@google/gemini-cli 0.62.0-preview.0 → 0.63.0-nightly.20260928.g2fe7c2d3f

package/bundle/{chunk-7LRWECUM.js → chunk-B3EF23HT.js}

@@ -252396,14 +252396,21 @@ function trimTrailingSpacesAndDots(str2) {
   return str2.slice(0, end + 1);
 }
 var GIT_SFN_REGEX = /^(git|gi[0-9a-f]{4})~\d+$/;
-var ENV_SFN_REGEX = /^(env|en[0-9a-f]{4})~\d+$/;
+var ENV_SFN_REGEX = /^(env|en[0-9a-f]{4})~\d+(\..+)?$/i;
 var NODE_MODULES_SFN_REGEX = /^(node_m|no[0-9a-f]{4})~\d+$/;
 var GHA_CREDS_SFN_REGEX = /^(gha-cr|gh[0-9a-f]{4})~\d+\.jso(n)?$/;
+var SAFE_ENV_TEMPLATES = /* @__PURE__ */ new Set([
+  ".env.example",
+  ".env.sample",
+  ".env.template",
+  ".env.dist"
+]);
 function hasBlockedPathSegment(p) {
   const segments = p.split(/[/\\]/);
   for (const segment of segments) {
     const clean = trimTrailingSpacesAndDots(segment.split(":")[0]).toLowerCase();
-    if (clean === ".git" || clean === ".env" || clean === "node_modules" || GIT_SFN_REGEX.test(clean) || ENV_SFN_REGEX.test(clean) || NODE_MODULES_SFN_REGEX.test(clean)) {
+    const isEnvFile = clean === ".env" || clean.startsWith(".env.") && !SAFE_ENV_TEMPLATES.has(clean);
+    if (clean === ".git" || isEnvFile || clean === "node_modules" || GIT_SFN_REGEX.test(clean) || ENV_SFN_REGEX.test(clean) || NODE_MODULES_SFN_REGEX.test(clean)) {
       return true;
     }
     if (clean.startsWith("gha-creds-") && clean.endsWith(".json") || GHA_CREDS_SFN_REGEX.test(clean)) {
@@ -253700,6 +253707,7 @@ var REFERENCE_CONTENT_END = "--- End of content ---";
 var DEFAULT_MAX_LINES_TEXT_FILE = 2e3;
 var MAX_LINE_LENGTH_TEXT_FILE = 2e3;
 var MAX_FILE_SIZE_MB = 20;
+var MAX_STORED_TOOL_OUTPUT_BYTES = 64 * 1024;
 var EMPTY_RESPONSE_COMPRESS_SUGGESTION = "The model returned an empty text response. If your context window is near capacity, try using /compress.";
 var THINKING_ONLY_COMPRESS_SUGGESTION = "The model returned reasoning thoughts but no final response text. If your context window is near capacity, try using /compress.";
 var MAX_TOKENS_EXCEEDED_SUGGESTION = "Model response was truncated because it exceeded the token limit. Try using /compress to free up context space.";
@@ -253783,8 +253791,41 @@ function decodeUTF32(buf, littleEndian) {
   }
   return out2;
 }
-async function readFileWithEncoding(filePath) {
-  const full = await fs7.promises.readFile(filePath);
+async function readSecureFileBuffer(filePath, expectedStats) {
+  const initialStats = expectedStats ?? await fs7.promises.stat(filePath);
+  let fileHandle;
+  try {
+    if (typeof fs7.promises.open === "function") {
+      try {
+        fileHandle = await fs7.promises.open(filePath, "r");
+      } catch {
+      }
+      if (fileHandle && typeof fileHandle.stat === "function") {
+        const handleStats = await fileHandle.stat();
+        if (initialStats.dev !== void 0 && initialStats.ino !== void 0 && handleStats && handleStats.dev !== void 0 && handleStats.ino !== void 0 && (initialStats.dev !== handleStats.dev || initialStats.ino !== handleStats.ino)) {
+          throw new Error(`File device or inode changed during read: ${filePath}`);
+        }
+      }
+    }
+    const contentBuffer = fileHandle ? await fileHandle.readFile() : await fs7.promises.readFile(filePath);
+    let postStats;
+    try {
+      postStats = await fs7.promises.stat(filePath);
+    } catch {
+    }
+    if (postStats && initialStats.dev !== void 0 && initialStats.ino !== void 0 && postStats.dev !== void 0 && postStats.ino !== void 0 && (initialStats.dev !== postStats.dev || initialStats.ino !== postStats.ino)) {
+      throw new Error(`File device or inode changed during read: ${filePath}`);
+    }
+    return contentBuffer;
+  } finally {
+    if (fileHandle) {
+      await fileHandle.close().catch(() => {
+      });
+    }
+  }
+}
+async function readFileWithEncoding(filePath, expectedStats) {
+  const full = await readSecureFileBuffer(filePath, expectedStats);
   if (full.length === 0)
     return "";
   const bom = detectBOM(full);
@@ -254011,14 +254052,14 @@ async function processSingleFileContent(filePath, rootDirectory, _fileSystemServ
             returnDisplay: `Skipped large SVG file (>1MB): ${relativePathForDisplay}`
           };
         }
-        const content = await readFileWithEncoding(filePath);
+        const content = await readFileWithEncoding(filePath, stats);
         return {
           llmContent: content,
           returnDisplay: `Read SVG as text: ${relativePathForDisplay}`
         };
       }
       case "text": {
-        const content = await readFileWithEncoding(filePath);
+        const content = await readFileWithEncoding(filePath, stats);
         const lines = content.split(/\r?\n/);
         const originalLineCount = lines.length;
         let sliceStart = 0;
@@ -254068,7 +254109,7 @@ async function processSingleFileContent(filePath, rootDirectory, _fileSystemServ
             errorType: ToolErrorType.READ_CONTENT_FAILURE
           };
         }
-        const contentBuffer = await fs7.promises.readFile(filePath);
+        const contentBuffer = await readSecureFileBuffer(filePath, stats);
         const base64Data = contentBuffer.toString("base64");
         return {
           llmContent: {
@@ -254084,7 +254125,7 @@ async function processSingleFileContent(filePath, rootDirectory, _fileSystemServ
       case "pdf":
       case "video": {
         const mimeType = getSpecificMimeType(filePath) ?? "application/octet-stream";
-        const contentBuffer = await fs7.promises.readFile(filePath);
+        const contentBuffer = await readSecureFileBuffer(filePath, stats);
         const base64Data = contentBuffer.toString("base64");
         return {
           llmContent: {
@@ -283412,8 +283453,8 @@ function isValidToolName(name3, options = {}) {
 }
 
 // packages/core/dist/src/generated/git-commit.js
-var GIT_COMMIT_INFO = "f50ba8608";
-var CLI_VERSION = "0.62.0-preview.0";
+var GIT_COMMIT_INFO = "2fe7c2d3f";
+var CLI_VERSION = "0.63.0-nightly.20260923.gf50ba8608";
 
 // packages/core/dist/src/ide/detect-ide.js
 var IDE_DEFINITIONS = {
@@ -286379,7 +286420,12 @@ var ChatRecordingService = class {
         if (this.kind === "subagent") {
           filename = `${safeSessionId}.jsonl`;
         } else {
-          filename = `${SESSION_FILE_PREFIX}${timestamp2}-${safeSessionId.slice(0, 8)}.jsonl`;
+          const shortId = safeSessionId.slice(0, 8);
+          filename = `${SESSION_FILE_PREFIX}${timestamp2}-${shortId}.jsonl`;
+          let collisionIndex = 1;
+          while (fs32.existsSync(path29.join(chatsDir, filename))) {
+            filename = `${SESSION_FILE_PREFIX}${timestamp2}-${collisionIndex++}-${shortId}.jsonl`;
+          }
         }
         this.conversationFile = path29.join(chatsDir, filename);
         const directories = this.kind === "subagent" ? [
@@ -306707,7 +306753,7 @@ function getVersion() {
   }
   versionPromise = (async () => {
     const pkgJson = await getPackageJson(__dirname4);
-    return "0.62.0-preview.0";
+    return "0.63.0-nightly.20260928.g2fe7c2d3f";
   })();
   return versionPromise;
 }
@@ -313293,10 +313339,11 @@ function getSafeGitEnv(baseEnv = process.env) {
   }
   return {
     ...cleanedEnv,
+    GIT_TERMINAL_PROMPT: "0",
     GIT_CONFIG_GLOBAL: devNullPath,
     GIT_CONFIG_SYSTEM: devNullPath,
     GIT_CONFIG_NOSYSTEM: "1",
-    GIT_CONFIG_COUNT: "8",
+    GIT_CONFIG_COUNT: "7",
     GIT_CONFIG_KEY_0: "credential.helper",
     GIT_CONFIG_VALUE_0: "",
     GIT_CONFIG_KEY_1: "core.fsmonitor",
@@ -313310,9 +313357,7 @@ function getSafeGitEnv(baseEnv = process.env) {
     GIT_CONFIG_KEY_5: "core.editor",
     GIT_CONFIG_VALUE_5: "",
     GIT_CONFIG_KEY_6: "sequence.editor",
-    GIT_CONFIG_VALUE_6: "",
-    GIT_CONFIG_KEY_7: "diff.external",
-    GIT_CONFIG_VALUE_7: ""
+    GIT_CONFIG_VALUE_6: ""
   };
 }
 async function getAbsoluteGitDir(cwd) {
@@ -313607,7 +313652,14 @@ var ReadFileToolInvocation = class extends BaseToolInvocation {
     };
   }
   async execute(_options) {
-    const validationError = this.config.validatePathAccess(this.resolvedPath, "read");
+    const sanitizedPath = resolveDefensiveToolPath(this.params.file_path, this.config.getTargetDir());
+    let targetPathToRead = this.resolvedPath;
+    try {
+      targetPathToRead = resolveToRealPath(path52.resolve(this.config.getTargetDir(), sanitizedPath));
+    } catch {
+      targetPathToRead = path52.resolve(this.config.getTargetDir(), sanitizedPath);
+    }
+    const validationError = this.config.validatePathAccess(targetPathToRead, "read");
     if (validationError) {
       return {
         llmContent: validationError,
@@ -313618,7 +313670,7 @@ var ReadFileToolInvocation = class extends BaseToolInvocation {
         }
       };
     }
-    const result2 = await processSingleFileContent(this.resolvedPath, this.config.getTargetDir(), this.config.getFileSystemService(), this.params.start_line, this.params.end_line);
+    const result2 = await processSingleFileContent(targetPathToRead, this.config.getTargetDir(), this.config.getFileSystemService(), this.params.start_line, this.params.end_line);
     if (result2.error) {
       return {
         llmContent: result2.llmContent,
@@ -313644,12 +313696,12 @@ ${result2.llmContent}`;
       llmContent = result2.llmContent || "";
     }
     const lines = typeof result2.llmContent === "string" ? result2.llmContent.split("\n").length : void 0;
-    const mimetype = getSpecificMimeType(this.resolvedPath);
+    const mimetype = getSpecificMimeType(targetPathToRead);
     const programming_language = getProgrammingLanguage({
-      file_path: this.resolvedPath
+      file_path: targetPathToRead
     });
-    logFileOperation(this.config, new FileOperationEvent(READ_FILE_TOOL_NAME, FileOperation.READ, lines, mimetype, path52.extname(this.resolvedPath), programming_language));
-    const jitContext = await discoverJitContext(this.config, this.resolvedPath);
+    logFileOperation(this.config, new FileOperationEvent(READ_FILE_TOOL_NAME, FileOperation.READ, lines, mimetype, path52.extname(targetPathToRead), programming_language));
+    const jitContext = await discoverJitContext(this.config, targetPathToRead);
     if (jitContext) {
       if (typeof llmContent === "string") {
         llmContent = appendJitContext(llmContent, jitContext);
@@ -313799,7 +313851,7 @@ var ReadMcpResourceToolInvocation = class extends BaseToolInvocation {
         }
       }
       return {
-        llmContent: contentText || "No content returned from resource.",
+        llmContent: contentText ? wrapUntrusted(contentText) : "No content returned from resource.",
         returnDisplay: this.resource ? `Successfully read resource "${this.resource.name}" from server "${this.resource.serverName}"` : `Successfully read resource: ${uri}`
       };
     } catch (e2) {
@@ -313873,7 +313925,7 @@ var ListMcpResourcesToolInvocation = class extends BaseToolInvocation {
       content += "\n";
     }
     return {
-      llmContent: content,
+      llmContent: wrapUntrusted(content),
       returnDisplay: `Listed ${resources.length} resources.`
     };
   }
@@ -322337,7 +322389,7 @@ var ActivateSkillTool = class _ActivateSkillTool extends BaseDeclarativeTool {
 };
 
 // packages/core/dist/src/tools/shell.js
-import fsPromises9 from "node:fs/promises";
+import fsPromises10 from "node:fs/promises";
 import fs51 from "node:fs";
 import path61 from "node:path";
 import os32 from "node:os";
@@ -322397,6 +322449,7 @@ import { spawn as cpSpawn } from "node:child_process";
 import { TextDecoder as TextDecoder2 } from "node:util";
 import os30 from "node:os";
 import fs49, { mkdirSync as mkdirSync4 } from "node:fs";
+import fsPromises9 from "node:fs/promises";
 import path59 from "node:path";
 var import_headless3 = __toESM(require_xterm_headless(), 1);
 
@@ -323447,6 +323500,7 @@ var ShellExecutionService = class _ShellExecutionService {
   static activeChildProcesses = /* @__PURE__ */ new Map();
   static backgroundLogPids = /* @__PURE__ */ new Set();
   static backgroundLogStreams = /* @__PURE__ */ new Map();
+  static backgroundTempDirs = /* @__PURE__ */ new Map();
   static backgroundProcessHistory = /* @__PURE__ */ new Map();
   static getLogDir() {
     return path59.join(Storage.getGlobalTempDir(), "background-processes");
@@ -323474,6 +323528,10 @@ ${truncated}`;
     }
   }
   static async cleanupLogStream(pid) {
+    const tempDir = this.backgroundTempDirs.get(pid);
+    this.backgroundTempDirs.delete(pid);
+    const rmPromise = tempDir ? fsPromises9.rm(tempDir, { recursive: true, force: true }).catch(() => {
+    }) : Promise.resolve();
     const stream2 = this.backgroundLogStreams.get(pid);
     if (stream2) {
       await new Promise((resolve29) => {
@@ -323482,6 +323540,7 @@ ${truncated}`;
       this.backgroundLogStreams.delete(pid);
     }
     this.backgroundLogPids.delete(pid);
+    await rmPromise;
   }
   /**
    * Executes a shell command using `node-pty`, capturing all output and lifecycle events.
@@ -323574,8 +323633,7 @@ ${truncated}`;
       ["core.sshCommand", ""],
       ["core.pager", "cat"],
       ["core.editor", ""],
-      ["sequence.editor", ""],
-      ["diff.external", ""]
+      ["sequence.editor", ""]
     ];
     for (const [overrideKey, overrideVal] of defaultGitOverrides) {
       const keyVar = `GIT_CONFIG_KEY_${gitConfigCount}`;
@@ -323653,6 +323711,33 @@ ${truncated}`;
             }
           }
         }
+        if (child.stdout) {
+          child.stdout.removeAllListeners();
+          try {
+            child.stdout.destroy();
+          } catch {
+          }
+        }
+        if (child.stderr) {
+          child.stderr.removeAllListeners();
+          try {
+            child.stderr.destroy();
+          } catch {
+          }
+        }
+        const stdin = child.stdin;
+        if (stdin) {
+          stdin.removeAllListeners();
+          try {
+            stdin.destroy();
+          } catch {
+          }
+        }
+        child.removeAllListeners("error");
+        child.removeAllListeners("close");
+        state.sniffChunks.length = 0;
+        stdoutDecoder = null;
+        stderrDecoder = null;
         return;
       };
       var cleanup = cleanup2;
@@ -323680,7 +323765,8 @@ ${truncated}`;
           process: child,
           state,
           command: shellExecutionConfig.originalCommand ?? commandToExecute,
-          sessionId: shellExecutionConfig.sessionId
+          sessionId: shellExecutionConfig.sessionId,
+          tempDir: shellExecutionConfig.tempDir
         });
       }
       const lifecycleHandle = child.pid ? ExecutionLifecycleService.attachExecution(child.pid, {
@@ -323784,6 +323870,7 @@ ${truncated}`;
         cleanup2();
         cmdCleanup?.();
         let combinedOutput = state.output;
+        state.output = "";
         if (state.truncated) {
           const truncationMessage = `
 [GEMINI_CLI_WARNING: Output truncated. The buffer is limited to ${MAX_CHILD_PROCESS_BUFFER_SIZE / (1024 * 1024)}MB.]`;
@@ -323819,9 +323906,8 @@ ${truncated}`;
             historyItem.endTime = Date.now();
           }
           onOutputEvent(event);
-          _ShellExecutionService.cleanupLogStream(pid).then(() => {
-            _ShellExecutionService.activeChildProcesses.delete(pid);
-          });
+          _ShellExecutionService.activeChildProcesses.delete(pid);
+          _ShellExecutionService.cleanupLogStream(pid);
           ExecutionLifecycleService.completeWithResult(pid, resultPayload);
         } else {
           resolveWithoutPid?.(resultPayload);
@@ -324031,7 +324117,8 @@ ${truncated}`;
         maxSerializedLines: shellExecutionConfig.maxSerializedLines,
         command: shellExecutionConfig.originalCommand ?? commandToExecute,
         sessionId: shellExecutionConfig.sessionId,
-        cancelRender
+        cancelRender,
+        tempDir: shellExecutionConfig.tempDir
       });
       const result2 = ExecutionLifecycleService.attachExecution(assignedPid, {
         executionMethod: ptyInfo?.name ?? "node-pty",
@@ -324448,18 +324535,32 @@ ${truncated}`;
    * This resolves the execution promise but keeps the PTY active.
    *
    * @param pid The process ID of the target PTY.
+   * @param sessionId Optional session ID for process history tracking.
+   * @param command Optional command string for display.
+   * @param tempDir Optional temporary directory path owned by this execution to clean up on exit.
    */
-  static background(pid, sessionId, command) {
-    if (this.backgroundLogPids.has(pid)) {
-      return;
-    }
+  static background(pid, sessionId, command, tempDir) {
     const activePty = this.activePtys.get(pid);
     const activeChild = this.activeChildProcesses.get(pid);
+    const resolvedTempDir = tempDir ?? activePty?.tempDir ?? activeChild?.tempDir;
     const resolvedSessionId = sessionId ?? activePty?.sessionId ?? activeChild?.sessionId;
     const resolvedCommand = command ?? activePty?.command ?? activeChild?.command ?? "unknown command";
     if (!resolvedSessionId) {
       throw new Error("Session ID is required for background operations");
     }
+    if (!activePty && !activeChild) {
+      if (resolvedTempDir) {
+        fsPromises9.rm(resolvedTempDir, { recursive: true, force: true }).catch(() => {
+        });
+      }
+      return;
+    }
+    if (resolvedTempDir) {
+      this.backgroundTempDirs.set(pid, resolvedTempDir);
+    }
+    if (this.backgroundLogPids.has(pid)) {
+      return;
+    }
     const MAX_BACKGROUND_PROCESS_HISTORY_SIZE = 100;
     const history = this.backgroundProcessHistory.get(resolvedSessionId) ?? /* @__PURE__ */ new Map();
     if (history.size >= MAX_BACKGROUND_PROCESS_HISTORY_SIZE) {
@@ -324471,7 +324572,8 @@ ${truncated}`;
     history.set(pid, {
       command: resolvedCommand,
       status: "running",
-      startTime: Date.now()
+      startTime: Date.now(),
+      ...resolvedTempDir ? { tempDir: resolvedTempDir } : {}
     });
     this.backgroundProcessHistory.set(resolvedSessionId, history);
     const logPath = this.getLogFilePath(pid);
@@ -324611,8 +324713,15 @@ ${truncated}`;
       } catch {
       }
     }
+    for (const tempDir of this.backgroundTempDirs.values()) {
+      try {
+        fs49.rmSync(tempDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
     this.backgroundLogPids.clear();
     this.backgroundLogStreams.clear();
+    this.backgroundTempDirs.clear();
     this.backgroundProcessHistory.clear();
   }
 };
@@ -324904,15 +325013,19 @@ exit $__code`;
   getExplanation() {
     return this.getContextualDetails().trim();
   }
+  hasTaintedOrBuildFileRisk() {
+    const command = stripShellWrapper(this.params.command);
+    const history = this.getHistory();
+    const untrustedContext = extractUntrustedContext(history);
+    const untrustedFlags = findUntrustedFlags(command, untrustedContext);
+    const modifiedBuildFiles = getModifiedBuildFiles(this.context.config);
+    const isBuildCmd = isBuildOrTestCommand(command);
+    return untrustedFlags.length > 0 || isBuildCmd && modifiedBuildFiles.length > 0;
+  }
   getPolicyUpdateOptions(outcome) {
     if (outcome === ToolConfirmationOutcome.ProceedAlwaysAndSave || outcome === ToolConfirmationOutcome.ProceedAlways) {
       const command = stripShellWrapper(this.params.command);
-      const history = this.getHistory();
-      const untrustedContext = extractUntrustedContext(history);
-      const untrustedFlags = findUntrustedFlags(command, untrustedContext);
-      const modifiedBuildFiles = getModifiedBuildFiles(this.context.config);
-      const isBuildCmd = isBuildOrTestCommand(command);
-      if (untrustedFlags.length > 0 || isBuildCmd && modifiedBuildFiles.length > 0) {
+      if (this.hasTaintedOrBuildFileRisk()) {
         return void 0;
       }
       const rootCommands = [...new Set(getCommandRoots(command))];
@@ -324928,24 +325041,18 @@ exit $__code`;
     if (forcedDecision === "deny") {
       return super.shouldConfirmExecute(abortSignal, forcedDecision);
     }
-    const command = stripShellWrapper(this.params.command);
-    const history = this.getHistory();
-    const untrustedContext = extractUntrustedContext(history);
-    const untrustedFlags = findUntrustedFlags(command, untrustedContext);
-    const modifiedBuildFiles = getModifiedBuildFiles(this.context.config);
-    const isBuildCmd = isBuildOrTestCommand(command);
-    if (untrustedFlags.length > 0 || isBuildCmd && modifiedBuildFiles.length > 0) {
+    if (this.hasTaintedOrBuildFileRisk()) {
       return this.getConfirmationDetails(abortSignal);
     }
-    if (this.context.config.getApprovalMode() === ApprovalMode.YOLO) {
+    if (this.context.config.getApprovalMode() === ApprovalMode.YOLO && forcedDecision !== "ask_user") {
       return super.shouldConfirmExecute(abortSignal, forcedDecision);
     }
     if (this.params[PARAM_ADDITIONAL_PERMISSIONS]) {
       return this.getConfirmationDetails(abortSignal);
     }
     if (this.context.config.getSandboxEnabled()) {
-      const command2 = stripShellWrapper(this.params.command);
-      const rootCommands = getCommandRoots(command2);
+      const command = stripShellWrapper(this.params.command);
+      const rootCommands = getCommandRoots(command);
       const rawRootCommand = rootCommands[0];
       if (rawRootCommand) {
         const rootCommand = normalizeCommand(rawRootCommand);
@@ -324956,7 +325063,7 @@ exit $__code`;
           const approved = this.context.config.sandboxPolicyManager.getCommandPermissions(rootCommand);
           const hasNetwork = modeConfig.network || approved.network;
           const missingNetwork = !!proactive.network && !hasNetwork;
-          const parsed = parseCommandDetails(command2);
+          const parsed = parseCommandDetails(command);
           const subCommand = parsed?.details[0]?.args?.[0];
           const needsNetwork = isNetworkReliantCommand(rootCommand, subCommand);
           if (needsNetwork) {
@@ -325076,6 +325183,7 @@ exit $__code`;
     const isWindows3 = os32.platform() === "win32";
     let tempFilePath = "";
     let tempDir = "";
+    let isBackgrounded = false;
     const timeoutMs = this.context.config.getShellToolInactivityTimeout();
     const timeoutController = new AbortController();
     let timeoutTimer;
@@ -325218,7 +325326,8 @@ exit $__code`;
           }
         },
         backgroundCompletionBehavior: this.context.config.getShellBackgroundCompletionBehavior(),
-        originalCommand: strippedCommand
+        originalCommand: strippedCommand,
+        tempDir
       });
       if (pid) {
         if (setExecutionIdCallback) {
@@ -325231,7 +325340,12 @@ exit $__code`;
           let promotionTimer = setTimeout(() => {
             promotionTimer = null;
             if (!completed) {
-              ShellExecutionService.background(pid, sessionId, strippedCommand);
+              try {
+                ShellExecutionService.background(pid, sessionId, strippedCommand, tempDir);
+                isBackgrounded = true;
+              } catch (err2) {
+                debugLogger.error("Failed to background shell execution:", err2);
+              }
             }
           }, delay3);
           const clearPromotionTimer = () => {
@@ -325268,20 +325382,22 @@ ${cumulativeOutput}`,
         }
       }
       const result2 = await resultPromise;
-      if (!result2.backgrounded) {
+      if (result2.backgrounded) {
+        isBackgrounded = true;
+      } else {
         flushOutput();
       }
       const backgroundPIDs = [];
       if (os32.platform() !== "win32") {
         let tempFileExists = false;
         try {
-          await fsPromises9.access(tempFilePath);
+          await fsPromises10.access(tempFilePath);
           tempFileExists = true;
         } catch {
           tempFileExists = false;
         }
         if (tempFileExists) {
-          const backgroundPIDContent = await fsPromises9.readFile(tempFilePath, "utf8");
+          const backgroundPIDContent = await fsPromises10.readFile(tempFilePath, "utf8");
           const backgroundPIDLines = backgroundPIDContent.split("\n").map((line) => line.trim()).filter(Boolean);
           for (const line of backgroundPIDLines) {
             if (!/^\d+$/.test(line)) {
@@ -325507,16 +325623,16 @@ ${result2.output}`;
       }
       signal.removeEventListener("abort", onAbort);
       timeoutController.signal.removeEventListener("abort", onAbort);
-      if (!this.params.is_background) {
+      if (!isBackgrounded) {
         if (tempFilePath) {
           try {
-            await fsPromises9.unlink(tempFilePath);
+            await fsPromises10.unlink(tempFilePath);
           } catch {
           }
         }
         if (tempDir) {
           try {
-            await fsPromises9.rm(tempDir, { recursive: true, force: true });
+            await fsPromises10.rm(tempDir, { recursive: true, force: true });
           } catch {
           }
         }
@@ -331471,7 +331587,7 @@ var WebSearchToolInvocation = class extends BaseToolInvocation {
       return {
         llmContent: `Web search results for "${this.params.query}":
 
-${modifiedResponseText}`,
+${wrapUntrusted(modifiedResponseText)}`,
         returnDisplay: `Search results for "${this.params.query}" returned.`,
         sources
       };
@@ -335883,6 +335999,133 @@ var PreCompressTrigger;
 
 // packages/core/dist/src/context/chatCompressionService.js
 var DEFAULT_COMPRESSION_TOKEN_THRESHOLD = 0.5;
+var RECENT_TURNS_PROTECTED = 3;
+var RETRIEVAL_TOOL_NAMES_EXEMPT_FROM_COLLAPSE = /* @__PURE__ */ new Set([
+  "read_file",
+  "read_many_files",
+  "get_internal_docs",
+  "read_mcp_resource",
+  "grep",
+  "rip_grep",
+  "glob",
+  "search_file_content",
+  "find_files"
+]);
+function isExemptRetrievalTool(toolName, exemptTools = RETRIEVAL_TOOL_NAMES_EXEMPT_FROM_COLLAPSE) {
+  if (!toolName) {
+    return false;
+  }
+  const normalized2 = toolName.toLowerCase();
+  if (exemptTools.has(normalized2)) {
+    return true;
+  }
+  return normalized2.endsWith("read_file") || normalized2.endsWith("read_files") || normalized2.endsWith("read_many_files") || normalized2.endsWith("read_resource");
+}
+var COLLAPSED_FUNCTION_RESPONSE_MAX_BYTES = 2048;
+var defaultGraphemeSegmenter = new Intl.Segmenter(void 0, {
+  granularity: "grapheme"
+});
+function collapseOlderFunctionResponses(history, maxBytesPerOldResponse = COLLAPSED_FUNCTION_RESPONSE_MAX_BYTES, segmenter2 = defaultGraphemeSegmenter, protectedTurns = RECENT_TURNS_PROTECTED, exemptTools = RETRIEVAL_TOOL_NAMES_EXEMPT_FROM_COLLAPSE) {
+  const toolIndices = [];
+  for (let i3 = 0; i3 < history.length; i3++) {
+    if (history[i3].role === "user" && history[i3].parts?.some((p) => !!p.functionResponse)) {
+      toolIndices.push(i3);
+    }
+  }
+  if (toolIndices.length <= protectedTurns) {
+    return history;
+  }
+  const cutoffToolIndex = toolIndices[toolIndices.length - protectedTurns];
+  const collapseString = (str2) => {
+    const totalBytes = Buffer.byteLength(str2, "utf8");
+    if (totalBytes <= maxBytesPerOldResponse) {
+      return str2;
+    }
+    const previewBytes = maxBytesPerOldResponse;
+    let preview = "";
+    let currentBytes = 0;
+    for (const { segment } of segmenter2.segment(str2)) {
+      const segmentBytes = Buffer.byteLength(segment, "utf8");
+      if (currentBytes + segmentBytes > previewBytes) {
+        break;
+      }
+      preview += segment;
+      currentBytes += segmentBytes;
+    }
+    const omittedBytes = totalBytes - currentBytes;
+    return `${preview}
+... [Tool output collapsed from previous turn: ${omittedBytes} bytes omitted to conserve memory] ...`;
+  };
+  const collapseValue = (val) => {
+    if (typeof val === "string") {
+      return collapseString(val);
+    }
+    if (Array.isArray(val)) {
+      let arrayModified = false;
+      const newVal = val.map((item) => {
+        const collapsed = collapseValue(item);
+        if (collapsed !== item) {
+          arrayModified = true;
+        }
+        return collapsed;
+      });
+      return arrayModified ? newVal : val;
+    }
+    if (typeof val === "object" && val !== null) {
+      const proto = Object.getPrototypeOf(val);
+      if (proto !== Object.prototype && proto !== null) {
+        return val;
+      }
+      let objModified = false;
+      const copy = {};
+      for (const [k, v] of Object.entries(val)) {
+        const collapsed = collapseValue(v);
+        if (collapsed !== v) {
+          objModified = true;
+        }
+        copy[k] = collapsed;
+      }
+      return objModified ? copy : val;
+    }
+    return val;
+  };
+  let modified = false;
+  const newHistory = history.map((content, idx) => {
+    if (idx >= cutoffToolIndex || content.role !== "user" || !content.parts) {
+      return content;
+    }
+    let partsModified = false;
+    const newParts = content.parts.map((part) => {
+      if (!part.functionResponse?.response) {
+        return part;
+      }
+      if (isExemptRetrievalTool(part.functionResponse.name, exemptTools)) {
+        return part;
+      }
+      const resp = part.functionResponse.response;
+      const newResp = collapseValue(resp);
+      if (newResp !== resp) {
+        partsModified = true;
+        return {
+          ...part,
+          functionResponse: {
+            // eslint-disable-next-line @typescript-eslint/no-misused-spread
+            ...part.functionResponse,
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+            response: newResp
+          }
+        };
+      }
+      return part;
+    });
+    if (partsModified) {
+      modified = true;
+      return { ...content, parts: newParts };
+    }
+    return content;
+  });
+  return modified ? newHistory : history;
+}
 var COMPRESSION_PRESERVE_THRESHOLD = 0.3;
 var COMPRESSION_FUNCTION_RESPONSE_TOKEN_BUDGET = 5e4;
 function findCompressSplitPoint(contents, fraction) {
@@ -336011,10 +336254,12 @@ var ChatCompressionService = class {
     }
     const trigger = force ? PreCompressTrigger.Manual : PreCompressTrigger.Auto;
     await config2.getHookSystem()?.firePreCompressEvent(trigger);
-    const originalTokenCount = chat.getLastPromptTokenCount();
+    const lastPromptTokenCount = chat.getLastPromptTokenCount();
+    const originalTokenCount = lastPromptTokenCount > 0 ? lastPromptTokenCount : estimateTokenCountSync(curatedHistory.flatMap((c4) => c4.parts || []));
     if (!force) {
       const threshold = await config2.getCompressionThreshold() ?? DEFAULT_COMPRESSION_TOKEN_THRESHOLD;
-      if (originalTokenCount < threshold * tokenLimit(model)) {
+      const isOverModelThreshold = originalTokenCount >= threshold * tokenLimit(model);
+      if (!isOverModelThreshold) {
         return {
           newHistory: null,
           info: {
@@ -336152,6 +336397,8 @@ First, reason in your scratchpad. Then, generate the updated <state_snapshot>.`
         }
       };
     } else {
+      historyToCompressTruncated.length = 0;
+      originalHistoryToCompress.length = 0;
       return {
         newHistory: extraHistory,
         info: {
@@ -336164,6 +336411,169 @@ First, reason in your scratchpad. Then, generate the updated <state_snapshot>.`
   }
 };
 
+// packages/core/dist/src/utils/tool-utils.js
+var import_fast_levenshtein2 = __toESM(require_levenshtein(), 1);
+function isToolCallResponseInfo(data) {
+  return typeof data === "object" && data !== null && "callId" in data && "responseParts" in data;
+}
+function getToolSuggestion(unknownToolName, allToolNames, topN = 3) {
+  const matches = allToolNames.map((toolName) => ({
+    name: toolName,
+    distance: import_fast_levenshtein2.default.get(unknownToolName, toolName)
+  }));
+  matches.sort((a2, b) => a2.distance - b.distance);
+  const topNResults = matches.slice(0, topN);
+  if (topNResults.length === 0) {
+    return "";
+  }
+  const suggestedNames = topNResults.map((match2) => `"${match2.name}"`).join(", ");
+  if (topNResults.length > 1) {
+    return ` Did you mean one of: ${suggestedNames}?`;
+  } else {
+    return ` Did you mean ${suggestedNames}?`;
+  }
+}
+function doesToolInvocationMatch(toolOrToolName, invocation, patterns) {
+  let toolNames;
+  if (isTool(toolOrToolName)) {
+    toolNames = [toolOrToolName.name, toolOrToolName.constructor.name];
+  } else {
+    toolNames = [toolOrToolName];
+  }
+  if (toolNames.some((name3) => SHELL_TOOL_NAMES.includes(name3))) {
+    toolNames = [.../* @__PURE__ */ new Set([...toolNames, ...SHELL_TOOL_NAMES])];
+  }
+  for (const pattern of patterns) {
+    const openParen = pattern.indexOf("(");
+    if (openParen === -1) {
+      if (toolNames.includes(pattern)) {
+        return true;
+      }
+      continue;
+    }
+    const patternToolName = pattern.substring(0, openParen);
+    if (!toolNames.includes(patternToolName)) {
+      continue;
+    }
+    if (!pattern.endsWith(")")) {
+      continue;
+    }
+    const argPattern = pattern.substring(openParen + 1, pattern.length - 1);
+    let command;
+    if (typeof invocation === "string") {
+      command = invocation;
+    } else {
+      if (!("command" in invocation.params)) {
+        continue;
+      }
+      command = String(invocation.params.command);
+    }
+    if (toolNames.some((name3) => SHELL_TOOL_NAMES.includes(name3))) {
+      if (command === argPattern || command.startsWith(argPattern + " ")) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+var segmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+function truncateToolOutput(text, maxBytes = MAX_STORED_TOOL_OUTPUT_BYTES, savedFilePath) {
+  if (Buffer.byteLength(text, "utf8") <= maxBytes) {
+    return text;
+  }
+  const suffix = savedFilePath ? `
+... [Tool output truncated to conserve memory. For full output see: ${savedFilePath}]` : "\n... [Tool output truncated to conserve memory]";
+  const targetBytes = Math.max(0, maxBytes - Buffer.byteLength(suffix, "utf8"));
+  let accumulatedBytes = 0;
+  let truncatedText = "";
+  for (const { segment } of segmenter.segment(text)) {
+    const segmentBytes = Buffer.byteLength(segment, "utf8");
+    if (accumulatedBytes + segmentBytes > targetBytes) {
+      break;
+    }
+    accumulatedBytes += segmentBytes;
+    truncatedText += segment;
+  }
+  return truncatedText + suffix;
+}
+function truncateFunctionResponsePart(part, maxBytes = MAX_STORED_TOOL_OUTPUT_BYTES, savedFilePath) {
+  if (part.text && Buffer.byteLength(part.text, "utf8") > maxBytes) {
+    return {
+      ...part,
+      text: truncateToolOutput(part.text, maxBytes, savedFilePath)
+    };
+  }
+  if (!part.functionResponse?.response) {
+    return part;
+  }
+  const resp = part.functionResponse.response;
+  if (typeof resp === "string") {
+    if (Buffer.byteLength(resp, "utf8") > maxBytes) {
+      return {
+        ...part,
+        functionResponse: {
+          // eslint-disable-next-line @typescript-eslint/no-misused-spread
+          ...part.functionResponse,
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+          response: truncateToolOutput(resp, maxBytes, savedFilePath)
+        }
+      };
+    }
+    return part;
+  }
+  if (typeof resp === "object" && resp !== null) {
+    const truncateValue = (val) => {
+      if (typeof val === "string") {
+        if (Buffer.byteLength(val, "utf8") > maxBytes) {
+          return truncateToolOutput(val, maxBytes, savedFilePath);
+        }
+        return val;
+      }
+      if (Array.isArray(val)) {
+        let arrayModified = false;
+        const newVal = val.map((item) => {
+          const truncated = truncateValue(item);
+          if (truncated !== item) {
+            arrayModified = true;
+          }
+          return truncated;
+        });
+        return arrayModified ? newVal : val;
+      }
+      if (typeof val === "object" && val !== null) {
+        const proto = Object.getPrototypeOf(val);
+        if (proto !== Object.prototype && proto !== null) {
+          return val;
+        }
+        let objModified = false;
+        const copy = {};
+        for (const [k, v] of Object.entries(val)) {
+          const truncated = truncateValue(v);
+          if (truncated !== v) {
+            objModified = true;
+          }
+          copy[k] = truncated;
+        }
+        return objModified ? copy : val;
+      }
+      return val;
+    };
+    const newResp = truncateValue(resp);
+    if (newResp !== resp) {
+      return {
+        ...part,
+        functionResponse: {
+          // eslint-disable-next-line @typescript-eslint/no-misused-spread
+          ...part.functionResponse,
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+          response: newResp
+        }
+      };
+    }
+  }
+  return part;
+}
+
 // packages/core/dist/src/agents/types.js
 var AgentTerminateMode;
 (function(AgentTerminateMode2) {
@@ -340529,7 +340939,7 @@ var A2AAuthProviderFactory = class _A2AAuthProviderFactory {
         return provider;
       }
       case "oauth2": {
-        const { OAuth2AuthProvider } = await import("./oauth2-provider-TBQ7JUDB.js");
+        const { OAuth2AuthProvider } = await import("./oauth2-provider-CEQ4PAUC.js");
         const provider = new OAuth2AuthProvider(authConfig, options.agentName ?? "unknown", agentCard, options.agentCardUrl);
         await provider.initialize();
         return provider;
@@ -341651,72 +342061,6 @@ function getToolCallContext() {
   return toolCallContext.getStore();
 }
 
-// packages/core/dist/src/utils/tool-utils.js
-var import_fast_levenshtein2 = __toESM(require_levenshtein(), 1);
-function isToolCallResponseInfo(data) {
-  return typeof data === "object" && data !== null && "callId" in data && "responseParts" in data;
-}
-function getToolSuggestion(unknownToolName, allToolNames, topN = 3) {
-  const matches = allToolNames.map((toolName) => ({
-    name: toolName,
-    distance: import_fast_levenshtein2.default.get(unknownToolName, toolName)
-  }));
-  matches.sort((a2, b) => a2.distance - b.distance);
-  const topNResults = matches.slice(0, topN);
-  if (topNResults.length === 0) {
-    return "";
-  }
-  const suggestedNames = topNResults.map((match2) => `"${match2.name}"`).join(", ");
-  if (topNResults.length > 1) {
-    return ` Did you mean one of: ${suggestedNames}?`;
-  } else {
-    return ` Did you mean ${suggestedNames}?`;
-  }
-}
-function doesToolInvocationMatch(toolOrToolName, invocation, patterns) {
-  let toolNames;
-  if (isTool(toolOrToolName)) {
-    toolNames = [toolOrToolName.name, toolOrToolName.constructor.name];
-  } else {
-    toolNames = [toolOrToolName];
-  }
-  if (toolNames.some((name3) => SHELL_TOOL_NAMES.includes(name3))) {
-    toolNames = [.../* @__PURE__ */ new Set([...toolNames, ...SHELL_TOOL_NAMES])];
-  }
-  for (const pattern of patterns) {
-    const openParen = pattern.indexOf("(");
-    if (openParen === -1) {
-      if (toolNames.includes(pattern)) {
-        return true;
-      }
-      continue;
-    }
-    const patternToolName = pattern.substring(0, openParen);
-    if (!toolNames.includes(patternToolName)) {
-      continue;
-    }
-    if (!pattern.endsWith(")")) {
-      continue;
-    }
-    const argPattern = pattern.substring(openParen + 1, pattern.length - 1);
-    let command;
-    if (typeof invocation === "string") {
-      command = invocation;
-    } else {
-      if (!("command" in invocation.params)) {
-        continue;
-      }
-      command = String(invocation.params.command);
-    }
-    if (toolNames.some((name3) => SHELL_TOOL_NAMES.includes(name3))) {
-      if (command === argPattern || command.startsWith(argPattern + " ")) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-
 // packages/core/dist/src/scheduler/state-manager.js
 var SchedulerStateManager = class {
   messageBus;
@@ -343425,7 +343769,7 @@ ${summary}
 
 // packages/core/dist/src/context/toolOutputMaskingService.js
 import path68 from "node:path";
-import * as fsPromises10 from "node:fs/promises";
+import * as fsPromises11 from "node:fs/promises";
 var DEFAULT_TOOL_PROTECTION_THRESHOLD = 5e4;
 var DEFAULT_MIN_PRUNABLE_TOKENS_THRESHOLD = 3e4;
 var DEFAULT_PROTECT_LATEST_TURN = true;
@@ -343502,7 +343846,7 @@ var ToolOutputMaskingService = class {
       const safeSessionId = sanitizeFilenamePart(sessionId);
       toolOutputsDir = path68.join(toolOutputsDir, `session-${safeSessionId}`);
     }
-    await fsPromises10.mkdir(toolOutputsDir, { recursive: true });
+    await fsPromises11.mkdir(toolOutputsDir, { recursive: true });
     for (const item of prunableParts) {
       const { contentIndex, partIndex, content, tokens } = item;
       const contentRecord = newHistory[contentIndex];
@@ -343515,7 +343859,7 @@ var ToolOutputMaskingService = class {
       const safeCallId = sanitizeFilenamePart(callId).toLowerCase();
       const fileName = `${safeToolName}_${safeCallId}_${Math.random().toString(36).substring(7)}.txt`;
       const filePath = path68.join(toolOutputsDir, fileName);
-      await fsPromises10.writeFile(filePath, content, "utf-8");
+      await fsPromises11.writeFile(filePath, content, "utf-8");
       const originalResponse = (
         // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         part.functionResponse.response || {}
@@ -346768,6 +347112,15 @@ var GeminiClient = class {
     coreEvents.off(CoreEvent.ApprovalModeChanged, this.handleApprovalModeChanged);
   }
   async resumeChat(history, resumedSessionData) {
+    if (resumedSessionData?.filePath) {
+      const previousRecordingService = this.chat?.getChatRecordingService?.();
+      if (previousRecordingService && previousRecordingService.getConversationFilePath?.() !== resumedSessionData.filePath) {
+        try {
+          await previousRecordingService.deleteCurrentSessionIfNotResumableAsync?.();
+        } catch {
+        }
+      }
+    }
     this.chat = await this.startChat(history, resumedSessionData);
     this.updateTelemetryTokenCount();
   }
@@ -347612,13 +347965,16 @@ var ToolExecutor = class {
         const originalContentLength = content.length;
         const { outputFile: savedPath } = await saveTruncatedToolOutput(content, toolName, callId, this.config.storage.getProjectTempDir(), this.context.promptId);
         outputFile = savedPath;
-        const truncatedContent = formatTruncatedToolOutput(content, outputFile, threshold);
+        let truncatedContent = formatTruncatedToolOutput(content, outputFile, threshold);
         logToolOutputTruncated(this.config, new ToolOutputTruncatedEvent(call.request.prompt_id, {
           toolName,
           originalContentLength,
           truncatedContentLength: truncatedContent.length,
           threshold
         }));
+        if (typeof truncatedContent === "string" && Buffer.byteLength(truncatedContent, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+          truncatedContent = truncateToolOutput(truncatedContent, MAX_STORED_TOOL_OUTPUT_BYTES);
+        }
         return { truncatedContent, outputFile };
       }
     } else if (Array.isArray(content) && content.length === 1 && "tool" in call && call.tool instanceof DiscoveredMCPTool) {
@@ -347630,7 +347986,10 @@ var ToolExecutor = class {
           const originalContentLength = textContent2.length;
           const { outputFile: savedPath } = await saveTruncatedToolOutput(textContent2, toolName, callId, this.config.storage.getProjectTempDir(), this.context.promptId);
           outputFile = savedPath;
-          const truncatedText = formatTruncatedToolOutput(textContent2, outputFile, threshold);
+          let truncatedText = formatTruncatedToolOutput(textContent2, outputFile, threshold);
+          if (typeof truncatedText === "string" && Buffer.byteLength(truncatedText, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+            truncatedText = truncateToolOutput(truncatedText, MAX_STORED_TOOL_OUTPUT_BYTES);
+          }
           const truncatedContent = [
             { ...firstPart, text: truncatedText }
           ];
@@ -347644,7 +348003,45 @@ var ToolExecutor = class {
         }
       }
     }
-    return { truncatedContent: content, outputFile };
+    const ensureOutputFile = async (rawText) => {
+      if (!outputFile) {
+        try {
+          const { outputFile: savedPath } = await saveTruncatedToolOutput(rawText, toolName, callId, this.config.storage.getProjectTempDir(), this.context.promptId);
+          outputFile = savedPath;
+        } catch {
+        }
+      }
+      return outputFile;
+    };
+    let finalContent = content;
+    if (typeof finalContent === "string") {
+      if (Buffer.byteLength(finalContent, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+        const savedPath = await ensureOutputFile(finalContent);
+        finalContent = truncateToolOutput(finalContent, MAX_STORED_TOOL_OUTPUT_BYTES, savedPath);
+      }
+    } else if (Array.isArray(finalContent)) {
+      finalContent = await Promise.all(finalContent.map(async (part) => {
+        if (typeof part === "string" && Buffer.byteLength(part, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+          const savedPath = await ensureOutputFile(part);
+          return truncateToolOutput(part, MAX_STORED_TOOL_OUTPUT_BYTES, savedPath);
+        }
+        if (typeof part === "object" && part !== null && "text" in part && typeof part.text === "string" && Buffer.byteLength(part.text, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+          const savedPath = await ensureOutputFile(part.text);
+          return {
+            ...part,
+            text: truncateToolOutput(part.text, MAX_STORED_TOOL_OUTPUT_BYTES, savedPath)
+          };
+        }
+        return part;
+      }));
+    } else if (typeof finalContent === "object" && finalContent !== null && "text" in finalContent && typeof finalContent.text === "string" && Buffer.byteLength(finalContent.text, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+      const savedPath = await ensureOutputFile(finalContent.text);
+      finalContent = {
+        ...finalContent,
+        text: truncateToolOutput(finalContent.text, MAX_STORED_TOOL_OUTPUT_BYTES, savedPath)
+      };
+    }
+    return { truncatedContent: finalContent, outputFile };
   }
   async createCancelledResult(call, reason, toolResult) {
     const errorMessage = `[Operation Cancelled] ${reason}`;
@@ -347813,6 +348210,9 @@ var ToolModificationHandler = class {
 };
 
 // packages/core/dist/src/scheduler/scheduler.js
+function isTaintRiskDetectable(invocation) {
+  return typeof invocation === "object" && invocation !== null && "hasTaintedOrBuildFileRisk" in invocation && typeof invocation.hasTaintedOrBuildFileRisk === "function";
+}
 var createErrorResponse = (request, error40, errorType) => ({
   callId: request.callId,
   error: error40,
@@ -348172,6 +348572,10 @@ var Scheduler = class {
     if (hookDecision === "ask") {
       decision = PolicyDecision.ASK_USER;
     }
+    const hasTaintRisk = isTaintRiskDetectable(toolCall.invocation) && toolCall.invocation.hasTaintedOrBuildFileRisk();
+    if (decision === PolicyDecision.ALLOW && hasTaintRisk) {
+      decision = this.config.isInteractive?.() ?? true ? PolicyDecision.ASK_USER : PolicyDecision.DENY;
+    }
     if (decision === PolicyDecision.DENY) {
       const { errorMessage, errorType } = getPolicyDenialError(this.config, rule);
       this.state.updateStatus(callId, CoreToolCallStatus.Error, createErrorResponse(toolCall.request, new Error(errorMessage), errorType));
@@ -348180,6 +348584,7 @@ var Scheduler = class {
     let outcome = ToolConfirmationOutcome.ProceedOnce;
     let lastDetails;
     if (decision === PolicyDecision.ASK_USER) {
+      const forcedDecision = hookDecision === "ask" || policyDecision === PolicyDecision.ALLOW && hasTaintRisk ? "ask_user" : void 0;
       const result2 = await resolveConfirmation(toolCall, signal, {
         config: this.config,
         messageBus: this.messageBus,
@@ -348189,7 +348594,7 @@ var Scheduler = class {
         schedulerId: this.schedulerId,
         onWaitingForConfirmation: this.onWaitingForConfirmation,
         systemMessage: hookSystemMessage,
-        forcedDecision: hookDecision === "ask" ? "ask_user" : void 0
+        forcedDecision
       });
       outcome = result2.outcome;
       lastDetails = result2.lastDetails;
@@ -348460,14 +348865,14 @@ function normalizeSpace(text) {
   return text.replace(/\s+/g, " ").trim();
 }
 function safeSlice(text, start2, end) {
-  const segmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
-  const segments = Array.from(segmenter.segment(text));
+  const segmenter2 = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+  const segments = Array.from(segmenter2.segment(text));
   return segments.slice(start2, end).map((s2) => s2.segment).join("");
 }
 function safeLength(text) {
-  const segmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+  const segmenter2 = new Intl.Segmenter(void 0, { granularity: "grapheme" });
   let count2 = 0;
-  for (const _ of segmenter.segment(text)) {
+  for (const _ of segmenter2.segment(text)) {
     count2++;
   }
   return count2;
@@ -349592,13 +349997,30 @@ var LocalAgentExecutor = class _LocalAgentExecutor {
   }
   async tryCompressChat(chat, prompt_id, abortSignal) {
     const model = this.definition.modelConfig.model ?? DEFAULT_GEMINI_MODEL;
+    const threshold = await this.context.config.getCompressionThreshold() ?? DEFAULT_COMPRESSION_TOKEN_THRESHOLD;
+    const modelLimit = tokenLimit(model);
+    const lastPromptTokenCount = chat.getLastPromptTokenCount();
+    const currentHistory = chat.getHistory(false);
+    const originalTokenCount = lastPromptTokenCount > 0 ? lastPromptTokenCount : estimateTokenCountSync(currentHistory.flatMap((c4) => c4.parts || []));
+    if (originalTokenCount >= threshold * modelLimit) {
+      const collapsedHistory = collapseOlderFunctionResponses(currentHistory);
+      if (collapsedHistory !== currentHistory) {
+        const existingTurns = chat.getHistoryTurns?.(false) ?? [];
+        const turns = collapsedHistory.map((c4, idx) => ({
+          id: existingTurns[idx]?.id ?? randomUUID13(),
+          content: c4
+        }));
+        chat.setHistory(turns);
+      }
+    }
     const { newHistory, info: info2 } = await this.compressionService.compress(chat, prompt_id, false, model, this.context.config, this.hasFailedCompressionAttempt, abortSignal);
     if (info2.compressionStatus === CompressionStatus.COMPRESSION_FAILED_INFLATED_TOKEN_COUNT) {
       this.hasFailedCompressionAttempt = true;
     } else if (info2.compressionStatus === CompressionStatus.COMPRESSED) {
       if (newHistory) {
-        const turns = newHistory.map((c4) => ({
-          id: randomUUID13(),
+        const existingTurns = chat.getHistoryTurns?.(false) ?? [];
+        const turns = newHistory.map((c4, idx) => ({
+          id: existingTurns[idx]?.id ?? randomUUID13(),
           content: c4
         }));
         chat.setHistory(turns);
@@ -349606,8 +350028,9 @@ var LocalAgentExecutor = class _LocalAgentExecutor {
       }
     } else if (info2.compressionStatus === CompressionStatus.CONTENT_TRUNCATED) {
       if (newHistory) {
-        const turns = newHistory.map((c4) => ({
-          id: randomUUID13(),
+        const existingTurns = chat.getHistoryTurns?.(false) ?? [];
+        const turns = newHistory.map((c4, idx) => ({
+          id: existingTurns[idx]?.id ?? randomUUID13(),
           content: c4
         }));
         chat.setHistory(turns);
@@ -349790,6 +350213,15 @@ var LocalAgentExecutor = class _LocalAgentExecutor {
         signal,
         onWaitingForConfirmation
       });
+      for (const call of completedCalls) {
+        const outputFile = call.response?.outputFile;
+        if (call.response?.responseParts) {
+          call.response.responseParts = call.response.responseParts.map((p) => truncateFunctionResponsePart(p, MAX_STORED_TOOL_OUTPUT_BYTES, outputFile));
+        }
+        if (typeof call.response?.resultDisplay === "string" && Buffer.byteLength(call.response.resultDisplay, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+          call.response.resultDisplay = truncateToolOutput(call.response.resultDisplay, MAX_STORED_TOOL_OUTPUT_BYTES, outputFile);
+        }
+      }
       chat.recordCompletedToolCalls(model, completedCalls);
       for (const call of completedCalls) {
         const toolName = toolNameMap.get(call.request.callId) || call.request.name;
@@ -349855,7 +350287,7 @@ var LocalAgentExecutor = class _LocalAgentExecutor {
       const callId = functionCall.id ?? `${promptId}-${index}`;
       const part = syncResults.get(callId);
       if (part) {
-        toolResponseParts.push(part);
+        toolResponseParts.push(truncateFunctionResponsePart(part, MAX_STORED_TOOL_OUTPUT_BYTES));
         continue;
       }
       const isAborted2 = signal.aborted;
@@ -362802,11 +363234,14 @@ var PolicyEngine = class {
   isAlwaysAllowRule(rule) {
     return rule.priority !== void 0 && Math.round(rule.priority % 1 * 1e3) === ALWAYS_ALLOW_PRIORITY_FRACTION;
   }
-  shouldDowngradeForRedirection(command, allowRedirection) {
+  shouldDowngradeForRedirection(command, allowRedirection, rule) {
     if (allowRedirection)
       return false;
     if (!hasRedirection(command))
       return false;
+    if (rule?.argsPattern && !allowRedirection) {
+      return true;
+    }
     if (this.approvalMode === ApprovalMode.AUTO_EDIT || this.approvalMode === ApprovalMode.YOLO) {
       return false;
     }
@@ -362893,7 +363328,7 @@ var PolicyEngine = class {
     }
     let aggregateDecision = ruleDecision;
     let responsibleRule = rule && ruleDecision === rule.decision ? rule : void 0;
-    if (this.shouldDowngradeForRedirection(command, allowRedirection)) {
+    if (this.shouldDowngradeForRedirection(command, allowRedirection, rule)) {
       if (aggregateDecision === PolicyDecision.ALLOW) {
         debugLogger.debug(`[PolicyEngine.check] Downgrading ALLOW to ASK_USER for redirected command: ${command}`);
         aggregateDecision = PolicyDecision.ASK_USER;
@@ -362932,7 +363367,7 @@ var PolicyEngine = class {
           }
           aggregateDecision = PolicyDecision.ASK_USER;
         }
-        if (subResult.decision === PolicyDecision.ALLOW && this.shouldDowngradeForRedirection(subCmd, allowRedirection)) {
+        if (subResult.decision === PolicyDecision.ALLOW && this.shouldDowngradeForRedirection(subCmd, subResult.rule?.allowRedirection ?? allowRedirection, subResult.rule)) {
           if (aggregateDecision === PolicyDecision.ALLOW) {
             aggregateDecision = PolicyDecision.ASK_USER;
             responsibleRule = void 0;
@@ -363116,6 +363551,9 @@ var PolicyEngine = class {
         }
       }
     }
+    if (this.nonInteractive && decision === PolicyDecision.ASK_USER) {
+      decision = PolicyDecision.DENY;
+    }
     return {
       decision,
       rule: matchedRule
@@ -365811,7 +366249,7 @@ var SecurityValidator = class {
 };
 function getWindowsPowerShellPath() {
   let systemRoot = process.env["SystemRoot"] || process.env["systemroot"] || process.env["windir"] || process.env["WINDIR"] || "C:\\Windows";
-  if (!/^[a-zA-Z]:\\/.test(systemRoot)) {
+  if (!/^[a-zA-Z]:\\Windows\\?$/i.test(systemRoot) || systemRoot.includes("..")) {
     systemRoot = "C:\\Windows";
   }
   const pathModule = os33.platform() === "win32" ? path87.win32 : path87.posix;
@@ -367032,7 +367470,8 @@ import * as fs77 from "node:fs";
 
 // packages/core/dist/src/safety/built-in.js
 import * as path89 from "node:path";
-var VSCODE_SFN_REGEX = /^(vscode|vs[0-9a-f]{4})~\d+$/;
+var VSCODE_SFN_REGEX = /^(vscode|vs[0-9a-f]{4})~\d+(\..+)?$/i;
+var GEMINI_SFN_REGEX = /^(gemini|ge[0-9a-f]{4})~\d+(\..+)?$/i;
 var AllowedPathChecker = class {
   async check(input) {
     const { toolCall, context: context2 } = input;
@@ -367055,6 +367494,7 @@ var AllowedPathChecker = class {
       }
       let hasBlockedSegment = false;
       let isVscodePath = false;
+      let isGeminiPath = false;
       for (const resolvedDir of resolvedAllowedDirs) {
         if (!this.isPathAllowed(resolvedPath, resolvedDir))
           continue;
@@ -367068,6 +367508,9 @@ var AllowedPathChecker = class {
           if (clean === ".vscode" || VSCODE_SFN_REGEX.test(clean)) {
             isVscodePath = true;
           }
+          if (clean === ".gemini" || GEMINI_SFN_REGEX.test(clean)) {
+            isGeminiPath = true;
+          }
         }
       }
       if (hasBlockedSegment) {
@@ -367076,6 +367519,12 @@ var AllowedPathChecker = class {
           reason: `Access to sensitive path "${p}" in argument "${argName}" is blocked.`
         };
       }
+      if (isGeminiPath) {
+        return {
+          decision: SafetyCheckDecision.ASK_USER,
+          reason: `Modifying .gemini configuration files requires explicit user confirmation.`
+        };
+      }
       if (isVscodePath) {
         return {
           decision: SafetyCheckDecision.ASK_USER,
@@ -390275,7 +390724,7 @@ var LegacyAgentSession = class extends AgentSession {
 };
 
 // packages/core/dist/src/tools/read-many-files.js
-import * as fsPromises11 from "node:fs/promises";
+import * as fsPromises12 from "node:fs/promises";
 import * as path107 from "node:path";
 function getDefaultExcludes(config2) {
   return config2?.getFileExclusions().getReadManyFilesExcludes() ?? [];
@@ -390324,7 +390773,7 @@ ${finalExclusionPatternsForDescription.slice(0, 2).join("`, `")}${finalExclusion
           const fullPath = path107.join(dir, normalizedP);
           let exists2 = false;
           try {
-            const st = await fsPromises11.stat(fullPath);
+            const st = await fsPromises12.stat(fullPath);
             exists2 = st.isFile();
           } catch {
             exists2 = false;
@@ -398322,6 +398771,7 @@ export {
   DEFAULT_MAX_LINES_TEXT_FILE,
   MAX_LINE_LENGTH_TEXT_FILE,
   MAX_FILE_SIZE_MB,
+  MAX_STORED_TOOL_OUTPUT_BYTES,
   EMPTY_RESPONSE_COMPRESS_SUGGESTION,
   THINKING_ONLY_COMPRESS_SUGGESTION,
   MAX_TOKENS_EXCEEDED_SUGGESTION,
@@ -398333,6 +398783,7 @@ export {
   loadWasmBinary,
   DEFAULT_ENCODING,
   detectBOM,
+  readSecureFileBuffer,
   readFileWithEncoding,
   getSpecificMimeType,
   canonicalizeMacosPath,
@@ -399095,6 +399546,11 @@ export {
   SessionStartSource,
   SessionEndReason,
   PreCompressTrigger,
+  isToolCallResponseInfo,
+  getToolSuggestion,
+  doesToolInvocationMatch,
+  truncateToolOutput,
+  truncateFunctionResponsePart,
   AgentTerminateMode,
   DEFAULT_QUERY_STRING,
   DEFAULT_MAX_TURNS,
@@ -399129,9 +399585,6 @@ export {
   exchangeCodeForToken,
   refreshAccessToken,
   ModelConfigService,
-  isToolCallResponseInfo,
-  getToolSuggestion,
-  doesToolInvocationMatch,
   getPolicyDenialError,
   checkPolicy,
   updatePolicy,
@@ -399241,6 +399694,7 @@ export {
   createPathSecurityCache,
   clearSecurityCacheForTesting,
   SecurityValidator,
+  getWindowsPowerShellPath,
   isDirectorySecure,
   normalizeSecurityPath,
   isPathSecureSync,