@google/gemini-cli 0.48.0-nightly.20260612.g4e10a34be → 0.48.0-preview.0

package/bundle/{chunk-3P56CQDW.js → chunk-KXJA2W44.js}

@@ -6,7 +6,7 @@ import {
 import {
   exitCli,
   require_source
-} from "./chunk-3BHPNRR5.js";
+} from "./chunk-WLIX7UZL.js";
 import {
   DEFAULT_BACKGROUND_OPACITY,
   DEFAULT_BORDER_OPACITY,
@@ -58,22 +58,20 @@ import {
   stripUnsafeCharacters,
   toCodePoints,
   validateCustomTheme
-} from "./chunk-57QJRHS6.js";
+} from "./chunk-76ONBIQT.js";
 import {
   isDevelopment
-} from "./chunk-DR6M2CVX.js";
+} from "./chunk-OAXLII52.js";
 import {
   emptyIcon,
   require_react
-} from "./chunk-GUFPYIHD.js";
+} from "./chunk-ZMBUTQOC.js";
 import {
   ALL_EDITORS,
   ApprovalMode,
   AsyncFzf,
-  AuthType,
   Config,
   CoreEvent,
-  CoreToolCallStatus,
   DiscoveredMCPTool,
   ExtensionDisableEvent,
   ExtensionEnableEvent,
@@ -84,31 +82,20 @@ import {
   ExtensionUpdateEvent,
   GEMINI_CLI_COMPANION_EXTENSION_NAME,
   GEMINI_DIR,
-  HookType,
-  IDEConnectionStatus,
   INITIAL_HISTORY_LENGTH,
   IdeClient,
   IdeConnectionEvent,
-  IdeConnectionType,
-  IntegrityDataStatus,
   KeychainTokenStorage,
-  LlmRole,
-  MCPDiscoveryState,
   MCPOAuthTokenStorage,
-  MCPServerStatus,
   ModelSlashCommandEvent,
-  PolicyDecision,
   ProjectIdRequiredError,
   REFERENCE_CONTENT_END,
   REFERENCE_CONTENT_START,
   ReadManyFilesTool,
   RewindEvent,
-  SessionEndReason,
-  SessionStartSource,
   ShellExecutionService,
   StartSessionEvent,
   Storage,
-  TrustLevel,
   UPGRADE_URL_PAGE,
   UserAccountManager,
   ValidationRequiredError,
@@ -243,7 +230,7 @@ import {
   tokenLimit,
   uiTelemetryService,
   unescapePath
-} from "./chunk-47O5POZQ.js";
+} from "./chunk-JFJQ6J4C.js";
 import {
   require_src
 } from "./chunk-TUDYL3X4.js";
@@ -11708,9 +11695,9 @@ var require_prompts = __commonJS({
     $3.date = (args) => toPrompt("DatePrompt", args);
     $3.confirm = (args) => toPrompt("ConfirmPrompt", args);
     $3.list = (args) => {
-      const sep4 = args.separator || ",";
+      const sep5 = args.separator || ",";
       return toPrompt("TextPrompt", args, {
-        onSubmit: (str) => str.split(sep4).map((s3) => s3.trim())
+        onSubmit: (str) => str.split(sep5).map((s3) => s3.trim())
       });
     };
     $3.toggle = (args) => toPrompt("TogglePrompt", args);
@@ -13998,9 +13985,9 @@ var require_prompts2 = __commonJS({
     $3.date = (args) => toPrompt("DatePrompt", args);
     $3.confirm = (args) => toPrompt("ConfirmPrompt", args);
     $3.list = (args) => {
-      const sep4 = args.separator || ",";
+      const sep5 = args.separator || ",";
       return toPrompt("TextPrompt", args, {
-        onSubmit: (str) => str.split(sep4).map((s3) => s3.trim())
+        onSubmit: (str) => str.split(sep5).map((s3) => s3.trim())
       });
     };
     $3.toggle = (args) => toPrompt("TogglePrompt", args);
@@ -34598,9 +34585,16 @@ var TerminalCapabilityManager = class _TerminalCapabilityManager {
               match[2],
               match[3]
             );
-            debugLogger.log(
-              `Detected terminal background color: ${this.terminalBackgroundColor}`
-            );
+            if (this.terminalBackgroundColor === "#ffffff" && this.isTmux()) {
+              debugLogger.log(
+                "Ignored #ffffff background in tmux (common false positive over mosh)."
+              );
+              this.terminalBackgroundColor = void 0;
+            } else {
+              debugLogger.log(
+                `Detected terminal background color: ${this.terminalBackgroundColor}`
+              );
+            }
           }
         }
         if (!kittyKeyboardReceived && _TerminalCapabilityManager.KITTY_REGEX.test(buffer)) {
@@ -39460,7 +39454,7 @@ var import_react34 = __toESM(require_react(), 1);
 function useIdeTrustListener() {
   const settings = useSettings();
   const [connectionStatus, setConnectionStatus] = (0, import_react34.useState)(
-    IDEConnectionStatus.Disconnected
+    "disconnected" /* Disconnected */
   );
   const previousTrust = (0, import_react34.useRef)(void 0);
   const [restartReason, setRestartReason] = (0, import_react34.useState)("NONE");
@@ -39490,7 +39484,7 @@ function useIdeTrustListener() {
     };
   }, []);
   const getSnapshot = () => {
-    if (connectionStatus !== IDEConnectionStatus.Connected) {
+    if (connectionStatus !== "connected" /* Connected */) {
       return void 0;
     }
     return ideContextStore.get()?.workspaceState?.isTrusted;
@@ -40195,7 +40189,7 @@ async function initializeApp(config, settings) {
       await ideClient.connect();
       logIdeConnection(
         config,
-        new IdeConnectionEvent(IdeConnectionType.START)
+        new IdeConnectionEvent("start" /* START */)
       );
     }).catch((e) => {
       debugLogger.error("Failed to initialize IDE client:", e);
@@ -40213,17 +40207,17 @@ async function initializeApp(config, settings) {
 // packages/cli/src/config/auth.ts
 async function validateAuthMethod(authMethod) {
   loadEnvironment(loadSettings().merged, process.cwd());
-  if (authMethod === AuthType.LOGIN_WITH_GOOGLE || authMethod === AuthType.COMPUTE_ADC) {
+  if (authMethod === "oauth-personal" /* LOGIN_WITH_GOOGLE */ || authMethod === "compute-default-credentials" /* COMPUTE_ADC */) {
     return null;
   }
-  if (authMethod === AuthType.USE_GEMINI) {
+  if (authMethod === "gemini-api-key" /* USE_GEMINI */) {
     const key = process.env["GEMINI_API_KEY"] || await loadApiKey();
     if (!key) {
       return "When using Gemini API, you must specify the GEMINI_API_KEY environment variable.\nUpdate your environment and try again (no reload needed if using .env)!";
     }
     return null;
   }
-  if (authMethod === AuthType.USE_VERTEX_AI) {
+  if (authMethod === "vertex-ai" /* USE_VERTEX_AI */) {
     const hasVertexProjectLocationConfig = !!process.env["GOOGLE_CLOUD_PROJECT"] && !!process.env["GOOGLE_CLOUD_LOCATION"];
     const hasGoogleApiKey = !!process.env["GOOGLE_API_KEY"];
     if (!hasVertexProjectLocationConfig && !hasGoogleApiKey) {
@@ -40577,8 +40571,8 @@ async function maybePromptForSettings(extensionConfig, extensionId, requestSetti
   }
   const envContent = formatEnvContent(nonSensitiveSettings);
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (stat7.isDirectory()) {
       throw new Error(
         `Cannot write extension settings to ${envFilePath} because it is a directory.`
       );
@@ -40622,8 +40616,8 @@ async function getScopedEnvContents(extensionConfig, extensionId, scope, workspa
   const envFilePath = getEnvFilePath(extensionName, scope, workspaceDir);
   let customEnv = {};
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (!stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (!stat7.isDirectory()) {
       const envFile = fsSync.readFileSync(envFilePath, "utf-8");
       customEnv = dotenv.parse(envFile);
     }
@@ -40691,8 +40685,8 @@ async function updateSetting(extensionConfig, extensionId, settingKey, requestSe
   const envFilePath = getEnvFilePath(extensionName, scope, workspaceDir);
   let envContent = "";
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (stat7.isDirectory()) {
       throw new Error(
         `Cannot write extension settings to ${envFilePath} because it is a directory.`
       );
@@ -40740,8 +40734,8 @@ function getSettingsChanges(settings, oldSettings) {
 }
 async function clearSettings(envFilePath, keychain) {
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (!stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (!stat7.isDirectory()) {
       await fs11.writeFile(envFilePath, "");
     }
   }
@@ -44650,7 +44644,7 @@ var ExtensionManager = class extends ExtensionLoader {
           const trustedFolders = loadTrustedFolders();
           await trustedFolders.setValue(
             this.workspaceDir,
-            TrustLevel.TRUST_FOLDER
+            "TRUST_FOLDER" /* TRUST_FOLDER */
           );
         } else {
           throw new Error(
@@ -44836,7 +44830,7 @@ Would you like to attempt to install via "git clone" instead?`
               newExtensionConfig.version,
               previousExtensionConfig.version,
               installMetadata.type,
-              CoreToolCallStatus.Success
+              "success" /* Success */
             )
           );
           if (newExtensionName !== previousName) {
@@ -44859,7 +44853,7 @@ Would you like to attempt to install via "git clone" instead?`
               getExtensionId(newExtensionConfig, installMetadata),
               newExtensionConfig.version,
               installMetadata.type,
-              CoreToolCallStatus.Success
+              "success" /* Success */
             )
           );
           await this.enableExtension(
@@ -44892,7 +44886,7 @@ Would you like to attempt to install via "git clone" instead?`
             newExtensionConfig?.version ?? "",
             previousExtensionConfig.version,
             installMetadata.type,
-            CoreToolCallStatus.Error
+            "error" /* Error */
           )
         );
       } else {
@@ -44904,7 +44898,7 @@ Would you like to attempt to install via "git clone" instead?`
             extensionId ?? "",
             newExtensionConfig?.version ?? "",
             installMetadata.type,
-            CoreToolCallStatus.Error
+            "error" /* Error */
           )
         );
       }
@@ -44935,7 +44929,7 @@ Would you like to attempt to install via "git clone" instead?`
         extension.name,
         hashValue(extension.name),
         extension.id,
-        CoreToolCallStatus.Success
+        "success" /* Success */
       )
     );
   }
@@ -45205,7 +45199,7 @@ Would you like to attempt to install via "git clone" instead?`
             if (eventHooks) {
               for (const definition of eventHooks) {
                 for (const hook of definition.hooks) {
-                  if (hook.type === HookType.Command) {
+                  if (hook.type === "command" /* Command */) {
                     hook.env = { ...hook.env, ...hookEnv };
                   }
                 }
@@ -46236,7 +46230,7 @@ async function readMcpResources(resourceParts, config, signal) {
           callId: `mcp-resource-${resource.serverName}-${resource.uri}`,
           name: `resources/read (${resource.serverName})`,
           description: resource.uri,
-          status: CoreToolCallStatus.Success,
+          status: "success" /* Success */,
           isClientInitiated: true,
           resultDisplay: `Successfully read resource ${resource.uri}`,
           confirmationDetails: void 0
@@ -46251,7 +46245,7 @@ async function readMcpResources(resourceParts, config, signal) {
           callId: `mcp-resource-${resource.serverName}-${resource.uri}`,
           name: `resources/read (${resource.serverName})`,
           description: resource.uri,
-          status: CoreToolCallStatus.Error,
+          status: "error" /* Error */,
           isClientInitiated: true,
           resultDisplay: `Error reading resource ${resource.uri}: ${getErrorMessage(error)}`,
           confirmationDetails: void 0
@@ -46276,7 +46270,7 @@ Content from @${result.uri}:
   }
   if (hasError) {
     const firstError = displays.find(
-      (d) => d.status === CoreToolCallStatus.Error
+      (d) => d.status === "error" /* Error */
     );
     return {
       parts: [],
@@ -46317,7 +46311,7 @@ async function readLocalFiles(resolvedFiles, config, signal, userMessageTimestam
       callId: `client-read-${userMessageTimestamp}`,
       name: readManyFilesTool.displayName,
       description: invocation.getDescription(),
-      status: CoreToolCallStatus.Success,
+      status: "success" /* Success */,
       isClientInitiated: true,
       resultDisplay: result.returnDisplay || `Successfully read: ${fileLabelsForDisplay.join(", ")}`,
       confirmationDetails: void 0
@@ -46364,7 +46358,7 @@ Content from @${displayPath}:
       callId: `client-read-${userMessageTimestamp}`,
       name: readManyFilesTool.displayName,
       description: invocation?.getDescription() ?? "Error attempting to execute tool to read files",
-      status: CoreToolCallStatus.Error,
+      status: "error" /* Error */,
       isClientInitiated: true,
       resultDisplay: `Error reading files (${fileLabelsForDisplay.join(", ")}): ${getErrorMessage(error)}`,
       confirmationDetails: void 0
@@ -49631,7 +49625,7 @@ async function openFileInEditor(filePath, stdin, setRawMode, preferredEditorType
     if (wasRaw) {
       setRawMode?.(true);
     }
-    coreEvents.emit(CoreEvent.ExternalEditorClosed);
+    coreEvents.emit("external-editor-closed" /* ExternalEditorClosed */);
   }
 }
 
@@ -52326,7 +52320,7 @@ async function updateExtension(extension, extensionManager, currentState, dispat
       extension.name,
       installMetadata
     );
-    if (status === IntegrityDataStatus.INVALID) {
+    if (status === "invalid" /* INVALID */) {
       throw new Error("Extension integrity cannot be verified");
     }
   } catch (e) {
@@ -53744,11 +53738,11 @@ var ShellProcessor = class {
         },
         void 0
       );
-      if (decision === PolicyDecision.DENY) {
+      if (decision === "deny" /* DENY */) {
         throw new Error(
           `${this.commandName} cannot be run. Blocked command: "${command}". Reason: Blocked by policy.`
         );
-      } else if (decision === PolicyDecision.ASK_USER) {
+      } else if (decision === "ask_user" /* ASK_USER */) {
         commandsToConfirm.add(command);
       }
     }
@@ -54866,7 +54860,7 @@ var MultiFolderTrustDialog = ({
           if (choice === 1 /* YES_AND_REMEMBER */) {
             await trustedFolders.setValue(
               expandedPath,
-              TrustLevel.TRUST_FOLDER
+              "TRUST_FOLDER" /* TRUST_FOLDER */
             );
           }
           workspaceContext.addDirectory(expandedPath);
@@ -56544,7 +56538,7 @@ var authCommand = {
 import process29 from "node:process";
 
 // packages/cli/src/generated/git-commit.ts
-var GIT_COMMIT_INFO = "2404548cc";
+var GIT_COMMIT_INFO = "4d3dcdce1";
 
 // packages/cli/src/ui/utils/historyExportUtils.ts
 import * as fsPromises from "node:fs/promises";
@@ -57190,7 +57184,7 @@ var clearCommand = {
     const config = context.services.agentContext?.config;
     const hookSystem = config?.getHookSystem();
     if (hookSystem) {
-      await hookSystem.fireSessionEndEvent(SessionEndReason.Clear);
+      await hookSystem.fireSessionEndEvent("clear" /* Clear */);
     }
     config?.injectionService.clear();
     let newSessionId;
@@ -57207,7 +57201,7 @@ var clearCommand = {
     }
     let result;
     if (hookSystem) {
-      result = await hookSystem.fireSessionStartEvent(SessionStartSource.Clear);
+      result = await hookSystem.fireSessionStartEvent("clear" /* Clear */);
     }
     await new Promise((resolve9) => setImmediate(resolve9));
     if (config) {
@@ -60206,7 +60200,7 @@ var Footer = () => {
       case "auth": {
         if (!settings.merged.ui.showUserIdentity) break;
         if (!authType) break;
-        const displayStr = authType === AuthType.LOGIN_WITH_GOOGLE ? email ?? "google" : authType;
+        const displayStr = authType === "oauth-personal" /* LOGIN_WITH_GOOGLE */ ? email ?? "google" : authType;
         addCol(
           id,
           header,
@@ -61974,12 +61968,12 @@ import path29 from "node:path";
 function getIdeStatusMessage(ideClient) {
   const connection = ideClient.getConnectionStatus();
   switch (connection.status) {
-    case IDEConnectionStatus.Connected:
+    case "connected" /* Connected */:
       return {
         messageType: "info",
         content: `\u{1F7E2} Connected to ${ideClient.getDetectedIdeDisplayName()}`
       };
-    case IDEConnectionStatus.Connecting:
+    case "connecting" /* Connecting */:
       return {
         messageType: "info",
         content: `\u{1F7E1} Connecting...`
@@ -62020,7 +62014,7 @@ ${infoMessage}`;
 async function getIdeStatusMessageWithFiles(ideClient) {
   const connection = ideClient.getConnectionStatus();
   switch (connection.status) {
-    case IDEConnectionStatus.Connected: {
+    case "connected" /* Connected */: {
       let content = `\u{1F7E2} Connected to ${ideClient.getDetectedIdeDisplayName()}`;
       const context = ideContextStore.get();
       const openFiles = context?.workspaceState?.openFiles;
@@ -62032,7 +62026,7 @@ async function getIdeStatusMessageWithFiles(ideClient) {
         content
       };
     }
-    case IDEConnectionStatus.Connecting:
+    case "connecting" /* Connecting */:
       return {
         messageType: "info",
         content: `\u{1F7E1} Connecting...`
@@ -62054,7 +62048,7 @@ async function setIdeModeAndSyncConnection(config, value, options = {}) {
   const ideClient = await IdeClient.getInstance();
   if (value) {
     await ideClient.connect(options);
-    logIdeConnection(config, new IdeConnectionEvent(IdeConnectionType.SESSION));
+    logIdeConnection(config, new IdeConnectionEvent("session" /* SESSION */));
   } else {
     await ideClient.disconnect();
   }
@@ -62142,7 +62136,7 @@ var ideCommand = async () => {
               logToConsole: false
             }
           );
-          if (ideClient.getConnectionStatus().status === IDEConnectionStatus.Connected) {
+          if (ideClient.getConnectionStatus().status === "connected" /* Connected */) {
             break;
           }
           await new Promise((resolve9) => setTimeout(resolve9, 500));
@@ -62219,7 +62213,7 @@ var ideCommand = async () => {
     }
   };
   const { status } = ideClient.getConnectionStatus();
-  const isConnected = status === IDEConnectionStatus.Connected;
+  const isConnected = status === "connected" /* Connected */;
   if (isConnected) {
     ideSlashCommand.subCommands = [statusCommand2, disableCommand5];
   } else {
@@ -62319,13 +62313,13 @@ Use /mcp auth <server-name> to authenticate.`
     const displayListener = (message) => {
       context.ui.addItem({ type: "info", text: message });
     };
-    coreEvents.on(CoreEvent.OauthDisplayMessage, displayListener);
+    coreEvents.on("oauth-display-message" /* OauthDisplayMessage */, displayListener);
     try {
       context.ui.addItem({
         type: "info",
         text: `Starting OAuth authentication for MCP server '${serverName}'...`
       });
-      const { MCPOAuthProvider } = await import("./dist-PNS3BBFZ.js");
+      const { MCPOAuthProvider } = await import("./core-6YK2A6I7.js");
       let oauthConfig = server.oauth;
       if (!oauthConfig) {
         oauthConfig = { enabled: false };
@@ -62362,7 +62356,7 @@ Use /mcp auth <server-name> to authenticate.`
         content: `Failed to authenticate with MCP server '${serverName}': ${getErrorMessage(error)}`
       };
     } finally {
-      coreEvents.removeListener(CoreEvent.OauthDisplayMessage, displayListener);
+      coreEvents.removeListener("oauth-display-message" /* OauthDisplayMessage */, displayListener);
     }
   },
   completion: async (context, partialArg) => {
@@ -62408,10 +62402,10 @@ var listAction2 = async (context, showDescriptions = false, showSchema = false,
   }
   const serverNames = Object.keys(mcpServers);
   const connectingServers = serverNames.filter(
-    (name) => getMCPServerStatus(name) === MCPServerStatus.CONNECTING
+    (name) => getMCPServerStatus(name) === "connecting" /* CONNECTING */
   );
   const discoveryState = getMCPDiscoveryState();
-  const discoveryInProgress = discoveryState === MCPDiscoveryState.IN_PROGRESS || connectingServers.length > 0;
+  const discoveryInProgress = discoveryState === "in_progress" /* IN_PROGRESS */ || connectingServers.length > 0;
   const allTools = toolRegistry.getAllTools();
   const mcpTools = allTools.filter((tool) => tool instanceof DiscoveredMCPTool);
   const promptRegistry = config.getPromptRegistry();
@@ -78169,7 +78163,7 @@ Return a JSON object with:
         },
         abortSignal: new AbortController().signal,
         promptId: "triage-duplicates",
-        role: LlmRole.UTILITY_TOOL
+        role: "utility_tool" /* UTILITY_TOOL */
       });
       const rec = response;
       let canonical;
@@ -79003,7 +78997,7 @@ Return a JSON object with:
         },
         abortSignal: abortControllerRef.current.signal,
         promptId: "triage-issues",
-        role: LlmRole.UTILITY_TOOL
+        role: "utility_tool" /* UTILITY_TOOL */
       });
       return response;
     },
@@ -79577,8 +79571,8 @@ var planCommand = {
       return;
     }
     const previousApprovalMode = config.getApprovalMode();
-    config.setApprovalMode(ApprovalMode.PLAN);
-    if (previousApprovalMode !== ApprovalMode.PLAN) {
+    config.setApprovalMode("plan" /* PLAN */);
+    if (previousApprovalMode !== "plan" /* PLAN */) {
       coreEvents.emitFeedback("info", "Switched to Plan Mode.");
     }
     if (context.invocation?.args) {
@@ -79637,10 +79631,10 @@ var categorizeRulesByMode = (rules) => {
   rules.forEach((rule) => {
     const modes = rule.modes?.length ? rule.modes : ALL_MODES;
     const modeSet = new Set(modes);
-    if (modeSet.has(ApprovalMode.DEFAULT)) result.normal.push(rule);
-    if (modeSet.has(ApprovalMode.AUTO_EDIT)) result.autoEdit.push(rule);
-    if (modeSet.has(ApprovalMode.YOLO)) result.yolo.push(rule);
-    if (modeSet.has(ApprovalMode.PLAN)) result.plan.push(rule);
+    if (modeSet.has("default" /* DEFAULT */)) result.normal.push(rule);
+    if (modeSet.has("autoEdit" /* AUTO_EDIT */)) result.autoEdit.push(rule);
+    if (modeSet.has("yolo" /* YOLO */)) result.yolo.push(rule);
+    if (modeSet.has("plan" /* PLAN */)) result.plan.push(rule);
   });
   return result;
 };
@@ -80166,6 +80160,12 @@ function renderSkillActionFeedback(result, formatScope) {
   const s3 = formatScopeItem(totalAffectedScopes[0]);
   return `Skill "${skillName}" ${actionVerb} ${preposition} ${s3} settings.`;
 }
+function isPathTraversal(relative3) {
+  return relative3 === ".." || relative3.startsWith(".." + path36.sep) || path36.isAbsolute(relative3);
+}
+function isInvalidSubpath(relative3) {
+  return relative3 === "" || isPathTraversal(relative3);
+}
 async function installSkill(source2, scope, subpath, onLog, requestConsent = () => Promise.resolve(true)) {
   let sourcePath = source2;
   let tempDirToClean = void 0;
@@ -80197,8 +80197,12 @@ async function installSkill(source2, scope, subpath, onLog, requestConsent = ()
       sourcePath = path36.join(sourcePath, subpath);
     }
     sourcePath = path36.resolve(sourcePath);
-    if (tempDirToClean && !sourcePath.startsWith(path36.resolve(tempDirToClean))) {
-      throw new Error("Invalid path: Directory traversal not allowed.");
+    if (tempDirToClean) {
+      const resolvedTemp = path36.resolve(tempDirToClean);
+      const relative3 = path36.relative(resolvedTemp, sourcePath);
+      if (isPathTraversal(relative3)) {
+        throw new Error("Invalid path: Directory traversal not allowed.");
+      }
     }
     onLog(`Searching for skills in ${sourcePath}...`);
     const skills = await loadSkillsFromDir(sourcePath);
@@ -80213,13 +80217,18 @@ async function installSkill(source2, scope, subpath, onLog, requestConsent = ()
     if (!await requestConsent(skills, targetDir)) {
       throw new Error("Skill installation cancelled by user.");
     }
-    await fs36.mkdir(targetDir, { recursive: true });
+    const resolvedTarget = path36.resolve(targetDir);
+    await fs36.mkdir(resolvedTarget, { recursive: true });
     const installedSkills = [];
     for (const skill of skills) {
       const skillName = skill.name;
       const skillDir = path36.dirname(skill.location);
-      const destPath = path36.join(targetDir, skillName);
-      const exists = await fs36.stat(destPath).catch(() => null);
+      const destPath = path36.resolve(resolvedTarget, skillName);
+      const relative3 = path36.relative(resolvedTarget, destPath);
+      if (isInvalidSubpath(relative3)) {
+        throw new Error("Invalid skill name: Path traversal detected.");
+      }
+      const exists = await fs36.lstat(destPath).catch(() => null);
       if (exists) {
         onLog(`Skill "${skillName}" already exists. Overwriting...`);
         await fs36.rm(destPath, { recursive: true, force: true });
@@ -80260,12 +80269,17 @@ async function linkSkill(source2, scope, onLog, requestConsent = () => Promise.r
   if (!await requestConsent(skills, targetDir)) {
     throw new Error("Skill linking cancelled by user.");
   }
-  await fs36.mkdir(targetDir, { recursive: true });
+  const resolvedTarget = path36.resolve(targetDir);
+  await fs36.mkdir(resolvedTarget, { recursive: true });
   const linkedSkills = [];
   for (const skill of skills) {
     const skillName = skill.name;
     const skillSourceDir = path36.dirname(skill.location);
-    const destPath = path36.join(targetDir, skillName);
+    const destPath = path36.resolve(resolvedTarget, skillName);
+    const relative3 = path36.relative(resolvedTarget, destPath);
+    if (isInvalidSubpath(relative3)) {
+      throw new Error("Invalid skill name: Path traversal detected.");
+    }
     const exists = await fs36.lstat(destPath).catch(() => null);
     if (exists) {
       onLog(
@@ -80286,11 +80300,13 @@ async function uninstallSkill(name, scope) {
   const workspaceDir = process.cwd();
   const storage = new Storage(workspaceDir);
   const targetDir = scope === "workspace" ? storage.getProjectSkillsDir() : Storage.getUserSkillsDir();
-  const discoveredSkills = await loadSkillsFromDir(targetDir);
+  const resolvedTarget = path36.resolve(targetDir);
+  const discoveredSkills = await loadSkillsFromDir(resolvedTarget);
   const skillToUninstall = discoveredSkills.find((s3) => s3.name === name);
   if (!skillToUninstall) {
-    const skillPath = path36.resolve(targetDir, name);
-    if (!skillPath.startsWith(path36.resolve(targetDir))) {
+    const skillPath = path36.resolve(resolvedTarget, name);
+    const relative4 = path36.relative(resolvedTarget, skillPath);
+    if (isInvalidSubpath(relative4)) {
       return null;
     }
     const exists = await fs36.lstat(skillPath).catch(() => null);
@@ -80300,7 +80316,11 @@ async function uninstallSkill(name, scope) {
     await fs36.rm(skillPath, { recursive: true, force: true });
     return { location: skillPath };
   }
-  const skillDir = path36.dirname(skillToUninstall.location);
+  const skillDir = path36.resolve(path36.dirname(skillToUninstall.location));
+  const relative3 = path36.relative(resolvedTarget, skillDir);
+  if (isInvalidSubpath(relative3)) {
+    return null;
+  }
   await fs36.rm(skillDir, { recursive: true, force: true });
   return { location: skillDir };
 }
@@ -80992,7 +81012,7 @@ var upgradeCommand = {
   action: async (context) => {
     const config = context.services.agentContext?.config;
     const authType = config?.getContentGeneratorConfig()?.authType;
-    if (authType !== AuthType.LOGIN_WITH_GOOGLE) {
+    if (authType !== "oauth-personal" /* LOGIN_WITH_GOOGLE */) {
       return {
         type: "message",
         messageType: "error",
@@ -81221,7 +81241,7 @@ var BuiltinCommandLoader = class {
       setupGithubCommand,
       terminalSetupCommand,
       ...this.config?.isVoiceModeEnabled() ? [voiceCommand] : [],
-      ...this.config?.getContentGeneratorConfig()?.authType === AuthType.LOGIN_WITH_GOOGLE ? [upgradeCommand] : []
+      ...this.config?.getContentGeneratorConfig()?.authType === "oauth-personal" /* LOGIN_WITH_GOOGLE */ ? [upgradeCommand] : []
     ];
     handle?.end();
     return allDefinitions.filter((cmd) => cmd !== null);

package/bundle/{chunk-3BHPNRR5.js → chunk-LHJYE2I2.js}

@@ -1,7 +1,7 @@
 const require = (await import('node:module')).createRequire(import.meta.url); const __chunk_filename = (await import('node:url')).fileURLToPath(import.meta.url); const __chunk_dirname = (await import('node:path')).dirname(__chunk_filename);
 import {
   runExitCleanup
-} from "./chunk-DV5H7HVO.js";
+} from "./chunk-GOJGZJTT.js";
 import {
   __commonJS,
   __require

package/bundle/{chunk-TRKBNK3S.js → chunk-MGTB4OGF.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   exitCli,
   require_source
-} from "./chunk-ERRTQLZ3.js";
+} from "./chunk-LHJYE2I2.js";
 import {
   DEFAULT_PORT,
   SERVER_START_WAIT_MS,
@@ -14,10 +14,10 @@ import {
   isServerRunning,
   resolveGemmaConfig,
   writeServerProcessInfo
-} from "./chunk-4FWMMTHD.js";
+} from "./chunk-KRCY6JZY.js";
 import {
   debugLogger
-} from "./chunk-GSKH763B.js";
+} from "./chunk-NELP7HPM.js";
 import {
   __toESM
 } from "./chunk-34MYV7JD.js";