@google/gemini-cli 0.57.0 → 0.58.0

package/bundle/{chunk-7HKQGPWB.js → chunk-MFLFXOVQ.js}

@@ -48566,13 +48566,13 @@ var require_path = __commonJS({
   "node_modules/@protobufjs/path/index.js"(exports2) {
     "use strict";
     var path114 = exports2;
-    var isAbsolute10 = (
+    var isAbsolute11 = (
       /**
        * Tests if the specified path is absolute.
        * @param {string} path Path to test
        * @returns {boolean} `true` if path is absolute
        */
-      path114.isAbsolute = function isAbsolute11(path115) {
+      path114.isAbsolute = function isAbsolute12(path115) {
         return /^(?:\/|\w+:)/.test(path115);
       }
     );
@@ -48584,7 +48584,7 @@ var require_path = __commonJS({
        */
       path114.normalize = function normalize7(path115) {
         path115 = path115.replace(/\\/g, "/").replace(/\/{2,}/g, "/");
-        var parts2 = path115.split("/"), absolute = isAbsolute10(path115), prefix = "";
+        var parts2 = path115.split("/"), absolute = isAbsolute11(path115), prefix = "";
         if (absolute)
           prefix = parts2.shift() + "/";
         for (var i3 = 0; i3 < parts2.length; ) {
@@ -48606,7 +48606,7 @@ var require_path = __commonJS({
     path114.resolve = function resolve29(originPath, includePath, alreadyNormalized) {
       if (!alreadyNormalized)
         includePath = normalize6(includePath);
-      if (isAbsolute10(includePath))
+      if (isAbsolute11(includePath))
         return includePath;
       if (!alreadyNormalized)
         originPath = normalize6(originPath);
@@ -253732,11 +253732,38 @@ function getSupportedAudioMimeTypeForFile(filePath) {
   }
   return extensionMimeType;
 }
+function canonicalizeMacosPath(p) {
+  if (process.platform === "darwin") {
+    if (p === "/var" || p.startsWith("/var/")) {
+      return "/private" + p;
+    }
+    if (p === "/tmp" || p.startsWith("/tmp/")) {
+      return "/private" + p;
+    }
+    if (p === "/etc" || p.startsWith("/etc/")) {
+      return "/private" + p;
+    }
+  }
+  return p;
+}
 function isWithinRoot(pathToCheck, rootDirectory) {
-  const normalizedPathToCheck = path7.resolve(pathToCheck);
-  const normalizedRootDirectory = path7.resolve(rootDirectory);
+  const normalizedPathToCheck = canonicalizeMacosPath(path7.resolve(pathToCheck));
+  const normalizedRootDirectory = canonicalizeMacosPath(path7.resolve(rootDirectory));
   const rootWithSeparator = normalizedRootDirectory === path7.sep || normalizedRootDirectory.endsWith(path7.sep) ? normalizedRootDirectory : normalizedRootDirectory + path7.sep;
-  return normalizedPathToCheck === normalizedRootDirectory || normalizedPathToCheck.startsWith(rootWithSeparator);
+  if (normalizedPathToCheck === normalizedRootDirectory || normalizedPathToCheck.startsWith(rootWithSeparator)) {
+    return true;
+  }
+  if (process.platform === "darwin") {
+    try {
+      const realPathToCheck = resolveToRealPath(normalizedPathToCheck);
+      const realRootDirectory = resolveToRealPath(normalizedRootDirectory);
+      const realRootWithSeparator = realRootDirectory === path7.sep || realRootDirectory.endsWith(path7.sep) ? realRootDirectory : realRootDirectory + path7.sep;
+      return realPathToCheck === realRootDirectory || realPathToCheck.startsWith(realRootWithSeparator);
+    } catch {
+      return false;
+    }
+  }
+  return false;
 }
 function getRealPath(filePath) {
   try {
@@ -256237,6 +256264,54 @@ var BASE_SEATBELT_PROFILE = `(version 1)
   (subpath "/dev")
 )
 
+; Block Docker & container daemon UNIX domain sockets (read & write)
+(deny file-read* file-write*
+  (literal "/var/run/docker.sock")
+  (literal "/var/run/docker.sock.raw")
+  (literal "/private/var/run/docker.sock")
+  (literal "/private/var/run/docker.sock.raw")
+  (subpath "/var/run/docker")
+  (subpath "/private/var/run/docker")
+  (subpath "/Users/Shared/.docker")
+  (regex #"^/Users/[^/]+/\\.docker/run/")
+  (regex #"^/Users/[^/]+/\\.docker/desktop/")
+  (regex #"^/Users/[^/]+/\\.colima/")
+  (regex #"^/Users/[^/]+/\\.orbstack/run/")
+  (regex #"^/Users/[^/]+/\\.rd/")
+)
+
+; Block container CLI and daemon binaries from execution
+(deny process-exec
+  (literal "/usr/local/bin/docker")
+  (literal "/usr/local/bin/dockerd")
+  (literal "/usr/local/bin/docker-compose")
+  (literal "/usr/bin/docker")
+  (literal "/opt/homebrew/bin/docker")
+  (literal "/opt/homebrew/bin/dockerd")
+  (literal "/opt/homebrew/bin/docker-compose")
+  (literal "/opt/homebrew/bin/podman")
+  (literal "/usr/local/bin/podman")
+  (literal "/opt/homebrew/bin/colima")
+  (literal "/usr/local/bin/colima")
+  (literal "/opt/homebrew/bin/orb")
+  (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
+  (subpath "/Applications/Docker.app/Contents/MacOS/")
+  (subpath "/Applications/OrbStack.app/Contents/MacOS/")
+  (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
+)
+
+; Block com.docker.* and container manager Mach lookup / XPC services
+(deny mach-lookup
+  (xpc-service-name-prefix "com.docker.")
+  (global-name-prefix "com.docker.")
+  (global-name-prefix "dev.kdrag0n.OrbStack")
+)
+
+; Block Docker POSIX Shared Memory
+(deny ipc-posix-shm*
+  (ipc-posix-name-prefix "docker")
+  (ipc-posix-name-prefix "com.docker.")
+)
 `;
 var NETWORK_SEATBELT_PROFILE = `
 ; Network Access
@@ -282559,8 +282634,8 @@ function isValidToolName(name3, options = {}) {
 }
 
 // packages/core/dist/src/generated/git-commit.js
-var GIT_COMMIT_INFO = "1110ce8bc";
-var CLI_VERSION = "0.57.0";
+var GIT_COMMIT_INFO = "49b6e5d46";
+var CLI_VERSION = "0.58.0";
 
 // packages/core/dist/src/ide/detect-ide.js
 var IDE_DEFINITIONS = {
@@ -305854,7 +305929,7 @@ function getVersion() {
   }
   versionPromise = (async () => {
     const pkgJson = await getPackageJson(__dirname4);
-    return "0.57.0";
+    return "0.58.0";
   })();
   return versionPromise;
 }
@@ -311975,7 +312050,18 @@ function getNormalizedRelativePath(projectRoot, filePath, isDirectory) {
   if (!isWithinRoot(absoluteFilePath, projectRoot)) {
     return null;
   }
-  const relativePath = path45.relative(projectRoot, absoluteFilePath);
+  const canonicalRoot = canonicalizeMacosPath(projectRoot);
+  const canonicalAbs = canonicalizeMacosPath(absoluteFilePath);
+  let relativePath = path45.relative(canonicalRoot, canonicalAbs);
+  if (process.platform === "darwin" && relativePath.startsWith("..")) {
+    try {
+      const crossPlatformRel = path45.relative(resolveToRealPath(projectRoot), resolveToRealPath(absoluteFilePath));
+      if (!crossPlatformRel.startsWith("..")) {
+        relativePath = crossPlatformRel;
+      }
+    } catch {
+    }
+  }
   let normalized2 = relativePath.replace(/\\/g, "/");
   if (isDirectory && !normalized2.endsWith("/") && normalized2 !== "") {
     normalized2 += "/";
@@ -312296,14 +312382,18 @@ var FileDiscoveryService = class {
       }
       await Promise.all(dirEntries.map(async (entry) => {
         const fullPath = path49.join(currentDir, entry.name);
+        const entryOptions = {
+          ...options,
+          isSymbolicLink: entry.isSymbolicLink()
+        };
         if (entry.isDirectory()) {
-          if (this.shouldIgnoreDirectory(fullPath, options)) {
+          if (this.shouldIgnoreDirectory(fullPath, entryOptions)) {
             ignoredPaths.push(fullPath);
           } else {
             await walk(fullPath);
           }
         } else {
-          if (this.shouldIgnoreFile(fullPath, options)) {
+          if (this.shouldIgnoreFile(fullPath, entryOptions)) {
             ignoredPaths.push(fullPath);
           }
         }
@@ -312364,10 +312454,7 @@ var FileDiscoveryService = class {
   shouldIgnoreDirectory(dirPath, options = {}) {
     return this._shouldIgnore(dirPath, true, options);
   }
-  /**
-   * Internal unified check for paths.
-   */
-  _shouldIgnore(filePath, isDirectory, options = {}) {
+  _checkIgnoreFilters(filePath, isDirectory, options = {}) {
     const { respectGitIgnore = this.defaultFilterFileOptions.respectGitIgnore, respectGeminiIgnore = this.defaultFilterFileOptions.respectGeminiIgnore } = options;
     if (respectGitIgnore && respectGeminiIgnore && this.combinedIgnoreFilter) {
       return this.combinedIgnoreFilter.isIgnored(filePath, isDirectory);
@@ -312383,6 +312470,31 @@ var FileDiscoveryService = class {
     }
     return false;
   }
+  /**
+   * Internal unified check for paths.
+   */
+  _shouldIgnore(filePath, isDirectory, options = {}) {
+    if (this._checkIgnoreFilters(filePath, isDirectory, options)) {
+      return true;
+    }
+    try {
+      const absolutePath = path49.isAbsolute(filePath) ? filePath : path49.resolve(this.projectRoot, filePath);
+      const isSymlink = options.isSymbolicLink ?? fs42.lstatSync(absolutePath, { throwIfNoEntry: false })?.isSymbolicLink() ?? false;
+      if (isSymlink) {
+        const realPath = resolveToRealPath(absolutePath);
+        let targetIsDir = isDirectory;
+        try {
+          targetIsDir = fs42.statSync(realPath).isDirectory();
+        } catch {
+        }
+        if (this._checkIgnoreFilters(realPath, targetIsDir, options)) {
+          return true;
+        }
+      }
+    } catch {
+    }
+    return false;
+  }
   /**
    * Returns the list of ignore files being used (e.g. .geminiignore) excluding .gitignore.
    */
@@ -312535,7 +312647,7 @@ var ReadFileTool = class _ReadFileTool extends BaseDeclarativeTool {
       return "start_line cannot be greater than end_line";
     }
     const fileFilteringOptions = this.config.getFileFilteringOptions();
-    if (this.fileDiscoveryService.shouldIgnoreFile(resolvedPath, fileFilteringOptions)) {
+    if (this.fileDiscoveryService.shouldIgnoreFile(sanitizedPath, fileFilteringOptions) || this.fileDiscoveryService.shouldIgnoreFile(resolvedPath, fileFilteringOptions)) {
       return `File path '${resolvedPath}' is ignored by configured ignore patterns.`;
     }
     return null;
@@ -322672,6 +322784,8 @@ ${truncated}`;
     }
     let spawnedPty;
     let cmdCleanup;
+    let headlessTerminal;
+    const disposables = [];
     try {
       const cols = shellExecutionConfig.terminalWidth ?? 80;
       const rows = shellExecutionConfig.terminalHeight ?? 30;
@@ -322697,17 +322811,18 @@ ${truncated}`;
         ...isWindowsPlatform ? { useConpty: true } : {}
       });
       spawnedPty = ptyProcess;
-      const ptyPid = Number(ptyProcess.pid);
-      const headlessTerminal = new Terminal({
+      const pty = spawnedPty;
+      const ptyPid = Number(pty.pid);
+      headlessTerminal = new Terminal({
         allowProposedApi: true,
         cols,
         rows,
         scrollback: shellExecutionConfig.scrollback ?? SCROLLBACK_LIMIT
       });
       headlessTerminal.scrollToTop();
+      const terminal = headlessTerminal;
       this.activePtys.set(ptyPid, {
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-        ptyProcess,
+        ptyProcess: pty,
         headlessTerminal,
         maxSerializedLines: shellExecutionConfig.maxSerializedLines,
         command: shellExecutionConfig.originalCommand ?? commandToExecute,
@@ -322719,13 +322834,12 @@ ${truncated}`;
           if (!ExecutionLifecycleService.isActive(ptyPid)) {
             return;
           }
-          ptyProcess.write(input);
+          pty.write(input);
         },
         kill: () => {
           killProcessGroup({
             pid: ptyPid,
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-            pty: ptyProcess
+            pty
           }).catch(() => {
           });
         },
@@ -322739,11 +322853,11 @@ ${truncated}`;
             return false;
           }
         },
-        getBackgroundOutput: () => getFullBufferText(headlessTerminal),
+        getBackgroundOutput: () => getFullBufferText(terminal),
         getSubscriptionSnapshot: () => {
-          const endLine = headlessTerminal.buffer.active.length;
+          const endLine = terminal.buffer.active.length;
           const startLine = Math.max(0, endLine - (shellExecutionConfig.maxSerializedLines ?? 2e3));
-          const bufferData = serializeTerminalToObject(headlessTerminal, startLine, endLine);
+          const bufferData = serializeTerminalToObject(terminal, startLine, endLine);
           return bufferData.length > 0 ? bufferData : void 0;
         },
         formatInjection: (output2, error41) => _ShellExecutionService.formatShellBackgroundCompletion(ptyPid, shellExecutionConfig.backgroundCompletionBehavior || "silent", output2, error41 ?? void 0),
@@ -322769,21 +322883,21 @@ ${truncated}`;
         }
         if (!shellExecutionConfig.disableDynamicLineTrimming) {
           if (!hasStartedOutput) {
-            const bufferText = getFullBufferText(headlessTerminal);
+            const bufferText = getFullBufferText(terminal);
             if (bufferText.trim().length === 0) {
               return;
             }
             hasStartedOutput = true;
           }
         }
-        const buffer = headlessTerminal.buffer.active;
+        const buffer = terminal.buffer.active;
         const endLine = buffer.length;
         const startLine = Math.max(0, endLine - (shellExecutionConfig.maxSerializedLines ?? 2e3));
         let newOutput;
         if (shellExecutionConfig.showColor) {
-          newOutput = serializeTerminalToObject(headlessTerminal, startLine, endLine);
+          newOutput = serializeTerminalToObject(terminal, startLine, endLine);
         } else {
-          newOutput = (serializeTerminalToObject(headlessTerminal, startLine, endLine) || []).map((line) => line.map((token2) => {
+          newOutput = (serializeTerminalToObject(terminal, startLine, endLine) || []).map((line) => line.map((token2) => {
             token2.fg = "";
             token2.bg = "";
             return token2;
@@ -322866,7 +322980,7 @@ ${truncated}`;
               _ShellExecutionService.syncBackgroundLog(ptyPid, decodedChunk);
             }
             isWriting = true;
-            headlessTerminal.write(decodedChunk, () => {
+            terminal.write(decodedChunk, () => {
               render3();
               isWriting = false;
               resolveChunk();
@@ -322883,17 +322997,24 @@ ${truncated}`;
           }
         }));
       };
-      ptyProcess.onData((data) => {
+      const dataListener = pty.onData((data) => {
         const bufferData = Buffer.from(data, "utf-8");
         handleOutput(bufferData);
       });
-      ptyProcess.onExit(({ exitCode, signal }) => {
+      disposables.push(dataListener);
+      const exitListener = pty.onExit(({ exitCode, signal }) => {
         exited = true;
         abortSignal.removeEventListener("abort", abortHandler);
-        _ShellExecutionService.destroyPtyProcess(ptyProcess);
+        _ShellExecutionService.destroyPtyProcess(pty);
         const finalize = () => {
           render3(true);
           cmdCleanup?.();
+          disposables.forEach((d) => {
+            try {
+              d.dispose();
+            } catch {
+            }
+          });
           const event = {
             type: "exit",
             exitCode,
@@ -322909,12 +323030,12 @@ ${truncated}`;
             historyItem.endTime = Date.now();
           }
           onOutputEvent(event);
-          const endLine = headlessTerminal.buffer.active.length;
+          const endLine = headlessTerminal ? headlessTerminal.buffer.active.length : 0;
           const startLine = Math.max(0, endLine - (shellExecutionConfig.maxSerializedLines ?? 2e3));
-          const ansiOutputSnapshot = serializeTerminalToObject(headlessTerminal, startLine, endLine);
-          const finalOutput = getFullBufferText(headlessTerminal);
+          const ansiOutputSnapshot = headlessTerminal ? serializeTerminalToObject(headlessTerminal, startLine, endLine) : [];
+          const finalOutput = headlessTerminal ? getFullBufferText(headlessTerminal) : "";
           try {
-            headlessTerminal.dispose();
+            headlessTerminal?.dispose();
           } catch {
           }
           _ShellExecutionService.cleanupLogStream(ptyPid).then(() => {
@@ -322950,6 +323071,7 @@ ${truncated}`;
           finalize();
         });
       });
+      disposables.push(exitListener);
       const abortHandler = async () => {
         if (ptyProcess.pid && !exited) {
           await killProcessGroup({
@@ -322969,10 +323091,23 @@ ${truncated}`;
       if (spawnedPty) {
         _ShellExecutionService.destroyPtyProcess(spawnedPty);
       }
-      if (error40?.message?.includes("posix_spawnp failed")) {
+      if (headlessTerminal) {
+        try {
+          headlessTerminal.dispose();
+        } catch {
+        }
+      }
+      disposables.forEach((d) => {
+        try {
+          d.dispose();
+        } catch {
+        }
+      });
+      const isPtyCreationFailure = error40?.message?.includes("posix_spawnp failed") || error40?.message?.includes("ENXIO") || isNodeError(error40) && error40.code === "ENXIO" || error40?.message?.includes("Device not configured");
+      if (isPtyCreationFailure) {
         onOutputEvent({
           type: "data",
-          chunk: "[GEMINI_CLI_WARNING] PTY execution failed, falling back to child_process. This may be due to sandbox restrictions.\n"
+          chunk: "[GEMINI_CLI_WARNING] PTY execution failed, falling back to child_process. This may be due to terminal exhaustion or sandbox restrictions.\n"
         });
         throw e2;
       } else {
@@ -331554,13 +331689,13 @@ function stripToolCallIdPrefixes(contents) {
           };
         }
       }
-      const hasOtherKeys = Object.keys(newPart).some((key) => key !== "text" && key !== "thought" && key !== "callIndex" && newPart[key] !== void 0);
+      const hasOtherKeys = Object.keys(newPart).some((key) => key !== "text" && key !== "thought" && key !== "callIndex");
       if (newPart.text !== void 0 && newPart.text === "" && hasOtherKeys) {
         delete newPart.text;
       }
       return newPart;
     }).filter((part) => {
-      const hasOtherKeys = Object.keys(part).some((key) => key !== "text" && key !== "thought" && key !== "callIndex" && part[key] !== void 0);
+      const hasOtherKeys = Object.keys(part).some((key) => key !== "text" && key !== "thought" && key !== "callIndex");
       if (part.text !== void 0 && part.text === "" && !hasOtherKeys) {
         return false;
       }
@@ -338785,7 +338920,7 @@ var A2AAuthProviderFactory = class _A2AAuthProviderFactory {
         return provider;
       }
       case "oauth2": {
-        const { OAuth2AuthProvider } = await import("./oauth2-provider-BYKBBEKI.js");
+        const { OAuth2AuthProvider } = await import("./oauth2-provider-YDONBTSO.js");
         const provider = new OAuth2AuthProvider(authConfig, options.agentName ?? "unknown", agentCard, options.agentCardUrl);
         await provider.initialize();
         return provider;
@@ -395932,6 +396067,7 @@ export {
   detectBOM,
   readFileWithEncoding,
   getSpecificMimeType,
+  canonicalizeMacosPath,
   isWithinRoot,
   getRealPath,
   isEmpty,

package/bundle/{chunk-MNBBUQQS.js → chunk-MPJ66UCC.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   exitCli,
   require_source
-} from "./chunk-HY6GN2F7.js";
+} from "./chunk-NI56QRLL.js";
 import {
   DEFAULT_PORT,
   SERVER_START_WAIT_MS,
@@ -14,10 +14,10 @@ import {
   isServerRunning,
   resolveGemmaConfig,
   writeServerProcessInfo
-} from "./chunk-GPOBVDAD.js";
+} from "./chunk-34DO53P3.js";
 import {
   debugLogger
-} from "./chunk-DFPYJMVX.js";
+} from "./chunk-MFLFXOVQ.js";
 import {
   __toESM
 } from "./chunk-34MYV7JD.js";

package/bundle/{chunk-HY6GN2F7.js → chunk-NI56QRLL.js}

@@ -1,7 +1,7 @@
 const require = (await import('node:module')).createRequire(import.meta.url); const __chunk_filename = (await import('node:url')).fileURLToPath(import.meta.url); const __chunk_dirname = (await import('node:path')).dirname(__chunk_filename);
 import {
   runExitCleanup
-} from "./chunk-RLDNVR77.js";
+} from "./chunk-VR4KVJQS.js";
 import {
   __commonJS,
   __require