google-gemini/gemini-cli

This system is the Gemini CLI, a command-line interface for interacting with Google's Gemini AI models, designed for both interactive terminal use and programmatic integration via an SDK. It provides a comprehensive agent runtime that manages sessions, tool execution, and policy enforcement, featuring capabilities such as local model routing, browser automation, and extensibility through skills and MCP servers. The platform also includes an A2A server for inter-agent communication and a VS Code companion extension for IDE integration, supported by extensive infrastructure for testing, telemetry, and automated release workflows.

94 changes.

This period established the foundational structure of the Gemini CLI monorepo, introducing the core package, CLI interface, and VS Code companion extension. It implemented essential infrastructure including React-based UI components, a TOML-based policy engine, and modular tool scheduling, while adding initial support for local Gemma models and Model Context Protocol (MCP) integration.

43 changes.

This period focused on hardening the execution environment with strict, platform-specific sandboxing and introducing a comprehensive skills system for agent extensibility. It also established a robust SDK and Agent Client Protocol to enable IDE integration and external embedding, while launching the Caretaker Agent infrastructure for automated repository maintenance.

Introduces a new non-interactive UI implementation for the CLI that provides no-op functions for interactive features while ensuring error, warning, and info messages are correctly written to stderr and stdout respectively. This enables the CLI to operate in headless or non-interactive modes by gracefully handling UI operations that are not applicable in such environments, such as clearing the screen, loading history, or toggling debug profilers.

packages/cli/src/ui/noninteractive · high confidence

The core output module now supports structured JSON and streaming JSON (stream-json) output formats in addition to the existing text format. The new JsonFormatter produces a single JSON object containing the response, session ID, error details, and optional session statistics (including per-model token usage and tool call metrics), while automatically stripping ANSI escape sequences from text. The new StreamJsonFormatter emits newline-delimited JSON (JSONL) events to stdout in real-time, covering init, message, tool use, tool result, error, and result events, with the result event including aggregated and per-model token statistics. These formats are defined in the new types.ts file and are intended for programmatic consumption, particularly in headless or non-interactive modes.

packages/core/src/output · high confidence

Users can now automatically migrate their existing hook configurations from Claude Code to Gemini using the new \migrate\ command. This feature reads settings from \.claude/settings.json\ (or \.claude/settings.local.json\ if present) and converts event names (e.g., \PreToolUse\ to \BeforeTool\), tool matchers (e.g., \Edit\ to \replace\), and environment variables (\$CLAUDE\_PROJECT\_DIR\ to \$GEMINI\_PROJECT\_DIR\) into the Gemini format, writing the result to \.gemini/settings.json\.

packages/cli/src/commands/hooks · high confidence

A new bash script (deploy.sh) has been added to the Caretaker Agent tools to automate the deployment of its services to Google Cloud Platform. The script supports deploying four distinct components—Ingestion Service, Triage Worker Job, Egress Service, and Triage Eval Runner Job—either individually or as a complete set. It configures specific Cloud Run settings for each component, such as instance limits, service accounts, and resource allocations, and requires the PROJECT\_ID environment variable to target the correct GCP project in the us-west1 region.

tools/caretaker-agent/scripts · high confidence

The A2A server now supports persisting task metadata and workspace files to Google Cloud Storage (GCS) via the new GCSTaskStore. This implementation validates task IDs to prevent path traversal attacks, compresses data using gzip, and handles bucket initialization and file uploads to GCS, with corresponding unit tests added to verify the behavior.

packages/a2a-server/src/persistence · high confidence

Administrators can now centrally manage Model Context Protocol (MCP) server access through the admin controls system. This update introduces logic to filter local MCP servers against an admin-defined allowlist, blocking unauthorized servers and overriding their connection details (such as URL and trust settings) with the admin configuration. Additionally, administrators can enforce the presence of specific MCP servers by defining a list of required servers, which are injected into the client configuration and take precedence over any local user settings. The system also includes robust sanitization of admin settings to handle invalid JSON or schema mismatches gracefully, ensuring stable configuration application.

_packages/core/src/code\assist/admin · high confidence

A new 'ci' skill has been added to Gemini CLI, providing a script that automatically monitors GitHub Actions workflows for the current branch and replicates failures locally. The tool discovers active or recent CI runs, detects job failures, filters out noise, and generates specific local test or lint commands (e.g., \npm test -w \<pkg\>\) to reproduce issues immediately, streamlining the triage and fix cycle.

.gemini/skills/ci · high confidence

The test-utils package now provides a centralized collection of predefined test agents (such as docs-agent, testing-agent, and database-agent) in the new \agents.ts\ fixture. These agents, which include specific tool sets and descriptions for tasks like documentation updates, security audits, and CI/CD, are designed to be reused directly in evaluation tests via the \asFile\ helper, simplifying the setup of consistent agent configurations across different test suites.

packages/test-utils/src/fixtures · high confidence

The \packages/core/src\ location now exposes a consolidated public API via \index.ts\, re-exporting configuration, policy, commands, core logic, routing, utilities, services, IDE integration, and tool definitions. A placeholder test file (\index.test.ts\) has been added to verify the module loads correctly. This change defines the export boundary for the core package, enabling consumers to import from a single entry point rather than navigating internal subdirectories.

packages/core/src · high confidence

The CLI now introduces a dedicated settings manager for external editors, dynamically listing available options (such as Vim, Emacs, Neovim, Zed, and VSCodium) while indicating their installation status and sandbox availability. This change centralizes the logic for validating editor commands and restricting access in sandboxed environments, providing users with a clearer view of which external editors are ready to use for modifications.

packages/cli/src/ui/editors · high confidence

The \tools/gemini-cli-bot\ directory now implements a layered, skills-based composition model for repository automation. The system features a 'System 1' Pulse layer for high-frequency, deterministic maintenance (triage, routing) and a 'System 2' Brain layer for strategic, 24-hour root-cause analysis and self-optimization. This architecture is driven by new prompt templates (\brain/\) and modular 'skills' (\skills/\) that define specialized agent behaviors for metrics analysis, code critique, state memory, and PR management. To support this, the bot now includes a comprehensive metrics collection suite (\metrics/\) that tracks time-series data such as PR/issue latency, backlog age, and GitHub Actions spend, while enforcing strict security policies (zero-trust input handling, payload-injection detection) and deterministic execution constraints.

tools/gemini-cli-bot · high confidence

The \packages/core/src/telemetry/clearcut-logger\ directory now contains the core implementation for the Clearcut logging system, including the \ClearcutLogger\ class, event metadata definitions, and a comprehensive test suite. This introduces a new telemetry backend that captures a wide range of user interactions and system events—such as session starts, tool calls, API responses, loop detection, and extension activities—and sends them to Google's Clearcut infrastructure for analysis.

packages/core/src/telemetry/clearcut-logger · high confidence

The repository has been initialized with the foundational structure for the Gemini CLI monorepo. This includes a multi-stage Dockerfile for building and running the CLI, a Makefile for common development tasks, and a comprehensive ESLint configuration enforcing strict TypeScript and React best practices. Project conventions are defined in GEMINI.md, while CONTRIBUTING.md and ROADMAP.md provide guidelines for community involvement. Additionally, standard configuration files such as .editorconfig, .prettierrc.json, .npmrc, and .gitignore have been added to standardize development workflows and environment setup.

(repo-wide) · high confidence

This change introduces the \packages/vscode-ide-companion\ directory, establishing the VS Code extension that pairs with Gemini CLI. The extension provides IDE workspace access to the CLI agent, enabling features such as open editor file context, selection context, native diffing, and launching Gemini CLI sessions. The package includes the necessary build configuration (esbuild, TypeScript, Vitest), licensing (Apache 2.0, NOTICES.txt), and documentation (README, development guide) to support the extension's lifecycle and distribution.

packages/vscode-ide-companion · high confidence

This change introduces the initial version of the Gemini Code CLI, establishing the core entry point, configuration, and testing infrastructure. The CLI now uses a lightweight parent process to manage a heavy child process, optimizing startup time and handling automatic memory configuration based on system resources. It includes a new UI framework based on React and Ink, with specific guidelines for handling state and rendering. The package is configured with Vitest for testing, featuring a robust test setup that mocks dependencies and ensures consistent snapshot behavior across environments. Additionally, the TypeScript configuration has been updated to support composite projects and modern JSX settings.

packages/cli · high confidence

The new \@google/gemini-cli-sdk\ package provides a programmatic interface to embed Gemini CLI agent capabilities into other applications. Users can instantiate a \GeminiCliAgent\ to manage sessions, stream responses, and define custom tools using a \tool()\ helper with Zod schemas. The SDK supports dynamic system instructions that receive session context, allowing agents to access environment details like the current working directory, session ID, and timestamp. It also enables loading custom skills from filesystem directories, giving developers the ability to extend agent behavior with domain-specific instructions and tools.

packages/sdk · high confidence

Added the A2AClientManager to orchestrate communication with remote A2A agents, supporting REST, JSON-RPC, and gRPC transports with a dedicated 30-minute timeout to accommodate long-running tasks. The implementation includes a new error classification system (A2AAgentError and subclasses) that provides user-friendly messages for common failure modes like 404s, authentication failures, and connection errors, along with utilities for reassembling streaming updates and normalizing agent cards.

packages/core/src/agents · high confidence

The \packages/a2a-server\ package is added, providing the foundational types and entry points for the A2A server implementation. The \index.ts\ file exposes the agent executor, HTTP application, and type definitions. The \types.ts\ file defines the \CoderAgentEvent\ enum (covering events like tool call confirmations, updates, text content, state changes, thoughts, and citations) and associated interfaces such as \AgentSettings\, \ToolCallConfirmation\, and \TaskMetadata\. It also includes utility functions for managing persisted state metadata, enabling the server to handle agent configuration and task context persistence.

packages/a2a-server/src · high confidence

The a2a-server package now includes a set of new utility modules in src/utils to support its event-driven architecture and security requirements. executor\_utils.ts provides helper functions to publish task failure states via the ExecutionEventBus, ensuring users receive clear error messages when agent execution fails. path\_utils.ts introduces a validateWorkspacePath function that prevents path traversal attacks by resolving and validating workspace paths against an allowed root, throwing errors for null bytes or out-of-bounds paths. logger.ts configures a structured winston logger with timestamps and JSON support for better observability. Additionally, testing\_utils.ts provides comprehensive mock configurations and request builders to facilitate unit testing of the server components.

packages/a2a-server/src/utils · high confidence

A new ingestion service has been added to handle GitHub webhook events for issues and issue comments. The service validates incoming payloads using HMAC signatures, sanitizes issue titles and bodies by wrapping them in untrusted\_context tags, and stores new issues in Firestore with an UNTRIAGED status. It supports re-triaging existing issues via specific comments (e.g., /caretaker triage) or mentions (@caretaker-agent), and publishes processed data to Pub/Sub for downstream handling.

tools/caretaker-agent/cloudrun/ingestion-service · high confidence

The A2A server now exposes an HTTP interface (Express) to allow external clients to interact with the agent. This includes a streaming POST endpoint for sending messages and receiving task status updates, an /executeCommand endpoint for running registered commands (with support for streaming responses), and standard endpoints for task management (create, metadata) and agent discovery (/.well-known/agent-card.json). The server also implements basic HTTP authentication (Bearer and Basic) via a custom user builder and supports configurable task persistence (InMemory or GCS).

packages/a2a-server/src/http · high confidence

The test-utils package now includes a TestMcpServerBuilder and supporting infrastructure (including a generic MCP process template and JSON configuration support) that allows tests to spin up isolated, local MCP servers. This enables testing of tool triggers and workflows without relying on live API endpoints or being subject to rate-limiting, with the test rig providing a compliant way to inject these mock servers into end-to-end CLI sessions.

packages/test-utils · high confidence

This change adds a new Cloud Run job and its supporting infrastructure to automatically generate pull requests by fixing bugs. The system deploys a Docker container that runs a Python orchestrator, which coordinates an iterative loop involving a coding agent, a code evaluator, and a revision agent. The orchestrator clones repositories, executes targeted tests, and uses Google Antigravity to apply fixes and write tests. A separate evaluator agent checks the code for correctness, security (including ReDoS prevention), and linting compliance, providing feedback for revision if needed. The workflow is triggered via Google Cloud Workflows listening to Pub/Sub messages, which update Firestore with the job status. The entry includes the Dockerfile, Cloud Run job configuration, workflow definitions, agent prompt templates, and the core Python workflow modules along with their unit tests.

tools/caretaker-agent/cloudrun/pr-generator · high confidence

The Caretaker Triage worker is now available as a Cloud Run Job to automatically process incoming GitHub issues. It acquires transactional locks in Firestore to prevent race conditions, then invokes an LLM-based orchestrator to evaluate issue quality (classifying issues as SPAM, EMPTY, FEATURE, NEEDS\_INFO, or OK). Based on the assessment, the worker posts comments, applies labels (such as auto-close or effort estimates), and publishes a 'ready-for-code' event with a structured workable spec for valid bugs. The system includes a retry mechanism for transient failures and escalates to human review after two failed attempts.

tools/caretaker-agent/cloudrun/triage-worker · high confidence

Adds a new behavioral evaluation system to the \evals\ directory, designed to test the agent's decision-making and tool usage rather than just system functionality. The change includes a comprehensive README explaining the framework's policies (\ALWAYS\_PASSES\ for stable tests, \USUALLY\_PASSES\ for flaky ones), a promotion process for moving tests to CI-blocking status, and helper utilities like \evalTest\, \appEvalTest\, and \componentEvalTest\. It also ships with initial test suites covering specific agent behaviors, such as distinguishing between inspecting and fixing code, using the \ask\_user\ tool for clarification, respecting auto-memory contracts, and leveraging automated tools like \eslint --fix\ and \prettier --write\.

evals · high confidence

A new Cloud Run-based egress service has been added to handle outbound GitHub operations for the caretaker agent. The service exposes a single HTTP endpoint that accepts Pub/Sub push messages to perform issue management actions, including posting comments, adding or removing labels, and adding reactions to comments. It authenticates to GitHub using an App installation token and enforces strict allowlisting of the target owner and repository to ensure actions are only executed on authorized codebases.

tools/caretaker-agent/cloudrun/egress-service · high confidence

A new ModelRouterService has been added to the core package to centralize and manage model selection decisions. This service implements a composite strategy chain that evaluates requests through a sequence of strategies—including fallback, override, approval mode, classifier, numerical classifier, and default logic—to determine the appropriate model for a given context. The system supports conditional inclusion of specialized classifiers (such as Gemma) based on configuration, logs detailed telemetry for each routing decision, and handles errors gracefully by falling back to a default model while recording the exception.

packages/core/src/routing · high confidence

The A2A server now includes a new command registry that registers four top-level commands: \init\ (analyzes the project and creates a tailored GEMINI.md file), \restore\ (restores the server to a previous checkpoint or lists available checkpoints), \memory\ (manages memory with sub-commands to show, refresh, and list memory files), and \extensions\ (manages extensions with a sub-command to list installed extensions). These commands are registered in the \CommandRegistry\ and expose their functionality through a standardized \Command\ interface, allowing users to interact with these features via the A2A server.

packages/a2a-server/src/commands · high confidence

Added the \@google/gemini-cli-a2a-server\ package, an experimental Agent-to-Agent (A2A) server that exposes Gemini CLI capabilities over HTTP for inter-agent communication. This package includes the core server implementation (session management, HTTP routes, and persistence) and introduces the \development-tool\ extension specification, which defines a standardized protocol for clients to interact with the Gemini CLI agent, including real-time streaming of tool calls, thoughts, and status updates. The addition is accompanied by necessary build configuration (tsconfig, vitest) and documentation.

packages/a2a-server · high confidence

An experimental browser agent is now available for delegated web automation tasks, allowing the system to interact with JavaScript-heavy pages, fill forms, and navigate multi-step flows. The agent features a new \analyze\_screenshot\ tool that sends page screenshots to a visual model to identify elements by color or precise coordinates when accessibility tree data is insufficient. To improve user awareness and security, a pulsating blue border overlay is injected into the browser window during automation, and an input blocker can be enabled to prevent user interference. The agent also includes strict security prompts to prevent prompt injection, domain restrictions to limit navigation to allowed sites, and policy rules to require user confirmation for sensitive actions like file uploads.

packages/core/src/agents/browser · high confidence

The CLI now uses a new \CommandService\ to orchestrate slash command discovery, supporting multiple loader sources (built-in, file-based, MCP prompts, and skills) and automatically resolving name conflicts by prefixing duplicate commands with their source identifier. This change adds a robust command loading architecture that handles errors gracefully, emits telemetry for conflicts, and ensures all commands are uniquely addressable while maintaining backward compatibility for built-in commands.

packages/cli/src/services · high confidence

Users can now selectively enable or disable specific MCP servers included in an extension. This change adds a new configuration module that manages server enablement state, supporting both persistent file-based settings and temporary session-only overrides. It introduces a centralized check (\canLoadServer\) that enforces these user preferences alongside existing administrative allowlists and excludelists, ensuring that disabled servers are blocked from loading. The implementation includes a singleton manager to track session state and helper functions for case-insensitive server ID matching and backward compatibility with extension identifiers.

packages/cli/src/config/mcp · high confidence

The file search system in the core package has been replaced with a new, high-performance engine. This update introduces in-memory caching for crawl results (with configurable TTL and automatic eviction) and a file watcher that keeps the search index updated when files are added or deleted. The new crawler supports recursive and non-recursive search modes, respects .gitignore and .geminiignore rules, and integrates with fzf for fast fuzzy matching. Users will experience faster autocomplete and file discovery, with the search results staying in sync with the file system in real time.

packages/core/src/utils/filesearch · high confidence

The \packages/sdk/src\ directory now contains the initial bootstrap for the Gemini CLI SDK, providing the core classes \GeminiCliAgent\ and \GeminiCliSession\ to manage agent configuration and conversation lifecycles. Users can create new sessions or resume existing ones via \resumeSession\, which loads conversation history from storage. The SDK supports dynamic system instructions (functions that receive session context), custom tools defined with Zod schemas, and skill directories. It also includes \SdkAgentFilesystem\ and \SdkAgentShell\ implementations that enforce path-based access policies and handle command execution within the agent's security sandbox.

packages/sdk/src · high confidence

Adds a new \gemini gemma\ command group to the CLI that enables local model routing using the LiteRT-LM runtime. Users can now run \gemini gemma setup\ to download and verify the LiteRT binary and Gemma model, \gemini gemma start\ to launch the local inference server, \gemini gemma status\ to check the health of the binary, model, and server, \gemini gemma logs\ to view server logs, and \gemini gemma stop\ to terminate the server. The feature includes platform-specific binary detection, SHA-256 verification, and configuration support for custom binary paths and ports.

packages/cli/src · high confidence

Developers can now override remote experiment flags locally by setting the GEMINI\_EXP environment variable to point to a JSON file containing flag definitions. The core experiment system in packages/core/src/code\_assist/experiments checks for this file first, parsing the local configuration to apply specific flags and experiment IDs, and only falls back to fetching from the remote server if the file is missing, unreadable, or malformed. This change adds the necessary client metadata handling, type definitions, and caching logic to support this local-first experiment resolution strategy.

_packages/core/src/code\assist/experiments · high confidence

The hooks subsystem in \packages/core/src/hooks\ has been restructured into a new \HookSystem\ architecture. This change introduces dedicated components for managing hook lifecycles: \HookRegistry\ handles loading and validating hook definitions from project and extension configurations; \HookPlanner\ creates execution plans by filtering hooks based on event context and matchers; \HookRunner\ executes command and runtime hooks with security checks for untrusted folders; \HookAggregator\ merges results from multiple hooks using event-specific strategies (e.g., OR logic for blocking decisions); and \HookEventHandler\ coordinates the entire flow. The new system supports parallel and sequential execution, tool-name matching via regex or wildcards, and proper aggregation of outputs and errors across multiple hook invocations.

packages/core/src/hooks · high confidence

Custom commands now support a new prompt processing pipeline that allows injecting shell command results and file contents directly into the model's context. Users can use the \!{...}\ syntax to execute shell commands (with automatic argument escaping and policy-based approval) and the \@{...}\ syntax to read and inject file contents from the workspace. The system handles nested braces, preserves placeholders on read errors, and provides UI feedback for failures, while argument placeholders (\{{args}}\) are injected raw outside shell blocks and shell-escaped inside them.

packages/cli/src/services/prompt-processors · high confidence

Users can now use real-time voice mode, which captures microphone audio and transcribes it using either the Gemini Live API (cloud) or a local Whisper.cpp backend. The system includes an audio recorder that streams 16kHz PCM data, a transcription factory that selects the backend, and a response formatter that cleans up AI outputs (stripping ANSI codes, markdown, and abbreviating paths) to make them suitable for speech synthesis.

packages/core/src/voice · high confidence

Mac users now benefit from a hardened execution environment where tool commands run inside an Apple Seatbelt sandbox profile. This change introduces a strict allowlist policy that restricts file system access to the workspace and temporary directories, while explicitly blocking access to Docker and container runtime sockets and binaries to prevent container escape or unauthorized orchestration. The implementation supports dynamic path resolution, enforces read-only access to git worktrees to prevent hook-based code execution, and applies governance file protections (such as denying writes to .gitignore) even in permissive modes. Environment variable redaction is also enforced within the sandboxed context to prevent sensitive data leakage.

packages/core/src/sandbox/macos · high confidence

The ACP CLI now uses a modular command registry to expose a set of slash commands. Users can run /help to see a sorted list of available commands, /about to view version, OS, sandbox, model, auth, and IDE details, and /memory (with subcommands like inbox, show, refresh, list) to manage and review extracted memory items. Extension management is available via /extensions (list, enable, disable, install, uninstall, etc.), including automatic MCP server restarts on enable. The /restore command allows listing and restoring conversation checkpoints, while /init generates a tailored GEMINI.md file for the current workspace. These commands are implemented in packages/cli/src/acp/commands with corresponding unit tests for error paths.

packages/cli/src/acp/commands · high confidence

A new message bus in the core package now handles tool execution confirmations, routing tool calls through the policy engine to automatically allow, deny, or request user confirmation based on policy decisions. The bus supports scoped subagent derivation to prevent policy bypass and spoofing, and ensures that headless flows do not hang by automatically rejecting ASK\_USER decisions when no UI listeners are present.

packages/core/src/confirmation-bus · high confidence

The core package now includes AgentChatHistory, a durable wrapper for chat turns that supports rollback, and BaseLlmClient, a stateless client for utility LLM calls. Additionally, apiKeyCredentialStorage has been added to manage API keys with a 30-second cache to reduce redundant keychain access.

packages/core/src/core · high confidence

Adds a new CommonJS entry point (sea-launch.cjs) that bootstraps the application from a Single Executable Application (SEA) bundle. This launcher extracts embedded assets to a secure, user-specific temporary directory, sanitizes command-line arguments to handle Node.js injection quirks, and verifies the integrity of the extracted runtime files against a manifest using SHA-256 hashes before execution. A corresponding test suite (sea-launch.test.js) validates the argument sanitization, name sanitization, and integrity verification logic.

sea · high confidence

The system now uses a ClassifierStrategy to automatically route user requests to either the Flash or Pro model based on task complexity. This strategy analyzes the request and conversation history to determine if a task is simple (routed to Flash) or complex (routed to Pro), improving efficiency and performance for different types of user interactions.

packages/core/src/routing/strategies · high confidence

The CLI now supports fully customizable keyboard shortcuts, allowing users to define, modify, and remove keybindings via a configuration file. The new keybinding infrastructure parses complex modifier combinations (Ctrl, Shift, Alt, Cmd) and aliases (e.g., 'option' for Alt), and applies platform-specific defaults for actions like Undo and Redo. Users can also remove default bindings using a '-' prefix. To ensure clarity, the system formats these shortcuts for display using platform-appropriate terminology (e.g., 'Cmd' on macOS, 'Win' on Windows, 'Super' on Linux).

packages/cli/src/ui/key · high confidence

The MCP OAuth credential system now uses a \HybridTokenStorage\ implementation that attempts to store tokens in the system keychain first, automatically falling back to encrypted file storage if the keychain is unavailable or explicitly forced via the \GEMINI\_FORCE\_ENCRYPTED\_FILE\_STORAGE\ environment variable. This change introduces a new \BaseTokenStorage\ abstraction, \KeychainTokenStorage\ for secure OS-level storage, and \HybridTokenStorage\ to manage the selection logic and telemetry reporting. Users benefit from improved security when a keychain is available, while maintaining reliability through the encrypted file fallback.

packages/core/src/mcp/token-storage · high confidence

The VS Code companion extension now supports viewing and accepting code changes directly within the IDE via a new \DiffManager\ and \DiffContentProvider\. This feature introduces a custom \gemini-diff\ URI scheme to render diffs, registers commands to open, accept, and cancel these views, and ensures that terminal focus is preserved when a diff is accepted. The extension also includes an \OpenFilesManager\ to track active files and context, and an \IDEServer\ that handles authentication, CORS, and host validation while writing connection details to a port file.

packages/vscode-ide-companion/src · high confidence

The Linux sandbox implementation has been replaced with a new architecture that utilizes Bubblewrap (bwrap) for containerization and a custom seccomp-BPF filter to restrict system calls (specifically blocking ptrace). This change introduces a dedicated LinuxSandboxManager and bwrapArgsBuilder to handle command preparation, path resolution, and governance file protection, ensuring that commands run in a strictly isolated environment with read-only workspace access by default and explicit write permissions only where granted.

packages/core/src/sandbox/linux · high confidence

The Gemini CLI now includes a complete implementation of the Agent Client Protocol (ACP), allowing external clients like IDE extensions to communicate with the agent via a structured JSON-RPC interface. This change introduces a modularized architecture in \packages/cli/src/acp\ featuring specialized modules for RPC dispatching (\acpRpcDispatcher.ts\), session management (\acpSessionManager.ts\), and individual session handling (\acpSession.ts\). Key capabilities include support for multi-session state, session resumption, slash command interception (e.g., \/memory\, \/init\), and a file system service that respects workspace boundaries and IDE permissions. The implementation also integrates the PolicyEngine to prevent deadlocks during tool approval and provides robust error handling and authentication methods (Google Login, API Key, Vertex AI, Gateway) for external clients.

packages/cli/src/acp · high confidence

The Gemini CLI now includes dedicated command groups for managing extensions, agent skills, MCP servers, local Gemma models, and hooks. Users can manage extensions via \gemini extensions\ (with subcommands for install, uninstall, list, update, enable, disable, link, new, validate, and configure), manage agent skills via \gemini skills\ (list, enable, disable, install, link, uninstall), manage MCP servers via \gemini mcp\ (add, remove, list, enable, disable), control local Gemma models via \gemini gemma\ (setup, start, stop, status, logs), and manage hooks via \gemini hooks\ (migrate). These commands are registered as yargs command modules with aliases (e.g., \extension\, \skill\, \hook\) and require a subcommand to execute.

packages/cli/src/commands · high confidence

The CLI now includes a comprehensive set of commands for managing extensions, including \install\ (with folder trust enforcement and consent handling), \link\ for local development, \enable\/\disable\ with user or workspace scoping, \list\ (supporting JSON output), \config\ for setting extension-specific values, and \new\ for scaffolding new extensions. These commands provide users with full control over installing, configuring, and enabling/disabling extensions directly from the command line.

packages/cli/src/commands/extensions · high confidence

The \gemini mcp\ command group now includes \add\, \remove\, \list\, \enable\, and \disable\ subcommands, allowing users to fully manage Model Context Protocol servers from the terminal. The \add\ command supports configuring stdio, SSE, and HTTP transports with options for environment variables, HTTP headers, timeouts, and tool filtering, while \remove\ deletes server definitions from user or project settings. The \list\ command displays configured servers with their connection status and respects admin allowlists and folder trust requirements. Additionally, \enable\ and \disable\ commands allow users to toggle server availability, including session-only toggles, while respecting administrator-configured allowlists and exclusion lists.

packages/cli/src/commands/mcp · high confidence

The CLI now includes a full set of commands for managing agent skills: \install\ (from a git URL or local path, with optional \--scope\ and \--consent\ flags), \uninstall\ (by name, with optional \--scope\), \link\ (from a local path, with optional \--scope\ and \--consent\), \enable\ (by name), \disable\ (by name, with optional \--scope\), and \list\ (with an optional \--all\ flag to include built-in skills). These commands allow users to control skill availability and configuration at both user and workspace scopes, with security consent prompts for install and link operations.

packages/cli/src/commands/skills · high confidence

The CLI now displays a comprehensive set of tips covering settings, keyboard shortcuts, and commands to help users discover features, and introduces a new collection of witty loading phrases shown during processing to improve the user experience.

packages/cli/src/ui/constants · high confidence

The CLI now includes dedicated UI components to display the status and details of local and remote agents, saved conversation checkpoints, installed and registry extensions (including install, link, and update workflows), and MCP server configurations with tool and resource listings. These views provide structured, color-coded status indicators and interactive keybindings for managing extensions and navigating agent/MCP states directly within the terminal interface.

packages/cli/src/ui/components/views · high confidence

This change introduces new infrastructure files in the .gcp directory to support local development workflows and CI/CD pipelines. It adds a Dockerfile and dockerignore for a development environment that installs specific tooling (Node.js 20, Python, linters like actionlint and shellcheck, and global npm packages including the Gemini CLI). It also defines Cloud Build configurations: development-worker.yml builds and pushes development Docker images to Artifact Registry based on branch names, while release-docker.yml handles building and publishing sandbox container images for releases, determining tags from version strings or commit SHAs.

.gcp · high confidence

A new integrated developer tools package has been added to Gemini CLI, providing a Chrome DevTools-like interface for inspecting network requests and console output. When the \general.devtools\ setting is enabled, the CLI automatically launches a local server on port 25417 that streams real-time logs via WebSocket and Server-Sent Events (SSE) to a React-based UI. This feature supports multiple CLI sessions, allows importing and exporting session logs as JSONL files, and includes a debugger trigger endpoint for debugging specific sessions.

packages/devtools · high confidence

Users can now authenticate to MCP servers using Google Application Default Credentials (ADC) or Service Account Impersonation. The new GoogleCredentialProvider automatically retrieves access tokens from the local Google auth environment, caching them to avoid redundant calls, and injects the X-Goog-User-Project header for quota tracking while enforcing strict host allowlisting (googleapis.com and luci.app). The ServiceAccountImpersonationProvider enables authentication to Cloud Run services protected by Identity-Aware Proxy (IAP) by dynamically generating ID tokens for a specified service account. Both providers implement the new McpAuthProvider interface, which extends the standard OAuth client provider to support custom request headers.

packages/core/src/mcp · high confidence

This change introduces the foundational files for the IDE integration feature within the core package. It adds a new \detect-ide.ts\ module that identifies the running IDE (such as VS Code, Cursor, JetBrains, Zed, and others) based on environment variables and process information, along with a corresponding test suite. It also introduces \ide-client.ts\ to manage the connection to the IDE server via HTTP or stdio transports, \ide-installer.ts\ to handle the installation of the companion extension, and \ide-connection-utils.ts\ for managing connection configuration files and workspace path validation. Additionally, \constants.ts\ defines key limits and timeouts, while \ideContext.ts\ provides a store for managing the active IDE context (open files, selection) with subscriber notifications.

packages/core/src/ide · high confidence

The CLI now includes dedicated UI components for managing agent settings, handling admin configuration changes, and displaying session details. The AgentConfigDialog allows users to configure specific agent parameters such as model, temperature, and execution limits. The AdminSettingsChangedDialog prompts users to restart the session when admin settings are updated. Additionally, the AboutBox provides a detailed view of the CLI version, git commit, model, sandbox environment, OS, and authentication details.

packages/cli/src/ui/components · high confidence

The \packages/cli/src/ui/utils\ directory now includes new components and utilities to enhance the terminal interface. A \CodeColorizer\ provides syntax highlighting for code blocks using the \lowlight\ library and theme-aware colors. A \MarkdownDisplay\ component renders structured markdown content, including tables, lists, and code blocks, with support for raw markdown viewing. A \TableRenderer\ handles the layout and wrapping of markdown tables within the terminal width. Additionally, a \ConsolePatcher\ utility intercepts console output to route messages through a centralized event system, improving logging consistency and allowing for better control over output in interactive versus non-interactive modes.

packages/cli/src/ui/utils · high confidence

The agent core now introduces a new \AgentSession\ abstraction that wraps the underlying protocol to provide a convenient \AsyncIterable\ API for consuming agent activity, including features like event replay and stream filtering. To support this, a new \event-translator\ converts raw Gemini stream events into a unified \AgentEvent\ format, and \content-utils\ handles the bidirectional conversion between Gemini API parts and framework-agnostic content types. A \LegacyAgentSession\ is also provided to adapt the existing Gemini client and scheduler loop to this new interface, ensuring backward compatibility while the system migrates to the consolidated agent protocol.

packages/core/src/agent · high confidence

A new 'async-pr-review' skill has been added to the Gemini CLI, enabling users to initiate asynchronous, background reviews of Pull Requests. This feature introduces a workflow where the AI spawns background shell jobs to perform preflight checks, execute test plans, and conduct comprehensive code reviews using custom prompts, all while avoiding interference with the user's main workspace through ephemeral git worktrees. The skill includes scripts to start the review process and check its status, providing users with a non-blocking way to leverage AI for deeper code analysis and testing without halting their current work.

.gemini/skills/async-pr-review · high confidence

Added two new scripts in packages/core/scripts: bundle-browser-mcp.mjs, which bundles the chrome-devtools-mcp library using esbuild, excludes specific tools based on a manifest, copies necessary third-party assets, and sanitizes hardcoded Google CrUX API keys by replacing them with runtime environment variable lookups; and compile-windows-sandbox.js, which compiles the native Windows sandbox helper (GeminiSandbox.exe) from C\# source using the system C\# compiler on Windows platforms to support native restricted token sandboxing.

packages/core/scripts · high confidence

The scripts directory now includes a comprehensive suite of new automation tools: build.js and build\_binary.js handle workspace compilation, SEA bundling, and platform-specific binary signing; build\_sandbox.js and build\_vscode\_companion.js manage container image and VSIX packaging; check-build-status.js and check-lockfile.js provide pre-flight validation for source changes and dependency integrity (including a specific check for the gaxios stream corruption bug); and a new set of evaluation scripts (aggregate\_evals.js, compare\_evals.js, changed\_prompt.js) automates the collection, comparison, and reporting of nightly and PR-based test results against historical baselines.

scripts · high confidence

Added two new built-in skills to the core package: 'antigravity-support', which provides documentation and migration instructions for the Antigravity CLI, and 'skill-creator', which guides users in building new skills. The skill-creator includes bundled CommonJS scripts (init\_skill, package\_skill, validate\_skill) to automate the creation, validation, and packaging of skill directories into distributable .skill files.

packages/core/src/skills/builtin · high confidence

The context management system has been restructured into a modular, profile-driven architecture. Users can now configure context handling via declarative sidecar JSON files that define token budgets and processor pipelines (such as tool masking, node distillation, and state snapshots) through a unified schema. This change introduces a new \AgentHistoryProvider\ for managing conversation history with token-aware truncation and summarization, and a \ContextCompressionService\ that intelligently compresses file contents in the chat history based on recency and usage patterns to save tokens. The system also includes a \ChatCompressionService\ for general history compression and a \ContextProcessorRegistry\ to validate and manage these configuration profiles.

packages/core/src/context · high confidence

The core package now includes a new command framework (types.ts) and dedicated command implementations for managing extensions, initializing projects, handling memory, and restoring checkpoints. Users can now list installed extensions via the new extensions command, initialize a project with a GEMINI.md file via the init command, view and refresh project memory and list memory files via the memory command, and restore a project to a previous state via the restore command. Comprehensive unit tests have been added for all these new commands to ensure correct behavior.

packages/core/src/commands · high confidence

The tools package introduces the \ActivateSkill\ tool, which allows users to enable specialized agent skills and load their bundled resources into the workspace context, and the \AskUser\ tool, which enables the agent to present multi-question prompts (text, choice, and multi-line) to the user for interactive clarification. Additionally, a new \ResourceRegistry\ has been added to the core resources module to track and query MCP server-discovered resources, supporting server-scoped storage and URI-based lookups.

packages/core/src/tools · high confidence

The core package introduces several new utility modules to standardize internal operations. The \apiConversionUtils\ module provides a \convertToRestPayload\ function that transforms SDK \GenerateContentParameters\ objects into REST API payloads, handling the normalization of system instructions and the separation of hyperparameters from capabilities. The \atCommandUtils\ module adds a \resolveAtCommandPath\ function that safely resolves \@-command\ file paths within workspace boundaries, including logic to extract valid paths from noisy log fragments. Additionally, \agent-sanitization-utils\ introduces functions to redact sensitive data (such as PEM keys, API tokens, and passwords) from error messages, tool arguments, and LLM thought content, using a safe iterative approach to prevent ReDoS vulnerabilities.

packages/core/src/utils · high confidence

The CLI now ships with several new extension examples that demonstrate advanced capabilities. The \themes-example\ shows how to define custom UI themes via the \themes\ field in \gemini-extension.json\. The \policies\ example demonstrates the Policy Engine, using \.toml\ files to enforce rules like requiring user confirmation for \rm -rf\ or denying access to sensitive files. The \hooks\ example illustrates how to run scripts on session start using the \hooks\ configuration. Additionally, the \mcp-server\ example provides a template for building extensions that expose tools and prompts via the Model Context Protocol (MCP), while \custom-commands\ and \skills\ examples show basic command and skill structures.

packages/cli/src/commands/extensions/examples · high confidence

The CLI now uses a dedicated set of modules in \packages/cli/src/config/extensions\ to handle extension lifecycle tasks. This includes a consent system (\consent.ts\) that prompts users before installing extensions or agent skills, an enablement manager (\extensionEnablement.ts\) that allows extensions to be enabled or disabled per workspace path, and a settings handler (\extensionSettings.ts\) that prompts for and stores per-extension configuration (including sensitive values in the system keychain). The update flow (\extensionUpdates.ts\) and GitHub integration (\github.ts\) have been consolidated to manage installation, updates, and integrity verification. Comprehensive test suites have been added for all these components to ensure correct behavior across platforms.

packages/cli/src/config/extensions · high confidence

This change introduces the \FolderTrustDiscoveryService\ to safely scan workspace directories for commands, skills, agents, and settings before trust is granted, including security warnings for sensitive configurations. It also adds the \ChatRecordingService\ and its associated types to persist conversation history to JSONL files, supporting session resumption and rewind functionality. Additionally, the \ExecutionLifecycleService\ is introduced to manage the backgrounding and lifecycle of shell and tool executions, while \environmentSanitization\ is added to redact sensitive credentials from process environments. The diff is accompanied by extensive test suites for all these new services.

packages/core/src/services · high confidence

Added two new demonstration applications in the CLI examples package: an AskUserDialog demo that showcases interactive question-and-answer flows (including multi-select, text, and yes/no inputs) and a ScrollableList demo that demonstrates high-performance scrolling through large datasets with mouse wheel support, dynamic item addition/editing, and keyboard shortcuts.

packages/cli/examples · high confidence

The CLI now includes two new interactive UI components for issue triage: TriageDuplicates and TriageIssues. TriageDuplicates helps users identify and manage duplicate GitHub issues by displaying candidate issues, their duplicate status, and LLM-generated recommendations for merging or closing. TriageIssues provides a workflow for reviewing open issues labeled 'status/need-triage', using LLM analysis to suggest closing bogus, non-reproducible, or out-of-scope issues, with the ability to edit and submit suggested comments. Both components feature keyboard navigation, history tracking, and real-time analysis status.

packages/cli/src/ui/components/triage · high confidence

Added \DefaultAppLayout\ and \ScreenReaderAppLayout\ components to structure the CLI interface, along with unit tests for the default layout. The default layout conditionally renders the \BackgroundTaskDisplay\ only when a background task is active and the streaming state is not \WaitingForConfirmation\, and adjusts terminal height/padding for alternate buffer mode. The screen-reader layout provides a simplified structure with notifications, footer, main content, and composer/dialog management.

packages/cli/src/ui/layouts · high confidence

The CLI now displays dedicated status messages for the /compress and /export-session commands, showing progress spinners and final statistics (e.g., token reduction or file path). Tool results are rendered using a new DenseToolMessage component that provides a compact, structured view with clear status indicators (Confirming, Accepted, Rejected) and diff statistics, while the DiffRenderer component handles syntax-highlighted diffs for file changes. Additional UI updates include HintMessage for steering suggestions, ModelMessage to identify the responding model, and GeminiMessageContent to split long responses for better performance.

packages/cli/src/ui/components/messages · high confidence

The \scripts/releasing\ directory now includes four new Node.js scripts that automate the patch release process. \create-patch-pr.js\ handles the initial cherry-pick, creating release and hotfix branches (including PR numbers in branch names) and managing conflict markers. \patch-trigger.js\ detects the target channel (stable or preview) from branch names and dispatches the subsequent release workflow. \patch-create-comment.js\ and \patch-comment.js\ provide user feedback by posting status updates to the original pull request, covering success, failure, and specific edge cases like GitHub App permission errors or concurrent release race conditions.

scripts/releasing · high confidence

The CLI now displays specific privacy notices based on the user's authentication method: a Gemini API Key notice for direct API usage, a Vertex AI notice for enterprise/Google Cloud accounts, and a Cloud Free notice for personal Google accounts that includes a data collection opt-in prompt. These screens are rendered via the new \PrivacyNotice\ component and its sub-components (\GeminiPrivacyNotice\, \CloudPaidPrivacyNotice\, \CloudFreePrivacyNotice\), all of which support exiting via the Escape key. Comprehensive test coverage has been added for these components to verify correct rendering and key handling.

packages/cli/src/ui/privacy · high confidence

Added three new Node.js scripts to the \packages/vscode-ide-companion/scripts\ directory. \check-vscode-release.js\ automates the release process by comparing the latest signed VSIX in the GCS bucket against the current \main\ branch to detect new commits or dependency changes. \generate-notices.js\ creates a \NOTICES.txt\ file by recursively collecting license information for all direct and transitive dependencies listed in \package-lock.json\. \run-integration-tests.js\ provides a standardized way to execute integration tests using \@vscode/test-electron\.

packages/vscode-ide-companion/scripts · high confidence

The core safety module now includes a new safety checker framework that introduces an \AllowedPathChecker\ to validate file paths against workspace boundaries, denying access to paths outside allowed directories or those using symlinks to escape. It also enforces case-insensitive blocking of sensitive path segments and requires explicit user confirmation for modifications to \.vscode\ configuration files. Additionally, a new \ConsecaSafetyChecker\ has been added, which uses an LLM to generate and enforce fine-grained security policies based on user prompts and trusted tool context, providing a dynamic, AI-driven layer of safety for tool calls.

packages/core/src/safety · high confidence

Added a suite of new shared UI components and their corresponding tests in the CLI interface: BaseSelectionList and DescriptiveRadioButtonSelect for generic and descriptive radio-style selection lists; BaseSettingsDialog for a unified settings interface with search, scope selection, and inline editing; EnumSelector for left-right scrolling enum values; ExpandableText for truncating and highlighting long text with match windows; HalfLinePaddedBox for half-line padding with background blending; HorizontalLine for styled dividers; and DialogFooter for consistent shortcut hints. These components provide reusable, theme-aware building blocks for CLI dialogs and lists, with tests validating rendering, keyboard navigation, and edge cases.

packages/cli/src/ui/components/shared · high confidence

Added a new 'pr-address-comments' skill that assists users in reviewing and responding to feedback on their Pull Requests. This skill includes a new SKILL.md definition and a fetch-pr-info.js script that gathers PR metadata, diffs, commit history, and inline review threads via the GitHub CLI, presenting a structured summary of open comments and review statuses for the user to address.

.gemini/skills/pr-address-comments · high confidence

Added a suite of new utility modules in \scripts/utils\ to power the eval reporting and validation infrastructure. \eval-analysis.ts\ introduces a static source analyzer that parses eval files to extract test cases, policies, and tool references, emitting diagnostics for unresolved values. \eval-inventory.ts\ aggregates these analyses across the repository to generate a comprehensive inventory of eval cases. \eval-coverage.ts\ cross-references this inventory against the \tool-registry.ts\ (which now includes custom tool definitions and legacy alias resolution) to calculate coverage percentages and identify uncovered tools. \eval-validate.ts\ enforces coding standards via rules such as file naming, policy validity, and prompt presence. \eval-report.ts\ provides logic to scan for and summarize \report.json\ files by model and pass rate, while \tool-log-formatter.ts\ formats tool execution logs for display, and \autogen.ts\ provides helper functions for documentation generation.

scripts/utils · high confidence

The telemetry subsystem in the core package has been expanded with new capabilities to support advanced observability. An activity detector and monitor have been introduced to track user interaction states and trigger memory snapshots based on configurable idle thresholds and event types. Billing telemetry now includes specific events for AI credit usage, overage handling, and wallet management. Additionally, a Conseca security logger has been added to record policy generation and verdicts, and performance monitoring now includes an event loop delay monitor to track Node.js runtime health. These changes are accompanied by comprehensive test coverage for the new modules.

packages/core/src/telemetry · high confidence

The test-utils package now includes dedicated harnesses for running CPU performance and memory usage tests, complete with baseline comparison, tolerance checks, and ASCII chart reporting. It also provides utilities to isolate the test environment by redirecting configuration and telemetry to temporary directories, and introduces a builder for creating mock MCP servers to support integration testing.

packages/test-utils/src · high confidence

Added a new \test-utils\ module in \packages/core/src/test-utils\ providing standardized helpers for unit testing, including \MockMessageBus\ for simulating event-driven communication, \MockTool\ and \MockModifiableTool\ for testing tool execution and confirmation flows, \createMockWorkspaceContext\ for workspace path resolution, and \makeFakeConfig\ for generating test configurations.

packages/core/src/test-utils · high confidence

This change introduces a complete evaluation suite for the Gemini CLI Triage Worker located in \tools/caretaker-agent/evals/triage\. It adds a benchmark runner (\runner.py\) that executes parallel evaluations using isolated Git worktrees, a judge module (\judge.py\ and \judge.md\) that grades candidate Workable Specs against ground-truth Golden Specs using a 4-criterion rubric, and helper tools for dataset management including Firestore sync (\helpers/dataset.py\, \tools/sync\_firestore.py\) and golden spec generation (\tools/generate\_golden\_issue.py\). A new Cloud Run job entrypoint (\cloud\_runner.py\) allows the suite to be executed in a containerized environment, syncing results to GCS.

tools/caretaker-agent/evals · high confidence

The CLI now includes dedicated utility modules in \packages/cli/src/utils\ to manage agent enablement and disablement via settings overrides, parse slash commands with support for aliases and subcommand backtracking, and handle graceful process exit cleanup including stdin draining and telemetry shutdown. Additionally, a new \ActivityLogger\ utility captures and buffers network and console activity for session analysis, while \commentJson\ ensures settings updates preserve existing file comments and formatting.

packages/cli/src/utils · high confidence

The core agent runtime now supports a pluggable authentication provider system for connecting to remote A2A agents. This introduces a factory-based architecture (\A2AAuthProviderFactory\) that validates agent card security schemes and instantiates the appropriate provider. Four authentication methods are now available: API Key (supporting literal, environment variable, and command-based resolution with retry on 401/403), HTTP Basic/Bearer (with dynamic token re-resolution), Google Credentials (using Application Default Credentials with strict HTTPS enforcement and host allowlisting for \googleapis.com\ and \run.app\), and OAuth 2.0 Authorization Code flow with PKCE (including interactive browser login, token caching, and automatic refresh). A base provider class standardizes retry logic across all types, limiting authentication retries to two attempts to prevent infinite loops.

packages/core/src/agents/auth-provider · high confidence

The Windows sandbox now uses a native C\# helper (GeminiSandbox.exe) with Restricted Tokens, Job Objects, and Mandatory Integrity Control to isolate processes, replacing previous PowerShell-based approaches. This includes support for internal \_\read/\\_write commands for safe file I/O, explicit forbidden/allowed path manifests, and denial detection for file and network access errors. Command safety checks now validate that commands stay within the workspace, resolve symlinks, and handle Windows-specific path escaping.

packages/core/src/sandbox/windows · high confidence

The file system tools (Edit, Glob, Grep, LS, ReadFile, WriteFile) and the Terminal tool, along with their shared base classes (BaseTool, Tool, ToolResult) and the tool registry, have been removed from the CLI package. This deletion eliminates the existing capabilities for file manipulation, directory listing, content searching, and command execution within the CLI.

packages/cli/src/tools · high confidence

The A2A server now enforces a fail-closed security model for workspace trust. Environment variables from untrusted workspaces (such as GEMINI\_CLI\_TRUST\_WORKSPACE, GEMINI\_YOLO\_MODE, and API keys) are strictly ignored, and sensitive configuration settings—including MCP servers, policy paths, allowed tools, and telemetry endpoints—are stripped from the configuration when the workspace is not trusted. Additionally, the server now isolates environment variables per task using a proxy, preventing global pollution and ensuring that changes in one task do not affect others.

packages/a2a-server/src/config · high confidence

This change adds a new set of utility modules in \packages/core/src/sandbox/utils\ to harden sandbox execution and improve user experience. \commandSafety.ts\ and its tests enforce strict path validation for commands like ripgrep (requiring absolute, trusted system paths) and prevent workspace escape by blocking arguments that traverse outside the workspace or resolve via symlinks to external directories. \sandboxDenialUtils.ts\ introduces robust parsing of POSIX-style sandbox denials (file and network), extracting specific denied paths while sanitizing inputs to block directory traversal and null-byte attacks. \proactivePermissions.ts\ automatically suggests necessary file system and network permissions for network-reliant tools (npm, git, ssh, etc.) based on their configuration and cache directories. Additionally, \fsUtils.ts\ adds secure resolution of Git worktree paths with bidirectional link verification to prevent sandbox escapes, and \sandboxReadWriteUtils.ts\ implements safe \\_\read\ and \\\_write\ internal commands with path validation.

packages/core/src/sandbox/utils · high confidence

The configuration layer now encapsulates the execution-scoped view of the world for a single agent turn or sub-agent loop via the new AgentLoopContext interface. This context object aggregates the global runtime configuration, the unique prompt ID, the parent session ID (for sub-agents), and the specific registries for tools, prompts, and resources, along with the message bus, Gemini client, and sandbox manager. This change decouples the agent's execution state from the global configuration, allowing for isolated and scoped agent loops.

packages/core/src/config · high confidence

The core tool scheduler has been restructured into distinct, focused modules to improve maintainability and support event-driven execution. The main orchestrator is now in \scheduler.ts\, which coordinates tool execution using a new \SchedulerStateManager\ for reactive state tracking and a \ToolExecutor\ for actual execution. Policy checks and updates are handled by the new \policy.ts\ module, which supports custom deny messages and context-aware approvals. Tool confirmation logic, including user modifications via editors, is isolated in \confirmation.ts\. Additionally, \hook-utils.ts\ centralizes the evaluation of \BeforeTool\ hooks, allowing them to block, ask, or modify tool arguments. This modularization replaces the previous monolithic scheduler implementation.

packages/core/src/scheduler · high confidence

A change to existing behaviour in packages/core/vendor — 1 commit, 5 files.

packages/core/vendor · medium confidence · unverified

The A2A server's agent execution logic has been restructured to use an event-driven tool scheduler, replacing the previous callback-based approach. This change introduces a new \CoderAgentExecutor\ and \Task\ implementation that manages task state, tool confirmations, and execution loops via an event bus, improving reliability and status reporting. The update includes specific fixes for race conditions during tool completion waiting and task cancellation, ensuring that concurrent tool scheduling and confirmations are handled correctly without hanging or failing. Additionally, the executor now properly distinguishes between primary and secondary execution contexts and supports event-driven task reconstruction from persisted state.

packages/a2a-server/src/agent · high confidence

The core now discovers and manages Agent Skills from built-in, extension, user, and workspace locations with a strict precedence order (Workspace \> User \> Extension). It introduces a \.agents/skills\ directory alias that takes precedence over the legacy \.gemini/skills\ path at the same scope. To prevent silent overrides, the system detects and warns when a skill definition from a higher-precedence location conflicts with an existing one. Additionally, the frontmatter parser now robustly handles colons and multi-line descriptions in skill metadata, and workspace-level skills are only loaded when the folder is trusted.

packages/core/src/skills · high confidence

The built-in theme files in the CLI are now organized into dedicated \dark/\ and \light/\ subdirectories within the \builtin\ folder. This structural change groups themes by their visual mode, making it easier to locate and manage the available color schemes (such as Atom One, Dracula, GitHub Dark, and Solarized) without them being mixed together in a single flat directory.

packages/cli/src/ui/themes · high confidence

Core tool definitions are now centralized in a single location, organized by model family (default-legacy and Gemini 3) to allow model-specific optimizations of tool descriptions and schemas. The system resolves the correct toolset based on the model ID, enabling tailored behavior for different AI models while maintaining a unified interface. To ensure these definitions remain accurate and consistent, comprehensive snapshot tests have been added to verify the resolved tool schemas for specific models like gemini-2.5-pro and gemini-3-pro-preview.

packages/core/src/tools/definitions · high confidence

A new pre-commit hook has been added to the development workflow to automatically run formatting and linting checks before every commit. If these checks fail, the commit is blocked, and a clear error message is displayed to the user, including instructions on how to bypass the check in an emergency using \git commit --no-verify\.

.husky · high confidence

The \packages/core\ directory now includes its own \tsconfig.json\, \vitest.config.ts\, and \test-setup.ts\, enabling independent compilation and testing without relying on the root project configuration. A new \index.ts\ entry point explicitly exports core modules (such as model constants, IDE detection, and telemetry types), and a \GEMINI.md\ file documents the package's architecture and coding conventions. Additionally, a mock for \fs/promises\ is provided to support isolated unit testing.

packages/core · high confidence

The \third\_party/get-ripgrep\ module now includes the \downloadRipGrep\ script and \rgPath\ resolver, enabling the application to automatically download and cache the correct ripgrep binary (version v13.0.0-10) for the user's platform and architecture. This change provides the necessary infrastructure for detecting and using the ripgrep tool, addressing previous issues with Windows detection by standardizing the binary retrieval process.

_third\party/get-ripgrep · high confidence

The policy engine has been refactored to use a new TOML-based configuration system, replacing the previous legacy logic. This change introduces a tiered priority system (Default, Extension, Workspace, User, Admin) for loading policy rules, allowing for granular control over tool access, shell commands, and MCP servers. The engine now supports persistent 'Always Allow' policies, subagent-specific rules, and dynamic mode-aware evaluations. Additionally, a new integrity manager validates policy file hashes to detect unauthorized modifications, and sandbox permissions are now managed via dedicated TOML schemas.

packages/core/src/policy · high confidence

The \packages/core/src/availability\ directory now implements a structured fallback mechanism using \ModelPolicy\ and \ModelPolicyChain\ definitions. This change introduces a \ModelAvailabilityService\ to track model health states (terminal, sticky retry) and a \policyCatalog\ to define fallback chains (e.g., Pro → Flash). Users will experience automatic, silent fallbacks to secondary models (like Flash) when primary models (like Pro) hit quota or capacity errors, with specific retry limits (e.g., 3 attempts for Pro, 10 for Flash) and turn-based state resets to prevent infinite loops.

packages/core/src/availability · high confidence

The CLI now uses a dedicated reducer (\extensionUpdatesReducer\) to track extension update statuses, replacing previous state-handling logic. This change introduces specific states such as \UPDATED\_NEEDS\_RESTART\ and \UPDATE\_AVAILABLE\, and adds support for scheduling updates with completion callbacks. It also implements batch checking logic and ensures that notification flags are managed separately from status updates, providing a more robust foundation for the auto-update and restart features.

packages/cli/src/ui/state · high confidence

The slash commands in the CLI UI have been migrated to a new command architecture, introducing new built-in commands such as /about (displaying version, IDE, and user tier info), /agents (listing, enabling, and disabling agents), /auth (signing in and out), /bug (submitting reports with history export and heap snapshots), and /chat (managing conversation checkpoints). This change includes the implementation of these command handlers and adds extensive Vitest test coverage for the new command logic, ensuring correct behavior for user-facing features like authentication state changes, agent management, and diagnostic reporting.

packages/cli/src/ui/commands · high confidence

The CLI now uses a dedicated \initializeApp\ function to orchestrate startup, which runs authentication, theme validation, and IDE client connection before the React UI renders. Authentication errors are now handled with improved, specific messages (e.g., distinguishing between general failures and missing project IDs), and account suspension details are surfaced to the UI. Additionally, the IDE client connection is now performed in the background to speed up initialization, and the previous \GeminiClient\ and streaming logic have been removed.

packages/cli/src/core · high confidence

The core fallback mechanism in \packages/core/src/fallback\ has been refactored to use a policy-driven approach. When a model request fails, the system now classifies the error and consults a policy chain to determine available fallback candidates. If a fallback is selected, the user is presented with options (via the \FallbackModelHandler\) such as retrying once, retrying always with the new model, retrying with credits, upgrading, or stopping. Crucially, when the system automatically retries with a fallback model (\retry\_always\), it now rotates the session ID to prevent stateful API errors that can occur when switching models mid-session. The implementation also supports 'silent' policy actions where the fallback happens without user interaction, and integrates with the \ModelAvailabilityService\ to respect model access policies.

packages/core/src/fallback · high confidence

The CLI user interface has been restructured to use a set of dedicated React contexts (App, AskUserActions, Config, Input, Keypress, Mouse, Overflow, Quota, Scroll, Session, Settings, and UIState) to manage global state. This change centralizes the handling of critical user-facing concerns—including keyboard and mouse input parsing, session metrics and token usage, quota and billing limits, scroll behavior, and configuration—into a unified state management layer. For the user, this provides a more stable and responsive interface by decoupling UI rendering from complex event handling and ensuring consistent state propagation across the application.

packages/cli/src/ui/contexts · high confidence

The authentication UI in the CLI has been refactored into distinct, reusable React components—ApiAuthDialog, AuthDialog, AuthInProgress, BannedAccountDialog, and LoginRestartDialog—each with dedicated unit tests. This change introduces a more structured flow for API key entry, Google sign-in, account suspension handling, and session restarts, while ensuring robust error handling and keypress interactions for each dialog.

packages/cli/src/ui/auth · high confidence

The CLI now includes local patches to resolve compatibility issues with external dependencies. Patches for http-proxy-agent and https-proxy-agent ensure the correct constructor is resolved across different module systems (CommonJS vs ESM), preventing runtime errors when proxy agents are used. Additionally, a patch for the is-in-ci package forces a false return value to prevent the ink UI library from incorrectly detecting a CI environment, ensuring the interactive CLI interface renders correctly.

packages/cli/src/patches · high confidence

Add memory regression test harness and baselines for the CLI; Add tests for @-command processing and credits flow handling; Add tests for CLI configuration and authentication validation; Added SVG snapshot tests for CLI rendering utilities; Added comprehensive test coverage for UI components and core container logic; Added integration tests for model steering hints; Added snapshot tests for CLI extension consent strings; Added snapshot tests for non-interactive CLI streaming JSON output; Added snapshot tests for tool output masking service; Added test fixtures for steering hints and simple responses; Added test snapshots for shared UI components; Added tests for release, eval, and documentation utilities; Added visual regression and snapshot tests for CLI message components; Introduce CPU performance regression testing harness; New billing logic and expanded test coverage for Code Assist; New integration tests for ACP, browser agent, and API resilience; New prompt infrastructure and expanded test coverage for system prompt generation; New test utilities for CLI integration testing; Snapshot of Plan Mode system prompt with approval workflow and memory routing; Snapshot tests added for CLI UI components; Snapshot tests added for ReadFile and Shell tool schemas; Updated test snapshots for CLI UI components.

This release adds several new packages to the monorepo structure: the \@google/gemini-cli-a2a-server\ for Agent-to-Agent protocol communication, the \@google/gemini-cli-sdk\ for programmatic access, the \@google/gemini-cli-devtools\ for debugging, and the \gemini-cli-vscode-ide-companion\ for VS Code integration. It also introduces the \@google/gemini-cli-test-utils\ package for shared testing infrastructure and an example MCP server extension. Additionally, new Cloud Run services for the caretaker agent (egress and ingestion) and the \get-ripgrep\ third-party utility are added to support internal tooling and search capabilities.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 38 → 51 (+12.5)
• Rubric changed (rubric-2026.08.19 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 77 → 68 (-9.3)
• Architecture 21 → 62 (+40.7)
• Maturity 76 → 76 (-0.4)
• Readiness 56 → 64 (+8.2)
• Security 60 → 55 (-5.6)
• Accessibility 39 → 40 (+0.8)

• Change coupling clique: ansi-dark.ts, atom-one-dark.ts, dracula-dark.ts, github-light.ts, googlecode-light.ts, xcode-light.ts (packages/cli/src/ui/themes/builtin/dark/ansi-dark.ts)
• Change coupling: GeminiMessage.tsx ↔ GeminiMessageContent.tsx (packages/cli/src/ui/components/messages/GeminiMessage.tsx)
• Coverage not included — suite not readable by the collector
• Critical CVE: [GHSA redacted] (package-lock.json)
• Critical CVE: [GHSA redacted] (package-lock.json)
• Critical CVE: [GHSA redacted] (package-lock.json)
• Critical CVE: [GHSA redacted] (package-lock.json)
• Critical CVE: [GHSA redacted] (package-lock.json)
• Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• High CVE: [GHSA redacted] (package-lock.json)
• High CVE: [GHSA redacted] (package-lock.json)
• High CVE: [GHSA redacted] (package-lock.json)
• High CVE: [GHSA redacted] (package-lock.json)
• High CVE: [GHSA redacted] (package-lock.json)
• High CVE: [GHSA redacted] (package-lock.json)
• High CVE: [GHSA redacted] (package-lock.json)
• High CVE: [GHSA redacted] (package-lock.json)
• High CVE: [GHSA redacted] (package-lock.json)
• High CVE: [GHSA redacted] (package-lock.json)
• High CVE: [GHSA redacted] (package-lock.json)
• …and 58 more

• A2AAuthProviderFactory.findMatchingScheme (cognitive 22) (packages/core/src/agents/auth-provider/factory.ts)
• A2AResultReassembler.update (cognitive 31) (packages/core/src/agents/a2aUtils.ts)
• A2AResultReassembler.update (cyclomatic 20) (packages/core/src/agents/a2aUtils.ts)
• ActivityLogger.patchNodeHttp (cognitive 39) (packages/cli/src/utils/activityLogger.ts)
• ActivityLogger.patchNodeHttp (cyclomatic 46) (packages/cli/src/utils/activityLogger.ts)
• ActivityLogger.sanitizeNetworkLog (cognitive 16) (packages/cli/src/utils/activityLogger.ts)
• AgentConfigDialog.AgentConfigDialog (cognitive 27) (packages/cli/src/ui/components/AgentConfigDialog.tsx)
• AgentConfigDialog.AgentConfigDialog (cyclomatic 24) (packages/cli/src/ui/components/AgentConfigDialog.tsx)
• AgentRegistry.loadAgents (cognitive 38) (packages/core/src/agents/registry.ts)
• AgentRegistry.loadAgents (cyclomatic 20) (packages/core/src/agents/registry.ts)
• AgentRegistry.registerRemoteAgent (cognitive 27) (packages/core/src/agents/registry.ts)
• AgentRegistry.registerRemoteAgent (cyclomatic 24) (packages/core/src/agents/registry.ts)
• AgentRunner.run_agent (cognitive 31) (tools/caretaker-agent/cloudrun/pr-generator/workflow/agent_runner.py)
• AgentRunner.run_agent (cyclomatic 18) (tools/caretaker-agent/cloudrun/pr-generator/workflow/agent_runner.py)
• AgentSession.stream (cognitive 48) (packages/core/src/agent/agent-session.ts)
• AgentSession.stream (cyclomatic 32) (packages/core/src/agent/agent-session.ts)
• AllowedPathChecker.check (cognitive 30) (packages/core/src/safety/built-in.ts)
• AnalyzeScreenshotInvocation.execute (cognitive 20) (packages/core/src/agents/browser/analyzeScreenshot.ts)
• AnalyzeScreenshotInvocation.execute (cyclomatic 18) (packages/core/src/agents/browser/analyzeScreenshot.ts)
• App.App (cognitive 48) (packages/devtools/client/src/App.tsx)
• …and 1427 more

• 97 commits — 37 feature/other, 60 fixes

• packages/core — 33 commits
• packages/cli — 20 commits
• tools/caretaker-agent — 13 commits
• docs/changelogs — 11 commits
• (root) — 7 commits
• packages/a2a-server — 4 commits
• integration-tests/file-system-interactive.test.ts — 2 commits
• .github/actions — 1 commit
• docs/get-started — 1 commit
• docs/reference — 1 commit
• evals/test-helper.test.ts — 1 commit
• integration-tests/concurrency-limit.test.ts — 1 commit
• packages/vscode-ide-companion — 1 commit
• scripts/utils — 1 commit

• fix: (FIX) history rollback and retry nudge optimizations (#28934)
• fix: [SSR Agent] Issue Fix (19239): Update /clear command docs to include context reset (#28847)
• fix: [SSR Agent] Issue Fix (19463): Format cli_help subagent output as markdown (#28864)
• fix: [SSR Agent] Issue Fix (19826): Migrate process.env to vi.stubEnv in a2a-server tests (#28811)
• fix: [SSR Agent] Issue Fix (21477): Prevent indefinite TUI hang by adding execution timeouts (#28812)
• fix: [SSR Agent] Issue Fix (21911): Add composite flag to packages/cli tsconfig (#28813)
• fix: [SSR Agent] Issue Fix (21919): Fix TypeScript strict-null errors in integration tests (#28814)
• fix: [SSR Agent] Issue Fix (22093): Prevent subagents from running when agents mode is disabled (#28867)
• fix: [SSR Agent] Issue Fix (23954): Add trailing space to autocomplete suggestions (#28868)
• fix: [SSR Agent] Issue Fix (24587): Fix misleading admin error for personal accounts (#28819)
• fix: [SSR Agent] Issue Fix (24935): Force terminal buffer rerender after exiting external editors (#28880)
• fix: [SSR Agent] Issue Fix (26120): Clarify privacy notice wording and selection options (#28820)
• fix: [SSR Agent] Issue Fix (28050): Add Vertex AI locations documentation link (#28865)
• fix: [SSR Agent] Issue Fix (28518): Fix sub-agent handoff token regression on startup (#28882)
• fix: fix(a2a-server): add early return on unsupported store in tasks metadata endpoint (#29334)
• fix: fix(a2a-server): clear stale cancellation error on new message turns (#28940)
• fix: fix(caretaker): clear lock on NEEDS_HUMAN transition (#28601)
• fix: fix(cli): emit tool_call update prior to request_permission in ACP mode (#29439)
• fix: fix(cli): isolate settings directory in sandbox containers (#29216)
• fix: fix(cli): isolate temporary directory for macOS Seatbelt sandbox (#29171)
• …and 77 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

google-gemini/gemini-cli was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.