@google/gemini-cli 0.48.0-nightly.20260613.g9e5599c32 → 0.48.0-preview.0

package/bundle/{chunk-H4XKIOIJ.js → chunk-32OC6X7M.js}

@@ -1,13 +1,13 @@
 const require = (await import('node:module')).createRequire(import.meta.url); const __chunk_filename = (await import('node:url')).fileURLToPath(import.meta.url); const __chunk_dirname = (await import('node:path')).dirname(__chunk_filename);
 import {
   runExitCleanup
-} from "./chunk-72QY3QJN.js";
+} from "./chunk-C5HEG6L3.js";
 import {
   RELEASE_CHANNEL_STABILITY,
   debugLogger,
   getChannelFromVersion,
   isGitRepository
-} from "./chunk-ZOE7VNPK.js";
+} from "./chunk-4D6ZATMR.js";
 
 // packages/cli/src/utils/installationInfo.ts
 import * as fs from "node:fs";

package/bundle/{chunk-H3ZXB2VC.js → chunk-4D6ZATMR.js}

@@ -279324,8 +279324,8 @@ function isValidToolName(name3, options = {}) {
 }
 
 // packages/core/dist/src/generated/git-commit.js
-var GIT_COMMIT_INFO = "9e5599c32";
-var CLI_VERSION = "0.48.0-nightly.20260613.g9e5599c32";
+var GIT_COMMIT_INFO = "4d3dcdce1";
+var CLI_VERSION = "0.48.0-preview.0";
 
 // packages/core/dist/src/ide/detect-ide.js
 var IDE_DEFINITIONS = {
@@ -303729,7 +303729,7 @@ function getVersion() {
   }
   versionPromise = (async () => {
     const pkgJson = await getPackageJson(__dirname4);
-    return "0.48.0-nightly.20260613.g9e5599c32";
+    return "0.48.0-preview.0";
   })();
   return versionPromise;
 }
@@ -308658,15 +308658,22 @@ async function createContentGenerator(config2, gcConfig, sessionId) {
       }
       const proxyUrl = config2.proxy?.trim();
       const proxyAgent = proxyUrl ? baseUrl?.startsWith("http://") ? new import_dist2.HttpProxyAgent(proxyUrl) : new import_dist.HttpsProxyAgent(proxyUrl) : void 0;
+      const useVertex = config2.vertexai ?? config2.authType === AuthType2.USE_VERTEX_AI;
       const googleGenAI = new GoogleGenAI({
         apiKey: config2.authType === AuthType2.GATEWAY ? config2.apiKey : config2.apiKey === "" ? void 0 : config2.apiKey,
         vertexai: config2.vertexai ?? config2.authType === AuthType2.USE_VERTEX_AI,
         httpOptions,
         ...apiVersionEnv && { apiVersion: apiVersionEnv },
-        ...proxyAgent && {
+        // Merge proxy and GDCH endpoint into googleAuthOptions if either exists
+        ...(proxyAgent || useVertex && baseUrl) && {
           googleAuthOptions: {
             clientOptions: {
-              transporterOptions: { agent: proxyAgent }
+              ...proxyAgent && {
+                transporterOptions: { agent: proxyAgent }
+              },
+              ...useVertex && baseUrl && {
+                apiEndpoint: baseUrl
+              }
             }
           }
         }
@@ -335940,7 +335947,7 @@ var A2AAuthProviderFactory = class _A2AAuthProviderFactory {
         return provider;
       }
       case "oauth2": {
-        const { OAuth2AuthProvider } = await import("./oauth2-provider-SO5T5VJK.js");
+        const { OAuth2AuthProvider } = await import("./oauth2-provider-TBT32VYL.js");
         const provider = new OAuth2AuthProvider(authConfig, options.agentName ?? "unknown", agentCard, options.agentCardUrl);
         await provider.initialize();
         return provider;
@@ -343506,7 +343513,7 @@ var Scheduler = class {
     return false;
   }
   _isParallelizable(request) {
-    if (request.name === UPDATE_TOPIC_TOOL_NAME) {
+    if (request.name === UPDATE_TOPIC_TOOL_NAME || EDIT_TOOL_NAMES.has(request.name)) {
       return false;
     }
     if (request.args) {

package/bundle/{chunk-PMYHHVD7.js → chunk-4JHCXKYF.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   exitCli,
   require_source
-} from "./chunk-MDT4UJ3G.js";
+} from "./chunk-F754PAF2.js";
 import {
   DEFAULT_PORT,
   SERVER_START_WAIT_MS,
@@ -14,10 +14,10 @@ import {
   isServerRunning,
   resolveGemmaConfig,
   writeServerProcessInfo
-} from "./chunk-FZ7CBMCM.js";
+} from "./chunk-FKMHT24L.js";
 import {
   debugLogger
-} from "./chunk-ZOE7VNPK.js";
+} from "./chunk-4D6ZATMR.js";
 import {
   __toESM
 } from "./chunk-34MYV7JD.js";

package/bundle/{chunk-FZ7CBMCM.js → chunk-76ONBIQT.js}

@@ -29,7 +29,7 @@ import {
   require_strip_json_comments,
   sanitizeFilenamePart,
   stripAnsi
-} from "./chunk-ZOE7VNPK.js";
+} from "./chunk-JFJQ6J4C.js";
 import {
   __commonJS,
   __require,

package/bundle/{chunk-LGHXO4JF.js → chunk-7BRNIWQY.js}

@@ -1,7 +1,7 @@
 const require = (await import('node:module')).createRequire(import.meta.url); const __chunk_filename = (await import('node:url')).fileURLToPath(import.meta.url); const __chunk_dirname = (await import('node:path')).dirname(__chunk_filename);
 import {
   checkExhaustive
-} from "./chunk-ZOE7VNPK.js";
+} from "./chunk-NELP7HPM.js";
 import {
   __commonJS,
   __toESM

package/bundle/{chunk-XKHJ3UB3.js → chunk-BPCFUG3V.js}

@@ -6,7 +6,7 @@ import {
 import {
   exitCli,
   require_source
-} from "./chunk-MDT4UJ3G.js";
+} from "./chunk-LHJYE2I2.js";
 import {
   DEFAULT_BACKGROUND_OPACITY,
   DEFAULT_BORDER_OPACITY,
@@ -58,14 +58,14 @@ import {
   stripUnsafeCharacters,
   toCodePoints,
   validateCustomTheme
-} from "./chunk-FZ7CBMCM.js";
+} from "./chunk-KRCY6JZY.js";
 import {
   isDevelopment
-} from "./chunk-H4XKIOIJ.js";
+} from "./chunk-F643LQAW.js";
 import {
   emptyIcon,
   require_react
-} from "./chunk-LGHXO4JF.js";
+} from "./chunk-7BRNIWQY.js";
 import {
   ALL_EDITORS,
   ApprovalMode,
@@ -230,7 +230,7 @@ import {
   tokenLimit,
   uiTelemetryService,
   unescapePath
-} from "./chunk-ZOE7VNPK.js";
+} from "./chunk-NELP7HPM.js";
 import {
   require_src
 } from "./chunk-TUDYL3X4.js";
@@ -11695,9 +11695,9 @@ var require_prompts = __commonJS({
     $3.date = (args) => toPrompt("DatePrompt", args);
     $3.confirm = (args) => toPrompt("ConfirmPrompt", args);
     $3.list = (args) => {
-      const sep4 = args.separator || ",";
+      const sep5 = args.separator || ",";
       return toPrompt("TextPrompt", args, {
-        onSubmit: (str) => str.split(sep4).map((s3) => s3.trim())
+        onSubmit: (str) => str.split(sep5).map((s3) => s3.trim())
       });
     };
     $3.toggle = (args) => toPrompt("TogglePrompt", args);
@@ -13985,9 +13985,9 @@ var require_prompts2 = __commonJS({
     $3.date = (args) => toPrompt("DatePrompt", args);
     $3.confirm = (args) => toPrompt("ConfirmPrompt", args);
     $3.list = (args) => {
-      const sep4 = args.separator || ",";
+      const sep5 = args.separator || ",";
       return toPrompt("TextPrompt", args, {
-        onSubmit: (str) => str.split(sep4).map((s3) => s3.trim())
+        onSubmit: (str) => str.split(sep5).map((s3) => s3.trim())
       });
     };
     $3.toggle = (args) => toPrompt("TogglePrompt", args);
@@ -34585,9 +34585,16 @@ var TerminalCapabilityManager = class _TerminalCapabilityManager {
               match[2],
               match[3]
             );
-            debugLogger.log(
-              `Detected terminal background color: ${this.terminalBackgroundColor}`
-            );
+            if (this.terminalBackgroundColor === "#ffffff" && this.isTmux()) {
+              debugLogger.log(
+                "Ignored #ffffff background in tmux (common false positive over mosh)."
+              );
+              this.terminalBackgroundColor = void 0;
+            } else {
+              debugLogger.log(
+                `Detected terminal background color: ${this.terminalBackgroundColor}`
+              );
+            }
           }
         }
         if (!kittyKeyboardReceived && _TerminalCapabilityManager.KITTY_REGEX.test(buffer)) {
@@ -40564,8 +40571,8 @@ async function maybePromptForSettings(extensionConfig, extensionId, requestSetti
   }
   const envContent = formatEnvContent(nonSensitiveSettings);
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (stat7.isDirectory()) {
       throw new Error(
         `Cannot write extension settings to ${envFilePath} because it is a directory.`
       );
@@ -40609,8 +40616,8 @@ async function getScopedEnvContents(extensionConfig, extensionId, scope, workspa
   const envFilePath = getEnvFilePath(extensionName, scope, workspaceDir);
   let customEnv = {};
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (!stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (!stat7.isDirectory()) {
       const envFile = fsSync.readFileSync(envFilePath, "utf-8");
       customEnv = dotenv.parse(envFile);
     }
@@ -40678,8 +40685,8 @@ async function updateSetting(extensionConfig, extensionId, settingKey, requestSe
   const envFilePath = getEnvFilePath(extensionName, scope, workspaceDir);
   let envContent = "";
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (stat7.isDirectory()) {
       throw new Error(
         `Cannot write extension settings to ${envFilePath} because it is a directory.`
       );
@@ -40727,8 +40734,8 @@ function getSettingsChanges(settings, oldSettings) {
 }
 async function clearSettings(envFilePath, keychain) {
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (!stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (!stat7.isDirectory()) {
       await fs11.writeFile(envFilePath, "");
     }
   }
@@ -56531,7 +56538,7 @@ var authCommand = {
 import process29 from "node:process";
 
 // packages/cli/src/generated/git-commit.ts
-var GIT_COMMIT_INFO = "9e5599c32";
+var GIT_COMMIT_INFO = "4d3dcdce1";
 
 // packages/cli/src/ui/utils/historyExportUtils.ts
 import * as fsPromises from "node:fs/promises";
@@ -62312,7 +62319,7 @@ Use /mcp auth <server-name> to authenticate.`
         type: "info",
         text: `Starting OAuth authentication for MCP server '${serverName}'...`
       });
-      const { MCPOAuthProvider } = await import("./core-FQAKM62Z.js");
+      const { MCPOAuthProvider } = await import("./core-2HID3ALL.js");
       let oauthConfig = server.oauth;
       if (!oauthConfig) {
         oauthConfig = { enabled: false };
@@ -80153,6 +80160,12 @@ function renderSkillActionFeedback(result, formatScope) {
   const s3 = formatScopeItem(totalAffectedScopes[0]);
   return `Skill "${skillName}" ${actionVerb} ${preposition} ${s3} settings.`;
 }
+function isPathTraversal(relative3) {
+  return relative3 === ".." || relative3.startsWith(".." + path36.sep) || path36.isAbsolute(relative3);
+}
+function isInvalidSubpath(relative3) {
+  return relative3 === "" || isPathTraversal(relative3);
+}
 async function installSkill(source2, scope, subpath, onLog, requestConsent = () => Promise.resolve(true)) {
   let sourcePath = source2;
   let tempDirToClean = void 0;
@@ -80184,8 +80197,12 @@ async function installSkill(source2, scope, subpath, onLog, requestConsent = ()
       sourcePath = path36.join(sourcePath, subpath);
     }
     sourcePath = path36.resolve(sourcePath);
-    if (tempDirToClean && !sourcePath.startsWith(path36.resolve(tempDirToClean))) {
-      throw new Error("Invalid path: Directory traversal not allowed.");
+    if (tempDirToClean) {
+      const resolvedTemp = path36.resolve(tempDirToClean);
+      const relative3 = path36.relative(resolvedTemp, sourcePath);
+      if (isPathTraversal(relative3)) {
+        throw new Error("Invalid path: Directory traversal not allowed.");
+      }
     }
     onLog(`Searching for skills in ${sourcePath}...`);
     const skills = await loadSkillsFromDir(sourcePath);
@@ -80200,13 +80217,18 @@ async function installSkill(source2, scope, subpath, onLog, requestConsent = ()
     if (!await requestConsent(skills, targetDir)) {
       throw new Error("Skill installation cancelled by user.");
     }
-    await fs36.mkdir(targetDir, { recursive: true });
+    const resolvedTarget = path36.resolve(targetDir);
+    await fs36.mkdir(resolvedTarget, { recursive: true });
     const installedSkills = [];
     for (const skill of skills) {
       const skillName = skill.name;
       const skillDir = path36.dirname(skill.location);
-      const destPath = path36.join(targetDir, skillName);
-      const exists = await fs36.stat(destPath).catch(() => null);
+      const destPath = path36.resolve(resolvedTarget, skillName);
+      const relative3 = path36.relative(resolvedTarget, destPath);
+      if (isInvalidSubpath(relative3)) {
+        throw new Error("Invalid skill name: Path traversal detected.");
+      }
+      const exists = await fs36.lstat(destPath).catch(() => null);
       if (exists) {
         onLog(`Skill "${skillName}" already exists. Overwriting...`);
         await fs36.rm(destPath, { recursive: true, force: true });
@@ -80247,12 +80269,17 @@ async function linkSkill(source2, scope, onLog, requestConsent = () => Promise.r
   if (!await requestConsent(skills, targetDir)) {
     throw new Error("Skill linking cancelled by user.");
   }
-  await fs36.mkdir(targetDir, { recursive: true });
+  const resolvedTarget = path36.resolve(targetDir);
+  await fs36.mkdir(resolvedTarget, { recursive: true });
   const linkedSkills = [];
   for (const skill of skills) {
     const skillName = skill.name;
     const skillSourceDir = path36.dirname(skill.location);
-    const destPath = path36.join(targetDir, skillName);
+    const destPath = path36.resolve(resolvedTarget, skillName);
+    const relative3 = path36.relative(resolvedTarget, destPath);
+    if (isInvalidSubpath(relative3)) {
+      throw new Error("Invalid skill name: Path traversal detected.");
+    }
     const exists = await fs36.lstat(destPath).catch(() => null);
     if (exists) {
       onLog(
@@ -80273,11 +80300,13 @@ async function uninstallSkill(name, scope) {
   const workspaceDir = process.cwd();
   const storage = new Storage(workspaceDir);
   const targetDir = scope === "workspace" ? storage.getProjectSkillsDir() : Storage.getUserSkillsDir();
-  const discoveredSkills = await loadSkillsFromDir(targetDir);
+  const resolvedTarget = path36.resolve(targetDir);
+  const discoveredSkills = await loadSkillsFromDir(resolvedTarget);
   const skillToUninstall = discoveredSkills.find((s3) => s3.name === name);
   if (!skillToUninstall) {
-    const skillPath = path36.resolve(targetDir, name);
-    if (!skillPath.startsWith(path36.resolve(targetDir))) {
+    const skillPath = path36.resolve(resolvedTarget, name);
+    const relative4 = path36.relative(resolvedTarget, skillPath);
+    if (isInvalidSubpath(relative4)) {
       return null;
     }
     const exists = await fs36.lstat(skillPath).catch(() => null);
@@ -80287,7 +80316,11 @@ async function uninstallSkill(name, scope) {
     await fs36.rm(skillPath, { recursive: true, force: true });
     return { location: skillPath };
   }
-  const skillDir = path36.dirname(skillToUninstall.location);
+  const skillDir = path36.resolve(path36.dirname(skillToUninstall.location));
+  const relative3 = path36.relative(resolvedTarget, skillDir);
+  if (isInvalidSubpath(relative3)) {
+    return null;
+  }
   await fs36.rm(skillDir, { recursive: true, force: true });
   return { location: skillDir };
 }

package/bundle/{chunk-3ANNJGNC.js → chunk-C5HEG6L3.js}

@@ -5,7 +5,7 @@ import {
   isTelemetrySdkInitialized,
   resetBrowserSession,
   shutdownTelemetry
-} from "./chunk-3TJFAAMG.js";
+} from "./chunk-4D6ZATMR.js";
 
 // packages/cli/src/utils/cleanup.ts
 import { promises as fs } from "node:fs";

package/bundle/{chunk-OXNVNKEV.js → chunk-F643LQAW.js}

@@ -1,13 +1,13 @@
 const require = (await import('node:module')).createRequire(import.meta.url); const __chunk_filename = (await import('node:url')).fileURLToPath(import.meta.url); const __chunk_dirname = (await import('node:path')).dirname(__chunk_filename);
 import {
   runExitCleanup
-} from "./chunk-AYZTVUY2.js";
+} from "./chunk-GOJGZJTT.js";
 import {
   RELEASE_CHANNEL_STABILITY,
   debugLogger,
   getChannelFromVersion,
   isGitRepository
-} from "./chunk-KRG7Z454.js";
+} from "./chunk-NELP7HPM.js";
 
 // packages/cli/src/utils/installationInfo.ts
 import * as fs from "node:fs";

package/bundle/{chunk-EBXCGR4V.js → chunk-F754PAF2.js}

@@ -1,7 +1,7 @@
 const require = (await import('node:module')).createRequire(import.meta.url); const __chunk_filename = (await import('node:url')).fileURLToPath(import.meta.url); const __chunk_dirname = (await import('node:path')).dirname(__chunk_filename);
 import {
   runExitCleanup
-} from "./chunk-AYZTVUY2.js";
+} from "./chunk-C5HEG6L3.js";
 import {
   __commonJS,
   __require

package/bundle/{chunk-AYACUP3C.js → chunk-FKMHT24L.js}

@@ -32,7 +32,7 @@ import {
   require_strip_json_comments,
   sanitizeFilenamePart,
   stripAnsi
-} from "./chunk-KRG7Z454.js";
+} from "./chunk-4D6ZATMR.js";
 import {
   __commonJS,
   __require,

package/bundle/{chunk-7DSGEVU5.js → chunk-FOP27KUG.js}

@@ -6,7 +6,7 @@ import {
 import {
   exitCli,
   require_source
-} from "./chunk-EBXCGR4V.js";
+} from "./chunk-F754PAF2.js";
 import {
   DEFAULT_BACKGROUND_OPACITY,
   DEFAULT_BORDER_OPACITY,
@@ -58,14 +58,14 @@ import {
   stripUnsafeCharacters,
   toCodePoints,
   validateCustomTheme
-} from "./chunk-AYACUP3C.js";
+} from "./chunk-FKMHT24L.js";
 import {
   isDevelopment
-} from "./chunk-OXNVNKEV.js";
+} from "./chunk-32OC6X7M.js";
 import {
   emptyIcon,
   require_react
-} from "./chunk-GAWEPPRJ.js";
+} from "./chunk-PIL3VMYY.js";
 import {
   ALL_EDITORS,
   ApprovalMode,
@@ -243,7 +243,7 @@ import {
   tokenLimit,
   uiTelemetryService,
   unescapePath
-} from "./chunk-KRG7Z454.js";
+} from "./chunk-4D6ZATMR.js";
 import {
   require_src
 } from "./chunk-TUDYL3X4.js";
@@ -11708,9 +11708,9 @@ var require_prompts = __commonJS({
     $3.date = (args) => toPrompt("DatePrompt", args);
     $3.confirm = (args) => toPrompt("ConfirmPrompt", args);
     $3.list = (args) => {
-      const sep4 = args.separator || ",";
+      const sep5 = args.separator || ",";
       return toPrompt("TextPrompt", args, {
-        onSubmit: (str) => str.split(sep4).map((s3) => s3.trim())
+        onSubmit: (str) => str.split(sep5).map((s3) => s3.trim())
       });
     };
     $3.toggle = (args) => toPrompt("TogglePrompt", args);
@@ -13998,9 +13998,9 @@ var require_prompts2 = __commonJS({
     $3.date = (args) => toPrompt("DatePrompt", args);
     $3.confirm = (args) => toPrompt("ConfirmPrompt", args);
     $3.list = (args) => {
-      const sep4 = args.separator || ",";
+      const sep5 = args.separator || ",";
       return toPrompt("TextPrompt", args, {
-        onSubmit: (str) => str.split(sep4).map((s3) => s3.trim())
+        onSubmit: (str) => str.split(sep5).map((s3) => s3.trim())
       });
     };
     $3.toggle = (args) => toPrompt("TogglePrompt", args);
@@ -34598,9 +34598,16 @@ var TerminalCapabilityManager = class _TerminalCapabilityManager {
               match[2],
               match[3]
             );
-            debugLogger.log(
-              `Detected terminal background color: ${this.terminalBackgroundColor}`
-            );
+            if (this.terminalBackgroundColor === "#ffffff" && this.isTmux()) {
+              debugLogger.log(
+                "Ignored #ffffff background in tmux (common false positive over mosh)."
+              );
+              this.terminalBackgroundColor = void 0;
+            } else {
+              debugLogger.log(
+                `Detected terminal background color: ${this.terminalBackgroundColor}`
+              );
+            }
           }
         }
         if (!kittyKeyboardReceived && _TerminalCapabilityManager.KITTY_REGEX.test(buffer)) {
@@ -40577,8 +40584,8 @@ async function maybePromptForSettings(extensionConfig, extensionId, requestSetti
   }
   const envContent = formatEnvContent(nonSensitiveSettings);
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (stat7.isDirectory()) {
       throw new Error(
         `Cannot write extension settings to ${envFilePath} because it is a directory.`
       );
@@ -40622,8 +40629,8 @@ async function getScopedEnvContents(extensionConfig, extensionId, scope, workspa
   const envFilePath = getEnvFilePath(extensionName, scope, workspaceDir);
   let customEnv = {};
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (!stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (!stat7.isDirectory()) {
       const envFile = fsSync.readFileSync(envFilePath, "utf-8");
       customEnv = dotenv.parse(envFile);
     }
@@ -40691,8 +40698,8 @@ async function updateSetting(extensionConfig, extensionId, settingKey, requestSe
   const envFilePath = getEnvFilePath(extensionName, scope, workspaceDir);
   let envContent = "";
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (stat7.isDirectory()) {
       throw new Error(
         `Cannot write extension settings to ${envFilePath} because it is a directory.`
       );
@@ -40740,8 +40747,8 @@ function getSettingsChanges(settings, oldSettings) {
 }
 async function clearSettings(envFilePath, keychain) {
   if (fsSync.existsSync(envFilePath)) {
-    const stat8 = fsSync.statSync(envFilePath);
-    if (!stat8.isDirectory()) {
+    const stat7 = fsSync.statSync(envFilePath);
+    if (!stat7.isDirectory()) {
       await fs11.writeFile(envFilePath, "");
     }
   }
@@ -56544,7 +56551,7 @@ var authCommand = {
 import process29 from "node:process";
 
 // packages/cli/src/generated/git-commit.ts
-var GIT_COMMIT_INFO = "9e5599c32";
+var GIT_COMMIT_INFO = "35b1f0211";
 
 // packages/cli/src/ui/utils/historyExportUtils.ts
 import * as fsPromises from "node:fs/promises";
@@ -62325,7 +62332,7 @@ Use /mcp auth <server-name> to authenticate.`
         type: "info",
         text: `Starting OAuth authentication for MCP server '${serverName}'...`
       });
-      const { MCPOAuthProvider } = await import("./dist-2POHEWMG.js");
+      const { MCPOAuthProvider } = await import("./dist-XJ5HWKG4.js");
       let oauthConfig = server.oauth;
       if (!oauthConfig) {
         oauthConfig = { enabled: false };
@@ -80166,6 +80173,12 @@ function renderSkillActionFeedback(result, formatScope) {
   const s3 = formatScopeItem(totalAffectedScopes[0]);
   return `Skill "${skillName}" ${actionVerb} ${preposition} ${s3} settings.`;
 }
+function isPathTraversal(relative3) {
+  return relative3 === ".." || relative3.startsWith(".." + path36.sep) || path36.isAbsolute(relative3);
+}
+function isInvalidSubpath(relative3) {
+  return relative3 === "" || isPathTraversal(relative3);
+}
 async function installSkill(source2, scope, subpath, onLog, requestConsent = () => Promise.resolve(true)) {
   let sourcePath = source2;
   let tempDirToClean = void 0;
@@ -80197,8 +80210,12 @@ async function installSkill(source2, scope, subpath, onLog, requestConsent = ()
       sourcePath = path36.join(sourcePath, subpath);
     }
     sourcePath = path36.resolve(sourcePath);
-    if (tempDirToClean && !sourcePath.startsWith(path36.resolve(tempDirToClean))) {
-      throw new Error("Invalid path: Directory traversal not allowed.");
+    if (tempDirToClean) {
+      const resolvedTemp = path36.resolve(tempDirToClean);
+      const relative3 = path36.relative(resolvedTemp, sourcePath);
+      if (isPathTraversal(relative3)) {
+        throw new Error("Invalid path: Directory traversal not allowed.");
+      }
     }
     onLog(`Searching for skills in ${sourcePath}...`);
     const skills = await loadSkillsFromDir(sourcePath);
@@ -80213,13 +80230,18 @@ async function installSkill(source2, scope, subpath, onLog, requestConsent = ()
     if (!await requestConsent(skills, targetDir)) {
       throw new Error("Skill installation cancelled by user.");
     }
-    await fs36.mkdir(targetDir, { recursive: true });
+    const resolvedTarget = path36.resolve(targetDir);
+    await fs36.mkdir(resolvedTarget, { recursive: true });
     const installedSkills = [];
     for (const skill of skills) {
       const skillName = skill.name;
       const skillDir = path36.dirname(skill.location);
-      const destPath = path36.join(targetDir, skillName);
-      const exists = await fs36.stat(destPath).catch(() => null);
+      const destPath = path36.resolve(resolvedTarget, skillName);
+      const relative3 = path36.relative(resolvedTarget, destPath);
+      if (isInvalidSubpath(relative3)) {
+        throw new Error("Invalid skill name: Path traversal detected.");
+      }
+      const exists = await fs36.lstat(destPath).catch(() => null);
       if (exists) {
         onLog(`Skill "${skillName}" already exists. Overwriting...`);
         await fs36.rm(destPath, { recursive: true, force: true });
@@ -80260,12 +80282,17 @@ async function linkSkill(source2, scope, onLog, requestConsent = () => Promise.r
   if (!await requestConsent(skills, targetDir)) {
     throw new Error("Skill linking cancelled by user.");
   }
-  await fs36.mkdir(targetDir, { recursive: true });
+  const resolvedTarget = path36.resolve(targetDir);
+  await fs36.mkdir(resolvedTarget, { recursive: true });
   const linkedSkills = [];
   for (const skill of skills) {
     const skillName = skill.name;
     const skillSourceDir = path36.dirname(skill.location);
-    const destPath = path36.join(targetDir, skillName);
+    const destPath = path36.resolve(resolvedTarget, skillName);
+    const relative3 = path36.relative(resolvedTarget, destPath);
+    if (isInvalidSubpath(relative3)) {
+      throw new Error("Invalid skill name: Path traversal detected.");
+    }
     const exists = await fs36.lstat(destPath).catch(() => null);
     if (exists) {
       onLog(
@@ -80286,11 +80313,13 @@ async function uninstallSkill(name, scope) {
   const workspaceDir = process.cwd();
   const storage = new Storage(workspaceDir);
   const targetDir = scope === "workspace" ? storage.getProjectSkillsDir() : Storage.getUserSkillsDir();
-  const discoveredSkills = await loadSkillsFromDir(targetDir);
+  const resolvedTarget = path36.resolve(targetDir);
+  const discoveredSkills = await loadSkillsFromDir(resolvedTarget);
   const skillToUninstall = discoveredSkills.find((s3) => s3.name === name);
   if (!skillToUninstall) {
-    const skillPath = path36.resolve(targetDir, name);
-    if (!skillPath.startsWith(path36.resolve(targetDir))) {
+    const skillPath = path36.resolve(resolvedTarget, name);
+    const relative4 = path36.relative(resolvedTarget, skillPath);
+    if (isInvalidSubpath(relative4)) {
       return null;
     }
     const exists = await fs36.lstat(skillPath).catch(() => null);
@@ -80300,7 +80329,11 @@ async function uninstallSkill(name, scope) {
     await fs36.rm(skillPath, { recursive: true, force: true });
     return { location: skillPath };
   }
-  const skillDir = path36.dirname(skillToUninstall.location);
+  const skillDir = path36.resolve(path36.dirname(skillToUninstall.location));
+  const relative3 = path36.relative(resolvedTarget, skillDir);
+  if (isInvalidSubpath(relative3)) {
+    return null;
+  }
   await fs36.rm(skillDir, { recursive: true, force: true });
   return { location: skillDir };
 }

package/bundle/{chunk-3K4EYWSH.js → chunk-GOJGZJTT.js}

@@ -5,7 +5,7 @@ import {
   isTelemetrySdkInitialized,
   resetBrowserSession,
   shutdownTelemetry
-} from "./chunk-H3ZXB2VC.js";
+} from "./chunk-NELP7HPM.js";
 
 // packages/cli/src/utils/cleanup.ts
 import { promises as fs } from "node:fs";