLI_TRUST_WORKSPACE: true
         with:
           gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
           prompt: |
@@ -86,7 +89,7 @@ jobs:
 
       - name: 'Create Pull Request'
         if: "steps.validate_version.outputs.CONTINUE == 'true'"
-        uses: 'peter-evans/create-pull-request@v6'
+        uses: 'peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c' # ratchet:peter-evans/create-pull-request@v6
         with:
           token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
           commit-message: 'docs(changelog): update for ${{ steps.release_info.outputs.VERSION }}'
@@ -95,6 +98,8 @@ jobs:
             This PR contains the auto-generated changelog for the ${{ steps.release_info.outputs.VERSION }} release.
 
             Please review and merge.
+
+            Related to #18505
           branch: 'changelog-${{ steps.release_info.outputs.VERSION }}'
           base: 'main'
           team-reviewers: 'gemini-cli-docs, gemini-cli-maintainers'

.github/workflows/release-patch-0-from-comment.yml

@@ -17,6 +17,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           fetch-depth: 1
 
       - name: 'Slash Command Dispatch'

.github/workflows/release-patch-1-create-pr.yml

@@ -54,6 +54,7 @@ jobs:
         with:
           ref: '${{ github.event.inputs.ref }}'
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 'Setup Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4

.github/workflows/release-patch-2-trigger.yml

@@ -64,6 +64,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: "${{ github.event.inputs.workflow_ref || 'main' }}"
           fetch-depth: 1
 

.github/workflows/release-patch-3-release.yml

@@ -53,12 +53,14 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
 
       - name: 'Checkout Release Code'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.release_ref }}'
           path: 'release'
           fetch-depth: 0

.github/workflows/release-promote.yml

@@ -55,6 +55,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
 
@@ -171,11 +172,13 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ matrix.sha }}'
           path: 'release'
           fetch-depth: 0
@@ -197,9 +200,15 @@ jobs:
           gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
           working-directory: './release'
 
+  build-mac:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    uses: './.github/workflows/build-unsigned-mac-binaries.yml'
+    with:
+      ref: '${{ github.event.inputs.ref }}'
+
   publish-preview:
     name: 'Publish preview'
-    needs: ['calculate-versions', 'test']
+    needs: ['calculate-versions', 'test', 'build-mac']
     runs-on: 'ubuntu-latest'
     environment: "${{ github.event.inputs.environment || 'prod' }}"
     permissions:
@@ -210,11 +219,13 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ needs.calculate-versions.outputs.PREVIEW_SHA }}'
           path: 'release'
           fetch-depth: 0
@@ -229,6 +240,11 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
+      - name: 'Download macOS Binaries'
+        uses: './.github/actions/download-mac-binaries'
+        with:
+          path: 'release/dist'
+
       - name: 'Publish Release'
         uses: './.github/actions/publish-release'
         with:
@@ -266,7 +282,7 @@ jobs:
 
   publish-stable:
     name: 'Publish stable'
-    needs: ['calculate-versions', 'test', 'publish-preview']
+    needs: ['calculate-versions', 'test', 'publish-preview', 'build-mac']
     runs-on: 'ubuntu-latest'
     environment: "${{ github.event.inputs.environment || 'prod' }}"
     permissions:
@@ -277,11 +293,13 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ needs.calculate-versions.outputs.STABLE_SHA }}'
           path: 'release'
           fetch-depth: 0
@@ -296,6 +314,11 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
+      - name: 'Download macOS Binaries'
+        uses: './.github/actions/download-mac-binaries'
+        with:
+          path: 'release/dist'
+
       - name: 'Publish Release'
         uses: './.github/actions/publish-release'
         with:
@@ -344,6 +367,7 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Setup Node.js'
@@ -379,6 +403,7 @@ jobs:
           BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
           DRY_RUN: '${{ github.event.inputs.dry_run }}'
           NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION: '${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
+          GIT_PUSH_TOKEN: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
         run: |-
           git add package.json packages/*/package.json
           if [ -f package-lock.json ]; then
@@ -387,7 +412,7 @@ jobs:
           git commit -m "chore(release): bump version to ${NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION}"
           if [[ "${DRY_RUN}" == "false" ]]; then
             echo "Pushing release branch to remote..."
-            git push --set-upstream origin "${BRANCH_NAME}"
+            git push "https://x-access-token:${GIT_PUSH_TOKEN}@github.com/${{ github.repository }}.git" "HEAD:${BRANCH_NAME}" --follow-tags
           else
             echo "Dry run enabled. Skipping push."
           fi

.github/workflows/release-rollback.yml

@@ -52,6 +52,7 @@ jobs:
       - name: 'Checkout repository'
         uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
           fetch-depth: 0
 
@@ -192,7 +193,7 @@ jobs:
         run: |
           echo "ROLLBACK_TAG=$ROLLBACK_TAG_NAME" >> "$GITHUB_OUTPUT"
           git tag "$ROLLBACK_TAG_NAME" "${ORIGIN_HASH}"
-          git push origin --tags
+          git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.git" --tags
 
       - name: 'Verify Rollback Tag Added'
         if: "${{ github.event.inputs.dry-run == 'false' }}"

.github/workflows/release-sandbox.yml

@@ -26,6 +26,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
+          persist-credentials: false
           ref: '${{ github.event.inputs.ref || github.sha }}'
           fetch-depth: 0
       - name: 'Push'

.github/workflows/smoke-test.yml

@@ -32,6 +32,7 @@ jobs:
         with:
           ref: '${{ github.event.inputs.ref || github.sha }}'
           fetch-depth: 0
+          persist-credentials: false
       - name: 'Install Dependencies'
         run: 'npm ci'
       - name: 'Build bundle'

.github/workflows/stale.yml

@@ -1,44 +0,0 @@
-name: 'Mark stale issues and pull requests'
-
-# Run as a daily cron at 1:30 AM
-on:
-  schedule:
-    - cron: '30 1 * * *'
-  workflow_dispatch:
-
-jobs:
-  stale:
-    strategy:
-      fail-fast: false
-      matrix:
-        runner:
-          - 'ubuntu-latest' # GitHub-hosted
-    runs-on: '${{ matrix.runner }}'
-    if: |-
-      ${{ github.repository == 'google-gemini/gemini-cli' }}
-    permissions:
-      issues: 'write'
-      pull-requests: 'write'
-    concurrency:
-      group: '${{ github.workflow }}-stale'
-      cancel-in-progress: true
-    steps:
-      - uses: 'actions/stale@5bef64f19d7facfb25b37b414482c7164d639639' # ratchet:actions/stale@v9
-        with:
-          repo-token: '${{ secrets.GITHUB_TOKEN }}'
-          stale-issue-message: >-
-            This issue has been automatically marked as stale due to 60 days of inactivity.
-            It will be closed in 14 days if no further activity occurs.
-          stale-pr-message: >-
-            This pull request has been automatically marked as stale due to 60 days of inactivity.
-            It will be closed in 14 days if no further activity occurs.
-          close-issue-message: >-
-            This issue has been closed due to 14 additional days of inactivity after being marked as stale.
-            If you believe this is still relevant, feel free to comment or reopen the issue. Thank you!
-          close-pr-message: >-
-            This pull request has been closed due to 14 additional days of inactivity after being marked as stale.
-            If this is still relevant, you are welcome to reopen or leave a comment. Thanks for contributing!
-          days-before-stale: 60
-          days-before-close: 14
-          exempt-issue-labels: 'pinned,security,🔒 maintainer only,help wanted,🗓️ Public Roadmap'
-          exempt-pr-labels: 'pinned,security,🔒 maintainer only,help wanted,🗓️ Public Roadmap'

.github/workflows/test-build-binary.yml

@@ -33,7 +33,9 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Optimize Windows Performance'
         if: "matrix.os == 'windows-latest'"
@@ -46,7 +48,7 @@ jobs:
         shell: 'powershell'
 
       - name: 'Set up Node.js'
-        uses: 'actions/setup-node@v4'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
           architecture: '${{ matrix.arch }}'
@@ -63,7 +65,7 @@ jobs:
 
       - name: 'Setup Windows SDK (Windows)'
         if: "matrix.os == 'windows-latest'"
-        uses: 'microsoft/setup-msbuild@v2'
+        uses: 'microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce' # ratchet:microsoft/setup-msbuild@v2
 
       - name: 'Add Signtool to Path (Windows)'
         if: "matrix.os == 'windows-latest'"
@@ -141,6 +143,7 @@ jobs:
         if: "github.event_name != 'pull_request'"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_CLI_TRUST_WORKSPACE: true
         run: |
           echo "Running integration tests with binary..."
           if [[ "${{ matrix.os }}" == 'windows-latest' ]]; then
@@ -153,7 +156,7 @@ jobs:
           npm run test:integration:sandbox:none -- --testTimeout=600000
 
       - name: 'Upload Artifact'
-        uses: 'actions/upload-artifact@v4'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
         with:
           name: 'gemini-cli-${{ matrix.platform_name }}'
           path: 'dist/${{ matrix.platform_name }}/'

.github/workflows/unassign-inactive-assignees.yml

@@ -40,13 +40,13 @@ jobs:
     steps:
       - name: 'Generate GitHub App Token'
         id: 'generate_token'
-        uses: 'actions/create-github-app-token@v2'
+        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
         with:
           app-id: '${{ secrets.APP_ID }}'
           private-key: '${{ secrets.PRIVATE_KEY }}'
 
       - name: 'Unassign inactive assignees'
-        uses: 'actions/github-script@v7'
+        uses: 'actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' # ratchet:actions/github-script@v7
         env:
           DRY_RUN: '${{ inputs.dry_run }}'
         with:

.github/workflows/verify-release.yml

@@ -44,6 +44,8 @@ jobs:
         shell: 'bash'
         run: 'echo "${{ toJSON(vars) }}"'
       - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          persist-credentials: false
       - name: 'Verify release'
         uses: './.github/actions/verify-release'
         with:

.gitignore

@@ -48,6 +48,7 @@ packages/cli/src/generated/
 packages/core/src/generated/
 packages/devtools/src/_client-assets.ts
 .integration-tests/
+.perf-tests/
 packages/vscode-ide-companion/*.vsix
 packages/cli/download-ripgrep*/
 
@@ -64,3 +65,6 @@ gemini-debug.log
 evals/logs/
 
 temp_agents/
+
+# conductor extension and planning directories
+conductor/

.prettierignore

@@ -22,3 +22,4 @@ Thumbs.db
 .pytest_cache
 **/SKILL.md
 packages/sdk/test-data/*.json
+*.mdx

.vscode/launch.json

@@ -43,9 +43,13 @@
     {
       "type": "node",
       "request": "launch",
-      "name": "Launch Program",
+      "name": "CLI: Run Current File",
+      "runtimeExecutable": "node",
+      "runtimeArgs": ["--import", "tsx"],
       "skipFiles": ["<node_internals>/**"],
       "program": "${file}",
+      "cwd": "${workspaceFolder}",
+      "console": "integratedTerminal",
       "outFiles": ["${workspaceFolder}/**/*.js"]
     },
     {

CONTRIBUTING.md

@@ -110,7 +110,9 @@ assign or unassign the issue as requested, provided the conditions are met
 (e.g., an issue must be unassigned to be assigned).
 
 Please note that you can have a maximum of 3 issues assigned to you at any given
-time.
+time and that only
+[issues labeled "help wanted"](https://github.com/google-gemini/gemini-cli/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22help%20wanted%22)
+may be self-assigned.
 
 ### Pull request guidelines
 
@@ -323,8 +325,8 @@ fi
 
 #### Formatting
 
-To separately format the code in this project by running the following command
-from the root directory:
+To separately format the code in this project, run the following command from
+the root directory:
 
 ```bash
 npm run format
@@ -346,27 +348,14 @@ npm run lint
 
 - Please adhere to the coding style, patterns, and conventions used throughout
   the existing codebase.
-- Consult [GEMINI.md](../GEMINI.md) (typically found in the project root) for
-  specific instructions related to AI-assisted development, including
-  conventions for React, comments, and Git usage.
+- Consult
+  [GEMINI.md](https://github.com/google-gemini/gemini-cli/blob/main/GEMINI.md)
+  (typically found in the project root) for specific instructions related to
+  AI-assisted development, including conventions for React, comments, and Git
+  usage.
 - **Imports:** Pay special attention to import paths. The project uses ESLint to
   enforce restrictions on relative imports between packages.
 
-### Project structure
-
-- `packages/`: Contains the individual sub-packages of the project.
-  - `a2a-server`: A2A server implementation for the Gemini CLI. (Experimental)
-  - `cli/`: The command-line interface.
-  - `core/`: The core backend logic for the Gemini CLI.
-  - `test-utils` Utilities for creating and cleaning temporary file systems for
-    testing.
-  - `vscode-ide-companion/`: The Gemini CLI Companion extension pairs with
-    Gemini CLI.
-- `docs/`: Contains all project documentation.
-- `scripts/`: Utility scripts for building, testing, and development tasks.
-
-For more detailed architecture, see `docs/architecture.md`.
-
 ### Debugging
 
 #### VS Code
@@ -520,8 +509,9 @@ code.
 
 ### Documentation structure
 
-Our documentation is organized using [sidebar.json](/docs/sidebar.json) as the
-table of contents. When adding new documentation:
+Our documentation is organized using
+[sidebar.json](https://github.com/google-gemini/gemini-cli/blob/main/docs/sidebar.json)
+as the table of contents. When adding new documentation:
 
 1. Create your markdown file **in the appropriate directory** under `/docs`.
 2. Add an entry to `sidebar.json` in the relevant section.

Dockerfile

@@ -1,3 +1,44 @@
+# ---- Stage 1: Builder ----
+FROM docker.io/library/node:20-slim AS builder
+
+# Install git (needed by generate-git-commit-info.js script)
+RUN apt-get update && apt-get install -y --no-install-recommends git \
+  && apt-get clean && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+# Copy only package.json files first for better layer caching
+# Dependencies only re-install when package files change, not source files
+COPY package*.json ./
+COPY packages/cli/package*.json ./packages/cli/
+COPY packages/core/package*.json ./packages/core/
+COPY packages/vscode-ide-companion/package*.json ./packages/vscode-ide-companion/
+COPY packages/vscode-ide-companion/scripts/ ./packages/vscode-ide-companion/scripts/
+COPY packages/devtools/package*.json ./packages/devtools/
+COPY packages/sdk/package*.json ./packages/sdk/
+COPY packages/test-utils/package*.json ./packages/test-utils/
+COPY packages/a2a-server/package*.json ./packages/a2a-server/
+
+# Use npm ci for consistent, reliable builds (respects package-lock.json)
+RUN HUSKY=0 npm ci --ignore-scripts
+
+# Now copy the rest of the source (after install for better caching)
+COPY packages/ ./packages/
+COPY tsconfig*.json ./
+COPY eslint.config.js ./
+COPY scripts/ ./scripts/
+COPY esbuild.config.js ./
+
+# Pass git commit hash as build arg instead of copying entire .git directory
+ARG GIT_COMMIT=unknown
+ENV GIT_COMMIT=$GIT_COMMIT
+
+# Build and pack artifacts
+RUN HUSKY=0 npm run build && \
+    npm pack -w packages/core --pack-destination packages/core/dist/ && \
+    npm pack -w packages/cli --pack-destination packages/cli/dist/
+
+# ---- Stage 2: Runtime ----
 FROM docker.io/library/node:20-slim
 
 ARG SANDBOX_NAME="gemini-cli-sandbox"
@@ -40,8 +81,8 @@ ENV PATH=$PATH:/usr/local/share/npm-global/bin
 USER node
 
 # install gemini-cli and clean up
-COPY packages/cli/dist/google-gemini-cli-*.tgz /tmp/gemini-cli.tgz
-COPY packages/core/dist/google-gemini-cli-core-*.tgz /tmp/gemini-core.tgz
+COPY --chown=node:node packages/cli/dist/google-gemini-cli-*.tgz /tmp/gemini-cli.tgz
+COPY --chown=node:node packages/core/dist/google-gemini-cli-core-*.tgz /tmp/gemini-core.tgz
 RUN npm install -g /tmp/gemini-core.tgz \
   && npm install -g /tmp/gemini-cli.tgz \
   && node -e "const fs=require('node:fs'); JSON.parse(fs.readFileSync('/usr/local/share/npm-global/lib/node_modules/@google/gemini-cli/package.json','utf8')); JSON.parse(fs.readFileSync('/usr/local/share/npm-global/lib/node_modules/@google/gemini-cli-core/package.json','utf8'));" \
@@ -50,4 +91,4 @@ RUN npm install -g /tmp/gemini-core.tgz \
   && rm -f /tmp/gemini-{cli,core}.tgz
 
 # default entrypoint when none specified
-CMD ["gemini"]
+ENTRYPOINT ["/usr/local/share/npm-global/bin/gemini"]

GEMINI.md

@@ -22,9 +22,10 @@ powerful tool for developers.
     rendering.
   - `packages/core`: Backend logic, Gemini API orchestration, prompt
     construction, and tool execution.
-  - `packages/core/src/tools/`: Built-in tools for file system, shell, and web
-    operations.
   - `packages/a2a-server`: Experimental Agent-to-Agent server.
+  - `packages/sdk`: Programmatic SDK for embedding Gemini CLI capabilities.
+  - `packages/devtools`: Integrated developer tools (Network/Console inspector).
+  - `packages/test-utils`: Shared test utilities and test rig.
   - `packages/vscode-ide-companion`: VS Code extension pairing with the CLI.
 
 ## Building and Running
@@ -43,6 +44,13 @@ powerful tool for developers.
 - **Test Commands:**
   - **Unit (All):** `npm run test`
   - **Integration (E2E):** `npm run test:e2e`
+  - > **NOTE**: Please run the memory and perf tests locally **only if** you are
+    > implementing changes related to those test areas. Otherwise skip these
+    > tests locally and rely on CI to run them on nightly builds.
+  - **Memory (Nightly):** `npm run test:memory` (Runs memory regression tests
+    against baselines. Excluded from `preflight`, run nightly.)
+  - **Performance (Nightly):** `npm run test:perf` (Runs CPU performance
+    regression tests against baselines. Excluded from `preflight`, run nightly.)
   - **Workspace-Specific:** `npm test -w <pkg> -- <path>` (Note: `<path>` must
     be relative to the workspace root, e.g.,
     `-w @google/gemini-cli-core -- src/routing/modelRouterService.test.ts`)
@@ -58,10 +66,6 @@ powerful tool for developers.
 
 ## Development Conventions
 
-- **Legacy Snippets:** `packages/core/src/prompts/snippets.legacy.ts` is a
-  snapshot of an older system prompt. Avoid changing the prompting verbiage to
-  preserve its historical behavior; however, structural changes to ensure
-  compilation or simplify the code are permitted.
 - **Contributions:** Follow the process outlined in `CONTRIBUTING.md`. Requires
   signing the Google CLA.
 - **Pull Requests:** Keep PRs small, focused, and linked to an existing issue.
@@ -69,8 +73,6 @@ powerful tool for developers.
   `gh` CLI.
 - **Commit Messages:** Follow the
   [Conventional Commits](https://www.conventionalcommits.org/) standard.
-- **Coding Style:** Adhere to existing patterns in `packages/cli` (React/Ink)
-  and `packages/core` (Backend logic).
 - **Imports:** Use specific imports and avoid restricted relative imports
   between packages (enforced by ESLint).
 - **License Headers:** For all new source code files (`.ts`, `.tsx`, `.js`),

README.md

@@ -30,7 +30,7 @@ Learn all about Gemini CLI in our [documentation](https://geminicli.com/docs/).
 ## 📦 Installation
 
 See
-[Gemini CLI installation, execution, and releases](./docs/get-started/installation.md)
+[Gemini CLI installation, execution, and releases](https://www.geminicli.com/docs/get-started/installation)
 for recommended system specifications and a detailed installation guide.
 
 ### Quick Install
@@ -71,9 +71,9 @@ conda activate gemini_env
 npm install -g @google/gemini-cli
 ```
 
-## Release Cadence and Tags
+## Release Channels
 
-See [Releases](./docs/releases.md) for more details.
+See [Releases](https://www.geminicli.com/docs/changelogs) for more details.
 
 ### Preview
 
@@ -209,7 +209,7 @@ gemini
 ```
 
 For Google Workspace accounts and other authentication methods, see the
-[authentication guide](./docs/get-started/authentication.md).
+[authentication guide](https://www.geminicli.com/docs/get-started/authentication).
 
 ## 🚀 Getting Started
 
@@ -278,60 +278,64 @@ gemini
 
 ### Getting Started
 
-- [**Quickstart Guide**](./docs/get-started/index.md) - Get up and running
-  quickly.
-- [**Authentication Setup**](./docs/get-started/authentication.md) - Detailed
-  auth configuration.
-- [**Configuration Guide**](./docs/reference/configuration.md) - Settings and
-  customization.
-- [**Keyboard Shortcuts**](./docs/reference/keyboard-shortcuts.md) -
+- [**Quickstart Guide**](https://www.geminicli.com/docs/get-started) - Get up
+  and running quickly.
+- [**Authentication Setup**](https://www.geminicli.com/docs/get-started/authentication) -
+  Detailed auth configuration.
+- [**Configuration Guide**](https://www.geminicli.com/docs/reference/configuration) -
+  Settings and customization.
+- [**Keyboard Shortcuts**](https://www.geminicli.com/docs/reference/keyboard-shortcuts) -
   Productivity tips.
 
 ### Core Features
 
-- [**Commands Reference**](./docs/reference/commands.md) - All slash commands
-  (`/help`, `/chat`, etc).
-- [**Custom Commands**](./docs/cli/custom-commands.md) - Create your own
-  reusable commands.
-- [**Context Files (GEMINI.md)**](./docs/cli/gemini-md.md) - Provide persistent
-  context to Gemini CLI.
-- [**Checkpointing**](./docs/cli/checkpointing.md) - Save and resume
-  conversations.
-- [**Token Caching**](./docs/cli/token-caching.md) - Optimize token usage.
+- [**Commands Reference**](https://www.geminicli.com/docs/reference/commands) -
+  All slash commands (`/help`, `/chat`, etc).
+- [**Custom Commands**](https://www.geminicli.com/docs/cli/custom-commands) -
+  Create your own reusable commands.
+- [**Context Files (GEMINI.md)**](https://www.geminicli.com/docs/cli/gemini-md) -
+  Provide persistent context to Gemini CLI.
+- [**Checkpointing**](https://www.geminicli.com/docs/cli/checkpointing) - Save
+  and resume conversations.
+- [**Token Caching**](https://www.geminicli.com/docs/cli/token-caching) -
+  Optimize token usage.
 
 ### Tools & Extensions
 
-- [**Built-in Tools Overview**](./docs/reference/tools.md)
-  - [File System Operations](./docs/tools/file-system.md)
-  - [Shell Commands](./docs/tools/shell.md)
-  - [Web Fetch & Search](./docs/tools/web-fetch.md)
-- [**MCP Server Integration**](./docs/tools/mcp-server.md) - Extend with custom
-  tools.
-- [**Custom Extensions**](./docs/extensions/index.md) - Build and share your own
-  commands.
+- [**Built-in Tools Overview**](https://www.geminicli.com/docs/reference/tools)
+  - [File System Operations](https://www.geminicli.com/docs/tools/file-system)
+  - [Shell Commands](https://www.geminicli.com/docs/tools/shell)
+  - [Web Fetch & Search](https://www.geminicli.com/docs/tools/web-fetch)
+- [**MCP Server Integration**](https://www.geminicli.com/docs/tools/mcp-server) -
+  Extend with custom tools.
+- [**Custom Extensions**](https://geminicli.com/docs/extensions/writing-extensions) -
+  Build and share your own commands.
 
 ### Advanced Topics
 
-- [**Headless Mode (Scripting)**](./docs/cli/headless.md) - Use Gemini CLI in
-  automated workflows.
-- [**Architecture Overview**](./docs/architecture.md) - How Gemini CLI works.
-- [**IDE Integration**](./docs/ide-integration/index.md) - VS Code companion.
-- [**Sandboxing & Security**](./docs/cli/sandbox.md) - Safe execution
-  environments.
-- [**Trusted Folders**](./docs/cli/trusted-folders.md) - Control execution
-  policies by folder.
-- [**Enterprise Guide**](./docs/cli/enterprise.md) - Deploy and manage in a
-  corporate environment.
-- [**Telemetry & Monitoring**](./docs/cli/telemetry.md) - Usage tracking.
-- [**Tools reference**](./docs/reference/tools.md) - Built-in tools overview.
-- [**Local development**](./docs/local-development.md) - Local development
-  tooling.
+- [**Headless Mode (Scripting)**](https://www.geminicli.com/docs/cli/headless) -
+  Use Gemini CLI in automated workflows.
+- [**IDE Integration**](https://www.geminicli.com/docs/ide-integration) - VS
+  Code companion.
+- [**Sandboxing & Security**](https://www.geminicli.com/docs/cli/sandbox) - Safe
+  execution environments.
+- [**Trusted Folders**](https://www.geminicli.com/docs/cli/trusted-folders) -
+  Control execution policies by folder.
+- [**Enterprise Guide**](https://www.geminicli.com/docs/cli/enterprise) - Deploy
+  and manage in a corporate environment.
+- [**Telemetry & Monitoring**](https://www.geminicli.com/docs/cli/telemetry) -
+  Usage tracking.
+- [**Tools reference**](https://www.geminicli.com/docs/reference/tools) -
+  Built-in tools overview.
+- [**Local development**](https://www.geminicli.com/docs/local-development) -
+  Local development tooling.
 
 ### Troubleshooting & Support
 
-- [**Troubleshooting Guide**](./docs/resources/troubleshooting.md) - Common
-  issues and solutions.
-- [**FAQ**](./docs/resources/faq.md) - Frequently asked questions.
+- [**Troubleshooting Guide**](https://www.geminicli.com/docs/resources/troubleshooting) -
+  Common issues and solutions.
+- [**FAQ**](https://www.geminicli.com/docs/resources/faq) - Frequently asked
+  questions.
 - Use `/bug` command to report issues directly from the CLI.
 
 ### Using MCP Servers
@@ -345,8 +349,9 @@ custom tools:
 > @database Run a query to find inactive users
 ```
 
-See the [MCP Server Integration guide](./docs/tools/mcp-server.md) for setup
-instructions.
+See the
+[MCP Server Integration guide](https://www.geminicli.com/docs/tools/mcp-server)
+for setup instructions.
 
 ## 🤝 Contributing
 
@@ -366,8 +371,11 @@ for planned features and priorities.
 
 ## 📖 Resources
 
+- **[Free Course](https://learn.deeplearning.ai/courses/gemini-cli-code-and-create-with-an-open-source-agent/information)** -
+  Learn the basics.
 - **[Official Roadmap](./ROADMAP.md)** - See what's coming next.
-- **[Changelog](./docs/changelogs/index.md)** - See recent notable updates.
+- **[Changelog](https://www.geminicli.com/docs/changelogs)** - See recent
+  notable updates.
 - **[NPM Package](https://www.npmjs.com/package/@google/gemini-cli)** - Package
   registry.
 - **[GitHub Issues](https://github.com/google-gemini/gemini-cli/issues)** -
@@ -377,15 +385,26 @@ for planned features and priorities.
 
 ### Uninstall
 
-See the [Uninstall Guide](./docs/resources/uninstall.md) for removal
-instructions.
+See the [Uninstall Guide](https://www.geminicli.com/docs/resources/uninstall)
+for removal instructions.
 
 ## 📄 Legal
 
 - **License**: [Apache License 2.0](LICENSE)
-- **Terms of Service**: [Terms & Privacy](./docs/resources/tos-privacy.md)
+- **Terms of Service**:
+  [Terms & Privacy](https://www.geminicli.com/docs/resources/tos-privacy)
 - **Security**: [Security Policy](SECURITY.md)
 
+<p align="left">
+ <a href="https://www.star-history.com/google-gemini/gemini-cli">
+  <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/badge?repo=google-gemini/gemini-cli&theme=dark" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/badge?repo=google-gemini/gemini-cli" />
+   <img alt="Star History Rank" src="https://api.star-history.com/badge?repo=google-gemini/gemini-cli" />
+  </picture>
+ </a>
+</p>
+
 ---
 
 <p align="center">

docs/admin/enterprise-controls.md

@@ -72,7 +72,7 @@ organization.
 **Supported Fields:**
 
 - `url`: (Required) The full URL of the MCP server endpoint.
-- `type`: (Required) The connection type (e.g., `sse` or `http`).
+- `type`: (Required) The connection type (for example, `sse` or `http`).
 - `trust`: (Optional) If set to `true`, the server is trusted and tool execution
   will not require user approval.
 - `includeTools`: (Optional) An explicit list of tool names to allow. If
@@ -106,6 +106,67 @@ organization.
   ensures users maintain final control over which permitted servers are actually
   active in their environment.
 
+#### Required MCP Servers (preview)
+
+**Default**: empty
+
+Allows administrators to define MCP servers that are **always injected** into
+the user's environment. Unlike the allowlist (which filters user-configured
+servers), required servers are automatically added regardless of the user's
+local configuration.
+
+**Required Servers Format:**
+
+```json
+{
+  "requiredMcpServers": {
+    "corp-compliance-tool": {
+      "url": "https://mcp.corp/compliance",
+      "type": "http",
+      "trust": true,
+      "description": "Corporate compliance tool"
+    },
+    "internal-registry": {
+      "url": "https://registry.corp/mcp",
+      "type": "sse",
+      "authProviderType": "google_credentials",
+      "oauth": {
+        "scopes": ["https://www.googleapis.com/auth/scope"]
+      }
+    }
+  }
+}
+```
+
+**Supported Fields:**
+
+- `url`: (Required) The full URL of the MCP server endpoint.
+- `type`: (Required) The connection type (`sse` or `http`).
+- `trust`: (Optional) If set to `true`, tool execution will not require user
+  approval. Defaults to `true` for required servers.
+- `description`: (Optional) Human-readable description of the server.
+- `authProviderType`: (Optional) Authentication provider (`dynamic_discovery`,
+  `google_credentials`, or `service_account_impersonation`).
+- `oauth`: (Optional) OAuth configuration including `scopes`, `clientId`, and
+  `clientSecret`.
+- `targetAudience`: (Optional) OAuth target audience for service-to-service
+  auth.
+- `targetServiceAccount`: (Optional) Service account email to impersonate.
+- `headers`: (Optional) Additional HTTP headers to send with requests.
+- `includeTools` / `excludeTools`: (Optional) Tool filtering lists.
+- `timeout`: (Optional) Timeout in milliseconds for MCP requests.
+
+**Client Enforcement Logic:**
+
+- Required servers are injected **after** allowlist filtering, so they are
+  always available even if the allowlist is active.
+- If a required server has the **same name** as a locally configured server, the
+  admin configuration **completely overrides** the local one.
+- Required servers only support remote transports (`sse`, `http`). Local
+  execution fields (`command`, `args`, `env`, `cwd`) are not supported.
+- Required servers can coexist with allowlisted servers — both features work
+  independently.
+
 ### Unmanaged Capabilities
 
 **Enabled/Disabled** | Default: disabled

docs/changelogs/index.md

@@ -18,6 +18,193 @@ on GitHub.
 | [Preview](preview.md) | Experimental features ready for early feedback. |
 | [Stable](latest.md)   | Stable, recommended for general use.            |
 
+## Announcements: v0.42.0 - 2026-05-12
+
+- **Auto Memory Inbox:** Introduced a new inbox flow for Auto Memory with a
+  canonical-patch contract for seamless skill management
+  ([#26338](https://github.com/google-gemini/gemini-cli/pull/26338) by
+  @SandyTao520).
+- **Gemma 4 by Default:** Enabled Gemma 4 models by default via the Gemini API
+  for all users
+  ([#26307](https://github.com/google-gemini/gemini-cli/pull/26307) by
+  @Abhijit-2592).
+- **Voice Mode Enhancements:** Added wave animations and privacy/compliance UX
+  warnings for the Gemini Live backend
+  ([#26284](https://github.com/google-gemini/gemini-cli/pull/26284) by
+  @devr0306, [#26454](https://github.com/google-gemini/gemini-cli/pull/26454) by
+  @cocosheng-g).
+
+## Announcements: v0.41.0 - 2026-05-05
+
+- **Real-time Voice Mode:** Implemented real-time voice mode with cloud and
+  local backends
+  ([#24174](https://github.com/google-gemini/gemini-cli/pull/24174) by
+  @Abhijit-2592).
+- **Secure Environment Loading:** Enforced workspace trust and secured .env
+  loading in headless mode
+  ([#25814](https://github.com/google-gemini/gemini-cli/pull/25814) by
+  @ehedlund).
+- **Advanced Shell Validation:** Enhanced shell command validation and added
+  core tools allowlist for improved security
+  ([#25720](https://github.com/google-gemini/gemini-cli/pull/25720) by @galz10).
+
+## Announcements: v0.40.0 - 2026-04-28
+
+- **Offline Search and Themes:** Bundled ripgrep for offline search support and
+  added GitHub-style colorblind themes
+  ([#25342](https://github.com/google-gemini/gemini-cli/pull/25342) by
+  @scidomino, [#15504](https://github.com/google-gemini/gemini-cli/pull/15504)
+  by @Z1xus).
+- **Advanced Resource and Memory Management:** Introduced MCP resource tools and
+  transitioned to a prompt-driven, four-tier memory management system
+  ([#25395](https://github.com/google-gemini/gemini-cli/pull/25395) by
+  @ruomengz, [#25716](https://github.com/google-gemini/gemini-cli/pull/25716) by
+  @SandyTao520).
+- **UX and Local Models:** Enabled topic update narrations by default and
+  streamlined Gemma local model setup with `gemini gemma`
+  ([#25586](https://github.com/google-gemini/gemini-cli/pull/25586) by
+  @gundermanc, [#25498](https://github.com/google-gemini/gemini-cli/pull/25498)
+  by @Samee24).
+
+## Announcements: v0.39.0 - 2026-04-23
+
+- **Skill Management:** Added a new `/memory` inbox command for reviewing and
+  patching skills extracted during sessions
+  ([#24544](https://github.com/google-gemini/gemini-cli/pull/24544) by
+  @SandyTao520, [#25148](https://github.com/google-gemini/gemini-cli/pull/25148)
+  by @SandyTao520).
+- **Improved Transparency:** Plan Mode now requires confirmation for skill
+  activation and allows plan inspection
+  ([#24946](https://github.com/google-gemini/gemini-cli/pull/24946),
+  [#25058](https://github.com/google-gemini/gemini-cli/pull/25058) by
+  @ruomengz).
+- **Architecture & Reliability:** Introduced a decoupled `ContextManager`
+  architecture and resolved several critical memory leaks and PTY exhaustion
+  issues ([#24752](https://github.com/google-gemini/gemini-cli/pull/24752) by
+  @joshualitt, [#25079](https://github.com/google-gemini/gemini-cli/pull/25079)
+  by @spencer426).
+
+## Announcements: v0.38.0 - 2026-04-14
+
+- **Chapters Narrative Flow:** Group agent interactions into "Chapters" based on
+  intent and tool usage for better session structure
+  ([#23150](https://github.com/google-gemini/gemini-cli/pull/23150) by
+  @Abhijit-2592,
+  [#24079](https://github.com/google-gemini/gemini-cli/pull/24079) by
+  @gundermanc).
+- **Context Compression Service:** Advanced context management to efficiently
+  distill conversation history
+  ([#24483](https://github.com/google-gemini/gemini-cli/pull/24483) by
+  @joshualitt).
+- **UI Flicker & UX Enhancements:** Solved rendering flicker with "Terminal
+  Buffer" mode and introduced selective topic expansion
+  ([#24512](https://github.com/google-gemini/gemini-cli/pull/24512) by
+  @jacob314, [#24793](https://github.com/google-gemini/gemini-cli/pull/24793) by
+  @Abhijit-2592).
+- **Persistent Policy Approvals:** Implemented context-aware persistent
+  approvals for tool execution
+  ([#23257](https://github.com/google-gemini/gemini-cli/pull/23257) by @jerop).
+
+## Announcements: v0.37.0 - 2026-04-08
+
+- **Dynamic Sandbox Expansion:** Implemented dynamic sandbox expansion and
+  worktree support for Linux and Windows, improving developer workflows in
+  isolated environments
+  ([#23692](https://github.com/google-gemini/gemini-cli/pull/23692) by @galz10,
+  [#23691](https://github.com/google-gemini/gemini-cli/pull/23691) by
+  @scidomino).
+- **Chapters Narrative Flow:** Introduced tool-based topic grouping ("Chapters")
+  to provide better session structure and narrative continuity
+  ([#23150](https://github.com/google-gemini/gemini-cli/pull/23150) by
+  @Abhijit-2592,
+  [#24079](https://github.com/google-gemini/gemini-cli/pull/24079) by
+  @gundermanc).
+- **Advanced Browser Capabilities:** Enhanced the browser agent with persistent
+  sessions and dynamic tool discovery
+  ([#21306](https://github.com/google-gemini/gemini-cli/pull/21306) by
+  @kunal-10-cloud,
+  [#23805](https://github.com/google-gemini/gemini-cli/pull/23805) by
+  @cynthialong0-0).
+
+## Announcements: v0.36.0 - 2026-04-01
+
+- **Multi-Registry Architecture and Sandboxing:** Introduced a multi-registry
+  architecture and implemented native macOS Seatbelt and Windows sandboxing for
+  enhanced subagent security
+  ([#22712](https://github.com/google-gemini/gemini-cli/pull/22712),
+  [#22718](https://github.com/google-gemini/gemini-cli/pull/22718) by @akh64bit,
+  [#22832](https://github.com/google-gemini/gemini-cli/pull/22832) by @ehedlund,
+  [#21807](https://github.com/google-gemini/gemini-cli/pull/21807) by
+  @mattKorwel).
+- **Refreshed Composer UX:** Implemented a refreshed user experience for the
+  Composer layout and improved terminal interaction robustness
+  ([#21212](https://github.com/google-gemini/gemini-cli/pull/21212),
+  [#23286](https://github.com/google-gemini/gemini-cli/pull/23286) by
+  @jwhelangoog).
+- **Git Worktree Support:** Added native support for Git worktrees, allowing for
+  isolated parallel sessions
+  ([#22973](https://github.com/google-gemini/gemini-cli/pull/22973),
+  [#23265](https://github.com/google-gemini/gemini-cli/pull/23265) by @jerop).
+- **Subagent Context and Feedback:** Enhanced subagents with JIT context
+  injection and resilient tool rejection with contextual feedback
+  ([#23032](https://github.com/google-gemini/gemini-cli/pull/23032),
+  [#22951](https://github.com/google-gemini/gemini-cli/pull/22951) by
+  @abhipatel12).
+
+## Announcements: v0.35.0 - 2026-03-24
+
+- **Customizable Keyboard Shortcuts:** Users can now customize their keyboard
+  shortcuts, including support for literal character keybindings and the
+  extended Kitty protocol
+  ([#21945](https://github.com/google-gemini/gemini-cli/pull/21945),
+  [#21972](https://github.com/google-gemini/gemini-cli/pull/21972) by
+  @scidomino).
+- **Vim Mode Improvements:** Added missing motions (X, ~, r, f/F/t/T) and
+  yank/paste support with the unnamed register
+  ([#21932](https://github.com/google-gemini/gemini-cli/pull/21932),
+  [#22026](https://github.com/google-gemini/gemini-cli/pull/22026) by @aanari).
+- **Tool Isolation and Sandboxing:** Introduced `SandboxManager` to isolate
+  process-spawning tools and added Linux bubblewrap/seccomp sandboxing support
+  ([#21774](https://github.com/google-gemini/gemini-cli/pull/21774),
+  [#22231](https://github.com/google-gemini/gemini-cli/pull/22231) by @galz10,
+  [#22680](https://github.com/google-gemini/gemini-cli/pull/22680) by
+  @DavidAPierce).
+- **JIT Context Discovery:** Implemented Just-In-Time context discovery for file
+  system tools to improve model performance and accuracy
+  ([#22082](https://github.com/google-gemini/gemini-cli/pull/22082),
+  [#22736](https://github.com/google-gemini/gemini-cli/pull/22736) by
+  @SandyTao520).
+
+## Announcements: v0.34.0 - 2026-03-17
+
+- **Plan Mode Enabled by Default:** Plan Mode is now enabled by default to help
+  you break down complex tasks and execute them systematically
+  ([#21713](https://github.com/google-gemini/gemini-cli/pull/21713) by @jerop).
+- **Sandboxing Enhancements:** We've added native gVisor (runsc) and
+  experimental LXC container sandboxing support for safer execution environments
+  ([#21062](https://github.com/google-gemini/gemini-cli/pull/21062) by
+  @Zheyuan-Lin, [#20735](https://github.com/google-gemini/gemini-cli/pull/20735)
+  by @h30s).
+
+## Announcements: v0.33.0 - 2026-03-11
+
+- **Agent Architecture Enhancements:** Introduced HTTP authentication for A2A
+  remote agents and authenticated A2A agent card discovery
+  ([#20510](https://github.com/google-gemini/gemini-cli/pull/20510) by
+  @SandyTao520, [#20622](https://github.com/google-gemini/gemini-cli/pull/20622)
+  by @SandyTao520).
+- **Plan Mode Updates:** Expanded Plan Mode with built-in research subagents,
+  annotation support for feedback, and a new `copy` subcommand
+  ([#20972](https://github.com/google-gemini/gemini-cli/pull/20972) by @Adib234,
+  [#20988](https://github.com/google-gemini/gemini-cli/pull/20988) by
+  @ruomengz).
+- **CLI UX & Admin Controls:** Redesigned the header to be compact with an ASCII
+  icon, inverted context window display to show usage, and enabled a 30-day
+  default retention for chat history
+  ([#18713](https://github.com/google-gemini/gemini-cli/pull/18713) by
+  @keithguerin, [#20853](https://github.com/google-gemini/gemini-cli/pull/20853)
+  by @skeshive).
+
 ## Announcements: v0.32.0 - 2026-03-03
 
 - **Generalist Agent:** The generalist agent is now enabled to improve task
@@ -106,10 +293,6 @@ on GitHub.
 
 ## Announcements: v0.28.0 - 2026-02-10
 
-- **Slash Command:** We've added a new `/prompt-suggest` slash command to help
-  you generate prompt suggestions
-  ([#17264](https://github.com/google-gemini/gemini-cli/pull/17264) by
-  @NTaylorMullen).
 - **IDE Support:** Gemini CLI now supports the Positron IDE
   ([#15047](https://github.com/google-gemini/gemini-cli/pull/15047) by
   @kapsner).
@@ -149,8 +332,8 @@ on GitHub.
   ([#16638](https://github.com/google-gemini/gemini-cli/pull/16638) by
   @joshualitt).
 - **UI/UX Improvements:** You can now "Rewind" through your conversation history
-  ([#15717](https://github.com/google-gemini/gemini-cli/pull/15717) by @Adib234)
-  and use a new `/introspect` command for debugging.
+  ([#15717](https://github.com/google-gemini/gemini-cli/pull/15717) by
+  @Adib234).
 - **Core and Scheduler Refactoring:** The core scheduler has been significantly
   refactored to improve performance and reliability
   ([#16895](https://github.com/google-gemini/gemini-cli/pull/16895) by

docs/changelogs/latest.md

@@ -1,6 +1,6 @@
-# Latest stable release: v0.32.1
+# Latest stable release: v0.42.0
 
-Released: March 4, 2026
+Released: May 12, 2026
 
 For most users, our latest stable release is the recommended release. Install
 the latest stable version with:
@@ -11,198 +11,272 @@ npm install -g @google/gemini-cli
 
 ## Highlights
 
-- **Plan Mode Enhancements**: Significant updates to Plan Mode, including the
-  ability to open and modify plans in an external editor, adaptations for
-  complex tasks with multi-select options, and integration tests for plan mode.
-- **Agent and Steering Improvements**: The generalist agent has been enabled to
-  enhance task delegation, model steering is now supported directly within the
-  workspace, and contiguous parallel admission is enabled for `Kind.Agent`
-  tools.
-- **Interactive Shell**: Interactive shell autocompletion has been introduced,
-  significantly enhancing the user experience.
-- **Core Stability and Performance**: Extensions are now loaded in parallel,
-  fetch timeouts have been increased, robust A2A streaming reassembly was
-  implemented, and orphaned processes when terminal closes have been prevented.
-- **Billing and Quota Handling**: Implemented G1 AI credits overage flow with
-  billing telemetry and added support for quota error fallbacks across all
-  authentication types.
+- **Auto Memory Inbox:** Introduced a new inbox flow for Auto Memory using a
+  canonical-patch contract, enabling more robust and manageable skill
+  extraction.
+- **Gemma 4 Default:** Gemma 4 models are now enabled by default via the Gemini
+  API, providing improved performance and capabilities out of the box.
+- **Voice Mode Polish:** Added wave animations for visual feedback and
+  privacy/compliance UX warnings specifically for the Gemini Live backend.
+- **Session Management:** Added a `--delete` flag to the `/exit` command for
+  instant session deletion and introduced `/bug-memory` for easier heap
+  diagnostics.
+- **Improved Reliability:** Reduced default API timeouts to 60s and implemented
+  retries for undici and premature stream closure errors.
 
 ## What's Changed
 
-- fix(patch): cherry-pick 0659ad1 to release/v0.32.0-pr-21042 to patch version
-  v0.32.0 and create version 0.32.1 by @gemini-cli-robot in
-  [#21048](https://github.com/google-gemini/gemini-cli/pull/21048)
-- feat(plan): add integration tests for plan mode by @Adib234 in
-  [#20214](https://github.com/google-gemini/gemini-cli/pull/20214)
-- fix(acp): update auth handshake to spec by @skeshive in
-  [#19725](https://github.com/google-gemini/gemini-cli/pull/19725)
-- feat(core): implement robust A2A streaming reassembly and fix task continuity
-  by @adamfweidman in
-  [#20091](https://github.com/google-gemini/gemini-cli/pull/20091)
-- feat(cli): load extensions in parallel by @scidomino in
-  [#20229](https://github.com/google-gemini/gemini-cli/pull/20229)
-- Plumb the maxAttempts setting through Config args by @kevinjwang1 in
-  [#20239](https://github.com/google-gemini/gemini-cli/pull/20239)
-- fix(cli): skip 404 errors in setup-github file downloads by @h30s in
-  [#20287](https://github.com/google-gemini/gemini-cli/pull/20287)
-- fix(cli): expose model.name setting in settings dialog for persistence by
-  @achaljhawar in
-  [#19605](https://github.com/google-gemini/gemini-cli/pull/19605)
-- docs: remove legacy cmd examples in favor of powershell by @scidomino in
-  [#20323](https://github.com/google-gemini/gemini-cli/pull/20323)
-- feat(core): Enable model steering in workspace. by @joshualitt in
-  [#20343](https://github.com/google-gemini/gemini-cli/pull/20343)
-- fix: remove trailing comma in issue triage workflow settings json by @Nixxx19
-  in [#20265](https://github.com/google-gemini/gemini-cli/pull/20265)
-- feat(core): implement task tracker foundation and service by @anj-s in
-  [#19464](https://github.com/google-gemini/gemini-cli/pull/19464)
-- test: support tests that include color information by @jacob314 in
-  [#20220](https://github.com/google-gemini/gemini-cli/pull/20220)
-- feat(core): introduce Kind.Agent for sub-agent classification by @abhipatel12
-  in [#20369](https://github.com/google-gemini/gemini-cli/pull/20369)
-- Changelog for v0.30.0 by @gemini-cli-robot in
-  [#20252](https://github.com/google-gemini/gemini-cli/pull/20252)
-- Update changelog workflow to reject nightly builds by @g-samroberts in
-  [#20248](https://github.com/google-gemini/gemini-cli/pull/20248)
-- Changelog for v0.31.0-preview.0 by @gemini-cli-robot in
-  [#20249](https://github.com/google-gemini/gemini-cli/pull/20249)
-- feat(cli): hide workspace policy update dialog and auto-accept by default by
-  @Abhijit-2592 in
-  [#20351](https://github.com/google-gemini/gemini-cli/pull/20351)
-- feat(core): rename grep_search include parameter to include_pattern by
-  @SandyTao520 in
-  [#20328](https://github.com/google-gemini/gemini-cli/pull/20328)
-- feat(plan): support opening and modifying plan in external editor by @Adib234
-  in [#20348](https://github.com/google-gemini/gemini-cli/pull/20348)
-- feat(cli): implement interactive shell autocompletion by @mrpmohiburrahman in
-  [#20082](https://github.com/google-gemini/gemini-cli/pull/20082)
-- fix(core): allow /memory add to work in plan mode by @Jefftree in
-  [#20353](https://github.com/google-gemini/gemini-cli/pull/20353)
-- feat(core): add HTTP 499 to retryable errors and map to RetryableQuotaError by
-  @bdmorgan in [#20432](https://github.com/google-gemini/gemini-cli/pull/20432)
-- feat(core): Enable generalist agent by @joshualitt in
-  [#19665](https://github.com/google-gemini/gemini-cli/pull/19665)
-- Updated tests in TableRenderer.test.tsx to use SVG snapshots by @devr0306 in
-  [#20450](https://github.com/google-gemini/gemini-cli/pull/20450)
-- Refactor Github Action per b/485167538 by @google-admin in
-  [#19443](https://github.com/google-gemini/gemini-cli/pull/19443)
-- fix(github): resolve actionlint and yamllint regressions from #19443 by @jerop
-  in [#20467](https://github.com/google-gemini/gemini-cli/pull/20467)
-- fix: action var usage by @galz10 in
-  [#20492](https://github.com/google-gemini/gemini-cli/pull/20492)
-- feat(core): improve A2A content extraction by @adamfweidman in
-  [#20487](https://github.com/google-gemini/gemini-cli/pull/20487)
-- fix(cli): support quota error fallbacks for all authentication types by
-  @sehoon38 in [#20475](https://github.com/google-gemini/gemini-cli/pull/20475)
-- fix(core): flush transcript for pure tool-call responses to ensure BeforeTool
-  hooks see complete state by @krishdef7 in
-  [#20419](https://github.com/google-gemini/gemini-cli/pull/20419)
-- feat(plan): adapt planning workflow based on complexity of task by @jerop in
-  [#20465](https://github.com/google-gemini/gemini-cli/pull/20465)
-- fix: prevent orphaned processes from consuming 100% CPU when terminal closes
-  by @yuvrajangadsingh in
-  [#16965](https://github.com/google-gemini/gemini-cli/pull/16965)
-- feat(core): increase fetch timeout and fix [object Object] error
-  stringification by @bdmorgan in
-  [#20441](https://github.com/google-gemini/gemini-cli/pull/20441)
-- [Gemma x Gemini CLI] Add an Experimental Gemma Router that uses a LiteRT-LM
-  shim into the Composite Model Classifier Strategy by @sidwan02 in
-  [#17231](https://github.com/google-gemini/gemini-cli/pull/17231)
-- docs(plan): update documentation regarding supporting editing of plan files
-  during plan approval by @Adib234 in
-  [#20452](https://github.com/google-gemini/gemini-cli/pull/20452)
-- test(cli): fix flaky ToolResultDisplay overflow test by @jwhelangoog in
-  [#20518](https://github.com/google-gemini/gemini-cli/pull/20518)
-- ui(cli): reduce length of Ctrl+O hint by @jwhelangoog in
-  [#20490](https://github.com/google-gemini/gemini-cli/pull/20490)
-- fix(ui): correct styled table width calculations by @devr0306 in
-  [#20042](https://github.com/google-gemini/gemini-cli/pull/20042)
-- Avoid overaggressive unescaping by @scidomino in
-  [#20520](https://github.com/google-gemini/gemini-cli/pull/20520)
-- feat(telemetry) Instrument traces with more attributes and make them available
-  to OTEL users by @heaventourist in
-  [#20237](https://github.com/google-gemini/gemini-cli/pull/20237)
-- Add support for policy engine in extensions by @chrstnb in
-  [#20049](https://github.com/google-gemini/gemini-cli/pull/20049)
-- Docs: Update to Terms of Service & FAQ by @jkcinouye in
-  [#20488](https://github.com/google-gemini/gemini-cli/pull/20488)
-- Fix bottom border rendering for search and add a regression test. by @jacob314
-  in [#20517](https://github.com/google-gemini/gemini-cli/pull/20517)
-- fix(core): apply retry logic to CodeAssistServer for all users by @bdmorgan in
-  [#20507](https://github.com/google-gemini/gemini-cli/pull/20507)
-- Fix extension MCP server env var loading by @chrstnb in
-  [#20374](https://github.com/google-gemini/gemini-cli/pull/20374)
-- feat(ui): add 'ctrl+o' hint to truncated content message by @jerop in
-  [#20529](https://github.com/google-gemini/gemini-cli/pull/20529)
-- Fix flicker showing message to press ctrl-O again to collapse. by @jacob314 in
-  [#20414](https://github.com/google-gemini/gemini-cli/pull/20414)
-- fix(cli): hide shortcuts hint while model is thinking or the user has typed a
-  prompt + add debounce to avoid flicker by @jacob314 in
-  [#19389](https://github.com/google-gemini/gemini-cli/pull/19389)
-- feat(plan): update planning workflow to encourage multi-select with
-  descriptions of options by @Adib234 in
-  [#20491](https://github.com/google-gemini/gemini-cli/pull/20491)
-- refactor(core,cli): useAlternateBuffer read from config by @psinha40898 in
-  [#20346](https://github.com/google-gemini/gemini-cli/pull/20346)
-- fix(cli): ensure dialogs stay scrolled to bottom in alternate buffer mode by
-  @jacob314 in [#20527](https://github.com/google-gemini/gemini-cli/pull/20527)
-- fix(core): revert auto-save of policies to user space by @Abhijit-2592 in
-  [#20531](https://github.com/google-gemini/gemini-cli/pull/20531)
-- Demote unreliable test. by @gundermanc in
-  [#20571](https://github.com/google-gemini/gemini-cli/pull/20571)
-- fix(core): handle optional response fields from code assist API by @sehoon38
-  in [#20345](https://github.com/google-gemini/gemini-cli/pull/20345)
-- fix(cli): keep thought summary when loading phrases are off by @LyalinDotCom
-  in [#20497](https://github.com/google-gemini/gemini-cli/pull/20497)
-- feat(cli): add temporary flag to disable workspace policies by @Abhijit-2592
-  in [#20523](https://github.com/google-gemini/gemini-cli/pull/20523)
-- Disable expensive and scheduled workflows on personal forks by @dewitt in
-  [#20449](https://github.com/google-gemini/gemini-cli/pull/20449)
-- Moved markdown parsing logic to a separate util file by @devr0306 in
-  [#20526](https://github.com/google-gemini/gemini-cli/pull/20526)
-- fix(plan): prevent agent from using ask_user for shell command confirmation by
-  @Adib234 in [#20504](https://github.com/google-gemini/gemini-cli/pull/20504)
-- fix(core): disable retries for code assist streaming requests by @sehoon38 in
-  [#20561](https://github.com/google-gemini/gemini-cli/pull/20561)
-- feat(billing): implement G1 AI credits overage flow with billing telemetry by
-  @gsquared94 in
-  [#18590](https://github.com/google-gemini/gemini-cli/pull/18590)
-- feat: better error messages by @gsquared94 in
-  [#20577](https://github.com/google-gemini/gemini-cli/pull/20577)
-- fix(ui): persist expansion in AskUser dialog when navigating options by @jerop
-  in [#20559](https://github.com/google-gemini/gemini-cli/pull/20559)
-- fix(cli): prevent sub-agent tool calls from leaking into UI by @abhipatel12 in
-  [#20580](https://github.com/google-gemini/gemini-cli/pull/20580)
-- fix(cli): Shell autocomplete polish by @jacob314 in
-  [#20411](https://github.com/google-gemini/gemini-cli/pull/20411)
-- Changelog for v0.31.0-preview.1 by @gemini-cli-robot in
-  [#20590](https://github.com/google-gemini/gemini-cli/pull/20590)
-- Add slash command for promoting behavioral evals to CI blocking by @gundermanc
-  in [#20575](https://github.com/google-gemini/gemini-cli/pull/20575)
-- Changelog for v0.30.1 by @gemini-cli-robot in
-  [#20589](https://github.com/google-gemini/gemini-cli/pull/20589)
-- Add low/full CLI error verbosity mode for cleaner UI by @LyalinDotCom in
-  [#20399](https://github.com/google-gemini/gemini-cli/pull/20399)
-- Disable Gemini PR reviews on draft PRs. by @gundermanc in
-  [#20362](https://github.com/google-gemini/gemini-cli/pull/20362)
-- Docs: FAQ update by @jkcinouye in
-  [#20585](https://github.com/google-gemini/gemini-cli/pull/20585)
-- fix(core): reduce intrusive MCP errors and deduplicate diagnostics by
-  @spencer426 in
-  [#20232](https://github.com/google-gemini/gemini-cli/pull/20232)
-- docs: fix spelling typos in installation guide by @campox747 in
-  [#20579](https://github.com/google-gemini/gemini-cli/pull/20579)
-- Promote stable tests to CI blocking. by @gundermanc in
-  [#20581](https://github.com/google-gemini/gemini-cli/pull/20581)
-- feat(core): enable contiguous parallel admission for Kind.Agent tools by
+- fix(cli): prevent automatic updates from switching to less stable channels by
+  @Adib234 in [#26132](https://github.com/google-gemini/gemini-cli/pull/26132)
+- chore(release): bump version to 0.42.0-nightly.20260428.g59b2dea0e by
+  @gemini-cli-robot in
+  [#26142](https://github.com/google-gemini/gemini-cli/pull/26142)
+- fix(cli): pass node arguments via NODE_OPTIONS during relaunch to support SEA
+  by @cocosheng-g in
+  [#26130](https://github.com/google-gemini/gemini-cli/pull/26130)
+- fix(cli): handle DECKPAM keypad Enter sequences in terminal by @Gitanaskhan26
+  in [#26092](https://github.com/google-gemini/gemini-cli/pull/26092)
+- docs(cli): point plan-mode session retention to actual /settings labels by
+  @ifitisit in [#25978](https://github.com/google-gemini/gemini-cli/pull/25978)
+- fix(core): add missing oauth fields support in subagent parsing by
   @abhipatel12 in
-  [#20583](https://github.com/google-gemini/gemini-cli/pull/20583)
-- Enforce import/no-duplicates as error by @Nixxx19 in
-  [#19797](https://github.com/google-gemini/gemini-cli/pull/19797)
-- fix: merge duplicate imports in sdk and test-utils packages (1/4) by @Nixxx19
-  in [#19777](https://github.com/google-gemini/gemini-cli/pull/19777)
-- fix: merge duplicate imports in a2a-server package (2/4) by @Nixxx19 in
-  [#19781](https://github.com/google-gemini/gemini-cli/pull/19781)
+  [#26141](https://github.com/google-gemini/gemini-cli/pull/26141)
+- fix(core): disconnect extension-backed MCP clients in stopExtension by
+  @cocosheng-g in
+  [#26136](https://github.com/google-gemini/gemini-cli/pull/26136)
+- Update documentation workflows with workspace trust by @g-samroberts in
+  [#26150](https://github.com/google-gemini/gemini-cli/pull/26150)
+- refactor(acp): modularize monolithic acpClient into specialized files by
+  @sripasg in [#26143](https://github.com/google-gemini/gemini-cli/pull/26143)
+- test: fix failures due to antigravity environment leakage by @adamfweidman in
+  [#26162](https://github.com/google-gemini/gemini-cli/pull/26162)
+- fix(core): add explicit empty log guard in A2A pushMessage by @adamfweidman in
+  [#26198](https://github.com/google-gemini/gemini-cli/pull/26198)
+- feat(cli): add --delete flag to /exit command for session deletion by
+  @AbdulTawabJuly in
+  [#19332](https://github.com/google-gemini/gemini-cli/pull/19332)
+- test(core): add regression test for issue for ToolConfirmationResponse by
+  @Adib234 in [#26194](https://github.com/google-gemini/gemini-cli/pull/26194)
+- Add the ability to @ mention the gemini robot. by @gundermanc in
+  [#26207](https://github.com/google-gemini/gemini-cli/pull/26207)
+- test(evals): add EvalMetadata JSDoc annotations to older tests by @akh64bit in
+  [#26147](https://github.com/google-gemini/gemini-cli/pull/26147)
+- fix(core): reduce default API timeout to 60s and enable retries for undici
+  timeouts by @Adib234 in
+  [#26191](https://github.com/google-gemini/gemini-cli/pull/26191)
+- fix(core): distinguish fallback chains and fix maxAttempts for auto vs
+  explicit model selection by @adamfweidman in
+  [#26163](https://github.com/google-gemini/gemini-cli/pull/26163)
+- fix(cli): handle InvalidStream event gracefully without throwing by
+  @adamfweidman in
+  [#26218](https://github.com/google-gemini/gemini-cli/pull/26218)
+- ci(github-actions): switch to github app token and fix bot self-trigger by
+  @gundermanc in
+  [#26223](https://github.com/google-gemini/gemini-cli/pull/26223)
+- Respect logPrompts flag for logging sensitive fields by @lp-peg in
+  [#26153](https://github.com/google-gemini/gemini-cli/pull/26153)
+- fix: correct API key validation logic in handleApiKeySubmit by
+  @martin-hsu-test in
+  [#25453](https://github.com/google-gemini/gemini-cli/pull/25453)
+- fix(agent): prevent exit_plan_mode from being called via shell by
+  @Abhijit-2592 in
+  [#26230](https://github.com/google-gemini/gemini-cli/pull/26230)
+- # Fix: Inconsistent Case-Sensitivity in GrepTool by @.github/workflows/gemini-cli-bot-pulse.yml[bot] in [#26235](https://github.com/google-gemini/gemini-cli/pull/26235)
+- docs(core): add automated gemma setup guide by @Samee24 in
+  [#26233](https://github.com/google-gemini/gemini-cli/pull/26233)
+- Allow non-https proxy urls to support container environments by @stevemk14ebr
+  in [#26234](https://github.com/google-gemini/gemini-cli/pull/26234)
+- fix(bot): productivity and backlog optimizations by @gundermanc in
+  [#26236](https://github.com/google-gemini/gemini-cli/pull/26236)
+- refactor(acp): delegate prompt turn processing logic to GeminiClient by
+  @sripasg in [#26222](https://github.com/google-gemini/gemini-cli/pull/26222)
+- fix(cli): refine platform-specific undo/redo and smart bubbling for WSL by
+  @cocosheng-g in
+  [#26202](https://github.com/google-gemini/gemini-cli/pull/26202)
+- fix: suppress duplicate extension warnings during startup by @cocosheng-g in
+  [#26208](https://github.com/google-gemini/gemini-cli/pull/26208)
+- fix(cli): use byte length instead of string length for readStdin size limits
+  by @Adib234 in
+  [#26224](https://github.com/google-gemini/gemini-cli/pull/26224)
+- fix(ui): made shell tool header wrap on Ctrl+O by @devr0306 in
+  [#26229](https://github.com/google-gemini/gemini-cli/pull/26229)
+- Changelog for v0.41.0-preview.0 by @gemini-cli-robot in
+  [#26244](https://github.com/google-gemini/gemini-cli/pull/26244)
+- Skip binary CLI relaunch by @ruomengz in
+  [#26261](https://github.com/google-gemini/gemini-cli/pull/26261)
+- fix(cli): do not override GOOGLE_CLOUD_PROJECT in Cloud Shell when using
+  Vertex AI by @jackwotherspoon in
+  [#24455](https://github.com/google-gemini/gemini-cli/pull/24455)
+- docs(cli): add skill discovery troubleshooting checklist to tutorial by
+  @pmenic in [#26018](https://github.com/google-gemini/gemini-cli/pull/26018)
+- docs(policy-engine): link to tools reference for tool names and args by
+  @Aaxhirrr in [#22081](https://github.com/google-gemini/gemini-cli/pull/22081)
+- Fix posting invalid response to a comment by @gundermanc in
+  [#26266](https://github.com/google-gemini/gemini-cli/pull/26266)
+- fix(cli): prevent informational logs from polluting json output by
+  @cocosheng-g in
+  [#26264](https://github.com/google-gemini/gemini-cli/pull/26264)
+- feat(ui): added microphone and updated placeholder for voice mode by @devr0306
+  in [#26270](https://github.com/google-gemini/gemini-cli/pull/26270)
+- feat(cli): Add 'list' subcommand to '/commands' by @Jwhyee in
+  [#22324](https://github.com/google-gemini/gemini-cli/pull/22324)
+- fix(core): ensure tool output cleanup on session deletion for legacy files by
+  @cocosheng-g in
+  [#26263](https://github.com/google-gemini/gemini-cli/pull/26263)
+- Docs: Update Agent Skills documentation by @jkcinouye in
+  [#22388](https://github.com/google-gemini/gemini-cli/pull/22388)
+- test(acp): add missing coverage for extensions command error paths by
+  @sahilkirad in
+  [#25313](https://github.com/google-gemini/gemini-cli/pull/25313)
+- Changelog for v0.40.0 by @gemini-cli-robot in
+  [#26245](https://github.com/google-gemini/gemini-cli/pull/26245)
+- fix: report AgentExecutionBlocked in non-interactive programmatic modes by
+  @cocosheng-g in
+  [#26262](https://github.com/google-gemini/gemini-cli/pull/26262)
+- feat(extensions): add 'delete' as an alias for /extensions uninstall by
+  @martin-hsu-test in
+  [#25660](https://github.com/google-gemini/gemini-cli/pull/25660)
+- fix(core): silently skip GEMINI.md paths that are directories (EISDIR) by
+  @martin-hsu-test in
+  [#25662](https://github.com/google-gemini/gemini-cli/pull/25662)
+- fix(ci): checkout PR branch instead of main in bot workflow by @gundermanc in
+  [#26289](https://github.com/google-gemini/gemini-cli/pull/26289)
+- fix(cli): use resolved sandbox state for auto-update check by @Adib234 in
+  [#26285](https://github.com/google-gemini/gemini-cli/pull/26285)
+- # Metrics Integrity & Standardized Reporting (BT-01) by @.github/workflows/gemini-cli-bot-pulse.yml[bot] in [#26240](https://github.com/google-gemini/gemini-cli/pull/26240)
+- Add Star History section to README by @bdmorgan in
+  [#26290](https://github.com/google-gemini/gemini-cli/pull/26290)
+- Add Star History section to README by @bdmorgan in
+  [#26308](https://github.com/google-gemini/gemini-cli/pull/26308)
+- Remove Star History section from README by @bdmorgan in
+  [#26309](https://github.com/google-gemini/gemini-cli/pull/26309)
+- test(evals): add behavioral eval for file creation and write_file tool
+  selection by @akh64bit in
+  [#26292](https://github.com/google-gemini/gemini-cli/pull/26292)
+- feat(config): enable Gemma 4 models by default via Gemini API by @Abhijit-2592
+  in [#26307](https://github.com/google-gemini/gemini-cli/pull/26307)
+- fix(cli): insert voice transcription at cursor position instead of ap… by
+  @Zheyuan-Lin in
+  [#26287](https://github.com/google-gemini/gemini-cli/pull/26287)
+- fix(ui): fix issue with box edges by @gundermanc in
+  [#26148](https://github.com/google-gemini/gemini-cli/pull/26148)
+- fix(cli): respect .env override for GOOGLE_CLOUD_PROJECT by @DavidAPierce in
+  [#26288](https://github.com/google-gemini/gemini-cli/pull/26288)
+- fix(ci): robust version checking in release verification by @scidomino in
+  [#26337](https://github.com/google-gemini/gemini-cli/pull/26337)
+- fix(cli): enable daemon relaunch in binary and bundle keytar by @ruomengz in
+  [#26333](https://github.com/google-gemini/gemini-cli/pull/26333)
+- fix(core): discourage unprompted git add . in prompt snippets by @akh64bit in
+  [#26220](https://github.com/google-gemini/gemini-cli/pull/26220)
+- feat(ui): added wave animation for voice mode by @devr0306 in
+  [#26284](https://github.com/google-gemini/gemini-cli/pull/26284)
+- fix(cli): prevent Escape from clearing input buffer (#17083) by @cocosheng-g
+  in [#26339](https://github.com/google-gemini/gemini-cli/pull/26339)
+- fix(cli): undeprecate --prompt and correct positional query docs by @Adib234
+  in [#26329](https://github.com/google-gemini/gemini-cli/pull/26329)
+- Metrics updates by @.github/workflows/gemini-cli-bot-pulse.yml[bot] in
+  [#26348](https://github.com/google-gemini/gemini-cli/pull/26348)
+- fix(core): remove "System: Please continue." injection on InvalidStream events
+  by @SandyTao520 in
+  [#26340](https://github.com/google-gemini/gemini-cli/pull/26340)
+- docs(policy-engine): add tool argument keys reference and shell policy
+  cross-links by @harshpujari in
+  [#25292](https://github.com/google-gemini/gemini-cli/pull/25292)
+- fix(cli): resolve Ghostty/raw-mode False Cancellation in oauth flow by
+  @Aarchi-07 in [#25026](https://github.com/google-gemini/gemini-cli/pull/25026)
+- fix(core): reset session-scoped state on resumption by @cocosheng-g in
+  [#26342](https://github.com/google-gemini/gemini-cli/pull/26342)
+- Fix bulk of remaining issues with generalist profile by @joshualitt in
+  [#26073](https://github.com/google-gemini/gemini-cli/pull/26073)
+- fix(core): make subagents aware of active approval modes by @akh64bit in
+  [#23608](https://github.com/google-gemini/gemini-cli/pull/23608)
+- fix(acp): resolve agent mode disconnect and improve mode awareness by @sripasg
+  in [#26332](https://github.com/google-gemini/gemini-cli/pull/26332)
+- docs(sdk): add JSDoc to exported interfaces in packages/sdk/src/types.ts by
+  @cocosheng-g in
+  [#26441](https://github.com/google-gemini/gemini-cli/pull/26441)
+- perf: skip redundant GEMINI.md loading in partialConfig by @cocosheng-g in
+  [#26443](https://github.com/google-gemini/gemini-cli/pull/26443)
+- Enhance React guidelines by @psinha40898 in
+  [#22667](https://github.com/google-gemini/gemini-cli/pull/22667)
+- feat(core): reinforce Inquiry constraints to prevent unauthorized changes by
+  @akh64bit in [#26310](https://github.com/google-gemini/gemini-cli/pull/26310)
+- revert: fix(ci): robust version checking in release verification (#26337) by
+  @scidomino in [#26450](https://github.com/google-gemini/gemini-cli/pull/26450)
+- refactor(UI): created constants file for ThemeDialog by @devr0306 in
+  [#26446](https://github.com/google-gemini/gemini-cli/pull/26446)
+- docs: fix GitHub capitalization in releases guide by @haosenwang1018 in
+  [#26379](https://github.com/google-gemini/gemini-cli/pull/26379)
+- fix(cli): ensure branch indicator updates in sub-directories and worktrees by
+  @Adib234 in [#26330](https://github.com/google-gemini/gemini-cli/pull/26330)
+- feat: add minimal V8 heap snapshot utility for memory diagnostics by
+  @cocosheng-g in
+  [#26440](https://github.com/google-gemini/gemini-cli/pull/26440)
+- fix(hooks): preserve non-text parts in fromHookLLMRequest by @SandyTao520 in
+  [#26275](https://github.com/google-gemini/gemini-cli/pull/26275)
+- fix(cli): allow early stdout when config is undefined by @cocosheng-g in
+  [#26453](https://github.com/google-gemini/gemini-cli/pull/26453)
+- fix(cli)#21297: clear skills consent dialog before reload by @manavmax in
+  [#26431](https://github.com/google-gemini/gemini-cli/pull/26431)
+- fix(cli): render LaTeX-style output as Unicode in the TUI by @dimssu in
+  [#25802](https://github.com/google-gemini/gemini-cli/pull/25802)
+- fix(core): use close event instead of exit in child_process fallback by
+  @tusaryan in [#25695](https://github.com/google-gemini/gemini-cli/pull/25695)
+- feat(voice): add privacy and compliance UX warning for Gemini Live backend by
+  @cocosheng-g in
+  [#26454](https://github.com/google-gemini/gemini-cli/pull/26454)
+- feat(memory): add Auto Memory inbox flow with canonical-patch contract by
+  @SandyTao520 in
+  [#26338](https://github.com/google-gemini/gemini-cli/pull/26338)
+- test(cleanup): fix temporary directory leaks in test suites by @Adib234 in
+  [#26217](https://github.com/google-gemini/gemini-cli/pull/26217)
+- feat: add ignoreLocalEnv setting and --ignore-env flag (#2493) by @cocosheng-g
+  in [#26445](https://github.com/google-gemini/gemini-cli/pull/26445)
+- docs(sdk): add JSDoc to all exported interfaces and types by @fauzan171 in
+  [#26277](https://github.com/google-gemini/gemini-cli/pull/26277)
+- feat(cli): improve /agents refresh logging by @cocosheng-g in
+  [#26442](https://github.com/google-gemini/gemini-cli/pull/26442)
+- Fix: make Dockerfile self-contained with multi-stage build by @Famous077 in
+  [#24277](https://github.com/google-gemini/gemini-cli/pull/24277)
+- fix(core): filter unsupported multimodal types from tool responses by
+  @aishaneeshah in
+  [#26352](https://github.com/google-gemini/gemini-cli/pull/26352)
+- fix(core): properly format markdown in AskUser tool by unescaping newlines by
+  @Adib234 in [#26349](https://github.com/google-gemini/gemini-cli/pull/26349)
+- feat(bot): add actions spend metric script by @gundermanc in
+  [#26463](https://github.com/google-gemini/gemini-cli/pull/26463)
+- feat(cli): add /bug-memory command and auto-capture heap snapshot in /bug by
+  @Anjaligarhwal in
+  [#25639](https://github.com/google-gemini/gemini-cli/pull/25639)
+- fix(cli): make SkillInboxDialog fit and scroll in alternate buffer by
+  @SandyTao520 in
+  [#26455](https://github.com/google-gemini/gemini-cli/pull/26455)
+- Robust Scale-Safe Lifecycle Consolidation by @gemini-cli-robot in
+  [#26355](https://github.com/google-gemini/gemini-cli/pull/26355)
+- fix(ci): respect exempt labels when closing stale items by @gundermanc in
+  [#26475](https://github.com/google-gemini/gemini-cli/pull/26475)
+- fix(cli): use os.homedir() for home directory warning check by @TirthNaik-99
+  in [#25890](https://github.com/google-gemini/gemini-cli/pull/25890)
+- fix(a2a-server): resolve tool approval race condition and improve status
+  reporting by @kschaab in
+  [#26479](https://github.com/google-gemini/gemini-cli/pull/26479)
+- fix(cli): prevent settings dialog border clipping using maxHeight by
+  @jackwotherspoon in
+  [#26507](https://github.com/google-gemini/gemini-cli/pull/26507)
+- feat: allow queuing messages during compression (#24071) by @cocosheng-g in
+  [#26506](https://github.com/google-gemini/gemini-cli/pull/26506)
+- fix(core): retry on ERR_STREAM_PREMATURE_CLOSE errors by @cocosheng-g in
+  [#26519](https://github.com/google-gemini/gemini-cli/pull/26519)
+- fix(core): Minor fixes for generalist profile. by @joshualitt in
+  [#26357](https://github.com/google-gemini/gemini-cli/pull/26357)
+- fix(patch): cherry-pick 3627f47 to release/v0.42.0-preview.0-pr-26542 to patch
+  version v0.42.0-preview.0 and create version 0.42.0-preview.1 by
+  @gemini-cli-robot in
+  [#26544](https://github.com/google-gemini/gemini-cli/pull/26544)
+- fix(patch): cherry-pick 02995ba to release/v0.42.0-preview.1-pr-26568 to patch
+  version v0.42.0-preview.1 and create version 0.42.0-preview.2 by
+  @gemini-cli-robot in
+  [#26590](https://github.com/google-gemini/gemini-cli/pull/26590)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.31.0...v0.32.1
+https://github.com/google-gemini/gemini-cli/compare/v0.41.2...v0.42.0

docs/changelogs/preview.md

@@ -1,6 +1,6 @@
-# Preview release: v0.33.0-preview.13
+# Preview release: v0.43.0-preview.0
 
-Released: March 10, 2026
+Released: May 12, 2026
 
 Our preview release includes the latest, new, and experimental features. This
 release may not be as stable as our [latest weekly release](latest.md).
@@ -13,193 +13,184 @@ npm install -g @google/gemini-cli@preview
 
 ## Highlights
 
-- **Plan Mode Enhancements**: Added support for annotating plans with feedback
-  for iteration, enabling built-in research subagents in plan mode, and a new
-  `copy` subcommand.
-- **Agent and Skill Improvements**: Introduced the new `github-issue-creator`
-  skill, implemented HTTP authentication support for A2A remote agents, and
-  added support for authenticated A2A agent card discovery.
-- **CLI UX/UI Updates**: Redesigned the header to be compact with an ASCII icon,
-  inverted the context window display to show usage, and directly indicate auth
-  required state for agents.
-- **Core and ACP Enhancements**: Implemented slash command handling in ACP (for
-  `/memory`, `/init`, `/extensions`, and `/restore`), added a set models
-  interface to ACP, and centralized `read_file` limits while truncating large
-  MCP tool output.
+- **Surgical Code Edits:** Steer models to use the `edit` tool for precise code
+  modifications, improving accuracy and reducing context usage.
+- **Session Portability:** Added ability to export chat sessions to files and
+  import them via a new CLI flag, enabling session persistence and sharing.
+- **Enhanced Security:** Introduced comprehensive shell command safety
+  evaluations and strengthened model steering to prevent unauthorized changes.
+- **Context Management:** Implemented a new adaptive token calculator for more
+  accurate content size estimations and optimized context pipelines.
+- **UX Improvements:** Enhanced tool call visibility with prefixed IDs and
+  improved the UI for session resumption and MCP list management.
 
 ## What's Changed
 
-- fix(patch): cherry-pick e5615f4 to release/v0.33.0-preview.12-pr-21037 to
-  patch version v0.33.0-preview.12 and create version 0.33.0-preview.13 by
-  @gemini-cli-robot in
-  [#21922](https://github.com/google-gemini/gemini-cli/pull/21922)
-- fix(patch): cherry-pick 7ec477d to release/v0.33.0-preview.3-pr-21305 to patch
-  version v0.33.0-preview.3 and create version 0.33.0-preview.4 by
-  @gemini-cli-robot in
-  [#21349](https://github.com/google-gemini/gemini-cli/pull/21349)
-- fix(patch): cherry-pick 0135b03 to release/v0.33.0-preview.2-pr-21171
-  [CONFLICTS] by @gemini-cli-robot in
-  [#21336](https://github.com/google-gemini/gemini-cli/pull/21336)
-- fix(patch): cherry-pick 173376b to release/v0.33.0-preview.1-pr-21157 to patch
-  version v0.33.0-preview.1 and create version 0.33.0-preview.2 by
-  @gemini-cli-robot in
-  [#21300](https://github.com/google-gemini/gemini-cli/pull/21300)
-- fix(patch): cherry-pick 173376b to release/v0.33.0-preview.1-pr-21157 to patch
-  version v0.33.0-preview.1 and create version 0.33.0-preview.2 by
-  @gemini-cli-robot in
-  [#21300](https://github.com/google-gemini/gemini-cli/pull/21300)
-- fix(patch): cherry-pick 0659ad1 to release/v0.33.0-preview.0-pr-21042 to patch
-  version v0.33.0-preview.0 and create version 0.33.0-preview.1 by
-  @gemini-cli-robot in
-  [#21047](https://github.com/google-gemini/gemini-cli/pull/21047)
-- Docs: Update model docs to remove Preview Features. by @jkcinouye in
-  [#20084](https://github.com/google-gemini/gemini-cli/pull/20084)
-- docs: fix typo in installation documentation by @AdityaSharma-Git3207 in
-  [#20153](https://github.com/google-gemini/gemini-cli/pull/20153)
-- docs: add Windows PowerShell equivalents for environments and scripting by
-  @scidomino in [#20333](https://github.com/google-gemini/gemini-cli/pull/20333)
-- fix(core): parse raw ASCII buffer strings in Gaxios errors by @sehoon38 in
-  [#20626](https://github.com/google-gemini/gemini-cli/pull/20626)
-- chore(release): bump version to 0.33.0-nightly.20260227.ba149afa0 by @galz10
-  in [#20637](https://github.com/google-gemini/gemini-cli/pull/20637)
-- fix(github): use robot PAT for automated PRs to pass CLA check by @galz10 in
-  [#20641](https://github.com/google-gemini/gemini-cli/pull/20641)
-- chore/release: bump version to 0.33.0-nightly.20260228.1ca5c05d0 by
-  @gemini-cli-robot in
-  [#20644](https://github.com/google-gemini/gemini-cli/pull/20644)
-- Changelog for v0.31.0 by @gemini-cli-robot in
-  [#20634](https://github.com/google-gemini/gemini-cli/pull/20634)
-- fix: use full paths for ACP diff payloads by @JagjeevanAK in
-  [#19539](https://github.com/google-gemini/gemini-cli/pull/19539)
-- Changelog for v0.32.0-preview.0 by @gemini-cli-robot in
-  [#20627](https://github.com/google-gemini/gemini-cli/pull/20627)
-- fix: acp/zed race condition between MCP initialisation and prompt by
-  @kartikangiras in
-  [#20205](https://github.com/google-gemini/gemini-cli/pull/20205)
-- fix(cli): reset themeManager between tests to ensure isolation by
-  @NTaylorMullen in
-  [#20598](https://github.com/google-gemini/gemini-cli/pull/20598)
-- refactor(core): Extract tool parameter names as constants by @SandyTao520 in
-  [#20460](https://github.com/google-gemini/gemini-cli/pull/20460)
-- fix(cli): resolve autoThemeSwitching when background hasn't changed but theme
-  mismatches by @sehoon38 in
-  [#20706](https://github.com/google-gemini/gemini-cli/pull/20706)
-- feat(skills): add github-issue-creator skill by @sehoon38 in
-  [#20709](https://github.com/google-gemini/gemini-cli/pull/20709)
-- fix(cli): allow sub-agent confirmation requests in UI while preventing
-  background flicker by @abhipatel12 in
-  [#20722](https://github.com/google-gemini/gemini-cli/pull/20722)
-- Merge User and Agent Card Descriptions #20849 by @adamfweidman in
-  [#20850](https://github.com/google-gemini/gemini-cli/pull/20850)
-- fix(core): reduce LLM-based loop detection false positives by @SandyTao520 in
-  [#20701](https://github.com/google-gemini/gemini-cli/pull/20701)
-- fix(plan): deflake plan mode integration tests by @Adib234 in
-  [#20477](https://github.com/google-gemini/gemini-cli/pull/20477)
-- Add /unassign support by @scidomino in
-  [#20864](https://github.com/google-gemini/gemini-cli/pull/20864)
-- feat(core): implement HTTP authentication support for A2A remote agents by
-  @SandyTao520 in
-  [#20510](https://github.com/google-gemini/gemini-cli/pull/20510)
-- feat(core): centralize read_file limits and update gemini-3 description by
-  @aishaneeshah in
-  [#20619](https://github.com/google-gemini/gemini-cli/pull/20619)
-- Do not block CI on evals by @gundermanc in
-  [#20870](https://github.com/google-gemini/gemini-cli/pull/20870)
-- document node limitation for shift+tab by @scidomino in
-  [#20877](https://github.com/google-gemini/gemini-cli/pull/20877)
-- Add install as an option when extension is selected. by @DavidAPierce in
-  [#20358](https://github.com/google-gemini/gemini-cli/pull/20358)
-- Update CODEOWNERS for README.md reviewers by @g-samroberts in
-  [#20860](https://github.com/google-gemini/gemini-cli/pull/20860)
-- feat(core): truncate large MCP tool output by @SandyTao520 in
-  [#19365](https://github.com/google-gemini/gemini-cli/pull/19365)
-- Subagent activity UX. by @gundermanc in
-  [#17570](https://github.com/google-gemini/gemini-cli/pull/17570)
-- style(cli) : Dialog pattern for /hooks Command by @AbdulTawabJuly in
-  [#17930](https://github.com/google-gemini/gemini-cli/pull/17930)
-- feat: redesign header to be compact with ASCII icon by @keithguerin in
-  [#18713](https://github.com/google-gemini/gemini-cli/pull/18713)
-- fix(core): ensure subagents use qualified MCP tool names by @abhipatel12 in
-  [#20801](https://github.com/google-gemini/gemini-cli/pull/20801)
-- feat(core): support authenticated A2A agent card discovery by @SandyTao520 in
-  [#20622](https://github.com/google-gemini/gemini-cli/pull/20622)
-- refactor(cli): fully remove React anti patterns, improve type safety and fix
-  UX oversights in SettingsDialog.tsx by @psinha40898 in
-  [#18963](https://github.com/google-gemini/gemini-cli/pull/18963)
-- Adding MCPOAuthProvider implementing the MCPSDK OAuthClientProvider by
-  @Nayana-Parameswarappa in
-  [#20121](https://github.com/google-gemini/gemini-cli/pull/20121)
-- feat(core): add tool name validation in TOML policy files by @allenhutchison
-  in [#19281](https://github.com/google-gemini/gemini-cli/pull/19281)
-- docs: fix broken markdown links in main README.md by @Hamdanbinhashim in
-  [#20300](https://github.com/google-gemini/gemini-cli/pull/20300)
-- refactor(core): replace manual syncPlanModeTools with declarative policy rules
-  by @jerop in [#20596](https://github.com/google-gemini/gemini-cli/pull/20596)
-- fix(core): increase default headers timeout to 5 minutes by @gundermanc in
-  [#20890](https://github.com/google-gemini/gemini-cli/pull/20890)
-- feat(admin): enable 30 day default retention for chat history & remove warning
-  by @skeshive in
-  [#20853](https://github.com/google-gemini/gemini-cli/pull/20853)
-- feat(plan): support annotating plans with feedback for iteration by @Adib234
-  in [#20876](https://github.com/google-gemini/gemini-cli/pull/20876)
-- Add some dos and don'ts to behavioral evals README. by @gundermanc in
-  [#20629](https://github.com/google-gemini/gemini-cli/pull/20629)
-- fix(core): skip telemetry logging for AbortError exceptions by @yunaseoul in
-  [#19477](https://github.com/google-gemini/gemini-cli/pull/19477)
-- fix(core): restrict "System: Please continue" invalid stream retry to Gemini 2
-  models by @SandyTao520 in
-  [#20897](https://github.com/google-gemini/gemini-cli/pull/20897)
-- ci(evals): only run evals in CI if prompts or tools changed by @gundermanc in
-  [#20898](https://github.com/google-gemini/gemini-cli/pull/20898)
-- Build binary by @aswinashok44 in
-  [#18933](https://github.com/google-gemini/gemini-cli/pull/18933)
-- Code review fixes as a pr by @jacob314 in
-  [#20612](https://github.com/google-gemini/gemini-cli/pull/20612)
-- fix(ci): handle empty APP_ID in stale PR closer by @bdmorgan in
-  [#20919](https://github.com/google-gemini/gemini-cli/pull/20919)
-- feat(cli): invert context window display to show usage by @keithguerin in
-  [#20071](https://github.com/google-gemini/gemini-cli/pull/20071)
-- fix(plan): clean up session directories and plans on deletion by @jerop in
-  [#20914](https://github.com/google-gemini/gemini-cli/pull/20914)
-- fix(core): enforce optionality for API response fields in code_assist by
-  @sehoon38 in [#20714](https://github.com/google-gemini/gemini-cli/pull/20714)
-- feat(extensions): add support for plan directory in extension manifest by
-  @mahimashanware in
-  [#20354](https://github.com/google-gemini/gemini-cli/pull/20354)
-- feat(plan): enable built-in research subagents in plan mode by @Adib234 in
-  [#20972](https://github.com/google-gemini/gemini-cli/pull/20972)
-- feat(agents): directly indicate auth required state by @adamfweidman in
-  [#20986](https://github.com/google-gemini/gemini-cli/pull/20986)
-- fix(cli): wait for background auto-update before relaunching by @scidomino in
-  [#20904](https://github.com/google-gemini/gemini-cli/pull/20904)
-- fix: pre-load @scripts/copy_files.js references from external editor prompts
-  by @kartikangiras in
-  [#20963](https://github.com/google-gemini/gemini-cli/pull/20963)
-- feat(evals): add behavioral evals for ask_user tool by @Adib234 in
-  [#20620](https://github.com/google-gemini/gemini-cli/pull/20620)
-- refactor common settings logic for skills,agents by @ishaanxgupta in
-  [#17490](https://github.com/google-gemini/gemini-cli/pull/17490)
-- Update docs-writer skill with new resource by @g-samroberts in
-  [#20917](https://github.com/google-gemini/gemini-cli/pull/20917)
-- fix(cli): pin clipboardy to ~5.2.x by @scidomino in
-  [#21009](https://github.com/google-gemini/gemini-cli/pull/21009)
-- feat: Implement slash command handling in ACP for
-  `/memory`,`/init`,`/extensions` and `/restore` by @sripasg in
-  [#20528](https://github.com/google-gemini/gemini-cli/pull/20528)
-- Docs/add hooks reference by @AadithyaAle in
-  [#20961](https://github.com/google-gemini/gemini-cli/pull/20961)
-- feat(plan): add copy subcommand to plan (#20491) by @ruomengz in
-  [#20988](https://github.com/google-gemini/gemini-cli/pull/20988)
-- fix(core): sanitize and length-check MCP tool qualified names by @abhipatel12
-  in [#20987](https://github.com/google-gemini/gemini-cli/pull/20987)
-- Format the quota/limit style guide. by @g-samroberts in
-  [#21017](https://github.com/google-gemini/gemini-cli/pull/21017)
-- fix(core): send shell output to model on cancel by @devr0306 in
-  [#20501](https://github.com/google-gemini/gemini-cli/pull/20501)
-- remove hardcoded tiername when missing tier by @sehoon38 in
-  [#21022](https://github.com/google-gemini/gemini-cli/pull/21022)
-- feat(acp): add set models interface by @skeshive in
-  [#20991](https://github.com/google-gemini/gemini-cli/pull/20991)
+- feat(core): steer model to use edit tool for surgical edits, fix a typo in
+  [#26480](https://github.com/google-gemini/gemini-cli/pull/26480)
+- docs: clarify Auto Memory proposes memory updates and skills in
+  [#26527](https://github.com/google-gemini/gemini-cli/pull/26527)
+- fix(core): reject numeric project IDs in GOOGLE_CLOUD_PROJECT (#24695) in
+  [#26532](https://github.com/google-gemini/gemini-cli/pull/26532)
+- fix(core): remove unsafe type assertion suppressions in error utils in
+  [#19881](https://github.com/google-gemini/gemini-cli/pull/19881)
+- fix(core): allow redirection in YOLO and AUTO_EDIT modes without sandboxing in
+  [#26542](https://github.com/google-gemini/gemini-cli/pull/26542)
+- ci(release): build and attach unsigned macOS binaries to releases in
+  [#26462](https://github.com/google-gemini/gemini-cli/pull/26462)
+- fix(core): Fix chat corruption bug in context manager. in
+  [#26534](https://github.com/google-gemini/gemini-cli/pull/26534)
+- fix(cli): provide JSON output for AgentExecutionStopped in non-interactive
+  mode in [#26504](https://github.com/google-gemini/gemini-cli/pull/26504)
+- feat(evals): add shell command safety evals in
+  [#26528](https://github.com/google-gemini/gemini-cli/pull/26528)
+- fix(core): handle invalid custom plans directory gracefully in
+  [#26560](https://github.com/google-gemini/gemini-cli/pull/26560)
+- fix(acp): move tool explanation from thought stream to tool call content in
+  [#26554](https://github.com/google-gemini/gemini-cli/pull/26554)
+- fix(a2a-server): Resolve race condition in tool completion waiting in
+  [#26568](https://github.com/google-gemini/gemini-cli/pull/26568)
+- fix(cli): randomize sandbox container names in
+  [#26014](https://github.com/google-gemini/gemini-cli/pull/26014)
+- fix(core): Fix hysteresis in async context management pipelines. in
+  [#26452](https://github.com/google-gemini/gemini-cli/pull/26452)
+- Tighten private Auto Memory patch allowlist in
+  [#26535](https://github.com/google-gemini/gemini-cli/pull/26535)
+- fix(cli): hide read-only settings scopes in
+  [#26249](https://github.com/google-gemini/gemini-cli/pull/26249)
+- fix(ci): preserve executable bit for mac binaries in
+  [#26600](https://github.com/google-gemini/gemini-cli/pull/26600)
+- fix(cli): improve mcp list UX in untrusted folders in
+  [#26457](https://github.com/google-gemini/gemini-cli/pull/26457)
+- fix(core): prevent silent hang during OAuth auth on headless Linux in
+  [#26571](https://github.com/google-gemini/gemini-cli/pull/26571)
+- Changelog for v0.42.0-preview.0 in
+  [#26537](https://github.com/google-gemini/gemini-cli/pull/26537)
+- ci: fix Argument list too long in triage workflows in
+  [#26603](https://github.com/google-gemini/gemini-cli/pull/26603)
+- refactor(cli): migrate core tools to native ToolDisplay property and fix UI
+  rendering in [#25186](https://github.com/google-gemini/gemini-cli/pull/25186)
+- don't wrap args unnecessarily in
+  [#26599](https://github.com/google-gemini/gemini-cli/pull/26599)
+- fix(core): preserve system PATH in Git environment to fix ENOENT (#25034) in
+  [#26587](https://github.com/google-gemini/gemini-cli/pull/26587)
+- fix(routing): fix resolveClassifierModel argument mismatch in
+  ApprovalModeStrategy in
+  [#26658](https://github.com/google-gemini/gemini-cli/pull/26658)
+- docs: add vi mode shortcuts and clarify MCP/custom sandbox setup in
+  [#23853](https://github.com/google-gemini/gemini-cli/pull/23853)
+- fix(ux): fixed issue with transcribed text not showing after releasing space
+  in [#26609](https://github.com/google-gemini/gemini-cli/pull/26609)
+- ci: fix json parsing in scheduled triage workflow in
+  [#26656](https://github.com/google-gemini/gemini-cli/pull/26656)
+- fix(cli): hide /memory add subcommand when memoryV2 is enabled in
+  [#26605](https://github.com/google-gemini/gemini-cli/pull/26605)
+- fix: prevent false command conflicts when launching from home directory in
+  [#23069](https://github.com/google-gemini/gemini-cli/pull/23069)
+- fix(core): cache model routing decision in LocalAgentExecutor in
+  [#26548](https://github.com/google-gemini/gemini-cli/pull/26548)
+- Changelog for v0.42.0-preview.2 in
+  [#26597](https://github.com/google-gemini/gemini-cli/pull/26597)
+- skip broken test in
+  [#26705](https://github.com/google-gemini/gemini-cli/pull/26705)
+- feat: export session to file and import via flag in
+  [#26514](https://github.com/google-gemini/gemini-cli/pull/26514)
+- Feat: Add Machine Hostname to CLI interface in
+  [#25637](https://github.com/google-gemini/gemini-cli/pull/25637)
+- docs(extensions): refactor releasing guide and add update mechanisms in
+  [#26595](https://github.com/google-gemini/gemini-cli/pull/26595)
+- fix(ci): fix maintainer identification in lifecycle manager in
+  [#26706](https://github.com/google-gemini/gemini-cli/pull/26706)
+- fix(ui): added quotes around session id in resume tip in
+  [#26669](https://github.com/google-gemini/gemini-cli/pull/26669)
+- Changelog for v0.41.0 in
+  [#26670](https://github.com/google-gemini/gemini-cli/pull/26670)
+- refactor(core): agent session protocol changes in
+  [#26661](https://github.com/google-gemini/gemini-cli/pull/26661)
+- fix(context): implement loose boundary policy for gc backstop. in
+  [#26594](https://github.com/google-gemini/gemini-cli/pull/26594)
+- fix(core): throw explicit error on dropped tool responses in
+  [#26668](https://github.com/google-gemini/gemini-cli/pull/26668)
+- fix: resolve "function response turn must come immediately after function
+  call" error in
+  [#26691](https://github.com/google-gemini/gemini-cli/pull/26691)
+- fix(core): resolve parallel tool call streaming ID collision in
+  [#26646](https://github.com/google-gemini/gemini-cli/pull/26646)
+- feat(core): add LocalSubagentProtocol behind AgentProtocol in
+  [#25302](https://github.com/google-gemini/gemini-cli/pull/25302)
+- fix(cli): remove noisy theme registration logs from terminal in
+  [#25858](https://github.com/google-gemini/gemini-cli/pull/25858)
+- ci: implement codebase-aware effort level triage in
+  [#26666](https://github.com/google-gemini/gemini-cli/pull/26666)
+- feat(acp/core): prefix tool call IDs with tool names to support tool rendering
+  in ACP compliant IDEs. in
+  [#26676](https://github.com/google-gemini/gemini-cli/pull/26676)
+- fix(mcp): treat GET 404 as 405 in StreamableHTTPClientTransport in
+  [#24847](https://github.com/google-gemini/gemini-cli/pull/24847)
+- feat(core): add RemoteSubagentProtocol behind AgentProtocol in
+  [#25303](https://github.com/google-gemini/gemini-cli/pull/25303)
+- feat(context): Improvements to the snapshotter. in
+  [#26655](https://github.com/google-gemini/gemini-cli/pull/26655)
+- fix(context): Change snapshotter model config. in
+  [#26745](https://github.com/google-gemini/gemini-cli/pull/26745)
+- fix(cli): allow installing extensions from ssh repo in
+  [#26274](https://github.com/google-gemini/gemini-cli/pull/26274)
+- fix(cli): prevent duplicate SessionStart systemMessage render in
+  [#25827](https://github.com/google-gemini/gemini-cli/pull/25827)
+- fix(cli/acp): prevent infinite thought loop in ACP mode by disablig
+  nextSpeakerCheck in
+  [#26874](https://github.com/google-gemini/gemini-cli/pull/26874)
+- fix(cli): use static tool name in confirmation prompt to avoid parsing errors
+  in [#26866](https://github.com/google-gemini/gemini-cli/pull/26866)
+- fix(routing): Refactor tool turn handling for the conversation history in
+  NumericalClassifierStrategy to prevent 400 Bad Request in
+  [#26761](https://github.com/google-gemini/gemini-cli/pull/26761)
+- fix(core): handle malformed projects.json in ProjectRegistry in
+  [#26885](https://github.com/google-gemini/gemini-cli/pull/26885)
+- fix(ui): added a gutter width to the input prompt width calculation in
+  [#26882](https://github.com/google-gemini/gemini-cli/pull/26882)
+- fix: prevent EISDIR crash when customIgnoreFilePaths contains directories
+  (#19868) in [#19898](https://github.com/google-gemini/gemini-cli/pull/19898)
+- revert 6b9b778d821728427eea07b1b97ba07378137d0b in
+  [#26893](https://github.com/google-gemini/gemini-cli/pull/26893)
+- Fix/vscode run current file ts in
+  [#22894](https://github.com/google-gemini/gemini-cli/pull/22894)
+- Allow Enter to select session while in search mode in /resume in
+  [#21523](https://github.com/google-gemini/gemini-cli/pull/21523)
+- fix(core): ignore .pak and .rpa game archive formats by default in
+  [#26884](https://github.com/google-gemini/gemini-cli/pull/26884)
+- fix(cli): enable adk non-interactive session in
+  [#26895](https://github.com/google-gemini/gemini-cli/pull/26895)
+- fix(cli): restore resume for legacy sessions in
+  [#26577](https://github.com/google-gemini/gemini-cli/pull/26577)
+- fix: respect explicit model selection after Flash quota exhaustion (#26759) in
+  [#26872](https://github.com/google-gemini/gemini-cli/pull/26872)
+- feat(context): Introduce adaptive token calculator to more accurately
+  calculate content sizes. in
+  [#26888](https://github.com/google-gemini/gemini-cli/pull/26888)
+- chore: update checkout action configuration in workflows in
+  [#26897](https://github.com/google-gemini/gemini-cli/pull/26897)
+- fix (telemetry): inject quota_project_id to prevent fallback to default oauth
+  client in [#26698](https://github.com/google-gemini/gemini-cli/pull/26698)
+- Exclude extension context from skill extraction agent in
+  [#26879](https://github.com/google-gemini/gemini-cli/pull/26879)
+- Enable NumericalRouter when using dynamic model configs in
+  [#26929](https://github.com/google-gemini/gemini-cli/pull/26929)
+- ci: actively triage missing priority labels and intelligently clean up
+  conflicting labels in
+  [#26865](https://github.com/google-gemini/gemini-cli/pull/26865)
+- refactor(core): introduce SubagentState enum for progress in
+  [#26934](https://github.com/google-gemini/gemini-cli/pull/26934)
+- fix(ci): replace brittle --no-tag with explicit staging-tmp tag in
+  [#26940](https://github.com/google-gemini/gemini-cli/pull/26940)
+- Incremental refactor repo agent towards skills-based composition in
+  [#26717](https://github.com/google-gemini/gemini-cli/pull/26717)
+- fix(ui): fixed line wrap padding for selection lists in
+  [#26944](https://github.com/google-gemini/gemini-cli/pull/26944)
+- fix(core): update read_file schema for v1 compatibility (#22183) in
+  [#26922](https://github.com/google-gemini/gemini-cli/pull/26922)
+- fix(ci): configure git remote with token for authentication in
+  [#26949](https://github.com/google-gemini/gemini-cli/pull/26949)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.32.0-preview.0...v0.33.0-preview.13
+https://github.com/google-gemini/gemini-cli/compare/v0.42.0-preview.2...v0.43.0-preview.0

docs/cli/acp-mode.md

@@ -0,0 +1,126 @@
+# ACP Mode
+
+ACP (Agent Client Protocol) mode is a special operational mode of Gemini CLI
+designed for programmatic control, primarily for IDE and other developer tool
+integrations. It uses a JSON-RPC protocol over stdio to communicate between
+Gemini CLI agent and a client.
+
+To start Gemini CLI in ACP mode, use the `--acp` flag:
+
+```bash
+gemini --acp
+```
+
+## Agent Client Protocol (ACP)
+
+ACP is an open protocol that standardizes how AI coding agents communicate with
+code editors and IDEs. It addresses the challenge of fragmented distribution,
+where agents traditionally needed custom integrations for each client. With ACP,
+developers can implement their agent once, and it becomes compatible with any
+ACP-compliant editor.
+
+For a comprehensive introduction to ACP, including its architecture and
+benefits, refer to the official
+[ACP Introduction](https://agentclientprotocol.com/get-started/introduction)
+documentation.
+
+### Existing integrations using ACP
+
+The ACP Agent Registry simplifies the distribution and management of
+ACP-compatible agents across various IDEs. Gemini CLI is an ACP-compatible agent
+and can be found in this registry.
+
+For more general information about the registry, and how to use it with specific
+IDEs like JetBrains and Zed, refer to the
+[IDE Integration](../ide-integration/index.md) documentation.
+
+You can also find more information on the official
+[ACP Agent Registry](https://agentclientprotocol.com/get-started/registry) page.
+
+## Architecture and protocol basics
+
+ACP mode establishes a client-server relationship between your tool (the client)
+and Gemini CLI (the server).
+
+- **Communication:** The entire communication happens over standard input/output
+  (stdio) using the JSON-RPC 2.0 protocol.
+- **Client's role:** The client is responsible for sending requests (for
+  example, prompts) and handling responses and notifications from Gemini CLI.
+- **Gemini CLI's role:** In ACP mode, Gemini CLI listens for incoming JSON-RPC
+  requests, processes them, and sends back responses.
+
+The core of the ACP implementation can be found in
+`packages/cli/src/acp/acpClient.ts`.
+
+### Extending with MCP
+
+ACP can be used with the Model Context Protocol (MCP). This lets an ACP client
+(like an IDE) expose its own functionality as "tools" that the Gemini model can
+use.
+
+1.  The client implements an **MCP server** that advertises its tools.
+2.  During the ACP `initialize` handshake, the client provides the connection
+    details for its MCP server.
+3.  Gemini CLI connects to the MCP server, discovers the available tools, and
+    makes them available to the AI model.
+4.  When the model decides to use one of these tools, Gemini CLI sends a tool
+    call request to the MCP server.
+
+This mechanism lets for a powerful, two-way integration where the agent can
+leverage the IDE's capabilities to perform tasks. The MCP client logic is in
+`packages/core/src/tools/mcp-client.ts`.
+
+## Capabilities and supported methods
+
+The ACP protocol exposes a number of methods for ACP clients (for example IDEs)
+to control Gemini CLI.
+
+### Core methods
+
+- `initialize`: Establishes the initial connection and lets the client to
+  register its MCP server.
+- `authenticate`: Authenticates the user.
+- `newSession`: Starts a new chat session.
+- `loadSession`: Loads a previous session.
+- `prompt`: Sends a prompt to the agent.
+- `cancel`: Cancels an ongoing prompt.
+
+### Session control
+
+- `setSessionMode`: Allows changing the approval level for tool calls (for
+  example, to `auto-approve`).
+- `unstable_setSessionModel`: Changes the model for the current session.
+
+### File system proxy
+
+ACP includes a proxied file system service. This means that when the agent needs
+to read or write files, it does so through the ACP client. This is a security
+feature that ensures the agent only has access to the files that the client (and
+by extension, the user) has explicitly allowed.
+
+## Debugging and telemetry
+
+You can get insights into the ACP communication and the agent's behavior through
+debugging logs and telemetry.
+
+### Debugging logs
+
+To enable general debugging logs, start Gemini CLI with the `--debug` flag:
+
+```bash
+gemini --acp --debug
+```
+
+### Telemetry
+
+For more detailed telemetry, you can use the following environment variables to
+capture telemetry data to a file:
+
+- `GEMINI_TELEMETRY_ENABLED=true`
+- `GEMINI_TELEMETRY_TARGET=local`
+- `GEMINI_TELEMETRY_OUTFILE=/path/to/your/log.json`
+
+This will write a JSON log file containing detailed information about all the
+events happening within the agent, including ACP requests and responses. The
+integration test `integration-tests/acp-telemetry.test.ts` provides a working
+example of how to set this up.

docs/cli/auto-memory.md

@@ -0,0 +1,164 @@
+# Auto Memory
+
+Auto Memory is an experimental feature that mines your past Gemini CLI sessions
+in the background and proposes durable memory updates and reusable
+[Agent Skills](./skills.md). You review each candidate before it becomes
+available to future sessions: apply memory updates, promote skills, or discard
+anything you do not want.
+
+<!-- prettier-ignore -->
+> [!NOTE]
+> This is an experimental feature currently under active development.
+
+## Overview
+
+Every session you run with Gemini CLI is recorded locally as a transcript. Auto
+Memory scans those transcripts for durable facts, preferences, workflow
+constraints, and procedural patterns that recur across sessions. It can draft
+memory updates as unified diff `.patch` files and draft reusable procedures as
+`SKILL.md` files. All candidates are held in a project-local inbox until you
+approve or discard them.
+
+You'll use Auto Memory when you want to:
+
+- **Capture team workflows** that you find yourself walking the agent through
+  more than once.
+- **Preserve durable project context** such as repeated verification commands,
+  local constraints, or personal project notes.
+- **Codify hard-won fixes** for project-specific landmines so future sessions
+  avoid them.
+- **Bootstrap a skills library** without writing every `SKILL.md` by hand.
+
+Auto Memory complements direct memory-file editing. The agent can still persist
+explicit user instructions by editing the appropriate Markdown memory file; Auto
+Memory infers candidates from past sessions, writes reviewable patches or skill
+drafts, and never applies them without your approval.
+
+## Prerequisites
+
+- Gemini CLI installed and authenticated.
+- At least one idle project session with 10 or more user messages. Auto Memory
+  ignores active, trivial, and sub-agent sessions.
+
+## How to enable Auto Memory
+
+Auto Memory is off by default. Enable it in your settings file:
+
+1.  Open your global settings file at `~/.gemini/settings.json`. If you only
+    want Auto Memory in one project, edit `.gemini/settings.json` in that
+    project instead.
+
+2.  Add the experimental flag:
+
+    ```json
+    {
+      "experimental": {
+        "autoMemory": true
+      }
+    }
+    ```
+
+3.  Restart Gemini CLI. The flag requires a restart because the extraction
+    service starts during session boot.
+
+## How Auto Memory works
+
+Auto Memory runs as a background task on session startup. It does not block the
+UI, consume your interactive turns, or surface tool prompts.
+
+1.  **Eligibility scan.** The service indexes recent sessions from
+    `~/.gemini/tmp/<project>/chats/`. Sessions are eligible only if they have
+    been idle for at least three hours and contain at least 10 user messages.
+2.  **Lock acquisition.** A lock file in the project's memory directory
+    coordinates across multiple CLI instances so extraction runs at most once at
+    a time. A state file records processed session versions, and extraction is
+    throttled so short back-to-back CLI launches do not repeatedly scan history.
+3.  **Candidate extraction.** A background extraction agent reviews the session
+    index, reads any sessions that look like they contain durable memory or
+    repeated procedural workflows, and drafts candidates. It defaults to
+    creating no artifacts unless the evidence is strong, so many runs produce no
+    inbox items.
+4.  **Safety boundaries.** Auto Memory writes candidates to a review inbox. It
+    cannot directly edit active memory files, settings, credentials, or project
+    `GEMINI.md` files.
+5.  **Patch validation.** Skill update patches are parsed and dry-run before
+    they are surfaced. Memory patches are parsed, target-allowlisted, and
+    applied atomically only when you approve them from the inbox.
+6.  **Notification.** When a run produces new candidates, Gemini CLI surfaces an
+    inline message telling you how many items are waiting.
+
+## How to review extracted items
+
+Use the `/memory inbox` slash command to open the inbox dialog at any time:
+
+**Command:** `/memory inbox`
+
+The dialog groups pending items into new skills, skill updates, and memory
+updates. From there you can:
+
+- **Read** the full `SKILL.md` body before deciding.
+- **Promote** a skill to your user (`~/.gemini/skills/`) or workspace
+  (`.gemini/skills/`) directory.
+- **Discard** a skill you do not want.
+- **Apply** or reject a `.patch` proposal against an existing skill.
+- **Review** memory diffs before they touch active files.
+- **Apply** or dismiss private and global memory patches. Private patches target
+  the project memory directory; global patches target only your personal
+  `~/.gemini/GEMINI.md` file.
+
+Promoted skills become discoverable in the next session and follow the standard
+[skill discovery precedence](./skills.md#skill-discovery-tiers). Applied memory
+patches update the underlying memory files and reload memory for the current
+session.
+
+## How to disable Auto Memory
+
+To turn off background extraction, set the flag back to `false` in your settings
+file and restart Gemini CLI:
+
+```json
+{
+  "experimental": {
+    "autoMemory": false
+  }
+}
+```
+
+Disabling the flag stops the background service immediately on the next session
+start. Existing inbox items remain on disk; you can either drain them with
+`/memory inbox` first or remove the project memory directory manually.
+
+## Data and privacy
+
+- Auto Memory only reads session files that already exist locally on your
+  machine.
+- Auto Memory uses model calls to analyze selected local transcript content
+  during extraction. No candidates are applied automatically, but transcript
+  excerpts may be sent to the configured model as part of those calls.
+- The extraction agent is instructed to redact secrets, tokens, and credentials
+  it encounters and to never copy large tool outputs verbatim.
+- Drafted skills and memory patches live in your project's memory directory
+  until you promote, apply, dismiss, or discard them. They are not automatically
+  loaded into any session.
+
+## Limitations
+
+- The extraction agent runs on a preview Gemini Flash model. Extraction quality
+  depends on the model's ability to recognize durable patterns versus one-off
+  incidents.
+- Auto Memory does not extract memory or skills from the current session. It
+  only considers sessions that have been idle for three hours or more.
+- Project or workspace shared instructions in project `GEMINI.md` files are not
+  auto-extractable. Auto Memory can propose private project memory, global
+  personal memory, and skills.
+- Inbox items are stored per project. Skills extracted in one workspace are not
+  visible from another until you promote them to the user-scope skills
+  directory.
+
+## Next steps
+
+- Learn how skills are discovered and activated in [Agent Skills](./skills.md).
+- Explore the [memory management tutorial](./tutorials/memory-management.md) for
+  the complementary explicit-memory and `GEMINI.md` workflows.
+- Review the experimental settings catalog in
+  [Settings](./settings.md#experimental).

docs/cli/checkpointing.md

@@ -1,9 +1,9 @@
 # Checkpointing
 
-The Gemini CLI includes a Checkpointing feature that automatically saves a
-snapshot of your project's state before any file modifications are made by
-AI-powered tools. This lets you safely experiment with and apply code changes,
-knowing you can instantly revert back to the state before the tool was run.
+Gemini CLI includes a Checkpointing feature that automatically saves a snapshot
+of your project's state before any file modifications are made by AI-powered
+tools. This lets you safely experiment with and apply code changes, knowing you
+can instantly revert back to the state before the tool was run.
 
 ## How it works
 
@@ -39,7 +39,9 @@ file in your project's temporary directory, typically located at
 The Checkpointing feature is disabled by default. To enable it, you need to edit
 your `settings.json` file.
 
-> **Note:** The `--checkpointing` command-line flag was removed in version
+<!-- prettier-ignore -->
+> [!CAUTION]
+> The `--checkpointing` command-line flag was removed in version
 > 0.11.0. Checkpointing can now only be enabled through the `settings.json`
 > configuration file.
 
@@ -70,7 +72,7 @@ To see a list of all saved checkpoints for the current project, simply run:
 
 The CLI will display a list of available checkpoint files. These file names are
 typically composed of a timestamp, the name of the file being modified, and the
-name of the tool that was about to be run (e.g.,
+name of the tool that was about to be run (for example,
 `2025-06-22T10-00-00_000Z-my-file.txt-write_file`).
 
 ### Restore a specific checkpoint

docs/cli/cli-reference.md

@@ -9,7 +9,7 @@ and parameters.
 | ---------------------------------- | ---------------------------------- | ------------------------------------------------------------ |
 | `gemini`                           | Start interactive REPL             | `gemini`                                                     |
 | `gemini -p "query"`                | Query non-interactively            | `gemini -p "summarize README.md"`                            |
-| `gemini "query"`                   | Query and continue interactively   | `gemini "explain this project"`                              |
+| gemini "query"                     | Query and continue interactively   | gemini "explain this project"                                |
 | `cat file \| gemini`               | Process piped content              | `cat logs.txt \| gemini`<br>`Get-Content logs.txt \| gemini` |
 | `gemini -i "query"`                | Execute and continue interactively | `gemini -i "What is the purpose of this project?"`           |
 | `gemini -r "latest"`               | Continue most recent session       | `gemini -r "latest"`                                         |
@@ -29,16 +29,17 @@ and parameters.
 
 These commands are available within the interactive REPL.
 
-| Command              | Description                              |
-| -------------------- | ---------------------------------------- |
-| `/skills reload`     | Reload discovered skills from disk       |
-| `/agents reload`     | Reload the agent registry                |
-| `/commands reload`   | Reload custom slash commands             |
-| `/memory reload`     | Reload context files (e.g., `GEMINI.md`) |
-| `/mcp reload`        | Restart and reload MCP servers           |
-| `/extensions reload` | Reload all active extensions             |
-| `/help`              | Show help for all commands               |
-| `/quit`              | Exit the interactive session             |
+| Command              | Description                                     |
+| -------------------- | ----------------------------------------------- |
+| `/skills reload`     | Reload discovered skills from disk              |
+| `/agents reload`     | Reload the agent registry                       |
+| `/commands list`     | List available custom slash commands            |
+| `/commands reload`   | Reload custom slash commands                    |
+| `/memory reload`     | Reload context files (for example, `GEMINI.md`) |
+| `/mcp reload`        | Restart and reload MCP servers                  |
+| `/extensions reload` | Reload all active extensions                    |
+| `/help`              | Show help for all commands                      |
+| `/quit`              | Exit the interactive session                    |
 
 ## CLI Options
 
@@ -50,8 +51,10 @@ These commands are available within the interactive REPL.
 | `--model`                        | `-m`  | string  | `auto`    | Model to use. See [Model Selection](#model-selection) for available values.                                                                                            |
 | `--prompt`                       | `-p`  | string  | -         | Prompt text. Appended to stdin input if provided. Forces non-interactive mode.                                                                                         |
 | `--prompt-interactive`           | `-i`  | string  | -         | Execute prompt and continue in interactive mode                                                                                                                        |
+| `--worktree`                     | `-w`  | string  | -         | Start Gemini in a new git worktree. If no name is provided, one is generated automatically. Requires `experimental.worktrees: true` in settings.                       |
 | `--sandbox`                      | `-s`  | boolean | `false`   | Run in a sandboxed environment for safer execution                                                                                                                     |
-| `--approval-mode`                | -     | string  | `default` | Approval mode for tool execution. Choices: `default`, `auto_edit`, `yolo`                                                                                              |
+| `--skip-trust`                   | -     | boolean | `false`   | Trust the current workspace for this session, skipping the folder trust check.                                                                                         |
+| `--approval-mode`                | -     | string  | `default` | Approval mode for tool execution. Choices: `default`, `auto_edit`, `yolo`, `plan`                                                                                      |
 | `--yolo`                         | `-y`  | boolean | `false`   | **Deprecated.** Auto-approve all actions. Use `--approval-mode=yolo` instead.                                                                                          |
 | `--experimental-acp`             | -     | boolean | -         | Start in ACP (Agent Code Pilot) mode. **Experimental feature.**                                                                                                        |
 | `--experimental-zed-integration` | -     | boolean | -         | Run in Zed editor integration mode. **Experimental feature.**                                                                                                          |
@@ -59,7 +62,7 @@ These commands are available within the interactive REPL.
 | `--allowed-tools`                | -     | array   | -         | **Deprecated.** Use the [Policy Engine](../reference/policy-engine.md) instead. Tools that are allowed to run without confirmation (comma-separated or multiple flags) |
 | `--extensions`                   | `-e`  | array   | -         | List of extensions to use. If not provided, all extensions are enabled (comma-separated or multiple flags)                                                             |
 | `--list-extensions`              | `-l`  | boolean | -         | List all available extensions and exit                                                                                                                                 |
-| `--resume`                       | `-r`  | string  | -         | Resume a previous session. Use `"latest"` for most recent or index number (e.g. `--resume 5`)                                                                          |
+| `--resume`                       | `-r`  | string  | -         | Resume a previous session. Use `"latest"` for most recent or index number (for example `--resume 5`)                                                                   |
 | `--list-sessions`                | -     | boolean | -         | List available sessions for the current project and exit                                                                                                               |
 | `--delete-session`               | -     | string  | -         | Delete a session by index number (use `--list-sessions` to see available sessions)                                                                                     |
 | `--include-directories`          | -     | array   | -         | Additional directories to include in the workspace (comma-separated or multiple flags)                                                                                 |

docs/cli/creating-skills.md

@@ -1,43 +1,138 @@
 # Creating Agent Skills
 
-This guide provides an overview of how to create your own Agent Skills to extend
-the capabilities of Gemini CLI.
+Agent Skills let you extend Gemini CLI with specialized expertise, procedural
+workflows, and task-specific resources. This guide walks you through both
+automated and manual methods for creating and organizing your skills.
 
-## Getting started: The `skill-creator` skill
+## Quickstart: Create a skill with a prompt
 
-The recommended way to create a new skill is to use the built-in `skill-creator`
-skill. To use it, ask Gemini CLI to create a new skill for you.
+The fastest way to create a new skill is to use the built-in `skill-creator`.
+This meta-skill guides you through designing, scaffolding, and validating your
+expertise.
 
-**Example prompt:**
+Simply ask Gemini CLI to create a skill for you:
 
-> "create a new skill called 'code-reviewer'"
+> "Create a new skill called 'code-reviewer' that analyzes local files for
+> common errors and style violations."
 
-Gemini CLI will then use the `skill-creator` to generate the skill:
+Gemini will then:
 
-1.  Generate a new directory for your skill (e.g., `my-new-skill/`).
+1.  Generate a new directory for your skill (for example, `my-new-skill/`).
 2.  Create a `SKILL.md` file with the necessary YAML frontmatter (`name` and
     `description`).
 3.  Create the standard resource directories: `scripts/`, `references/`, and
     `assets/`.
 
-## Manual skill creation
+Once created, you can find your new skill in `.gemini/skills/code-reviewer/`.
 
-If you prefer to create skills manually:
+## Manual creation
 
-1.  **Create a directory** for your skill (e.g., `my-new-skill/`).
+1.  **Create a directory** for your skill (for example, `my-new-skill/`).
 2.  **Create a `SKILL.md` file** inside the new directory.
 
-To add additional resources that support the skill, refer to the skill
-structure.
+### 1. Create the directory structure
 
-## Skill structure
+The first step is to create the necessary folders for your skill and its
+scripts.
 
-A skill is a directory containing a `SKILL.md` file at its root.
+**macOS/Linux**
 
-### Folder structure
+```bash
+mkdir -p .gemini/skills/code-reviewer/scripts
+```
+
+**Windows (PowerShell)**
+
+```powershell
+New-Item -ItemType Directory -Force -Path ".gemini\skills\code-reviewer\scripts"
+```
+
+### 2. Define the skill (`SKILL.md`)
+
+The `SKILL.md` file defines the skill's purpose and instructions for the agent.
+Create a file at `.gemini/skills/code-reviewer/SKILL.md`.
+
+```markdown
+---
+name: code-reviewer
+description:
+  Expertise in reviewing code changes for correctness, security, and style. Use
+  when the user asks to "review" their code or a PR.
+---
+
+# Code Reviewer Instructions
+
+You act as a senior software engineer specialized in code quality. When this
+skill is active, you MUST:
+
+1.  **Analyze**: Review the provided code for logical errors, security
+    vulnerabilities, and style violations.
+2.  **Review**: Use the bundled `scripts/review.js` utility to perform an
+    automated check.
+3.  **Feedback**: Provide constructive feedback, clearly distinguishing between
+    critical issues and minor improvements.
+```
+
+### 3. Add the tool logic
+
+Skills can bundle resources like scripts to perform deterministic tasks. Create
+a file at `.gemini/skills/code-reviewer/scripts/review.js`.
+
+```javascript
+// .gemini/skills/code-reviewer/scripts/review.js
+const file = process.argv[2];
+
+if (!file) {
+  console.error('Usage: node review.js <file>');
+  process.exit(1);
+}
+
+console.log(`Reviewing ${file}...`);
+// Simple mock review logic
+setTimeout(() => {
+  console.log(`Result: Success (No major issues found in ${file})`);
+}, 500);
+```
+
+### 4. Test the skill
+
+Gemini CLI automatically discovers skills in the `.gemini/skills` directory.
+
+1.  Start a new session and ask a question that triggers the skill's
+    description: "Can you review index.js"
+2.  Gemini identifies the request matches the `code-reviewer` description and
+    asks for permission to activate it.
+3.  Once you approve, Gemini executes the bundled script:
+    `node .gemini/skills/code-reviewer/scripts/review.js index.js`
+
+To determine whether your skill has been correctly loaded, run the command:
+
+```bash
+/skills
+```
+
+### 5. Optional: Share your skill
+
+You can share your skills in several ways depending on your target audience.
+
+- **Workspace skills**: Commit your skill to a `.gemini/skills/` directory in
+  your project repository.
+- **Extensions**: Bundle your skill within a
+  [Gemini CLI extension](../extensions/writing-extensions.md).
+- **Git repositories**: Share the skill directory as a standalone Git repo and
+  install it using `gemini skills install <url>`.
+
+---
+
+## Core concepts
+
+Now that you've built your first skill, let's explore the core components and
+workflows for developing more complex expertise.
+
+### Skill structure
 
 While a `SKILL.md` file is the only required component, we recommend the
-following structure for organizing your skill's resources:
+following structure for organizing your skill's resources.
 
 ```text
 my-skill/
@@ -47,34 +142,66 @@ my-skill/
 └── assets/        (Optional) Templates and other resources
 ```
 
-### `SKILL.md` file
+When a skill is activated, the model is granted access to this entire directory.
+You can instruct the model to use the tools and files found within these
+folders.
 
-The `SKILL.md` file is the core of your skill. This file uses YAML frontmatter
-for metadata and Markdown for instructions. For example:
+### Metadata and triggers
 
-```markdown
----
-name: code-reviewer
-description:
-  Use this skill to review code. It supports both local changes and remote Pull
-  Requests.
----
-
-# Code Reviewer
-
-This skill guides the agent in conducting thorough code reviews.
-
-## Workflow
-
-### 1. Determine Review Target
-
-- **Remote PR**: If the user gives a PR number or URL, target that remote PR.
-- **Local Changes**: If changes are local... ...
-```
+The `SKILL.md` file uses YAML frontmatter for metadata.
 
 - **`name`**: A unique identifier for the skill. This should match the directory
   name.
-- **`description`**: A description of what the skill does and when Gemini should
-  use it.
-- **Body**: The Markdown body of the file contains the instructions that guide
-  the agent's behavior when the skill is active.
+- **`description`**: **CRITICAL.** This is how Gemini decides when to use the
+  skill. Be specific about the tasks it handles and the keywords that should
+  trigger it.
+
+### Discovery tiers
+
+Gemini CLI discovers skills from several locations, following a specific order
+of precedence (lowest to highest):
+
+1.  **Built-in Skills**: Included with Gemini CLI (pre-approved).
+2.  **Extension Skills**: Bundled within [extensions](../extensions/).
+3.  **User Skills**: `~/.gemini/skills/` or the `~/.agents/skills/` alias.
+4.  **Workspace Skills**: `.gemini/skills/` or the `.agents/skills/` alias.
+
+### Discovery aliases
+
+You can use `.agents/skills` as an alternative to `.gemini/skills`. This alias
+is compatible with other AI agent tools following the
+[Agent Skills](https://agentskills.io) standard.
+
+## Advanced development
+
+Once you've built a basic skill, you can use specialized scripts and workflows
+to streamline your development process.
+
+### Creation scripts
+
+If you are developing a skill and want to use the same scripts the built-in
+tools use, you can find them in the core package. These scripts help automate
+the initialization, validation, and packaging of skills.
+
+- **Initialize**: `node scripts/init_skill.cjs <name> --path <dir>`
+- **Validate**: `node scripts/validate_skill.cjs <path/to/skill>`
+- **Package**: `node scripts/package_skill.cjs <path/to/skill>` (Creates a
+  `.skill` zip file)
+
+### Linking for local development
+
+If you are developing a skill in a separate directory, you can link it to your
+user skills directory for testing:
+
+```bash
+gemini skills link .
+```
+
+## Next steps
+
+- [Skill best practices](./skills-best-practices.md): Learn strategies for
+  building reliable and effective skills.
+- [Agent Skills overview](./skills.md): Deep dive into discovery tiers and the
+  skill lifecycle.
+- [Get started with Agent Skills](./tutorials/skills-getting-started.md): A
+  quick walkthrough of triggering and using skills.

docs/cli/custom-commands.md

@@ -30,8 +30,11 @@ separator (`/` or `\`) being converted to a colon (`:`).
 - A file at `<project>/.gemini/commands/git/commit.toml` becomes the namespaced
   command `/git:commit`.
 
-> [!TIP] After creating or modifying `.toml` command files, run
+<!-- prettier-ignore -->
+> [!TIP]
+> After creating or modifying `.toml` command files, run
 > `/commands reload` to pick up your changes without restarting the CLI.
+> To see all available command files, run `/commands list`.
 
 ## TOML file format (v1)
 
@@ -83,8 +86,8 @@ The model receives:
 **B. Using arguments in shell commands (inside `!{...}` blocks)**
 
 When you use `{{args}}` inside a shell injection block (`!{...}`), the arguments
-are automatically **shell-escaped** before replacement. This allows you to
-safely pass arguments to shell commands, ensuring the resulting command is
+are automatically **shell-escaped** before replacement. This lets you safely
+pass arguments to shell commands, ensuring the resulting command is
 syntactically correct and secure while preventing command injection
 vulnerabilities.
 
@@ -103,8 +106,8 @@ When you run `/grep-code It's complicated`:
 
 1. The CLI sees `{{args}}` used both outside and inside `!{...}`.
 2. Outside: The first `{{args}}` is replaced raw with `It's complicated`.
-3. Inside: The second `{{args}}` is replaced with the escaped version (e.g., on
-   Linux: `"It\'s complicated"`).
+3. Inside: The second `{{args}}` is replaced with the escaped version (for
+   example, on Linux: `"It\'s complicated"`).
 4. The command executed is `grep -r "It's complicated" .`.
 5. The CLI prompts you to confirm this exact, secure command before execution.
 6. The final prompt is sent.
@@ -114,13 +117,13 @@ When you run `/grep-code It's complicated`:
 If your `prompt` does **not** contain the special placeholder `{{args}}`, the
 CLI uses a default behavior for handling arguments.
 
-If you provide arguments to the command (e.g., `/mycommand arg1`), the CLI will
-append the full command you typed to the end of the prompt, separated by two
-newlines. This allows the model to see both the original instructions and the
-specific arguments you just provided.
+If you provide arguments to the command (for example, `/mycommand arg1`), the
+CLI will append the full command you typed to the end of the prompt, separated
+by two newlines. This allows the model to see both the original instructions and
+the specific arguments you just provided.
 
-If you do **not** provide any arguments (e.g., `/mycommand`), the prompt is sent
-to the model exactly as it is, with nothing appended.
+If you do **not** provide any arguments (for example, `/mycommand`), the prompt
+is sent to the model exactly as it is, with nothing appended.
 
 **Example (`changelog.toml`):**
 
@@ -177,16 +180,16 @@ ensure that only intended commands can be run.
     automatically shell-escaped (see
     [Context-Aware Injection](#1-context-aware-injection-with-args) above).
 3.  **Robust parsing:** The parser correctly handles complex shell commands that
-    include nested braces, such as JSON payloads. **Note:** The content inside
-    `!{...}` must have balanced braces (`{` and `}`). If you need to execute a
-    command containing unbalanced braces, consider wrapping it in an external
-    script file and calling the script within the `!{...}` block.
+    include nested braces, such as JSON payloads. The content inside `!{...}`
+    must have balanced braces (`{` and `}`). If you need to execute a command
+    containing unbalanced braces, consider wrapping it in an external script
+    file and calling the script within the `!{...}` block.
 4.  **Security check and confirmation:** The CLI performs a security check on
     the final, resolved command (after arguments are escaped and substituted). A
     dialog will appear showing the exact command(s) to be executed.
 5.  **Execution and error reporting:** The command is executed. If the command
     fails, the output injected into the prompt will include the error messages
-    (stderr) followed by a status line, e.g.,
+    (stderr) followed by a status line, for example,
     `[Shell command exited with code 1]`. This helps the model understand the
     context of the failure.
 
@@ -227,9 +230,10 @@ operate on specific files.
 
 - **File injection**: `@{path/to/file.txt}` is replaced by the content of
   `file.txt`.
-- **Multimodal support**: If the path points to a supported image (e.g., PNG,
-  JPEG), PDF, audio, or video file, it will be correctly encoded and injected as
-  multimodal input. Other binary files are handled gracefully and skipped.
+- **Multimodal support**: If the path points to a supported image (for example,
+  PNG, JPEG), PDF, audio, or video file, it will be correctly encoded and
+  injected as multimodal input. Other binary files are handled gracefully and
+  skipped.
 - **Directory listing**: `@{path/to/dir}` is traversed and each file present
   within the directory and all subdirectories is inserted into the prompt. This
   respects `.gitignore` and `.geminiignore` if enabled.

docs/cli/enterprise.md

@@ -5,9 +5,11 @@ and managing Gemini CLI in an enterprise environment. By leveraging system-level
 settings, administrators can enforce security policies, manage tool access, and
 ensure a consistent experience for all users.
 
-> **A note on security:** The patterns described in this document are intended
-> to help administrators create a more controlled and secure environment for
-> using Gemini CLI. However, they should not be considered a foolproof security
+<!-- prettier-ignore -->
+> [!WARNING]
+> The patterns described in this document are intended to help
+> administrators create a more controlled and secure environment for using
+> Gemini CLI. However, they should not be considered a foolproof security
 > boundary. A determined user with sufficient privileges on their local machine
 > may still be able to circumvent these configurations. These measures are
 > designed to prevent accidental misuse and enforce corporate policy in a
@@ -173,8 +175,8 @@ the enterprise settings are always loaded with the highest precedence.
 **Example wrapper script:**
 
 Administrators can create a script named `gemini` and place it in a directory
-that appears earlier in the user's `PATH` than the actual Gemini CLI binary
-(e.g., `/usr/local/bin/gemini`).
+that appears earlier in the user's `PATH` than the actual Gemini CLI binary (for
+example, `/usr/local/bin/gemini`).
 
 ```bash
 #!/bin/bash
@@ -280,10 +282,12 @@ environment to a blocklist.
 }
 ```
 
-**Security note:** Blocklisting with `excludeTools` is less secure than
-allowlisting with `coreTools`, as it relies on blocking known-bad commands, and
-clever users may find ways to bypass simple string-based blocks. **Allowlisting
-is the recommended approach.**
+<!-- prettier-ignore -->
+> [!WARNING]
+> Blocklisting with `excludeTools` is less secure than
+> allowlisting with `coreTools`, as it relies on blocking known-bad commands,
+> and clever users may find ways to bypass simple string-based blocks.
+> **Allowlisting is the recommended approach.**
 
 ### Disabling YOLO mode
 
@@ -321,9 +325,9 @@ User. When it comes to the `mcpServers` object, these configurations are
 1.  **Merging:** The lists of servers from all three levels are combined into a
     single list.
 2.  **Precedence:** If a server with the **same name** is defined at multiple
-    levels (e.g., a server named `corp-api` exists in both system and user
-    settings), the definition from the highest-precedence level is used. The
-    order of precedence is: **System > Workspace > User**.
+    levels (for example, a server named `corp-api` exists in both system and
+    user settings), the definition from the highest-precedence level is used.
+    The order of precedence is: **System > Workspace > User**.
 
 This means a user **cannot** override the definition of a server that is already
 defined in the system-level settings. However, they **can** add new servers with
@@ -339,8 +343,8 @@ canonical servers and adding their names to an allowlist.
 For even greater security, especially when dealing with third-party MCP servers,
 you can restrict which specific tools from a server are exposed to the model.
 This is done using the `includeTools` and `excludeTools` properties within a
-server's definition. This allows you to use a subset of tools from a server
-without allowing potentially dangerous ones.
+server's definition. This lets you use a subset of tools from a server without
+allowing potentially dangerous ones.
 
 Following the principle of least privilege, it is highly recommended to use
 `includeTools` to create an allowlist of only the necessary tools.
@@ -477,9 +481,8 @@ an environment variable, but it can also be enforced for custom tools via the
 ## Telemetry and auditing
 
 For auditing and monitoring purposes, you can configure Gemini CLI to send
-telemetry data to a central location. This allows you to track tool usage and
-other events. For more information, see the
-[telemetry documentation](./telemetry.md).
+telemetry data to a central location. This lets you track tool usage and other
+events. For more information, see the [telemetry documentation](./telemetry.md).
 
 **Example:** Enable telemetry and send it to a local OTLP collector. If
 `otlpEndpoint` is not specified, it defaults to `http://localhost:4317`.
@@ -494,21 +497,27 @@ other events. For more information, see the
 }
 ```
 
-**Note:** Ensure that `logPrompts` is set to `false` in an enterprise setting to
-avoid collecting potentially sensitive information from user prompts.
+<!-- prettier-ignore -->
+> [!NOTE]
+> Ensure that `logPrompts` is set to `false` in an enterprise setting to
+> avoid collecting potentially sensitive information from user prompts.
 
 ## Authentication
 
 You can enforce a specific authentication method for all users by setting the
-`enforcedAuthType` in the system-level `settings.json` file. This prevents users
-from choosing a different authentication method. See the
-[Authentication docs](../get-started/authentication.md) for more details.
+`security.auth.enforcedType` in the system-level `settings.json` file. This
+prevents users from choosing a different authentication method. See the
+[Authentication docs](../get-started/authentication.mdx) for more details.
 
 **Example:** Enforce the use of Google login for all users.
 
 ```json
 {
-  "enforcedAuthType": "oauth-personal"
+  "security": {
+    "auth": {
+      "enforcedType": "oauth-personal"
+    }
+  }
 }
 ```
 

docs/cli/gemini-ignore.md

@@ -1,9 +1,9 @@
 # Ignoring files
 
 This document provides an overview of the Gemini Ignore (`.geminiignore`)
-feature of the Gemini CLI.
+feature of Gemini CLI.
 
-The Gemini CLI includes the ability to automatically ignore files, similar to
+Gemini CLI includes the ability to automatically ignore files, similar to
 `.gitignore` (used by Git) and `.aiexclude` (used by Gemini Code Assist). Adding
 paths to your `.geminiignore` file will exclude them from tools that support
 this feature, although they will still be visible to other services (such as