@google/gemini-cli-a2a-server 0.62.0-preview.0 → 0.63.0-nightly.20260928.g2fe7c2d3f

package/dist/a2a-server.mjs

@@ -66160,7 +66160,8 @@ function hasBlockedPathSegment(p2) {
   const segments = p2.split(/[/\\]/);
   for (const segment of segments) {
     const clean = trimTrailingSpacesAndDots(segment.split(":")[0]).toLowerCase();
-    if (clean === ".git" || clean === ".env" || clean === "node_modules" || GIT_SFN_REGEX.test(clean) || ENV_SFN_REGEX.test(clean) || NODE_MODULES_SFN_REGEX.test(clean)) {
+    const isEnvFile = clean === ".env" || clean.startsWith(".env.") && !SAFE_ENV_TEMPLATES.has(clean);
+    if (clean === ".git" || isEnvFile || clean === "node_modules" || GIT_SFN_REGEX.test(clean) || ENV_SFN_REGEX.test(clean) || NODE_MODULES_SFN_REGEX.test(clean)) {
       return true;
     }
     if (clean.startsWith("gha-creds-") && clean.endsWith(".json") || GHA_CREDS_SFN_REGEX.test(clean)) {
@@ -66169,16 +66170,22 @@ function hasBlockedPathSegment(p2) {
   }
   return false;
 }
-var GEMINI_DIR, GOOGLE_ACCOUNTS_FILENAME, GIT_SFN_REGEX, ENV_SFN_REGEX, NODE_MODULES_SFN_REGEX, GHA_CREDS_SFN_REGEX;
+var GEMINI_DIR, GOOGLE_ACCOUNTS_FILENAME, GIT_SFN_REGEX, ENV_SFN_REGEX, NODE_MODULES_SFN_REGEX, GHA_CREDS_SFN_REGEX, SAFE_ENV_TEMPLATES;
 var init_paths = __esm({
   "packages/core/dist/src/utils/paths.js"() {
     "use strict";
     GEMINI_DIR = ".gemini";
     GOOGLE_ACCOUNTS_FILENAME = "google_accounts.json";
     GIT_SFN_REGEX = /^(git|gi[0-9a-f]{4})~\d+$/;
-    ENV_SFN_REGEX = /^(env|en[0-9a-f]{4})~\d+$/;
+    ENV_SFN_REGEX = /^(env|en[0-9a-f]{4})~\d+(\..+)?$/i;
     NODE_MODULES_SFN_REGEX = /^(node_m|no[0-9a-f]{4})~\d+$/;
     GHA_CREDS_SFN_REGEX = /^(gha-cr|gh[0-9a-f]{4})~\d+\.jso(n)?$/;
+    SAFE_ENV_TEMPLATES = /* @__PURE__ */ new Set([
+      ".env.example",
+      ".env.sample",
+      ".env.template",
+      ".env.dist"
+    ]);
   }
 });
 
@@ -68266,7 +68273,7 @@ var init_ignorePatterns = __esm({
 });
 
 // packages/core/dist/src/utils/constants.js
-var REFERENCE_CONTENT_END, DEFAULT_MAX_LINES_TEXT_FILE, MAX_LINE_LENGTH_TEXT_FILE, MAX_FILE_SIZE_MB;
+var REFERENCE_CONTENT_END, DEFAULT_MAX_LINES_TEXT_FILE, MAX_LINE_LENGTH_TEXT_FILE, MAX_FILE_SIZE_MB, MAX_STORED_TOOL_OUTPUT_BYTES;
 var init_constants = __esm({
   "packages/core/dist/src/utils/constants.js"() {
     "use strict";
@@ -68274,6 +68281,7 @@ var init_constants = __esm({
     DEFAULT_MAX_LINES_TEXT_FILE = 2e3;
     MAX_LINE_LENGTH_TEXT_FILE = 2e3;
     MAX_FILE_SIZE_MB = 20;
+    MAX_STORED_TOOL_OUTPUT_BYTES = 64 * 1024;
   }
 });
 
@@ -68354,8 +68362,41 @@ function decodeUTF32(buf, littleEndian) {
   }
   return out2;
 }
-async function readFileWithEncoding(filePath) {
-  const full = await fs10.promises.readFile(filePath);
+async function readSecureFileBuffer(filePath, expectedStats) {
+  const initialStats = expectedStats ?? await fs10.promises.stat(filePath);
+  let fileHandle;
+  try {
+    if (typeof fs10.promises.open === "function") {
+      try {
+        fileHandle = await fs10.promises.open(filePath, "r");
+      } catch {
+      }
+      if (fileHandle && typeof fileHandle.stat === "function") {
+        const handleStats = await fileHandle.stat();
+        if (initialStats.dev !== void 0 && initialStats.ino !== void 0 && handleStats && handleStats.dev !== void 0 && handleStats.ino !== void 0 && (initialStats.dev !== handleStats.dev || initialStats.ino !== handleStats.ino)) {
+          throw new Error(`File device or inode changed during read: ${filePath}`);
+        }
+      }
+    }
+    const contentBuffer = fileHandle ? await fileHandle.readFile() : await fs10.promises.readFile(filePath);
+    let postStats;
+    try {
+      postStats = await fs10.promises.stat(filePath);
+    } catch {
+    }
+    if (postStats && initialStats.dev !== void 0 && initialStats.ino !== void 0 && postStats.dev !== void 0 && postStats.ino !== void 0 && (initialStats.dev !== postStats.dev || initialStats.ino !== postStats.ino)) {
+      throw new Error(`File device or inode changed during read: ${filePath}`);
+    }
+    return contentBuffer;
+  } finally {
+    if (fileHandle) {
+      await fileHandle.close().catch(() => {
+      });
+    }
+  }
+}
+async function readFileWithEncoding(filePath, expectedStats) {
+  const full = await readSecureFileBuffer(filePath, expectedStats);
   if (full.length === 0)
     return "";
   const bom = detectBOM(full);
@@ -68554,14 +68595,14 @@ async function processSingleFileContent(filePath, rootDirectory, _fileSystemServ
             returnDisplay: `Skipped large SVG file (>1MB): ${relativePathForDisplay}`
           };
         }
-        const content = await readFileWithEncoding(filePath);
+        const content = await readFileWithEncoding(filePath, stats);
         return {
           llmContent: content,
           returnDisplay: `Read SVG as text: ${relativePathForDisplay}`
         };
       }
       case "text": {
-        const content = await readFileWithEncoding(filePath);
+        const content = await readFileWithEncoding(filePath, stats);
         const lines = content.split(/\r?\n/);
         const originalLineCount = lines.length;
         let sliceStart = 0;
@@ -68611,7 +68652,7 @@ async function processSingleFileContent(filePath, rootDirectory, _fileSystemServ
             errorType: ToolErrorType.READ_CONTENT_FAILURE
           };
         }
-        const contentBuffer = await fs10.promises.readFile(filePath);
+        const contentBuffer = await readSecureFileBuffer(filePath, stats);
         const base64Data = contentBuffer.toString("base64");
         return {
           llmContent: {
@@ -68627,7 +68668,7 @@ async function processSingleFileContent(filePath, rootDirectory, _fileSystemServ
       case "pdf":
       case "video": {
         const mimeType = getSpecificMimeType(filePath) ?? "application/octet-stream";
-        const contentBuffer = await fs10.promises.readFile(filePath);
+        const contentBuffer = await readSecureFileBuffer(filePath, stats);
         const base64Data = contentBuffer.toString("base64");
         return {
           llmContent: {
@@ -221252,8 +221293,8 @@ var GIT_COMMIT_INFO, CLI_VERSION;
 var init_git_commit = __esm({
   "packages/core/dist/src/generated/git-commit.js"() {
     "use strict";
-    GIT_COMMIT_INFO = "f50ba8608";
-    CLI_VERSION = "0.62.0-preview.0";
+    GIT_COMMIT_INFO = "2fe7c2d3f";
+    CLI_VERSION = "0.63.0-nightly.20260928.g2fe7c2d3f";
   }
 });
 
@@ -292634,7 +292675,12 @@ var init_chatRecordingService = __esm({
             if (this.kind === "subagent") {
               filename = `${safeSessionId}.jsonl`;
             } else {
-              filename = `${SESSION_FILE_PREFIX}${timestamp2}-${safeSessionId.slice(0, 8)}.jsonl`;
+              const shortId = safeSessionId.slice(0, 8);
+              filename = `${SESSION_FILE_PREFIX}${timestamp2}-${shortId}.jsonl`;
+              let collisionIndex = 1;
+              while (fs36.existsSync(path30.join(chatsDir, filename))) {
+                filename = `${SESSION_FILE_PREFIX}${timestamp2}-${collisionIndex++}-${shortId}.jsonl`;
+              }
             }
             this.conversationFile = path30.join(chatsDir, filename);
             const directories = this.kind === "subagent" ? [
@@ -336984,7 +337030,7 @@ function getVersion() {
   }
   versionPromise = (async () => {
     const pkgJson = await getPackageJson(__dirname4);
-    return "0.62.0-preview.0";
+    return "0.63.0-nightly.20260928.g2fe7c2d3f";
   })();
   return versionPromise;
 }
@@ -344447,10 +344493,11 @@ function getSafeGitEnv(baseEnv = process.env) {
   }
   return {
     ...cleanedEnv,
+    GIT_TERMINAL_PROMPT: "0",
     GIT_CONFIG_GLOBAL: devNullPath,
     GIT_CONFIG_SYSTEM: devNullPath,
     GIT_CONFIG_NOSYSTEM: "1",
-    GIT_CONFIG_COUNT: "8",
+    GIT_CONFIG_COUNT: "7",
     GIT_CONFIG_KEY_0: "credential.helper",
     GIT_CONFIG_VALUE_0: "",
     GIT_CONFIG_KEY_1: "core.fsmonitor",
@@ -344464,9 +344511,7 @@ function getSafeGitEnv(baseEnv = process.env) {
     GIT_CONFIG_KEY_5: "core.editor",
     GIT_CONFIG_VALUE_5: "",
     GIT_CONFIG_KEY_6: "sequence.editor",
-    GIT_CONFIG_VALUE_6: "",
-    GIT_CONFIG_KEY_7: "diff.external",
-    GIT_CONFIG_VALUE_7: ""
+    GIT_CONFIG_VALUE_6: ""
   };
 }
 function isGitRepository(directory) {
@@ -344773,7 +344818,14 @@ var init_read_file = __esm({
         };
       }
       async execute(_options) {
-        const validationError = this.config.validatePathAccess(this.resolvedPath, "read");
+        const sanitizedPath = resolveDefensiveToolPath(this.params.file_path, this.config.getTargetDir());
+        let targetPathToRead = this.resolvedPath;
+        try {
+          targetPathToRead = resolveToRealPath(path53.resolve(this.config.getTargetDir(), sanitizedPath));
+        } catch {
+          targetPathToRead = path53.resolve(this.config.getTargetDir(), sanitizedPath);
+        }
+        const validationError = this.config.validatePathAccess(targetPathToRead, "read");
         if (validationError) {
           return {
             llmContent: validationError,
@@ -344784,7 +344836,7 @@ var init_read_file = __esm({
             }
           };
         }
-        const result2 = await processSingleFileContent(this.resolvedPath, this.config.getTargetDir(), this.config.getFileSystemService(), this.params.start_line, this.params.end_line);
+        const result2 = await processSingleFileContent(targetPathToRead, this.config.getTargetDir(), this.config.getFileSystemService(), this.params.start_line, this.params.end_line);
         if (result2.error) {
           return {
             llmContent: result2.llmContent,
@@ -344810,12 +344862,12 @@ ${result2.llmContent}`;
           llmContent = result2.llmContent || "";
         }
         const lines = typeof result2.llmContent === "string" ? result2.llmContent.split("\n").length : void 0;
-        const mimetype = getSpecificMimeType(this.resolvedPath);
+        const mimetype = getSpecificMimeType(targetPathToRead);
         const programming_language = getProgrammingLanguage({
-          file_path: this.resolvedPath
+          file_path: targetPathToRead
         });
-        logFileOperation(this.config, new FileOperationEvent(READ_FILE_TOOL_NAME, FileOperation.READ, lines, mimetype, path53.extname(this.resolvedPath), programming_language));
-        const jitContext = await discoverJitContext(this.config, this.resolvedPath);
+        logFileOperation(this.config, new FileOperationEvent(READ_FILE_TOOL_NAME, FileOperation.READ, lines, mimetype, path53.extname(targetPathToRead), programming_language));
+        const jitContext = await discoverJitContext(this.config, targetPathToRead);
         if (jitContext) {
           if (typeof llmContent === "string") {
             llmContent = appendJitContext(llmContent, jitContext);
@@ -344888,6 +344940,7 @@ var init_read_mcp_resource = __esm({
     init_tool_names();
     init_coreTools();
     init_tool_error();
+    init_textUtils();
     ReadMcpResourceTool = class _ReadMcpResourceTool extends BaseDeclarativeTool {
       context;
       static Name = READ_MCP_RESOURCE_TOOL_NAME;
@@ -344975,7 +345028,7 @@ var init_read_mcp_resource = __esm({
             }
           }
           return {
-            llmContent: contentText || "No content returned from resource.",
+            llmContent: contentText ? wrapUntrusted(contentText) : "No content returned from resource.",
             returnDisplay: this.resource ? `Successfully read resource "${this.resource.name}" from server "${this.resource.serverName}"` : `Successfully read resource: ${uri}`
           };
         } catch (e3) {
@@ -345003,6 +345056,7 @@ var init_list_mcp_resources = __esm({
     init_tool_names();
     init_coreTools();
     init_tool_error();
+    init_textUtils();
     ListMcpResourcesTool = class _ListMcpResourcesTool extends BaseDeclarativeTool {
       context;
       static Name = LIST_MCP_RESOURCES_TOOL_NAME;
@@ -345059,7 +345113,7 @@ var init_list_mcp_resources = __esm({
           content += "\n";
         }
         return {
-          llmContent: content,
+          llmContent: wrapUntrusted(content),
           returnDisplay: `Listed ${resources.length} resources.`
         };
       }
@@ -358115,6 +358169,7 @@ import { spawn as cpSpawn } from "node:child_process";
 import { TextDecoder as TextDecoder2 } from "node:util";
 import os31 from "node:os";
 import fs53, { mkdirSync as mkdirSync4 } from "node:fs";
+import fsPromises9 from "node:fs/promises";
 import path60 from "node:path";
 function ensurePromptvarsDisabled(command, shell) {
   if (shell !== "bash") {
@@ -358273,6 +358328,7 @@ var init_shellExecutionService = __esm({
       static activeChildProcesses = /* @__PURE__ */ new Map();
       static backgroundLogPids = /* @__PURE__ */ new Set();
       static backgroundLogStreams = /* @__PURE__ */ new Map();
+      static backgroundTempDirs = /* @__PURE__ */ new Map();
       static backgroundProcessHistory = /* @__PURE__ */ new Map();
       static getLogDir() {
         return path60.join(Storage2.getGlobalTempDir(), "background-processes");
@@ -358300,6 +358356,10 @@ ${truncated}`;
         }
       }
       static async cleanupLogStream(pid) {
+        const tempDir = this.backgroundTempDirs.get(pid);
+        this.backgroundTempDirs.delete(pid);
+        const rmPromise = tempDir ? fsPromises9.rm(tempDir, { recursive: true, force: true }).catch(() => {
+        }) : Promise.resolve();
         const stream2 = this.backgroundLogStreams.get(pid);
         if (stream2) {
           await new Promise((resolve23) => {
@@ -358308,6 +358368,7 @@ ${truncated}`;
           this.backgroundLogStreams.delete(pid);
         }
         this.backgroundLogPids.delete(pid);
+        await rmPromise;
       }
       /**
        * Executes a shell command using `node-pty`, capturing all output and lifecycle events.
@@ -358400,8 +358461,7 @@ ${truncated}`;
           ["core.sshCommand", ""],
           ["core.pager", "cat"],
           ["core.editor", ""],
-          ["sequence.editor", ""],
-          ["diff.external", ""]
+          ["sequence.editor", ""]
         ];
         for (const [overrideKey, overrideVal] of defaultGitOverrides) {
           const keyVar = `GIT_CONFIG_KEY_${gitConfigCount}`;
@@ -358479,6 +358539,33 @@ ${truncated}`;
                 }
               }
             }
+            if (child.stdout) {
+              child.stdout.removeAllListeners();
+              try {
+                child.stdout.destroy();
+              } catch {
+              }
+            }
+            if (child.stderr) {
+              child.stderr.removeAllListeners();
+              try {
+                child.stderr.destroy();
+              } catch {
+              }
+            }
+            const stdin = child.stdin;
+            if (stdin) {
+              stdin.removeAllListeners();
+              try {
+                stdin.destroy();
+              } catch {
+              }
+            }
+            child.removeAllListeners("error");
+            child.removeAllListeners("close");
+            state.sniffChunks.length = 0;
+            stdoutDecoder = null;
+            stderrDecoder = null;
             return;
           };
           var cleanup = cleanup2;
@@ -358506,7 +358593,8 @@ ${truncated}`;
               process: child,
               state,
               command: shellExecutionConfig.originalCommand ?? commandToExecute,
-              sessionId: shellExecutionConfig.sessionId
+              sessionId: shellExecutionConfig.sessionId,
+              tempDir: shellExecutionConfig.tempDir
             });
           }
           const lifecycleHandle = child.pid ? ExecutionLifecycleService.attachExecution(child.pid, {
@@ -358610,6 +358698,7 @@ ${truncated}`;
             cleanup2();
             cmdCleanup?.();
             let combinedOutput = state.output;
+            state.output = "";
             if (state.truncated) {
               const truncationMessage = `
 [GEMINI_CLI_WARNING: Output truncated. The buffer is limited to ${MAX_CHILD_PROCESS_BUFFER_SIZE / (1024 * 1024)}MB.]`;
@@ -358645,9 +358734,8 @@ ${truncated}`;
                 historyItem.endTime = Date.now();
               }
               onOutputEvent(event);
-              _ShellExecutionService.cleanupLogStream(pid).then(() => {
-                _ShellExecutionService.activeChildProcesses.delete(pid);
-              });
+              _ShellExecutionService.activeChildProcesses.delete(pid);
+              _ShellExecutionService.cleanupLogStream(pid);
               ExecutionLifecycleService.completeWithResult(pid, resultPayload);
             } else {
               resolveWithoutPid?.(resultPayload);
@@ -358857,7 +358945,8 @@ ${truncated}`;
             maxSerializedLines: shellExecutionConfig.maxSerializedLines,
             command: shellExecutionConfig.originalCommand ?? commandToExecute,
             sessionId: shellExecutionConfig.sessionId,
-            cancelRender
+            cancelRender,
+            tempDir: shellExecutionConfig.tempDir
           });
           const result2 = ExecutionLifecycleService.attachExecution(assignedPid, {
             executionMethod: ptyInfo?.name ?? "node-pty",
@@ -359274,18 +359363,32 @@ ${truncated}`;
        * This resolves the execution promise but keeps the PTY active.
        *
        * @param pid The process ID of the target PTY.
+       * @param sessionId Optional session ID for process history tracking.
+       * @param command Optional command string for display.
+       * @param tempDir Optional temporary directory path owned by this execution to clean up on exit.
        */
-      static background(pid, sessionId, command) {
-        if (this.backgroundLogPids.has(pid)) {
-          return;
-        }
+      static background(pid, sessionId, command, tempDir) {
         const activePty = this.activePtys.get(pid);
         const activeChild = this.activeChildProcesses.get(pid);
+        const resolvedTempDir = tempDir ?? activePty?.tempDir ?? activeChild?.tempDir;
         const resolvedSessionId = sessionId ?? activePty?.sessionId ?? activeChild?.sessionId;
         const resolvedCommand = command ?? activePty?.command ?? activeChild?.command ?? "unknown command";
         if (!resolvedSessionId) {
           throw new Error("Session ID is required for background operations");
         }
+        if (!activePty && !activeChild) {
+          if (resolvedTempDir) {
+            fsPromises9.rm(resolvedTempDir, { recursive: true, force: true }).catch(() => {
+            });
+          }
+          return;
+        }
+        if (resolvedTempDir) {
+          this.backgroundTempDirs.set(pid, resolvedTempDir);
+        }
+        if (this.backgroundLogPids.has(pid)) {
+          return;
+        }
         const MAX_BACKGROUND_PROCESS_HISTORY_SIZE = 100;
         const history = this.backgroundProcessHistory.get(resolvedSessionId) ?? /* @__PURE__ */ new Map();
         if (history.size >= MAX_BACKGROUND_PROCESS_HISTORY_SIZE) {
@@ -359297,7 +359400,8 @@ ${truncated}`;
         history.set(pid, {
           command: resolvedCommand,
           status: "running",
-          startTime: Date.now()
+          startTime: Date.now(),
+          ...resolvedTempDir ? { tempDir: resolvedTempDir } : {}
         });
         this.backgroundProcessHistory.set(resolvedSessionId, history);
         const logPath = this.getLogFilePath(pid);
@@ -359437,8 +359541,15 @@ ${truncated}`;
           } catch {
           }
         }
+        for (const tempDir of this.backgroundTempDirs.values()) {
+          try {
+            fs53.rmSync(tempDir, { recursive: true, force: true });
+          } catch {
+          }
+        }
         this.backgroundLogPids.clear();
         this.backgroundLogStreams.clear();
+        this.backgroundTempDirs.clear();
         this.backgroundProcessHistory.clear();
       }
     };
@@ -359583,7 +359694,7 @@ var init_proactivePermissions = __esm({
 });
 
 // packages/core/dist/src/tools/shell.js
-import fsPromises9 from "node:fs/promises";
+import fsPromises10 from "node:fs/promises";
 import fs55 from "node:fs";
 import path62 from "node:path";
 import os33 from "node:os";
@@ -359766,15 +359877,19 @@ exit $__code`;
       getExplanation() {
         return this.getContextualDetails().trim();
       }
+      hasTaintedOrBuildFileRisk() {
+        const command = stripShellWrapper(this.params.command);
+        const history = this.getHistory();
+        const untrustedContext = extractUntrustedContext(history);
+        const untrustedFlags = findUntrustedFlags(command, untrustedContext);
+        const modifiedBuildFiles = getModifiedBuildFiles(this.context.config);
+        const isBuildCmd = isBuildOrTestCommand(command);
+        return untrustedFlags.length > 0 || isBuildCmd && modifiedBuildFiles.length > 0;
+      }
       getPolicyUpdateOptions(outcome) {
         if (outcome === ToolConfirmationOutcome.ProceedAlwaysAndSave || outcome === ToolConfirmationOutcome.ProceedAlways) {
           const command = stripShellWrapper(this.params.command);
-          const history = this.getHistory();
-          const untrustedContext = extractUntrustedContext(history);
-          const untrustedFlags = findUntrustedFlags(command, untrustedContext);
-          const modifiedBuildFiles = getModifiedBuildFiles(this.context.config);
-          const isBuildCmd = isBuildOrTestCommand(command);
-          if (untrustedFlags.length > 0 || isBuildCmd && modifiedBuildFiles.length > 0) {
+          if (this.hasTaintedOrBuildFileRisk()) {
             return void 0;
           }
           const rootCommands = [...new Set(getCommandRoots(command))];
@@ -359790,24 +359905,18 @@ exit $__code`;
         if (forcedDecision === "deny") {
           return super.shouldConfirmExecute(abortSignal, forcedDecision);
         }
-        const command = stripShellWrapper(this.params.command);
-        const history = this.getHistory();
-        const untrustedContext = extractUntrustedContext(history);
-        const untrustedFlags = findUntrustedFlags(command, untrustedContext);
-        const modifiedBuildFiles = getModifiedBuildFiles(this.context.config);
-        const isBuildCmd = isBuildOrTestCommand(command);
-        if (untrustedFlags.length > 0 || isBuildCmd && modifiedBuildFiles.length > 0) {
+        if (this.hasTaintedOrBuildFileRisk()) {
           return this.getConfirmationDetails(abortSignal);
         }
-        if (this.context.config.getApprovalMode() === ApprovalMode.YOLO) {
+        if (this.context.config.getApprovalMode() === ApprovalMode.YOLO && forcedDecision !== "ask_user") {
           return super.shouldConfirmExecute(abortSignal, forcedDecision);
         }
         if (this.params[PARAM_ADDITIONAL_PERMISSIONS]) {
           return this.getConfirmationDetails(abortSignal);
         }
         if (this.context.config.getSandboxEnabled()) {
-          const command2 = stripShellWrapper(this.params.command);
-          const rootCommands = getCommandRoots(command2);
+          const command = stripShellWrapper(this.params.command);
+          const rootCommands = getCommandRoots(command);
           const rawRootCommand = rootCommands[0];
           if (rawRootCommand) {
             const rootCommand = normalizeCommand(rawRootCommand);
@@ -359818,7 +359927,7 @@ exit $__code`;
               const approved = this.context.config.sandboxPolicyManager.getCommandPermissions(rootCommand);
               const hasNetwork = modeConfig.network || approved.network;
               const missingNetwork = !!proactive.network && !hasNetwork;
-              const parsed = parseCommandDetails(command2);
+              const parsed = parseCommandDetails(command);
               const subCommand = parsed?.details[0]?.args?.[0];
               const needsNetwork = isNetworkReliantCommand(rootCommand, subCommand);
               if (needsNetwork) {
@@ -359938,6 +360047,7 @@ exit $__code`;
         const isWindows2 = os33.platform() === "win32";
         let tempFilePath = "";
         let tempDir = "";
+        let isBackgrounded = false;
         const timeoutMs = this.context.config.getShellToolInactivityTimeout();
         const timeoutController = new AbortController();
         let timeoutTimer;
@@ -360080,7 +360190,8 @@ exit $__code`;
               }
             },
             backgroundCompletionBehavior: this.context.config.getShellBackgroundCompletionBehavior(),
-            originalCommand: strippedCommand
+            originalCommand: strippedCommand,
+            tempDir
           });
           if (pid) {
             if (setExecutionIdCallback) {
@@ -360093,7 +360204,12 @@ exit $__code`;
               let promotionTimer = setTimeout(() => {
                 promotionTimer = null;
                 if (!completed) {
-                  ShellExecutionService.background(pid, sessionId, strippedCommand);
+                  try {
+                    ShellExecutionService.background(pid, sessionId, strippedCommand, tempDir);
+                    isBackgrounded = true;
+                  } catch (err2) {
+                    debugLogger.error("Failed to background shell execution:", err2);
+                  }
                 }
               }, delay3);
               const clearPromotionTimer = () => {
@@ -360130,20 +360246,22 @@ ${cumulativeOutput}`,
             }
           }
           const result2 = await resultPromise;
-          if (!result2.backgrounded) {
+          if (result2.backgrounded) {
+            isBackgrounded = true;
+          } else {
             flushOutput();
           }
           const backgroundPIDs = [];
           if (os33.platform() !== "win32") {
             let tempFileExists = false;
             try {
-              await fsPromises9.access(tempFilePath);
+              await fsPromises10.access(tempFilePath);
               tempFileExists = true;
             } catch {
               tempFileExists = false;
             }
             if (tempFileExists) {
-              const backgroundPIDContent = await fsPromises9.readFile(tempFilePath, "utf8");
+              const backgroundPIDContent = await fsPromises10.readFile(tempFilePath, "utf8");
               const backgroundPIDLines = backgroundPIDContent.split("\n").map((line) => line.trim()).filter(Boolean);
               for (const line of backgroundPIDLines) {
                 if (!/^\d+$/.test(line)) {
@@ -360369,16 +360487,16 @@ ${result2.output}`;
           }
           signal.removeEventListener("abort", onAbort);
           timeoutController.signal.removeEventListener("abort", onAbort);
-          if (!this.params.is_background) {
+          if (!isBackgrounded) {
             if (tempFilePath) {
               try {
-                await fsPromises9.unlink(tempFilePath);
+                await fsPromises10.unlink(tempFilePath);
               } catch {
               }
             }
             if (tempDir) {
               try {
-                await fsPromises9.rm(tempDir, { recursive: true, force: true });
+                await fsPromises10.rm(tempDir, { recursive: true, force: true });
               } catch {
               }
             }
@@ -366601,6 +366719,7 @@ var init_web_search = __esm({
     init_coreTools();
     init_resolver();
     init_llmRole();
+    init_textUtils();
     WebSearchToolInvocation = class extends BaseToolInvocation {
       context;
       constructor(context2, params, messageBus, _toolName, _toolDisplayName) {
@@ -366671,7 +366790,7 @@ var init_web_search = __esm({
           return {
             llmContent: `Web search results for "${this.params.query}":
 
-${modifiedResponseText}`,
+${wrapUntrusted(modifiedResponseText)}`,
             returnDisplay: `Search results for "${this.params.query}" returned.`,
             sources
           };
@@ -371214,6 +371333,117 @@ var init_types13 = __esm({
 });
 
 // packages/core/dist/src/context/chatCompressionService.js
+function isExemptRetrievalTool(toolName, exemptTools = RETRIEVAL_TOOL_NAMES_EXEMPT_FROM_COLLAPSE) {
+  if (!toolName) {
+    return false;
+  }
+  const normalized = toolName.toLowerCase();
+  if (exemptTools.has(normalized)) {
+    return true;
+  }
+  return normalized.endsWith("read_file") || normalized.endsWith("read_files") || normalized.endsWith("read_many_files") || normalized.endsWith("read_resource");
+}
+function collapseOlderFunctionResponses(history, maxBytesPerOldResponse = COLLAPSED_FUNCTION_RESPONSE_MAX_BYTES, segmenter2 = defaultGraphemeSegmenter, protectedTurns = RECENT_TURNS_PROTECTED, exemptTools = RETRIEVAL_TOOL_NAMES_EXEMPT_FROM_COLLAPSE) {
+  const toolIndices = [];
+  for (let i3 = 0; i3 < history.length; i3++) {
+    if (history[i3].role === "user" && history[i3].parts?.some((p2) => !!p2.functionResponse)) {
+      toolIndices.push(i3);
+    }
+  }
+  if (toolIndices.length <= protectedTurns) {
+    return history;
+  }
+  const cutoffToolIndex = toolIndices[toolIndices.length - protectedTurns];
+  const collapseString = (str2) => {
+    const totalBytes = Buffer.byteLength(str2, "utf8");
+    if (totalBytes <= maxBytesPerOldResponse) {
+      return str2;
+    }
+    const previewBytes = maxBytesPerOldResponse;
+    let preview = "";
+    let currentBytes = 0;
+    for (const { segment } of segmenter2.segment(str2)) {
+      const segmentBytes = Buffer.byteLength(segment, "utf8");
+      if (currentBytes + segmentBytes > previewBytes) {
+        break;
+      }
+      preview += segment;
+      currentBytes += segmentBytes;
+    }
+    const omittedBytes = totalBytes - currentBytes;
+    return `${preview}
+... [Tool output collapsed from previous turn: ${omittedBytes} bytes omitted to conserve memory] ...`;
+  };
+  const collapseValue = (val) => {
+    if (typeof val === "string") {
+      return collapseString(val);
+    }
+    if (Array.isArray(val)) {
+      let arrayModified = false;
+      const newVal = val.map((item) => {
+        const collapsed = collapseValue(item);
+        if (collapsed !== item) {
+          arrayModified = true;
+        }
+        return collapsed;
+      });
+      return arrayModified ? newVal : val;
+    }
+    if (typeof val === "object" && val !== null) {
+      const proto = Object.getPrototypeOf(val);
+      if (proto !== Object.prototype && proto !== null) {
+        return val;
+      }
+      let objModified = false;
+      const copy = {};
+      for (const [k2, v2] of Object.entries(val)) {
+        const collapsed = collapseValue(v2);
+        if (collapsed !== v2) {
+          objModified = true;
+        }
+        copy[k2] = collapsed;
+      }
+      return objModified ? copy : val;
+    }
+    return val;
+  };
+  let modified = false;
+  const newHistory = history.map((content, idx) => {
+    if (idx >= cutoffToolIndex || content.role !== "user" || !content.parts) {
+      return content;
+    }
+    let partsModified = false;
+    const newParts = content.parts.map((part) => {
+      if (!part.functionResponse?.response) {
+        return part;
+      }
+      if (isExemptRetrievalTool(part.functionResponse.name, exemptTools)) {
+        return part;
+      }
+      const resp = part.functionResponse.response;
+      const newResp = collapseValue(resp);
+      if (newResp !== resp) {
+        partsModified = true;
+        return {
+          ...part,
+          functionResponse: {
+            // eslint-disable-next-line @typescript-eslint/no-misused-spread
+            ...part.functionResponse,
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+            response: newResp
+          }
+        };
+      }
+      return part;
+    });
+    if (partsModified) {
+      modified = true;
+      return { ...content, parts: newParts };
+    }
+    return content;
+  });
+  return modified ? newHistory : history;
+}
 function findCompressSplitPoint(contents, fraction) {
   if (fraction <= 0 || fraction >= 1) {
     throw new Error("Fraction must be between 0 and 1");
@@ -371325,7 +371555,7 @@ async function truncateHistoryToBudget(history, config2) {
   }
   return truncatedHistory;
 }
-var DEFAULT_COMPRESSION_TOKEN_THRESHOLD, COMPRESSION_PRESERVE_THRESHOLD, COMPRESSION_FUNCTION_RESPONSE_TOKEN_BUDGET, ChatCompressionService;
+var DEFAULT_COMPRESSION_TOKEN_THRESHOLD, RECENT_TURNS_PROTECTED, RETRIEVAL_TOOL_NAMES_EXEMPT_FROM_COLLAPSE, COLLAPSED_FUNCTION_RESPONSE_MAX_BYTES, defaultGraphemeSegmenter, COMPRESSION_PRESERVE_THRESHOLD, COMPRESSION_FUNCTION_RESPONSE_TOKEN_BUDGET, ChatCompressionService;
 var init_chatCompressionService = __esm({
   "packages/core/dist/src/context/chatCompressionService.js"() {
     "use strict";
@@ -371342,6 +371572,22 @@ var init_chatCompressionService = __esm({
     init_models();
     init_types13();
     DEFAULT_COMPRESSION_TOKEN_THRESHOLD = 0.5;
+    RECENT_TURNS_PROTECTED = 3;
+    RETRIEVAL_TOOL_NAMES_EXEMPT_FROM_COLLAPSE = /* @__PURE__ */ new Set([
+      "read_file",
+      "read_many_files",
+      "get_internal_docs",
+      "read_mcp_resource",
+      "grep",
+      "rip_grep",
+      "glob",
+      "search_file_content",
+      "find_files"
+    ]);
+    COLLAPSED_FUNCTION_RESPONSE_MAX_BYTES = 2048;
+    defaultGraphemeSegmenter = new Intl.Segmenter(void 0, {
+      granularity: "grapheme"
+    });
     COMPRESSION_PRESERVE_THRESHOLD = 0.3;
     COMPRESSION_FUNCTION_RESPONSE_TOKEN_BUDGET = 5e4;
     ChatCompressionService = class {
@@ -371359,10 +371605,12 @@ var init_chatCompressionService = __esm({
         }
         const trigger = force ? PreCompressTrigger.Manual : PreCompressTrigger.Auto;
         await config2.getHookSystem()?.firePreCompressEvent(trigger);
-        const originalTokenCount = chat.getLastPromptTokenCount();
+        const lastPromptTokenCount = chat.getLastPromptTokenCount();
+        const originalTokenCount = lastPromptTokenCount > 0 ? lastPromptTokenCount : estimateTokenCountSync(curatedHistory.flatMap((c2) => c2.parts || []));
         if (!force) {
           const threshold = await config2.getCompressionThreshold() ?? DEFAULT_COMPRESSION_TOKEN_THRESHOLD;
-          if (originalTokenCount < threshold * tokenLimit(model)) {
+          const isOverModelThreshold = originalTokenCount >= threshold * tokenLimit(model);
+          if (!isOverModelThreshold) {
             return {
               newHistory: null,
               info: {
@@ -371500,6 +371748,8 @@ First, reason in your scratchpad. Then, generate the updated <state_snapshot>.`
             }
           };
         } else {
+          historyToCompressTruncated.length = 0;
+          originalHistoryToCompress.length = 0;
           return {
             newHistory: extraHistory,
             info: {
@@ -371514,6 +371764,135 @@ First, reason in your scratchpad. Then, generate the updated <state_snapshot>.`
   }
 });
 
+// packages/core/dist/src/utils/tool-utils.js
+function isToolCallResponseInfo(data) {
+  return typeof data === "object" && data !== null && "callId" in data && "responseParts" in data;
+}
+function getToolSuggestion(unknownToolName, allToolNames, topN = 3) {
+  const matches = allToolNames.map((toolName) => ({
+    name: toolName,
+    distance: import_fast_levenshtein2.default.get(unknownToolName, toolName)
+  }));
+  matches.sort((a, b2) => a.distance - b2.distance);
+  const topNResults = matches.slice(0, topN);
+  if (topNResults.length === 0) {
+    return "";
+  }
+  const suggestedNames = topNResults.map((match2) => `"${match2.name}"`).join(", ");
+  if (topNResults.length > 1) {
+    return ` Did you mean one of: ${suggestedNames}?`;
+  } else {
+    return ` Did you mean ${suggestedNames}?`;
+  }
+}
+function truncateToolOutput(text, maxBytes = MAX_STORED_TOOL_OUTPUT_BYTES, savedFilePath) {
+  if (Buffer.byteLength(text, "utf8") <= maxBytes) {
+    return text;
+  }
+  const suffix = savedFilePath ? `
+... [Tool output truncated to conserve memory. For full output see: ${savedFilePath}]` : "\n... [Tool output truncated to conserve memory]";
+  const targetBytes = Math.max(0, maxBytes - Buffer.byteLength(suffix, "utf8"));
+  let accumulatedBytes = 0;
+  let truncatedText = "";
+  for (const { segment } of segmenter.segment(text)) {
+    const segmentBytes = Buffer.byteLength(segment, "utf8");
+    if (accumulatedBytes + segmentBytes > targetBytes) {
+      break;
+    }
+    accumulatedBytes += segmentBytes;
+    truncatedText += segment;
+  }
+  return truncatedText + suffix;
+}
+function truncateFunctionResponsePart(part, maxBytes = MAX_STORED_TOOL_OUTPUT_BYTES, savedFilePath) {
+  if (part.text && Buffer.byteLength(part.text, "utf8") > maxBytes) {
+    return {
+      ...part,
+      text: truncateToolOutput(part.text, maxBytes, savedFilePath)
+    };
+  }
+  if (!part.functionResponse?.response) {
+    return part;
+  }
+  const resp = part.functionResponse.response;
+  if (typeof resp === "string") {
+    if (Buffer.byteLength(resp, "utf8") > maxBytes) {
+      return {
+        ...part,
+        functionResponse: {
+          // eslint-disable-next-line @typescript-eslint/no-misused-spread
+          ...part.functionResponse,
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+          response: truncateToolOutput(resp, maxBytes, savedFilePath)
+        }
+      };
+    }
+    return part;
+  }
+  if (typeof resp === "object" && resp !== null) {
+    const truncateValue = (val) => {
+      if (typeof val === "string") {
+        if (Buffer.byteLength(val, "utf8") > maxBytes) {
+          return truncateToolOutput(val, maxBytes, savedFilePath);
+        }
+        return val;
+      }
+      if (Array.isArray(val)) {
+        let arrayModified = false;
+        const newVal = val.map((item) => {
+          const truncated = truncateValue(item);
+          if (truncated !== item) {
+            arrayModified = true;
+          }
+          return truncated;
+        });
+        return arrayModified ? newVal : val;
+      }
+      if (typeof val === "object" && val !== null) {
+        const proto = Object.getPrototypeOf(val);
+        if (proto !== Object.prototype && proto !== null) {
+          return val;
+        }
+        let objModified = false;
+        const copy = {};
+        for (const [k2, v2] of Object.entries(val)) {
+          const truncated = truncateValue(v2);
+          if (truncated !== v2) {
+            objModified = true;
+          }
+          copy[k2] = truncated;
+        }
+        return objModified ? copy : val;
+      }
+      return val;
+    };
+    const newResp = truncateValue(resp);
+    if (newResp !== resp) {
+      return {
+        ...part,
+        functionResponse: {
+          // eslint-disable-next-line @typescript-eslint/no-misused-spread
+          ...part.functionResponse,
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+          response: newResp
+        }
+      };
+    }
+  }
+  return part;
+}
+var import_fast_levenshtein2, segmenter;
+var init_tool_utils = __esm({
+  "packages/core/dist/src/utils/tool-utils.js"() {
+    "use strict";
+    init_src3();
+    init_shell_utils();
+    import_fast_levenshtein2 = __toESM(require_levenshtein(), 1);
+    init_constants();
+    segmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+  }
+});
+
 // packages/core/dist/src/agents/types.js
 function isSubagentProgress(obj) {
   return typeof obj === "object" && obj !== null && "isSubagentProgress" in obj && obj.isSubagentProgress === true;
@@ -381221,37 +381600,6 @@ var init_toolCallContext = __esm({
   }
 });
 
-// packages/core/dist/src/utils/tool-utils.js
-function isToolCallResponseInfo(data) {
-  return typeof data === "object" && data !== null && "callId" in data && "responseParts" in data;
-}
-function getToolSuggestion(unknownToolName, allToolNames, topN = 3) {
-  const matches = allToolNames.map((toolName) => ({
-    name: toolName,
-    distance: import_fast_levenshtein2.default.get(unknownToolName, toolName)
-  }));
-  matches.sort((a, b2) => a.distance - b2.distance);
-  const topNResults = matches.slice(0, topN);
-  if (topNResults.length === 0) {
-    return "";
-  }
-  const suggestedNames = topNResults.map((match2) => `"${match2.name}"`).join(", ");
-  if (topNResults.length > 1) {
-    return ` Did you mean one of: ${suggestedNames}?`;
-  } else {
-    return ` Did you mean ${suggestedNames}?`;
-  }
-}
-var import_fast_levenshtein2;
-var init_tool_utils = __esm({
-  "packages/core/dist/src/utils/tool-utils.js"() {
-    "use strict";
-    init_src3();
-    init_shell_utils();
-    import_fast_levenshtein2 = __toESM(require_levenshtein(), 1);
-  }
-});
-
 // packages/core/dist/src/scheduler/state-manager.js
 var SchedulerStateManager;
 var init_state_manager = __esm({
@@ -383049,7 +383397,7 @@ ${summary}
 
 // packages/core/dist/src/context/toolOutputMaskingService.js
 import path70 from "node:path";
-import * as fsPromises10 from "node:fs/promises";
+import * as fsPromises11 from "node:fs/promises";
 var DEFAULT_TOOL_PROTECTION_THRESHOLD, DEFAULT_MIN_PRUNABLE_TOKENS_THRESHOLD, DEFAULT_PROTECT_LATEST_TURN, MASKING_INDICATOR_TAG, TOOL_OUTPUTS_DIR3, EXEMPT_TOOLS, ToolOutputMaskingService;
 var init_toolOutputMaskingService = __esm({
   "packages/core/dist/src/context/toolOutputMaskingService.js"() {
@@ -383136,7 +383484,7 @@ var init_toolOutputMaskingService = __esm({
           const safeSessionId = sanitizeFilenamePart(sessionId);
           toolOutputsDir = path70.join(toolOutputsDir, `session-${safeSessionId}`);
         }
-        await fsPromises10.mkdir(toolOutputsDir, { recursive: true });
+        await fsPromises11.mkdir(toolOutputsDir, { recursive: true });
         for (const item of prunableParts) {
           const { contentIndex, partIndex, content, tokens } = item;
           const contentRecord = newHistory[contentIndex];
@@ -383149,7 +383497,7 @@ var init_toolOutputMaskingService = __esm({
           const safeCallId = sanitizeFilenamePart(callId).toLowerCase();
           const fileName = `${safeToolName}_${safeCallId}_${Math.random().toString(36).substring(7)}.txt`;
           const filePath = path70.join(toolOutputsDir, fileName);
-          await fsPromises10.writeFile(filePath, content, "utf-8");
+          await fsPromises11.writeFile(filePath, content, "utf-8");
           const originalResponse = (
             // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
             part.functionResponse.response || {}
@@ -386692,6 +387040,15 @@ var init_client3 = __esm({
         coreEvents.off(CoreEvent.ApprovalModeChanged, this.handleApprovalModeChanged);
       }
       async resumeChat(history, resumedSessionData) {
+        if (resumedSessionData?.filePath) {
+          const previousRecordingService = this.chat?.getChatRecordingService?.();
+          if (previousRecordingService && previousRecordingService.getConversationFilePath?.() !== resumedSessionData.filePath) {
+            try {
+              await previousRecordingService.deleteCurrentSessionIfNotResumableAsync?.();
+            } catch {
+            }
+          }
+        }
         this.chat = await this.startChat(history, resumedSessionData);
         this.updateTelemetryTokenCount();
       }
@@ -387462,6 +387819,8 @@ var init_tool_executor = __esm({
     init_coreToolHookTriggers();
     init_fileUtils();
     init_generateContentResponseUtilities();
+    init_tool_utils();
+    init_constants();
     init_types3();
     init_constants2();
     ToolExecutor = class {
@@ -387563,13 +387922,16 @@ var init_tool_executor = __esm({
             const originalContentLength = content.length;
             const { outputFile: savedPath } = await saveTruncatedToolOutput(content, toolName, callId, this.config.storage.getProjectTempDir(), this.context.promptId);
             outputFile = savedPath;
-            const truncatedContent = formatTruncatedToolOutput(content, outputFile, threshold);
+            let truncatedContent = formatTruncatedToolOutput(content, outputFile, threshold);
             logToolOutputTruncated(this.config, new ToolOutputTruncatedEvent(call.request.prompt_id, {
               toolName,
               originalContentLength,
               truncatedContentLength: truncatedContent.length,
               threshold
             }));
+            if (typeof truncatedContent === "string" && Buffer.byteLength(truncatedContent, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+              truncatedContent = truncateToolOutput(truncatedContent, MAX_STORED_TOOL_OUTPUT_BYTES);
+            }
             return { truncatedContent, outputFile };
           }
         } else if (Array.isArray(content) && content.length === 1 && "tool" in call && call.tool instanceof DiscoveredMCPTool) {
@@ -387581,7 +387943,10 @@ var init_tool_executor = __esm({
               const originalContentLength = textContent2.length;
               const { outputFile: savedPath } = await saveTruncatedToolOutput(textContent2, toolName, callId, this.config.storage.getProjectTempDir(), this.context.promptId);
               outputFile = savedPath;
-              const truncatedText = formatTruncatedToolOutput(textContent2, outputFile, threshold);
+              let truncatedText = formatTruncatedToolOutput(textContent2, outputFile, threshold);
+              if (typeof truncatedText === "string" && Buffer.byteLength(truncatedText, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+                truncatedText = truncateToolOutput(truncatedText, MAX_STORED_TOOL_OUTPUT_BYTES);
+              }
               const truncatedContent = [
                 { ...firstPart, text: truncatedText }
               ];
@@ -387595,7 +387960,45 @@ var init_tool_executor = __esm({
             }
           }
         }
-        return { truncatedContent: content, outputFile };
+        const ensureOutputFile = async (rawText) => {
+          if (!outputFile) {
+            try {
+              const { outputFile: savedPath } = await saveTruncatedToolOutput(rawText, toolName, callId, this.config.storage.getProjectTempDir(), this.context.promptId);
+              outputFile = savedPath;
+            } catch {
+            }
+          }
+          return outputFile;
+        };
+        let finalContent = content;
+        if (typeof finalContent === "string") {
+          if (Buffer.byteLength(finalContent, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+            const savedPath = await ensureOutputFile(finalContent);
+            finalContent = truncateToolOutput(finalContent, MAX_STORED_TOOL_OUTPUT_BYTES, savedPath);
+          }
+        } else if (Array.isArray(finalContent)) {
+          finalContent = await Promise.all(finalContent.map(async (part) => {
+            if (typeof part === "string" && Buffer.byteLength(part, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+              const savedPath = await ensureOutputFile(part);
+              return truncateToolOutput(part, MAX_STORED_TOOL_OUTPUT_BYTES, savedPath);
+            }
+            if (typeof part === "object" && part !== null && "text" in part && typeof part.text === "string" && Buffer.byteLength(part.text, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+              const savedPath = await ensureOutputFile(part.text);
+              return {
+                ...part,
+                text: truncateToolOutput(part.text, MAX_STORED_TOOL_OUTPUT_BYTES, savedPath)
+              };
+            }
+            return part;
+          }));
+        } else if (typeof finalContent === "object" && finalContent !== null && "text" in finalContent && typeof finalContent.text === "string" && Buffer.byteLength(finalContent.text, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+          const savedPath = await ensureOutputFile(finalContent.text);
+          finalContent = {
+            ...finalContent,
+            text: truncateToolOutput(finalContent.text, MAX_STORED_TOOL_OUTPUT_BYTES, savedPath)
+          };
+        }
+        return { truncatedContent: finalContent, outputFile };
       }
       async createCancelledResult(call, reason, toolResult) {
         const errorMessage = `[Operation Cancelled] ${reason}`;
@@ -387774,6 +388177,9 @@ var init_tool_modifier = __esm({
 });
 
 // packages/core/dist/src/scheduler/scheduler.js
+function isTaintRiskDetectable(invocation) {
+  return typeof invocation === "object" && invocation !== null && "hasTaintedOrBuildFileRisk" in invocation && typeof invocation.hasTaintedOrBuildFileRisk === "function";
+}
 var createErrorResponse, Scheduler;
 var init_scheduler = __esm({
   "packages/core/dist/src/scheduler/scheduler.js"() {
@@ -388157,6 +388563,10 @@ var init_scheduler = __esm({
         if (hookDecision === "ask") {
           decision = PolicyDecision.ASK_USER;
         }
+        const hasTaintRisk = isTaintRiskDetectable(toolCall.invocation) && toolCall.invocation.hasTaintedOrBuildFileRisk();
+        if (decision === PolicyDecision.ALLOW && hasTaintRisk) {
+          decision = this.config.isInteractive?.() ?? true ? PolicyDecision.ASK_USER : PolicyDecision.DENY;
+        }
         if (decision === PolicyDecision.DENY) {
           const { errorMessage, errorType } = getPolicyDenialError(this.config, rule);
           this.state.updateStatus(callId, CoreToolCallStatus.Error, createErrorResponse(toolCall.request, new Error(errorMessage), errorType));
@@ -388165,6 +388575,7 @@ var init_scheduler = __esm({
         let outcome = ToolConfirmationOutcome.ProceedOnce;
         let lastDetails;
         if (decision === PolicyDecision.ASK_USER) {
+          const forcedDecision = hookDecision === "ask" || policyDecision === PolicyDecision.ALLOW && hasTaintRisk ? "ask_user" : void 0;
           const result2 = await resolveConfirmation(toolCall, signal, {
             config: this.config,
             messageBus: this.messageBus,
@@ -388174,7 +388585,7 @@ var init_scheduler = __esm({
             schedulerId: this.schedulerId,
             onWaitingForConfirmation: this.onWaitingForConfirmation,
             systemMessage: hookSystemMessage,
-            forcedDecision: hookDecision === "ask" ? "ask_user" : void 0
+            forcedDecision
           });
           outcome = result2.outcome;
           lastDetails = result2.lastDetails;
@@ -389046,6 +389457,8 @@ var init_local_executor = __esm({
     init_turn();
     init_types3();
     init_chatCompressionService();
+    init_constants();
+    init_tool_utils();
     init_environmentContext();
     init_snippets();
     init_promptIdContext();
@@ -389055,6 +389468,8 @@ var init_local_executor = __esm({
     init_errors2();
     init_utils6();
     init_models();
+    init_tokenLimits();
+    init_tokenCalculation();
     init_mnemonist();
     init_thoughtUtils();
     init_debugLogger();
@@ -389572,13 +389987,30 @@ var init_local_executor = __esm({
       }
       async tryCompressChat(chat, prompt_id, abortSignal) {
         const model = this.definition.modelConfig.model ?? DEFAULT_GEMINI_MODEL;
+        const threshold = await this.context.config.getCompressionThreshold() ?? DEFAULT_COMPRESSION_TOKEN_THRESHOLD;
+        const modelLimit = tokenLimit(model);
+        const lastPromptTokenCount = chat.getLastPromptTokenCount();
+        const currentHistory = chat.getHistory(false);
+        const originalTokenCount = lastPromptTokenCount > 0 ? lastPromptTokenCount : estimateTokenCountSync(currentHistory.flatMap((c2) => c2.parts || []));
+        if (originalTokenCount >= threshold * modelLimit) {
+          const collapsedHistory = collapseOlderFunctionResponses(currentHistory);
+          if (collapsedHistory !== currentHistory) {
+            const existingTurns = chat.getHistoryTurns?.(false) ?? [];
+            const turns = collapsedHistory.map((c2, idx) => ({
+              id: existingTurns[idx]?.id ?? randomUUID15(),
+              content: c2
+            }));
+            chat.setHistory(turns);
+          }
+        }
         const { newHistory, info: info2 } = await this.compressionService.compress(chat, prompt_id, false, model, this.context.config, this.hasFailedCompressionAttempt, abortSignal);
         if (info2.compressionStatus === CompressionStatus.COMPRESSION_FAILED_INFLATED_TOKEN_COUNT) {
           this.hasFailedCompressionAttempt = true;
         } else if (info2.compressionStatus === CompressionStatus.COMPRESSED) {
           if (newHistory) {
-            const turns = newHistory.map((c2) => ({
-              id: randomUUID15(),
+            const existingTurns = chat.getHistoryTurns?.(false) ?? [];
+            const turns = newHistory.map((c2, idx) => ({
+              id: existingTurns[idx]?.id ?? randomUUID15(),
               content: c2
             }));
             chat.setHistory(turns);
@@ -389586,8 +390018,9 @@ var init_local_executor = __esm({
           }
         } else if (info2.compressionStatus === CompressionStatus.CONTENT_TRUNCATED) {
           if (newHistory) {
-            const turns = newHistory.map((c2) => ({
-              id: randomUUID15(),
+            const existingTurns = chat.getHistoryTurns?.(false) ?? [];
+            const turns = newHistory.map((c2, idx) => ({
+              id: existingTurns[idx]?.id ?? randomUUID15(),
               content: c2
             }));
             chat.setHistory(turns);
@@ -389770,6 +390203,15 @@ var init_local_executor = __esm({
             signal,
             onWaitingForConfirmation
           });
+          for (const call of completedCalls) {
+            const outputFile = call.response?.outputFile;
+            if (call.response?.responseParts) {
+              call.response.responseParts = call.response.responseParts.map((p2) => truncateFunctionResponsePart(p2, MAX_STORED_TOOL_OUTPUT_BYTES, outputFile));
+            }
+            if (typeof call.response?.resultDisplay === "string" && Buffer.byteLength(call.response.resultDisplay, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+              call.response.resultDisplay = truncateToolOutput(call.response.resultDisplay, MAX_STORED_TOOL_OUTPUT_BYTES, outputFile);
+            }
+          }
           chat.recordCompletedToolCalls(model, completedCalls);
           for (const call of completedCalls) {
             const toolName = toolNameMap.get(call.request.callId) || call.request.name;
@@ -389835,7 +390277,7 @@ var init_local_executor = __esm({
           const callId = functionCall.id ?? `${promptId}-${index}`;
           const part = syncResults.get(callId);
           if (part) {
-            toolResponseParts.push(part);
+            toolResponseParts.push(truncateFunctionResponsePart(part, MAX_STORED_TOOL_OUTPUT_BYTES));
             continue;
           }
           const isAborted2 = signal.aborted;
@@ -403346,11 +403788,14 @@ var init_policy_engine = __esm({
       isAlwaysAllowRule(rule) {
         return rule.priority !== void 0 && Math.round(rule.priority % 1 * 1e3) === ALWAYS_ALLOW_PRIORITY_FRACTION;
       }
-      shouldDowngradeForRedirection(command, allowRedirection) {
+      shouldDowngradeForRedirection(command, allowRedirection, rule) {
         if (allowRedirection)
           return false;
         if (!hasRedirection(command))
           return false;
+        if (rule?.argsPattern && !allowRedirection) {
+          return true;
+        }
         if (this.approvalMode === ApprovalMode.AUTO_EDIT || this.approvalMode === ApprovalMode.YOLO) {
           return false;
         }
@@ -403437,7 +403882,7 @@ var init_policy_engine = __esm({
         }
         let aggregateDecision = ruleDecision;
         let responsibleRule = rule && ruleDecision === rule.decision ? rule : void 0;
-        if (this.shouldDowngradeForRedirection(command, allowRedirection)) {
+        if (this.shouldDowngradeForRedirection(command, allowRedirection, rule)) {
           if (aggregateDecision === PolicyDecision.ALLOW) {
             debugLogger.debug(`[PolicyEngine.check] Downgrading ALLOW to ASK_USER for redirected command: ${command}`);
             aggregateDecision = PolicyDecision.ASK_USER;
@@ -403476,7 +403921,7 @@ var init_policy_engine = __esm({
               }
               aggregateDecision = PolicyDecision.ASK_USER;
             }
-            if (subResult.decision === PolicyDecision.ALLOW && this.shouldDowngradeForRedirection(subCmd, allowRedirection)) {
+            if (subResult.decision === PolicyDecision.ALLOW && this.shouldDowngradeForRedirection(subCmd, subResult.rule?.allowRedirection ?? allowRedirection, subResult.rule)) {
               if (aggregateDecision === PolicyDecision.ALLOW) {
                 aggregateDecision = PolicyDecision.ASK_USER;
                 responsibleRule = void 0;
@@ -403660,6 +404105,9 @@ var init_policy_engine = __esm({
             }
           }
         }
+        if (this.nonInteractive && decision === PolicyDecision.ASK_USER) {
+          decision = PolicyDecision.DENY;
+        }
         return {
           decision,
           rule: matchedRule
@@ -406459,7 +406907,7 @@ import * as os34 from "node:os";
 import * as path89 from "node:path";
 function getWindowsPowerShellPath() {
   let systemRoot = process.env["SystemRoot"] || process.env["systemroot"] || process.env["windir"] || process.env["WINDIR"] || "C:\\Windows";
-  if (!/^[a-zA-Z]:\\/.test(systemRoot)) {
+  if (!/^[a-zA-Z]:\\Windows\\?$/i.test(systemRoot) || systemRoot.includes("..")) {
     systemRoot = "C:\\Windows";
   }
   const pathModule = os34.platform() === "win32" ? path89.win32 : path89.posix;
@@ -407299,13 +407747,14 @@ var init_context_builder = __esm({
 
 // packages/core/dist/src/safety/built-in.js
 import * as path91 from "node:path";
-var VSCODE_SFN_REGEX, AllowedPathChecker;
+var VSCODE_SFN_REGEX, GEMINI_SFN_REGEX, AllowedPathChecker;
 var init_built_in = __esm({
   "packages/core/dist/src/safety/built-in.js"() {
     "use strict";
     init_protocol2();
     init_paths();
-    VSCODE_SFN_REGEX = /^(vscode|vs[0-9a-f]{4})~\d+$/;
+    VSCODE_SFN_REGEX = /^(vscode|vs[0-9a-f]{4})~\d+(\..+)?$/i;
+    GEMINI_SFN_REGEX = /^(gemini|ge[0-9a-f]{4})~\d+(\..+)?$/i;
     AllowedPathChecker = class {
       async check(input) {
         const { toolCall, context: context2 } = input;
@@ -407328,6 +407777,7 @@ var init_built_in = __esm({
           }
           let hasBlockedSegment = false;
           let isVscodePath = false;
+          let isGeminiPath = false;
           for (const resolvedDir of resolvedAllowedDirs) {
             if (!this.isPathAllowed(resolvedPath, resolvedDir))
               continue;
@@ -407341,6 +407791,9 @@ var init_built_in = __esm({
               if (clean === ".vscode" || VSCODE_SFN_REGEX.test(clean)) {
                 isVscodePath = true;
               }
+              if (clean === ".gemini" || GEMINI_SFN_REGEX.test(clean)) {
+                isGeminiPath = true;
+              }
             }
           }
           if (hasBlockedSegment) {
@@ -407349,6 +407802,12 @@ var init_built_in = __esm({
               reason: `Access to sensitive path "${p2}" in argument "${argName}" is blocked.`
             };
           }
+          if (isGeminiPath) {
+            return {
+              decision: SafetyCheckDecision.ASK_USER,
+              reason: `Modifying .gemini configuration files requires explicit user confirmation.`
+            };
+          }
           if (isVscodePath) {
             return {
               decision: SafetyCheckDecision.ASK_USER,
@@ -439180,7 +439639,7 @@ var wo = (s6) => {
 // packages/a2a-server/src/persistence/gcs.ts
 var fse = __toESM(require_lib7(), 1);
 init_dist4();
-import { promises as fsPromises11, createReadStream as createReadStream5 } from "node:fs";
+import { promises as fsPromises12, createReadStream as createReadStream5 } from "node:fs";
 import { join as join35 } from "node:path";
 
 // packages/a2a-server/src/config/config.ts
@@ -439924,7 +440383,7 @@ var GCSTaskStore = class {
         `Task ${taskId} metadata saved to GCS: gs://${this.bucketName}/${metadataObjectPath}`
       );
       if (await fse.pathExists(workDir)) {
-        const entries = await fsPromises11.readdir(workDir);
+        const entries = await fsPromises12.readdir(workDir);
         if (entries.length > 0) {
           const tmpArchiveFile = join35(tmpdir(), getTmpArchiveFilename(taskId));
           try {