@google/gemini-cli-a2a-server 0.64.0-preview.0 → 0.64.0

package/dist/a2a-server.mjs

@@ -221367,8 +221367,8 @@ var GIT_COMMIT_INFO, CLI_VERSION;
 var init_git_commit = __esm({
   "packages/core/dist/src/generated/git-commit.js"() {
     "use strict";
-    GIT_COMMIT_INFO = "fb972b2f8";
-    CLI_VERSION = "0.64.0-preview.0";
+    GIT_COMMIT_INFO = "90997f398";
+    CLI_VERSION = "0.64.0";
   }
 });
 
@@ -337592,7 +337592,7 @@ function getVersion() {
   }
   versionPromise = (async () => {
     const pkgJson = await getPackageJson(__dirname4);
-    return "0.64.0-preview.0";
+    return "0.64.0";
   })();
   return versionPromise;
 }
@@ -339930,6 +339930,13 @@ var init_planUtils = __esm({
 });
 
 // packages/core/dist/src/utils/untrustedContextTracker.js
+function isHighRiskPatternToken(token2) {
+  return token2.startsWith("http://") || token2.startsWith("https://") || token2.startsWith("/") || token2.startsWith("\\") || token2.startsWith("./") || token2.startsWith("../") || /^[a-zA-Z]:[\\/]/.test(token2) || /\.(sh|bash|zsh|ps1|bat|cmd|exe)$/i.test(token2);
+}
+function hasUntrustedSubstring(untrustedContext, value) {
+  const normalized = value.toLowerCase().replace(/\\/g, "/");
+  return untrustedContext.untrustedTexts.some((text) => text.toLowerCase().includes(normalized));
+}
 function extractUntrustedContext(history) {
   const untrustedTexts = [];
   const untrustedTokens = /* @__PURE__ */ new Set();
@@ -339960,35 +339967,19 @@ function extractUntrustedContext(history) {
         if (untrustedContent) {
           const normalizedContent = untrustedContent.replace(/\\/g, "/");
           untrustedTexts.push(normalizedContent);
-          const tokens = normalizedContent.split(/[\s,`"';()|&[\]{}<>]+/).map((t3) => t3.trim()).filter((t3) => t3.length > 1).filter((t3) => !BENIGN_SUBCOMMAND_TOKENS.has(t3.toLowerCase()));
+          const contentWithoutShellMetadata = normalizedContent.replace(/^\s*Output:\s*(\(empty\))?\s*/i, "").replace(/\n(?:Exit Code|Signal|Background PIDs|Process Group PGID):.*$/gim, "");
+          const tokens = contentWithoutShellMetadata.split(/[\s,`"';()|&[\]{}<>]+/).map((t3) => t3.trim()).filter((t3) => t3.length > 1).filter((t3) => !BARE_DASHES_REGEX.test(t3)).filter((t3) => !FILE_MODE_STRING_REGEX.test(t3)).filter((t3) => !BENIGN_SUBCOMMAND_TOKENS.has(t3.toLowerCase())).filter((t3) => !SAFE_SHORT_FLAGS.has(t3)).filter((t3) => !SAFE_LONG_FLAGS.has(t3.toLowerCase()));
           for (const token2 of tokens) {
-            const lowerToken = token2.toLowerCase();
-            untrustedTokens.add(lowerToken);
-            if (lowerToken.startsWith("--")) {
-              untrustedTokens.add(lowerToken.substring(2));
-            } else if (lowerToken.startsWith("-")) {
-              untrustedTokens.add(lowerToken.substring(1));
-            }
-            if (lowerToken.includes("=")) {
-              const eqParts = lowerToken.split("=");
+            const isShortFlag = token2.startsWith("-") && !token2.startsWith("--");
+            const tokenToStore = isShortFlag ? token2 : token2.toLowerCase();
+            untrustedTokens.add(tokenToStore);
+            if (token2.includes("=")) {
+              const eqParts = token2.split("=");
               for (const eqPart of eqParts) {
                 const trimmedPart = eqPart.trim();
-                if (trimmedPart.length > 1) {
-                  untrustedTokens.add(trimmedPart);
-                  if (trimmedPart.startsWith("--")) {
-                    untrustedTokens.add(trimmedPart.substring(2));
-                  } else if (trimmedPart.startsWith("-")) {
-                    untrustedTokens.add(trimmedPart.substring(1));
-                  }
-                }
-              }
-            }
-            if (lowerToken.includes("/")) {
-              const pathParts = lowerToken.split("/");
-              for (const part2 of pathParts) {
-                const trimmedPart = part2.trim();
-                if (trimmedPart.length > 1) {
-                  untrustedTokens.add(trimmedPart);
+                if (trimmedPart.length > 1 && !BARE_DASHES_REGEX.test(trimmedPart) && !SAFE_SHORT_FLAGS.has(trimmedPart) && !SAFE_LONG_FLAGS.has(trimmedPart.toLowerCase())) {
+                  const isPartShortFlag = trimmedPart.startsWith("-") && !trimmedPart.startsWith("--");
+                  untrustedTokens.add(isPartShortFlag ? trimmedPart : trimmedPart.toLowerCase());
                 }
               }
             }
@@ -340007,7 +339998,7 @@ function findUntrustedFlags(command, untrustedContext) {
   let parsed;
   try {
     const normalizedCommand = process.platform === "win32" ? command.replace(/\\(?!")/g, "/") : command;
-    parsed = (0, import_shell_quote5.parse)(normalizedCommand);
+    parsed = (0, import_shell_quote5.parse)(normalizedCommand, (key) => `$${key}`);
   } catch {
     parsed = command.trim().split(/\s+/);
   }
@@ -340030,45 +340021,57 @@ function findUntrustedFlags(command, untrustedContext) {
     const token2 = rawTokens[i3];
     const lowerToken = token2.toLowerCase();
     if (token2.startsWith("-")) {
+      if (/^--?$/.test(token2)) {
+        continue;
+      }
+      let rawFlagName = token2;
       let flagToCheck = lowerToken;
+      let rawValToCheck;
       let valToCheck;
       if (token2.includes("=")) {
-        const eqIdx = lowerToken.indexOf("=");
+        const eqIdx = token2.indexOf("=");
+        rawFlagName = token2.substring(0, eqIdx);
         flagToCheck = lowerToken.substring(0, eqIdx);
+        rawValToCheck = token2.substring(eqIdx + 1);
         valToCheck = lowerToken.substring(eqIdx + 1);
       }
-      if (untrustedContext.untrustedTokens.has(lowerToken) || untrustedContext.untrustedTokens.has(flagToCheck)) {
+      const isSafeFlag = SAFE_SHORT_FLAGS.has(rawFlagName) || SAFE_LONG_FLAGS.has(flagToCheck);
+      const isHighRiskFlag = HIGH_RISK_VALUE_FLAGS.has(rawFlagName) || rawFlagName.startsWith("--") && HIGH_RISK_VALUE_FLAGS.has(flagToCheck);
+      const isShortFlag = rawFlagName.startsWith("-") && !rawFlagName.startsWith("--");
+      const tokenToLookup = isShortFlag ? rawFlagName : lowerToken;
+      const flagToLookup = isShortFlag ? rawFlagName : flagToCheck;
+      if (!isSafeFlag && (untrustedContext.untrustedTokens.has(tokenToLookup) || untrustedContext.untrustedTokens.has(flagToLookup))) {
         detected.add(token2);
-        continue;
+        if (token2.includes("=") || !isHighRiskFlag) {
+          continue;
+        }
       }
-      if (valToCheck && untrustedContext.untrustedTokens.has(valToCheck)) {
-        detected.add(token2);
-        continue;
+      if (valToCheck && rawValToCheck) {
+        const isValUntrusted = untrustedContext.untrustedTokens.has(valToCheck) && (isHighRiskFlag || !isSafeFlag && isHighRiskPatternToken(rawValToCheck));
+        const isHighRiskValSubstring = (!isSafeFlag || isHighRiskFlag) && isHighRiskPatternToken(rawValToCheck) && hasUntrustedSubstring(untrustedContext, valToCheck);
+        if (isValUntrusted || isHighRiskValSubstring) {
+          detected.add(token2);
+          continue;
+        }
       }
-      const nextToken = rawTokens[i3 + 1];
-      if (nextToken && !nextToken.startsWith("-") && untrustedContext.untrustedTokens.has(nextToken.toLowerCase())) {
-        detected.add(token2);
-        detected.add(nextToken);
+      if (!token2.includes("=") && isHighRiskFlag) {
+        const nextToken = rawTokens[i3 + 1];
+        if (nextToken && !nextToken.startsWith("-") && !BARE_SHELL_VARIABLE_REGEX.test(nextToken) && !BENIGN_SUBCOMMAND_TOKENS.has(nextToken.toLowerCase()) && (untrustedContext.untrustedTokens.has(nextToken.toLowerCase()) || isHighRiskPatternToken(nextToken) && hasUntrustedSubstring(untrustedContext, nextToken))) {
+          detected.add(token2);
+          detected.add(nextToken);
+        }
       }
     } else {
-      if (token2.length <= 1) {
+      if (token2.length <= 1 || BARE_SHELL_VARIABLE_REGEX.test(token2)) {
         continue;
       }
-      const isSensitiveWord = token2.includes("/") || token2.includes(".") || token2.includes(":");
-      const isHighRiskPattern = token2.startsWith("http://") || token2.startsWith("https://") || token2.startsWith("/") || token2.startsWith("\\") || /^[a-zA-Z]:[\\/]/.test(token2);
-      if (isSensitiveWord) {
+      if (isHighRiskPatternToken(token2)) {
         if (untrustedContext.untrustedTokens.has(lowerToken)) {
           detected.add(token2);
           continue;
         }
-        if (isHighRiskPattern) {
-          const normalizedLowerToken = lowerToken.replace(/\\/g, "/");
-          for (const text of untrustedContext.untrustedTexts) {
-            if (text.toLowerCase().includes(normalizedLowerToken)) {
-              detected.add(token2);
-              break;
-            }
-          }
+        if (hasUntrustedSubstring(untrustedContext, lowerToken)) {
+          detected.add(token2);
         }
       }
     }
@@ -340126,7 +340129,7 @@ function getModifiedBuildFiles(sessionKey) {
   }
   return [];
 }
-var import_shell_quote5, UNTRUSTED_CONTEXT_REGEX, BUILD_TEST_COMMAND_ROOTS, BENIGN_SUBCOMMAND_TOKENS, MODIFIED_BUILD_FILES_SYMBOL;
+var import_shell_quote5, UNTRUSTED_CONTEXT_REGEX, BUILD_TEST_COMMAND_ROOTS, BENIGN_SUBCOMMAND_TOKENS, SAFE_SHORT_FLAGS, SAFE_LONG_FLAGS, HIGH_RISK_VALUE_FLAGS, FILE_MODE_STRING_REGEX, BARE_DASHES_REGEX, BARE_SHELL_VARIABLE_REGEX, MODIFIED_BUILD_FILES_SYMBOL;
 var init_untrustedContextTracker = __esm({
   "packages/core/dist/src/utils/untrustedContextTracker.js"() {
     "use strict";
@@ -340177,6 +340180,135 @@ var init_untrustedContextTracker = __esm({
       "restart",
       "status"
     ]);
+    SAFE_SHORT_FLAGS = /* @__PURE__ */ new Set([
+      "-a",
+      "-A",
+      "-b",
+      "-B",
+      "-C",
+      "-d",
+      "-D",
+      "-E",
+      "-F",
+      "-g",
+      "-G",
+      "-h",
+      "-H",
+      "-i",
+      "-I",
+      "-l",
+      "-L",
+      "-m",
+      "-n",
+      "-N",
+      "-p",
+      "-P",
+      "-q",
+      "-r",
+      "-R",
+      "-s",
+      "-S",
+      "-t",
+      "-T",
+      "-u",
+      "-U",
+      "-v",
+      "-V",
+      "-w",
+      "-W",
+      "-x",
+      "-z",
+      "-1",
+      // Common combined POSIX inspection flags (ls, grep, ps, git)
+      "-la",
+      "-al",
+      "-ld",
+      "-dl",
+      "-lh",
+      "-hl",
+      "-lah",
+      "-alh",
+      "-lrt",
+      "-ltr",
+      "-rn",
+      "-nr",
+      "-ri",
+      "-ir",
+      "-rni",
+      "-rin",
+      "-ni",
+      "-in",
+      "-ef",
+      "-aux"
+    ]);
+    SAFE_LONG_FLAGS = /* @__PURE__ */ new Set([
+      "--all",
+      "--oneline",
+      "--stat",
+      "--numstat",
+      "--shortstat",
+      "--name-only",
+      "--name-status",
+      "--graph",
+      "--decorate",
+      "--no-pager",
+      "--color",
+      "--no-color",
+      "--grep",
+      "--author",
+      "--since",
+      "--until",
+      "--before",
+      "--after",
+      "--pretty",
+      "--format",
+      "--abbrev-commit",
+      "--max-count",
+      "--cached",
+      "--staged",
+      "--short",
+      "--branch",
+      "--porcelain",
+      "--help",
+      "--version",
+      "--quiet",
+      "--verbose",
+      "--dry-run",
+      "--ignore-case",
+      "--line-number",
+      "--recursive",
+      "--extended-regexp",
+      "--fixed-strings",
+      "--files-with-matches",
+      "--count",
+      "--context",
+      "--before-context",
+      "--after-context"
+    ]);
+    HIGH_RISK_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "-c",
+      "-e",
+      "--eval",
+      "--exec",
+      "-exec",
+      "-execdir",
+      "--run_under",
+      "--test_strategy",
+      "--test_arg",
+      "--test_env",
+      "--action_env",
+      "--jvmopt",
+      "--host_jvm_args",
+      "--wrapper_script_flag",
+      "--upload-pack",
+      "--receive-pack",
+      "--require",
+      "--import",
+      "--loader"
+    ]);
+    FILE_MODE_STRING_REGEX = /^[dcbpsl-][rwxstST-]{9}[+@.]?$/i;
+    BARE_DASHES_REGEX = /^--+$/;
+    BARE_SHELL_VARIABLE_REGEX = /^\$(?:[a-zA-Z_][a-zA-Z0-9_]*|\{[a-zA-Z_][a-zA-Z0-9_]*\})$/;
     MODIFIED_BUILD_FILES_SYMBOL = Symbol("sessionModifiedBuildFiles");
   }
 });
@@ -368074,6 +368206,9 @@ function scrubPart(part) {
     if (part.functionResponse.id) {
       scrubbedResp["id"] = part.functionResponse.id;
     }
+    if ("parts" in part.functionResponse && Array.isArray(part.functionResponse.parts)) {
+      scrubbedResp["parts"] = part.functionResponse.parts.map(scrubPart);
+    }
     scrubbed["functionResponse"] = scrubbedResp;
   }
   if ("fileData" in part) {
@@ -368221,8 +368356,41 @@ function isSchemaDepthError(errorMessage) {
 function isInvalidArgumentError(errorMessage) {
   return errorMessage.includes("Request contains an invalid argument");
 }
+function isEmptyTextPart(part) {
+  if (part.text !== "") {
+    return false;
+  }
+  return !Object.keys(part).some((key) => key !== "text" && key !== "thought" && key !== "callIndex");
+}
+function hasNonEmptyParts(content) {
+  return (content.parts ?? []).some((part) => !isEmptyTextPart(part));
+}
+function buildInterruptedToolResponseParts(parts2) {
+  return parts2.filter((part) => !!part?.functionCall).map((part) => ({
+    functionResponse: {
+      name: part.functionCall.name?.trim() || "generic_tool",
+      id: part.functionCall.id,
+      response: { error: INTERRUPTED_TOOL_RESPONSE_ERROR }
+    }
+  }));
+}
+function ensureTerminalUserTurn(contents) {
+  const last2 = contents.at(-1);
+  if (last2?.role === "user" && hasNonEmptyParts(last2)) {
+    return contents;
+  }
+  if (last2?.role === "user") {
+    return [
+      ...contents.slice(0, -1),
+      { ...last2, parts: [{ text: CONTINUE_PROMPT_TEXT }] }
+    ];
+  }
+  const missingResponses = buildInterruptedToolResponseParts(last2?.parts ?? []);
+  const parts2 = missingResponses.length > 0 ? missingResponses : [{ text: CONTINUE_PROMPT_TEXT }];
+  return [...contents, { role: "user", parts: parts2 }];
+}
 function stripToolCallIdPrefixes(contents) {
-  return contents.map((content) => {
+  const stripped = contents.map((content) => {
     const parts2 = (content.parts || []).map((part) => {
       const newPart = { ...part };
       if (newPart.functionCall) {
@@ -368230,8 +368398,7 @@ function stripToolCallIdPrefixes(contents) {
         const name3 = fc.name?.trim() || "generic_tool";
         if (fc.id && fc.id.startsWith(`${name3}__`)) {
           newPart.functionCall = {
-            name: fc.name,
-            args: fc.args,
+            ...fc,
             id: fc.id.substring(name3.length + 2)
           };
         }
@@ -368241,8 +368408,9 @@ function stripToolCallIdPrefixes(contents) {
         const name3 = fr2.name?.trim() || "generic_tool";
         if (fr2.id && fr2.id.startsWith(`${name3}__`)) {
           newPart.functionResponse = {
-            name: fr2.name,
-            response: fr2.response,
+            // History parts are plain JSON objects, not class instances.
+            // eslint-disable-next-line @typescript-eslint/no-misused-spread
+            ...fr2,
             id: fr2.id.substring(name3.length + 2)
           };
         }
@@ -368252,18 +368420,30 @@ function stripToolCallIdPrefixes(contents) {
         delete newPart.text;
       }
       return newPart;
-    }).filter((part) => {
-      const hasOtherKeys = Object.keys(part).some((key) => key !== "text" && key !== "thought" && key !== "callIndex");
-      if (part.text !== void 0 && part.text === "" && !hasOtherKeys) {
-        return false;
-      }
-      return true;
-    });
+    }).filter((part) => !isEmptyTextPart(part));
     return {
       ...content,
       parts: parts2
     };
-  });
+  }).filter((content) => content.parts.length > 0);
+  return coalesceConsecutiveContents(stripped);
+}
+function coalesceConsecutiveContents(contents) {
+  const result2 = [];
+  for (const item of contents) {
+    const lastIdx = result2.length - 1;
+    const last2 = result2[lastIdx];
+    if (last2 && last2.role && last2.role === item.role) {
+      const hasParts = last2.parts || item.parts;
+      result2[lastIdx] = {
+        ...last2,
+        parts: hasParts ? [...last2.parts || [], ...item.parts || []] : void 0
+      };
+    } else {
+      result2.push({ ...item });
+    }
+  }
+  return result2;
 }
 function coalesceConsecutiveRoles(history) {
   const result2 = [];
@@ -368318,7 +368498,7 @@ function stripThoughts2(history) {
     };
   }).filter((turn) => !turn.content.parts || turn.content.parts.length > 0);
 }
-var StreamEventType, MID_STREAM_RETRY_OPTIONS, SYNTHETIC_THOUGHT_SIGNATURE2, INTERRUPTED_RESPONSE_PLACEHOLDER, THINKING_ONLY_NUDGE_MESSAGE, NO_RESPONSE_TEXT_NUDGE_MESSAGE, InvalidStreamError, AgentExecutionStoppedError, AgentExecutionBlockedError, GeminiChat;
+var StreamEventType, MID_STREAM_RETRY_OPTIONS, SYNTHETIC_THOUGHT_SIGNATURE2, INTERRUPTED_RESPONSE_PLACEHOLDER, INTERRUPTED_TOOL_RESPONSE_ERROR, CONTINUE_PROMPT_TEXT, THINKING_ONLY_NUDGE_MESSAGE, NO_RESPONSE_TEXT_NUDGE_MESSAGE, InvalidStreamError, AgentExecutionStoppedError, AgentExecutionBlockedError, GeminiChat;
 var init_geminiChat = __esm({
   "packages/core/dist/src/core/geminiChat.js"() {
     "use strict";
@@ -368341,6 +368521,7 @@ var init_geminiChat = __esm({
     init_tokenCalculation();
     init_policyHelpers();
     init_events();
+    init_debugLogger();
     (function(StreamEventType2) {
       StreamEventType2["CHUNK"] = "chunk";
       StreamEventType2["RETRY"] = "retry";
@@ -368355,6 +368536,8 @@ var init_geminiChat = __esm({
     };
     SYNTHETIC_THOUGHT_SIGNATURE2 = "skip_thought_signature_validator";
     INTERRUPTED_RESPONSE_PLACEHOLDER = "[The previous response was interrupted before it completed.]";
+    INTERRUPTED_TOOL_RESPONSE_ERROR = "Response was lost or interrupted.";
+    CONTINUE_PROMPT_TEXT = "Please continue.";
     THINKING_ONLY_NUDGE_MESSAGE = "[System: You previously generated thoughts but failed to provide a final user-facing response. Please ensure you provide your final answer or call a tool now.]";
     NO_RESPONSE_TEXT_NUDGE_MESSAGE = "[System: You previously returned an empty response with no text or thoughts. Please ensure you provide your final answer or call a tool now.]";
     InvalidStreamError = class extends Error {
@@ -368486,6 +368669,7 @@ var init_geminiChat = __esm({
         let userContent = createUserContent(message);
         const isOriginalFunctionResponse = isFunctionResponse(userContent);
         if (!isOriginalFunctionResponse) {
+          this.closeUnansweredToolCallsTurn();
           this.closeUnansweredToolResponseTurn();
         }
         const { model } = this.context.config.modelConfigService.getResolvedConfig(modelConfigKey);
@@ -368512,7 +368696,7 @@ var init_geminiChat = __esm({
           } else {
             const history = this.agentHistory.get();
             const lastTurn = history[history.length - 1];
-            if (!lastTurn || partListUnionToString(lastTurn.content.parts || []) !== userMessageContent) {
+            if (!lastTurn || lastTurn.content.role !== "user" || partListUnionToString(lastTurn.content.parts || []) !== userMessageContent) {
               const id = this.chatRecordingService.recordMessage({
                 model,
                 type: "user",
@@ -368560,11 +368744,12 @@ var init_geminiChat = __esm({
           } else {
             const history = this.agentHistory.get();
             const lastTurn = history[history.length - 1];
-            if (!lastTurn || partListUnionToString(lastTurn.content.parts || []) !== partListUnionToString(userContent.parts || [])) {
+            if (!lastTurn || lastTurn.content.role !== "user" || partListUnionToString(lastTurn.content.parts || []) !== partListUnionToString(userContent.parts || [])) {
               this.agentHistory.push({ id, content: userContent });
             }
           }
         }
+        this.replaceEmptyTrailingUserTurn();
         const requestHistory = this.getHistoryTurns(true);
         const streamWithRetries = async function* () {
           let isSuccess = false;
@@ -368676,23 +368861,77 @@ var init_geminiChat = __esm({
         return streamWithRetries.call(this);
       }
       /**
-       * Appends a closing model turn when history ends with an unanswered tool
-       * response, so the next user message stays a turn of its own.
+       * Appends a dedicated synthetic user turn with matching functionResponse
+       * parts when history ends with an unclosed model functionCall. The
+       * subsequent user prompt is then recorded as a clean turn of its own (after
+       * `closeUnansweredToolResponseTurn` adds the closing model turn).
        */
-      closeUnansweredToolResponseTurn() {
+      closeUnansweredToolCallsTurn() {
         const turns = this.agentHistory.get();
         const last2 = turns[turns.length - 1];
-        if (last2?.content.role !== "user" || !last2.content.parts?.some((part) => !!part.functionResponse)) {
+        if (last2?.content.role !== "model") {
+          return;
+        }
+        const missingResponses = buildInterruptedToolResponseParts(last2.content.parts ?? []);
+        if (missingResponses.length === 0) {
           return;
         }
+        const id = this.chatRecordingService.recordSyntheticMessage("user", missingResponses);
         this.agentHistory.push({
-          id: randomUUID8(),
-          content: {
-            role: "model",
-            parts: [{ text: INTERRUPTED_RESPONSE_PLACEHOLDER }]
-          }
+          id,
+          content: { role: "user", parts: missingResponses }
         });
       }
+      /**
+       * Replaces the parts of a trailing user turn that carries no content (e.g.
+       * only empty text parts) with a continuation prompt, keeping the in-memory
+       * history and the session log in sync. Runs once per send so that the
+       * persisted history never keeps an empty user turn between model turns.
+       */
+      replaceEmptyTrailingUserTurn() {
+        const turns = this.agentHistory.get();
+        const last2 = turns[turns.length - 1];
+        if (last2?.content.role !== "user" || hasNonEmptyParts(last2.content)) {
+          return;
+        }
+        this.agentHistory.set([
+          ...turns.slice(0, -1),
+          {
+            id: last2.id,
+            content: { ...last2.content, parts: [{ text: CONTINUE_PROMPT_TEXT }] }
+          }
+        ]);
+        this.chatRecordingService.updateMessagesFromHistory(this.agentHistory.get());
+      }
+      /**
+       * Appends a closing model turn when history ends with an unanswered tool
+       * response, so the next user message stays a turn of its own.
+       */
+      closeUnansweredToolResponseTurn() {
+        const turns = this.agentHistory.get();
+        let targetTurn = turns[turns.length - 1];
+        let hadEmptyTrailingModelTurn = false;
+        if (targetTurn?.content.role === "model" && (!targetTurn.content.parts || targetTurn.content.parts.length === 0)) {
+          hadEmptyTrailingModelTurn = true;
+          targetTurn = turns[turns.length - 2];
+        }
+        if (targetTurn?.content.role !== "user" || !targetTurn.content.parts?.some((part) => !!part.functionResponse)) {
+          return;
+        }
+        if (hadEmptyTrailingModelTurn) {
+          const lastTurn = turns[turns.length - 1];
+          lastTurn.content.parts = [{ text: INTERRUPTED_RESPONSE_PLACEHOLDER }];
+          this.chatRecordingService.updateMessagesFromHistory(turns);
+        } else {
+          this.agentHistory.push({
+            id: randomUUID8(),
+            content: {
+              role: "model",
+              parts: [{ text: INTERRUPTED_RESPONSE_PLACEHOLDER }]
+            }
+          });
+        }
+      }
       extractBinaryInjections(parts2) {
         const binaryParts = [];
         if (parts2) {
@@ -368809,10 +369048,14 @@ var init_geminiChat = __esm({
           if (this.onModelChanged) {
             this.tools = await this.onModelChanged(modelToUse);
           }
+          const normalizedContents = ensureTerminalUserTurn(contentsToUse);
+          if (normalizedContents !== contentsToUse) {
+            debugLogger.warn("Final contents do not end with a valid user turn. Normalizing contents to satisfy Gemini API invariant.");
+          }
           lastModelToUse = modelToUse;
           lastConfig = config2;
-          lastContentsToUse = contentsToUse;
-          const finalContents = stripToolCallIdPrefixes(contentsToUse);
+          lastContentsToUse = normalizedContents;
+          const finalContents = stripToolCallIdPrefixes(normalizedContents);
           return this.context.config.getContentGenerator().generateContentStream({
             model: modelToUse,
             contents: finalContents,
@@ -368910,6 +369153,25 @@ var init_geminiChat = __esm({
         }
         ensureStableToolIds(this.agentHistory.get());
       }
+      /**
+       * Removes the trailing model turn when it holds function calls that were
+       * never answered (e.g. every call in the batch was declined). Earlier
+       * completed tool rounds and the originating user prompt are kept, and the
+       * durable IDs of the remaining turns are preserved.
+       *
+       * @returns true when a turn was removed.
+       */
+      discardTrailingUnansweredToolCallTurn() {
+        const turns = this.agentHistory.get();
+        const last2 = turns[turns.length - 1];
+        if (last2?.content.role !== "model" || !last2.content.parts?.some((part) => !!part.functionCall)) {
+          return false;
+        }
+        this.agentHistory.rollback(turns.length - 1);
+        this.lastPromptTokenCount = estimateTokenCountSync(this.agentHistory.flatMap((c2) => c2.content.parts || []));
+        this.chatRecordingService.updateMessagesFromHistory(this.agentHistory.get());
+        return true;
+      }
       setHistory(history) {
         const wrappedHistory = history.map((item) => {
           if ("id" in item && "content" in item) {
@@ -376673,7 +376935,13 @@ var init_oauth_utils = __esm({
           issuer: metadata2.issuer,
           tokenUrl: metadata2.token_endpoint,
           scopes: metadata2.scopes_supported || [],
-          registrationUrl: metadata2.registration_endpoint
+          registrationUrl: metadata2.registration_endpoint,
+          // RFC 9207 Section 3: the flag defaults to false when omitted. Discovered
+          // configurations therefore always carry an explicit boolean, which lets
+          // the callback policy distinguish them from an explicitly configured issuer.
+          // Only a literal boolean `true` enables the flag, so loosely typed values
+          // returned by some servers (e.g. "false" or "0") are not coerced to true.
+          authorizationResponseIssParameterSupported: metadata2.authorization_response_iss_parameter_supported === true
         };
       }
       /**
@@ -380473,7 +380741,7 @@ function areIssuersEqual(issuerA, issuerB) {
   }
   return normA === normB;
 }
-function startCallbackServer(expectedState, port, expectedIssuer) {
+function startCallbackServer(expectedState, port, expectedIssuer, requireIssInResponse) {
   let portResolve;
   let portReject;
   const portPromise = new Promise((resolve23, reject) => {
@@ -380527,8 +380795,9 @@ function startCallbackServer(expectedState, port, expectedIssuer) {
           return;
         }
         if (expectedIssuer) {
-          if (!iss) {
-            debugLogger.error('OAuth callback rejected: Missing required "iss" parameter when an expected issuer is configured. Possible IdP mix-up attack (RFC 9207).');
+          const requireIss = requireIssInResponse ?? true;
+          if (requireIss && !iss) {
+            debugLogger.error('OAuth callback rejected: Missing required "iss" parameter for the expected authorization server (RFC 9207).');
             res.writeHead(400, { "Content-Type": "text/html" });
             res.end(`
                 <html>
@@ -380543,7 +380812,7 @@ function startCallbackServer(expectedState, port, expectedIssuer) {
             reject(new Error('Missing "iss" parameter in authorization response per RFC 9207'));
             return;
           }
-          if (!areIssuersEqual(iss, expectedIssuer)) {
+          if (iss && !areIssuersEqual(iss, expectedIssuer)) {
             debugLogger.error("OAuth callback rejected: Issuer mismatch between authorization response and expected authorization server. Possible IdP mix-up attack (RFC 9207).");
             res.writeHead(400, { "Content-Type": "text/html" });
             res.end(`
@@ -380559,7 +380828,9 @@ function startCallbackServer(expectedState, port, expectedIssuer) {
             reject(new Error("Issuer mismatch in authorization response - possible OAuth mix-up attack"));
             return;
           }
-          debugLogger.debug("\u2713 OAuth callback issuer validated successfully.");
+          if (iss) {
+            debugLogger.debug("\u2713 OAuth callback issuer validated successfully.");
+          }
         } else if (iss) {
           debugLogger.debug('OAuth callback received "iss" parameter (no expected issuer was configured).');
         }
@@ -387642,6 +387913,21 @@ var init_client3 = __esm({
         this.updateTelemetryTokenCount();
         this.forceFullIdeContext = true;
       }
+      /**
+       * Removes the trailing model turn when it only holds unanswered function
+       * calls. See {@link GeminiChat.discardTrailingUnansweredToolCallTurn}.
+       * Returns false without side effects when the chat is not initialized.
+       */
+      discardTrailingUnansweredToolCallTurn() {
+        if (!this.isInitialized()) {
+          return false;
+        }
+        const removed = this.getChat().discardTrailingUnansweredToolCallTurn();
+        if (removed) {
+          this.updateTelemetryTokenCount();
+        }
+        return removed;
+      }
       lastUsedModelId;
       async setTools(modelId) {
         if (!this.chat) {
@@ -404549,7 +404835,7 @@ var init_policy_engine = __esm({
         }
         return decision;
       }
-      async checkShellCommand(toolName, command, ruleDecision, serverName, dir_path, allowRedirection, rule, toolAnnotations, subagent) {
+      async checkShellCommand(toolName, command, ruleDecision, serverName, dir_path, allowRedirection, rule, toolAnnotations, subagent, hasTopLevelHeuristicDowngrade = false) {
         if (!command) {
           return {
             decision: ruleDecision,
@@ -404585,13 +404871,17 @@ var init_policy_engine = __esm({
         }
         let aggregateDecision = ruleDecision;
         let responsibleRule = rule && ruleDecision === rule.decision ? rule : void 0;
-        if (this.shouldDowngradeForRedirection(command, allowRedirection, rule)) {
+        const hasTopLevelRedirectionDowngrade = this.shouldDowngradeForRedirection(command, allowRedirection, rule);
+        if (hasTopLevelRedirectionDowngrade) {
           if (aggregateDecision === PolicyDecision.ALLOW) {
             debugLogger.debug(`[PolicyEngine.check] Downgrading ALLOW to ASK_USER for redirected command: ${command}`);
             aggregateDecision = PolicyDecision.ASK_USER;
             responsibleRule = void 0;
           }
         }
+        let evaluatedSubCommands = 0;
+        let allSubCommandsExplicitlyAllowed = true;
+        let lastAllowedSubRule;
         for (const detail of subCommands) {
           if (REDIRECTION_NAMES.has(detail.name)) {
             continue;
@@ -404600,23 +404890,31 @@ var init_policy_engine = __esm({
           const isAtomic = subCmd === command || detail.startIndex === 0 && detail.text.length === command.length;
           const stripped = stripShellWrapper(subCmd);
           if (stripped !== subCmd) {
+            evaluatedSubCommands++;
             const wrapperResult = await this.check({ name: toolName, args: { command: stripped, dir_path } }, serverName, toolAnnotations, subagent, true);
             if (wrapperResult.decision === PolicyDecision.DENY)
               return wrapperResult;
             if (wrapperResult.decision === PolicyDecision.ASK_USER) {
+              allSubCommandsExplicitlyAllowed = false;
               if (aggregateDecision === PolicyDecision.ALLOW) {
                 responsibleRule = wrapperResult.rule;
               } else {
                 responsibleRule ??= wrapperResult.rule;
               }
               aggregateDecision = PolicyDecision.ASK_USER;
+            } else if (wrapperResult.decision === PolicyDecision.ALLOW && wrapperResult.rule?.decision === PolicyDecision.ALLOW && Boolean(wrapperResult.rule?.argsPattern)) {
+              lastAllowedSubRule = wrapperResult.rule;
+            } else {
+              allSubCommandsExplicitlyAllowed = false;
             }
           }
           if (!isAtomic) {
+            evaluatedSubCommands++;
             const subResult = await this.check({ name: toolName, args: { command: subCmd, dir_path } }, serverName, toolAnnotations, subagent, true);
             if (subResult.decision === PolicyDecision.DENY)
               return subResult;
             if (subResult.decision === PolicyDecision.ASK_USER) {
+              allSubCommandsExplicitlyAllowed = false;
               if (aggregateDecision === PolicyDecision.ALLOW) {
                 responsibleRule = subResult.rule;
               } else {
@@ -404625,13 +404923,31 @@ var init_policy_engine = __esm({
               aggregateDecision = PolicyDecision.ASK_USER;
             }
             if (subResult.decision === PolicyDecision.ALLOW && this.shouldDowngradeForRedirection(subCmd, subResult.rule?.allowRedirection ?? allowRedirection, subResult.rule)) {
+              allSubCommandsExplicitlyAllowed = false;
               if (aggregateDecision === PolicyDecision.ALLOW) {
                 aggregateDecision = PolicyDecision.ASK_USER;
                 responsibleRule = void 0;
               }
+            } else if (subResult.decision === PolicyDecision.ALLOW && subResult.rule?.decision === PolicyDecision.ALLOW && Boolean(subResult.rule?.argsPattern)) {
+              lastAllowedSubRule = subResult.rule;
+            } else {
+              allSubCommandsExplicitlyAllowed = false;
             }
+          } else if (stripped === subCmd) {
+            allSubCommandsExplicitlyAllowed = false;
           }
         }
+        const workspace = typeof this.sandboxManager.getWorkspace === "function" ? this.sandboxManager.getWorkspace() : process.cwd();
+        const effectiveCwd = dir_path ? path85.resolve(workspace, dir_path) : workspace;
+        const isOutsideWorkspace = effectiveCwd !== workspace && !isSubpath(workspace, effectiveCwd) && this.approvalMode !== ApprovalMode.YOLO;
+        const parsedObjArgs = (0, import_shell_quote7.parse)(command);
+        const parsedArgs = parsedObjArgs.map(extractStringFromParseEntry);
+        const isUntrustedGit = containsGitCommand(parsedArgs) && !this.isTrustedFolder();
+        const isDangerous = this.approvalMode !== ApprovalMode.YOLO && this.sandboxManager.isDangerousCommand(parsedArgs, effectiveCwd);
+        if (aggregateDecision === PolicyDecision.ASK_USER && !rule?.argsPattern && !hasTopLevelRedirectionDowngrade && !hasTopLevelHeuristicDowngrade && !isOutsideWorkspace && !isUntrustedGit && !isDangerous && evaluatedSubCommands > 0 && allSubCommandsExplicitlyAllowed) {
+          aggregateDecision = PolicyDecision.ALLOW;
+          responsibleRule = lastAllowedSubRule;
+        }
         return {
           decision: aggregateDecision,
           rule: aggregateDecision === ruleDecision ? rule : responsibleRule
@@ -404689,11 +405005,16 @@ var init_policy_engine = __esm({
           if (match2) {
             debugLogger.debug(`[PolicyEngine.check] MATCHED rule: toolName=${rule.toolName}, decision=${rule.decision}, priority=${rule.priority}, argsPattern=${rule.argsPattern?.source || "none"}`);
             let ruleDecision = rule.decision;
+            let hasTopLevelHeuristicDowngrade = false;
             if (!skipHeuristics && isShellCommand && command && !("commandPrefix" in rule) && !rule.argsPattern) {
+              const prevDecision = ruleDecision;
               ruleDecision = await this.applyShellHeuristics(command, ruleDecision, shellDirPath);
+              if (prevDecision === PolicyDecision.ALLOW && ruleDecision === PolicyDecision.ASK_USER) {
+                hasTopLevelHeuristicDowngrade = true;
+              }
             }
             if (isShellCommand && toolName) {
-              const shellResult = await this.checkShellCommand(toolName, command, ruleDecision, serverName, shellDirPath, rule.allowRedirection, rule, toolAnnotations, subagent);
+              const shellResult = await this.checkShellCommand(toolName, command, ruleDecision, serverName, shellDirPath, rule.allowRedirection, rule, toolAnnotations, subagent, hasTopLevelHeuristicDowngrade);
               decision = shellResult.decision;
               matchedRule = shellResult.rule;
               break;
@@ -404712,10 +405033,15 @@ var init_policy_engine = __esm({
             debugLogger.debug(`[PolicyEngine.check] NO MATCH - using default decision: ${this.defaultDecision}`);
             if (toolName && SHELL_TOOL_NAMES.includes(toolName)) {
               let heuristicDecision = this.defaultDecision;
+              let hasTopLevelHeuristicDowngrade = false;
               if (!skipHeuristics && command) {
+                const prevDecision = heuristicDecision;
                 heuristicDecision = await this.applyShellHeuristics(command, heuristicDecision, shellDirPath);
+                if (prevDecision === PolicyDecision.ALLOW && heuristicDecision === PolicyDecision.ASK_USER) {
+                  hasTopLevelHeuristicDowngrade = true;
+                }
               }
-              const shellResult = await this.checkShellCommand(toolName, command, heuristicDecision, serverName, shellDirPath, false, void 0, toolAnnotations, subagent);
+              const shellResult = await this.checkShellCommand(toolName, command, heuristicDecision, serverName, shellDirPath, false, void 0, toolAnnotations, subagent, hasTopLevelHeuristicDowngrade);
               decision = shellResult.decision;
               matchedRule = shellResult.rule;
             } else {
@@ -410196,6 +410522,7 @@ var init_oauth_provider = __esm({
                     issuer: discoveredConfig.issuer,
                     tokenUrl: discoveredConfig.tokenUrl,
                     scopes: config2.scopes || discoveredConfig.scopes || [],
+                    authorizationResponseIssParameterSupported: config2.authorizationResponseIssParameterSupported ?? discoveredConfig.authorizationResponseIssParameterSupported,
                     // Preserve existing client credentials
                     clientId: config2.clientId,
                     clientSecret: config2.clientSecret
@@ -410219,6 +410546,7 @@ var init_oauth_provider = __esm({
                 issuer: discoveredConfig.issuer,
                 scopes: config2.scopes || discoveredConfig.scopes || [],
                 registrationUrl: discoveredConfig.registrationUrl,
+                authorizationResponseIssParameterSupported: config2.authorizationResponseIssParameterSupported ?? discoveredConfig.authorizationResponseIssParameterSupported,
                 // Preserve existing client credentials
                 clientId: config2.clientId,
                 clientSecret: config2.clientSecret
@@ -410231,7 +410559,8 @@ var init_oauth_provider = __esm({
         const pkceParams = generatePKCEParams();
         const preferredPort = getPortFromUrl(config2.redirectUri);
         debugLogger.debug(`Starting callback server for "${serverName}" (expected issuer: ${config2.issuer || "none"})...`);
-        const callbackServer = startCallbackServer(pkceParams.state, preferredPort, config2.issuer);
+        const requireIssInResponse = config2.authorizationResponseIssParameterSupported ?? Boolean(config2.issuer);
+        const callbackServer = startCallbackServer(pkceParams.state, preferredPort, config2.issuer, requireIssInResponse);
         const redirectPort = await callbackServer.port;
         debugLogger.debug(`Callback server listening on port ${redirectPort}`);
         if (!config2.clientId) {
@@ -410628,7 +410957,8 @@ async function handleAutomaticOAuth(mcpServerName, mcpServerConfig, wwwAuthentic
       authorizationUrl: oauthConfig.authorizationUrl,
       issuer: oauthConfig.issuer,
       tokenUrl: oauthConfig.tokenUrl,
-      scopes: oauthConfig.scopes || []
+      scopes: oauthConfig.scopes || [],
+      authorizationResponseIssParameterSupported: mcpServerConfig.oauth?.authorizationResponseIssParameterSupported ?? oauthConfig.authorizationResponseIssParameterSupported
     };
     debugLogger.log(`Starting OAuth authentication for server '${mcpServerName}'...`);
     const authProvider = new MCPOAuthProvider(new MCPOAuthTokenStorage());
@@ -411044,7 +411374,8 @@ async function connectToMcpServer(clientVersion, mcpServerName, mcpServerConfig,
               authorizationUrl: oauthConfig.authorizationUrl,
               issuer: oauthConfig.issuer,
               tokenUrl: oauthConfig.tokenUrl,
-              scopes: oauthConfig.scopes || []
+              scopes: oauthConfig.scopes || [],
+              authorizationResponseIssParameterSupported: mcpServerConfig.oauth?.authorizationResponseIssParameterSupported ?? oauthConfig.authorizationResponseIssParameterSupported
             };
             const authServerUrl = mcpServerConfig.httpUrl || mcpServerConfig.url;
             debugLogger.log(`Starting OAuth authentication for server '${mcpServerName}'...`);