@google/gemini-cli 0.62.0-preview.0 → 0.63.0-nightly.20260928.g2fe7c2d3f

package/bundle/{chunk-2MIF7TLR.js → chunk-KRI5JA76.js}

@@ -252404,16 +252404,23 @@ function trimTrailingSpacesAndDots(str2) {
   return str2.slice(0, end + 1);
 }
 var GIT_SFN_REGEX = /^(git|gi[0-9a-f]{4})~\d+$/;
-var ENV_SFN_REGEX = /^(env|en[0-9a-f]{4})~\d+$/;
+var ENV_SFN_REGEX = /^(env|en[0-9a-f]{4})~\d+(\..+)?$/i;
 var NODE_MODULES_SFN_REGEX = /^(node_m|no[0-9a-f]{4})~\d+$/;
 var GHA_CREDS_SFN_REGEX = /^(gha-cr|gh[0-9a-f]{4})~\d+\.jso(n)?$/;
+var SAFE_ENV_TEMPLATES = /* @__PURE__ */ new Set([
+  ".env.example",
+  ".env.sample",
+  ".env.template",
+  ".env.dist"
+]);
 function hasBlockedPathSegment(p) {
   const segments = p.split(/[/\\]/);
   for (const segment of segments) {
     const clean = trimTrailingSpacesAndDots(
       segment.split(":")[0]
     ).toLowerCase();
-    if (clean === ".git" || clean === ".env" || clean === "node_modules" || GIT_SFN_REGEX.test(clean) || ENV_SFN_REGEX.test(clean) || NODE_MODULES_SFN_REGEX.test(clean)) {
+    const isEnvFile = clean === ".env" || clean.startsWith(".env.") && !SAFE_ENV_TEMPLATES.has(clean);
+    if (clean === ".git" || isEnvFile || clean === "node_modules" || GIT_SFN_REGEX.test(clean) || ENV_SFN_REGEX.test(clean) || NODE_MODULES_SFN_REGEX.test(clean)) {
       return true;
     }
     if (clean.startsWith("gha-creds-") && clean.endsWith(".json") || GHA_CREDS_SFN_REGEX.test(clean)) {
@@ -253766,6 +253773,7 @@ var REFERENCE_CONTENT_END = "--- End of content ---";
 var DEFAULT_MAX_LINES_TEXT_FILE = 2e3;
 var MAX_LINE_LENGTH_TEXT_FILE = 2e3;
 var MAX_FILE_SIZE_MB = 20;
+var MAX_STORED_TOOL_OUTPUT_BYTES = 64 * 1024;
 var EMPTY_RESPONSE_COMPRESS_SUGGESTION = "The model returned an empty text response. If your context window is near capacity, try using /compress.";
 var THINKING_ONLY_COMPRESS_SUGGESTION = "The model returned reasoning thoughts but no final response text. If your context window is near capacity, try using /compress.";
 var MAX_TOKENS_EXCEEDED_SUGGESTION = "Model response was truncated because it exceeded the token limit. Try using /compress to free up context space.";
@@ -253847,8 +253855,43 @@ function decodeUTF32(buf, littleEndian) {
   }
   return out2;
 }
-async function readFileWithEncoding(filePath) {
-  const full = await fs7.promises.readFile(filePath);
+async function readSecureFileBuffer(filePath, expectedStats) {
+  const initialStats = expectedStats ?? await fs7.promises.stat(filePath);
+  let fileHandle;
+  try {
+    if (typeof fs7.promises.open === "function") {
+      try {
+        fileHandle = await fs7.promises.open(filePath, "r");
+      } catch {
+      }
+      if (fileHandle && typeof fileHandle.stat === "function") {
+        const handleStats = await fileHandle.stat();
+        if (initialStats.dev !== void 0 && initialStats.ino !== void 0 && handleStats && handleStats.dev !== void 0 && handleStats.ino !== void 0 && (initialStats.dev !== handleStats.dev || initialStats.ino !== handleStats.ino)) {
+          throw new Error(
+            `File device or inode changed during read: ${filePath}`
+          );
+        }
+      }
+    }
+    const contentBuffer = fileHandle ? await fileHandle.readFile() : await fs7.promises.readFile(filePath);
+    let postStats;
+    try {
+      postStats = await fs7.promises.stat(filePath);
+    } catch {
+    }
+    if (postStats && initialStats.dev !== void 0 && initialStats.ino !== void 0 && postStats.dev !== void 0 && postStats.ino !== void 0 && (initialStats.dev !== postStats.dev || initialStats.ino !== postStats.ino)) {
+      throw new Error(`File device or inode changed during read: ${filePath}`);
+    }
+    return contentBuffer;
+  } finally {
+    if (fileHandle) {
+      await fileHandle.close().catch(() => {
+      });
+    }
+  }
+}
+async function readFileWithEncoding(filePath, expectedStats) {
+  const full = await readSecureFileBuffer(filePath, expectedStats);
   if (full.length === 0) return "";
   const bom = detectBOM(full);
   if (!bom) {
@@ -254085,14 +254128,14 @@ async function processSingleFileContent(filePath, rootDirectory, _fileSystemServ
             returnDisplay: `Skipped large SVG file (>1MB): ${relativePathForDisplay}`
           };
         }
-        const content = await readFileWithEncoding(filePath);
+        const content = await readFileWithEncoding(filePath, stats);
         return {
           llmContent: content,
           returnDisplay: `Read SVG as text: ${relativePathForDisplay}`
         };
       }
       case "text": {
-        const content = await readFileWithEncoding(filePath);
+        const content = await readFileWithEncoding(filePath, stats);
         const lines = content.split(/\r?\n/);
         const originalLineCount = lines.length;
         let sliceStart = 0;
@@ -254145,7 +254188,7 @@ async function processSingleFileContent(filePath, rootDirectory, _fileSystemServ
             errorType: "read_content_failure" /* READ_CONTENT_FAILURE */
           };
         }
-        const contentBuffer = await fs7.promises.readFile(filePath);
+        const contentBuffer = await readSecureFileBuffer(filePath, stats);
         const base64Data = contentBuffer.toString("base64");
         return {
           llmContent: {
@@ -254161,7 +254204,7 @@ async function processSingleFileContent(filePath, rootDirectory, _fileSystemServ
       case "pdf":
       case "video": {
         const mimeType = getSpecificMimeType(filePath) ?? "application/octet-stream";
-        const contentBuffer = await fs7.promises.readFile(filePath);
+        const contentBuffer = await readSecureFileBuffer(filePath, stats);
         const base64Data = contentBuffer.toString("base64");
         return {
           llmContent: {
@@ -283717,8 +283760,8 @@ function isValidToolName(name3, options = {}) {
 }
 
 // packages/core/src/generated/git-commit.ts
-var GIT_COMMIT_INFO = "f50ba8608";
-var CLI_VERSION = "0.62.0-preview.0";
+var GIT_COMMIT_INFO = "2fe7c2d3f";
+var CLI_VERSION = "0.63.0-nightly.20260923.gf50ba8608";
 
 // packages/core/src/ide/detect-ide.ts
 var IDE_DEFINITIONS = {
@@ -286760,10 +286803,12 @@ var ChatRecordingService = class {
         if (this.kind === "subagent") {
           filename = `${safeSessionId}.jsonl`;
         } else {
-          filename = `${SESSION_FILE_PREFIX}${timestamp2}-${safeSessionId.slice(
-            0,
-            8
-          )}.jsonl`;
+          const shortId = safeSessionId.slice(0, 8);
+          filename = `${SESSION_FILE_PREFIX}${timestamp2}-${shortId}.jsonl`;
+          let collisionIndex = 1;
+          while (fs32.existsSync(path29.join(chatsDir, filename))) {
+            filename = `${SESSION_FILE_PREFIX}${timestamp2}-${collisionIndex++}-${shortId}.jsonl`;
+          }
         }
         this.conversationFile = path29.join(chatsDir, filename);
         const directories = this.kind === "subagent" ? [
@@ -307338,7 +307383,7 @@ function getVersion() {
   }
   versionPromise = (async () => {
     const pkgJson = await getPackageJson(__dirname4);
-    return "0.62.0-preview.0";
+    return "0.63.0-nightly.20260923.gf50ba8608";
   })();
   return versionPromise;
 }
@@ -314969,10 +315014,11 @@ function getSafeGitEnv(baseEnv = process.env) {
   }
   return {
     ...cleanedEnv,
+    GIT_TERMINAL_PROMPT: "0",
     GIT_CONFIG_GLOBAL: devNullPath,
     GIT_CONFIG_SYSTEM: devNullPath,
     GIT_CONFIG_NOSYSTEM: "1",
-    GIT_CONFIG_COUNT: "8",
+    GIT_CONFIG_COUNT: "7",
     GIT_CONFIG_KEY_0: "credential.helper",
     GIT_CONFIG_VALUE_0: "",
     GIT_CONFIG_KEY_1: "core.fsmonitor",
@@ -314986,9 +315032,7 @@ function getSafeGitEnv(baseEnv = process.env) {
     GIT_CONFIG_KEY_5: "core.editor",
     GIT_CONFIG_VALUE_5: "",
     GIT_CONFIG_KEY_6: "sequence.editor",
-    GIT_CONFIG_VALUE_6: "",
-    GIT_CONFIG_KEY_7: "diff.external",
-    GIT_CONFIG_VALUE_7: ""
+    GIT_CONFIG_VALUE_6: ""
   };
 }
 async function getAbsoluteGitDir(cwd) {
@@ -315309,8 +315353,23 @@ var ReadFileToolInvocation = class extends BaseToolInvocation {
     };
   }
   async execute(_options) {
+    const sanitizedPath = resolveDefensiveToolPath(
+      this.params.file_path,
+      this.config.getTargetDir()
+    );
+    let targetPathToRead = this.resolvedPath;
+    try {
+      targetPathToRead = resolveToRealPath(
+        path52.resolve(this.config.getTargetDir(), sanitizedPath)
+      );
+    } catch {
+      targetPathToRead = path52.resolve(
+        this.config.getTargetDir(),
+        sanitizedPath
+      );
+    }
     const validationError = this.config.validatePathAccess(
-      this.resolvedPath,
+      targetPathToRead,
       "read"
     );
     if (validationError) {
@@ -315324,7 +315383,7 @@ var ReadFileToolInvocation = class extends BaseToolInvocation {
       };
     }
     const result2 = await processSingleFileContent(
-      this.resolvedPath,
+      targetPathToRead,
       this.config.getTargetDir(),
       this.config.getFileSystemService(),
       this.params.start_line,
@@ -315355,9 +315414,9 @@ ${result2.llmContent}`;
       llmContent = result2.llmContent || "";
     }
     const lines = typeof result2.llmContent === "string" ? result2.llmContent.split("\n").length : void 0;
-    const mimetype = getSpecificMimeType(this.resolvedPath);
+    const mimetype = getSpecificMimeType(targetPathToRead);
     const programming_language = getProgrammingLanguage({
-      file_path: this.resolvedPath
+      file_path: targetPathToRead
     });
     logFileOperation(
       this.config,
@@ -315366,11 +315425,11 @@ ${result2.llmContent}`;
         "read" /* READ */,
         lines,
         mimetype,
-        path52.extname(this.resolvedPath),
+        path52.extname(targetPathToRead),
         programming_language
       )
     );
-    const jitContext = await discoverJitContext(this.config, this.resolvedPath);
+    const jitContext = await discoverJitContext(this.config, targetPathToRead);
     if (jitContext) {
       if (typeof llmContent === "string") {
         llmContent = appendJitContext(llmContent, jitContext);
@@ -315564,7 +315623,7 @@ var ReadMcpResourceToolInvocation = class extends BaseToolInvocation {
         }
       }
       return {
-        llmContent: contentText || "No content returned from resource.",
+        llmContent: contentText ? wrapUntrusted(contentText) : "No content returned from resource.",
         returnDisplay: this.resource ? `Successfully read resource "${this.resource.name}" from server "${this.resource.serverName}"` : `Successfully read resource: ${uri}`
       };
     } catch (e2) {
@@ -315651,7 +315710,7 @@ var ListMcpResourcesToolInvocation = class extends BaseToolInvocation {
       content += "\n";
     }
     return {
-      llmContent: content,
+      llmContent: wrapUntrusted(content),
       returnDisplay: `Listed ${resources.length} resources.`
     };
   }
@@ -324320,7 +324379,7 @@ var ActivateSkillTool = class _ActivateSkillTool extends BaseDeclarativeTool {
 };
 
 // packages/core/src/tools/shell.ts
-import fsPromises9 from "node:fs/promises";
+import fsPromises10 from "node:fs/promises";
 import fs51 from "node:fs";
 import path61 from "node:path";
 import os32 from "node:os";
@@ -324388,6 +324447,7 @@ import { spawn as cpSpawn } from "node:child_process";
 import { TextDecoder as TextDecoder2 } from "node:util";
 import os30 from "node:os";
 import fs49, { mkdirSync as mkdirSync4 } from "node:fs";
+import fsPromises9 from "node:fs/promises";
 import path59 from "node:path";
 var import_headless3 = __toESM(require_xterm_headless(), 1);
 
@@ -325438,6 +325498,7 @@ var ShellExecutionService = class _ShellExecutionService {
   static activeChildProcesses = /* @__PURE__ */ new Map();
   static backgroundLogPids = /* @__PURE__ */ new Set();
   static backgroundLogStreams = /* @__PURE__ */ new Map();
+  static backgroundTempDirs = /* @__PURE__ */ new Map();
   static backgroundProcessHistory = /* @__PURE__ */ new Map();
   static getLogDir() {
     return path59.join(Storage.getGlobalTempDir(), "background-processes");
@@ -325464,6 +325525,10 @@ ${truncated}`;
     }
   }
   static async cleanupLogStream(pid) {
+    const tempDir = this.backgroundTempDirs.get(pid);
+    this.backgroundTempDirs.delete(pid);
+    const rmPromise = tempDir ? fsPromises9.rm(tempDir, { recursive: true, force: true }).catch(() => {
+    }) : Promise.resolve();
     const stream2 = this.backgroundLogStreams.get(pid);
     if (stream2) {
       await new Promise((resolve29) => {
@@ -325472,6 +325537,7 @@ ${truncated}`;
       this.backgroundLogStreams.delete(pid);
     }
     this.backgroundLogPids.delete(pid);
+    await rmPromise;
   }
   /**
    * Executes a shell command using `node-pty`, capturing all output and lifecycle events.
@@ -325588,8 +325654,7 @@ ${truncated}`;
       ["core.sshCommand", ""],
       ["core.pager", "cat"],
       ["core.editor", ""],
-      ["sequence.editor", ""],
-      ["diff.external", ""]
+      ["sequence.editor", ""]
     ];
     for (const [overrideKey, overrideVal] of defaultGitOverrides) {
       const keyVar = `GIT_CONFIG_KEY_${gitConfigCount}`;
@@ -325667,6 +325732,33 @@ ${truncated}`;
             }
           }
         }
+        if (child.stdout) {
+          child.stdout.removeAllListeners();
+          try {
+            child.stdout.destroy();
+          } catch {
+          }
+        }
+        if (child.stderr) {
+          child.stderr.removeAllListeners();
+          try {
+            child.stderr.destroy();
+          } catch {
+          }
+        }
+        const stdin = child.stdin;
+        if (stdin) {
+          stdin.removeAllListeners();
+          try {
+            stdin.destroy();
+          } catch {
+          }
+        }
+        child.removeAllListeners("error");
+        child.removeAllListeners("close");
+        state.sniffChunks.length = 0;
+        stdoutDecoder = null;
+        stderrDecoder = null;
         return;
       };
       var cleanup = cleanup2;
@@ -325705,7 +325797,8 @@ ${truncated}`;
           process: child,
           state,
           command: shellExecutionConfig.originalCommand ?? commandToExecute,
-          sessionId: shellExecutionConfig.sessionId
+          sessionId: shellExecutionConfig.sessionId,
+          tempDir: shellExecutionConfig.tempDir
         });
       }
       const lifecycleHandle = child.pid ? ExecutionLifecycleService.attachExecution(child.pid, {
@@ -325821,6 +325914,7 @@ ${truncated}`;
         cleanup2();
         cmdCleanup?.();
         let combinedOutput = state.output;
+        state.output = "";
         if (state.truncated) {
           const truncationMessage = `
 [GEMINI_CLI_WARNING: Output truncated. The buffer is limited to ${MAX_CHILD_PROCESS_BUFFER_SIZE / (1024 * 1024)}MB.]`;
@@ -325856,9 +325950,8 @@ ${truncated}`;
             historyItem.endTime = Date.now();
           }
           onOutputEvent(event);
-          _ShellExecutionService.cleanupLogStream(pid).then(() => {
-            _ShellExecutionService.activeChildProcesses.delete(pid);
-          });
+          _ShellExecutionService.activeChildProcesses.delete(pid);
+          _ShellExecutionService.cleanupLogStream(pid);
           ExecutionLifecycleService.completeWithResult(pid, resultPayload);
         } else {
           resolveWithoutPid?.(resultPayload);
@@ -326078,7 +326171,8 @@ ${truncated}`;
         maxSerializedLines: shellExecutionConfig.maxSerializedLines,
         command: shellExecutionConfig.originalCommand ?? commandToExecute,
         sessionId: shellExecutionConfig.sessionId,
-        cancelRender
+        cancelRender,
+        tempDir: shellExecutionConfig.tempDir
       });
       const result2 = ExecutionLifecycleService.attachExecution(assignedPid, {
         executionMethod: ptyInfo?.name ?? "node-pty",
@@ -326537,18 +326631,32 @@ ${truncated}`;
    * This resolves the execution promise but keeps the PTY active.
    *
    * @param pid The process ID of the target PTY.
+   * @param sessionId Optional session ID for process history tracking.
+   * @param command Optional command string for display.
+   * @param tempDir Optional temporary directory path owned by this execution to clean up on exit.
    */
-  static background(pid, sessionId, command) {
-    if (this.backgroundLogPids.has(pid)) {
-      return;
-    }
+  static background(pid, sessionId, command, tempDir) {
     const activePty = this.activePtys.get(pid);
     const activeChild = this.activeChildProcesses.get(pid);
+    const resolvedTempDir = tempDir ?? activePty?.tempDir ?? activeChild?.tempDir;
     const resolvedSessionId = sessionId ?? activePty?.sessionId ?? activeChild?.sessionId;
     const resolvedCommand = command ?? activePty?.command ?? activeChild?.command ?? "unknown command";
     if (!resolvedSessionId) {
       throw new Error("Session ID is required for background operations");
     }
+    if (!activePty && !activeChild) {
+      if (resolvedTempDir) {
+        fsPromises9.rm(resolvedTempDir, { recursive: true, force: true }).catch(() => {
+        });
+      }
+      return;
+    }
+    if (resolvedTempDir) {
+      this.backgroundTempDirs.set(pid, resolvedTempDir);
+    }
+    if (this.backgroundLogPids.has(pid)) {
+      return;
+    }
     const MAX_BACKGROUND_PROCESS_HISTORY_SIZE = 100;
     const history = this.backgroundProcessHistory.get(resolvedSessionId) ?? /* @__PURE__ */ new Map();
     if (history.size >= MAX_BACKGROUND_PROCESS_HISTORY_SIZE) {
@@ -326560,7 +326668,8 @@ ${truncated}`;
     history.set(pid, {
       command: resolvedCommand,
       status: "running",
-      startTime: Date.now()
+      startTime: Date.now(),
+      ...resolvedTempDir ? { tempDir: resolvedTempDir } : {}
     });
     this.backgroundProcessHistory.set(resolvedSessionId, history);
     const logPath = this.getLogFilePath(pid);
@@ -326708,8 +326817,15 @@ ${truncated}`;
       } catch {
       }
     }
+    for (const tempDir of this.backgroundTempDirs.values()) {
+      try {
+        fs49.rmSync(tempDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
     this.backgroundLogPids.clear();
     this.backgroundLogStreams.clear();
+    this.backgroundTempDirs.clear();
     this.backgroundProcessHistory.clear();
   }
 };
@@ -327003,15 +327119,19 @@ exit $__code`;
   getExplanation() {
     return this.getContextualDetails().trim();
   }
+  hasTaintedOrBuildFileRisk() {
+    const command = stripShellWrapper(this.params.command);
+    const history = this.getHistory();
+    const untrustedContext = extractUntrustedContext(history);
+    const untrustedFlags = findUntrustedFlags(command, untrustedContext);
+    const modifiedBuildFiles = getModifiedBuildFiles(this.context.config);
+    const isBuildCmd = isBuildOrTestCommand(command);
+    return untrustedFlags.length > 0 || isBuildCmd && modifiedBuildFiles.length > 0;
+  }
   getPolicyUpdateOptions(outcome) {
     if (outcome === "proceed_always_and_save" /* ProceedAlwaysAndSave */ || outcome === "proceed_always" /* ProceedAlways */) {
       const command = stripShellWrapper(this.params.command);
-      const history = this.getHistory();
-      const untrustedContext = extractUntrustedContext(history);
-      const untrustedFlags = findUntrustedFlags(command, untrustedContext);
-      const modifiedBuildFiles = getModifiedBuildFiles(this.context.config);
-      const isBuildCmd = isBuildOrTestCommand(command);
-      if (untrustedFlags.length > 0 || isBuildCmd && modifiedBuildFiles.length > 0) {
+      if (this.hasTaintedOrBuildFileRisk()) {
         return void 0;
       }
       const rootCommands = [...new Set(getCommandRoots(command))];
@@ -327027,24 +327147,18 @@ exit $__code`;
     if (forcedDecision === "deny") {
       return super.shouldConfirmExecute(abortSignal, forcedDecision);
     }
-    const command = stripShellWrapper(this.params.command);
-    const history = this.getHistory();
-    const untrustedContext = extractUntrustedContext(history);
-    const untrustedFlags = findUntrustedFlags(command, untrustedContext);
-    const modifiedBuildFiles = getModifiedBuildFiles(this.context.config);
-    const isBuildCmd = isBuildOrTestCommand(command);
-    if (untrustedFlags.length > 0 || isBuildCmd && modifiedBuildFiles.length > 0) {
+    if (this.hasTaintedOrBuildFileRisk()) {
       return this.getConfirmationDetails(abortSignal);
     }
-    if (this.context.config.getApprovalMode() === "yolo" /* YOLO */) {
+    if (this.context.config.getApprovalMode() === "yolo" /* YOLO */ && forcedDecision !== "ask_user") {
       return super.shouldConfirmExecute(abortSignal, forcedDecision);
     }
     if (this.params[PARAM_ADDITIONAL_PERMISSIONS]) {
       return this.getConfirmationDetails(abortSignal);
     }
     if (this.context.config.getSandboxEnabled()) {
-      const command2 = stripShellWrapper(this.params.command);
-      const rootCommands = getCommandRoots(command2);
+      const command = stripShellWrapper(this.params.command);
+      const rootCommands = getCommandRoots(command);
       const rawRootCommand = rootCommands[0];
       if (rawRootCommand) {
         const rootCommand = normalizeCommand(rawRootCommand);
@@ -327057,7 +327171,7 @@ exit $__code`;
           );
           const hasNetwork = modeConfig.network || approved.network;
           const missingNetwork = !!proactive.network && !hasNetwork;
-          const parsed = parseCommandDetails(command2);
+          const parsed = parseCommandDetails(command);
           const subCommand = parsed?.details[0]?.args?.[0];
           const needsNetwork = isNetworkReliantCommand(rootCommand, subCommand);
           if (needsNetwork) {
@@ -327196,6 +327310,7 @@ exit $__code`;
     const isWindows3 = os32.platform() === "win32";
     let tempFilePath = "";
     let tempDir = "";
+    let isBackgrounded = false;
     const timeoutMs = this.context.config.getShellToolInactivityTimeout();
     const timeoutController = new AbortController();
     let timeoutTimer;
@@ -327351,7 +327466,8 @@ exit $__code`;
             }
           },
           backgroundCompletionBehavior: this.context.config.getShellBackgroundCompletionBehavior(),
-          originalCommand: strippedCommand
+          originalCommand: strippedCommand,
+          tempDir
         }
       );
       if (pid) {
@@ -327366,11 +327482,20 @@ exit $__code`;
             () => {
               promotionTimer = null;
               if (!completed) {
-                ShellExecutionService.background(
-                  pid,
-                  sessionId,
-                  strippedCommand
-                );
+                try {
+                  ShellExecutionService.background(
+                    pid,
+                    sessionId,
+                    strippedCommand,
+                    tempDir
+                  );
+                  isBackgrounded = true;
+                } catch (err2) {
+                  debugLogger.error(
+                    "Failed to background shell execution:",
+                    err2
+                  );
+                }
               }
             },
             delay3
@@ -327409,20 +327534,22 @@ ${cumulativeOutput}`,
         }
       }
       const result2 = await resultPromise;
-      if (!result2.backgrounded) {
+      if (result2.backgrounded) {
+        isBackgrounded = true;
+      } else {
         flushOutput();
       }
       const backgroundPIDs = [];
       if (os32.platform() !== "win32") {
         let tempFileExists = false;
         try {
-          await fsPromises9.access(tempFilePath);
+          await fsPromises10.access(tempFilePath);
           tempFileExists = true;
         } catch {
           tempFileExists = false;
         }
         if (tempFileExists) {
-          const backgroundPIDContent = await fsPromises9.readFile(
+          const backgroundPIDContent = await fsPromises10.readFile(
             tempFilePath,
             "utf8"
           );
@@ -327667,16 +327794,16 @@ ${result2.output}`;
       }
       signal.removeEventListener("abort", onAbort);
       timeoutController.signal.removeEventListener("abort", onAbort);
-      if (!this.params.is_background) {
+      if (!isBackgrounded) {
         if (tempFilePath) {
           try {
-            await fsPromises9.unlink(tempFilePath);
+            await fsPromises10.unlink(tempFilePath);
           } catch {
           }
         }
         if (tempDir) {
           try {
-            await fsPromises9.rm(tempDir, { recursive: true, force: true });
+            await fsPromises10.rm(tempDir, { recursive: true, force: true });
           } catch {
           }
         }
@@ -333787,7 +333914,7 @@ var WebSearchToolInvocation = class extends BaseToolInvocation {
       return {
         llmContent: `Web search results for "${this.params.query}":
 
-${modifiedResponseText}`,
+${wrapUntrusted(modifiedResponseText)}`,
         returnDisplay: `Search results for "${this.params.query}" returned.`,
         sources
       };
@@ -338493,6 +338620,133 @@ var PreCompressTrigger = /* @__PURE__ */ ((PreCompressTrigger2) => {
 
 // packages/core/src/context/chatCompressionService.ts
 var DEFAULT_COMPRESSION_TOKEN_THRESHOLD = 0.5;
+var RECENT_TURNS_PROTECTED = 3;
+var RETRIEVAL_TOOL_NAMES_EXEMPT_FROM_COLLAPSE = /* @__PURE__ */ new Set([
+  "read_file",
+  "read_many_files",
+  "get_internal_docs",
+  "read_mcp_resource",
+  "grep",
+  "rip_grep",
+  "glob",
+  "search_file_content",
+  "find_files"
+]);
+function isExemptRetrievalTool(toolName, exemptTools = RETRIEVAL_TOOL_NAMES_EXEMPT_FROM_COLLAPSE) {
+  if (!toolName) {
+    return false;
+  }
+  const normalized2 = toolName.toLowerCase();
+  if (exemptTools.has(normalized2)) {
+    return true;
+  }
+  return normalized2.endsWith("read_file") || normalized2.endsWith("read_files") || normalized2.endsWith("read_many_files") || normalized2.endsWith("read_resource");
+}
+var COLLAPSED_FUNCTION_RESPONSE_MAX_BYTES = 2048;
+var defaultGraphemeSegmenter = new Intl.Segmenter(void 0, {
+  granularity: "grapheme"
+});
+function collapseOlderFunctionResponses(history, maxBytesPerOldResponse = COLLAPSED_FUNCTION_RESPONSE_MAX_BYTES, segmenter2 = defaultGraphemeSegmenter, protectedTurns = RECENT_TURNS_PROTECTED, exemptTools = RETRIEVAL_TOOL_NAMES_EXEMPT_FROM_COLLAPSE) {
+  const toolIndices = [];
+  for (let i3 = 0; i3 < history.length; i3++) {
+    if (history[i3].role === "user" && history[i3].parts?.some((p) => !!p.functionResponse)) {
+      toolIndices.push(i3);
+    }
+  }
+  if (toolIndices.length <= protectedTurns) {
+    return history;
+  }
+  const cutoffToolIndex = toolIndices[toolIndices.length - protectedTurns];
+  const collapseString = (str2) => {
+    const totalBytes = Buffer.byteLength(str2, "utf8");
+    if (totalBytes <= maxBytesPerOldResponse) {
+      return str2;
+    }
+    const previewBytes = maxBytesPerOldResponse;
+    let preview = "";
+    let currentBytes = 0;
+    for (const { segment } of segmenter2.segment(str2)) {
+      const segmentBytes = Buffer.byteLength(segment, "utf8");
+      if (currentBytes + segmentBytes > previewBytes) {
+        break;
+      }
+      preview += segment;
+      currentBytes += segmentBytes;
+    }
+    const omittedBytes = totalBytes - currentBytes;
+    return `${preview}
+... [Tool output collapsed from previous turn: ${omittedBytes} bytes omitted to conserve memory] ...`;
+  };
+  const collapseValue = (val) => {
+    if (typeof val === "string") {
+      return collapseString(val);
+    }
+    if (Array.isArray(val)) {
+      let arrayModified = false;
+      const newVal = val.map((item) => {
+        const collapsed = collapseValue(item);
+        if (collapsed !== item) {
+          arrayModified = true;
+        }
+        return collapsed;
+      });
+      return arrayModified ? newVal : val;
+    }
+    if (typeof val === "object" && val !== null) {
+      const proto = Object.getPrototypeOf(val);
+      if (proto !== Object.prototype && proto !== null) {
+        return val;
+      }
+      let objModified = false;
+      const copy = {};
+      for (const [k, v] of Object.entries(val)) {
+        const collapsed = collapseValue(v);
+        if (collapsed !== v) {
+          objModified = true;
+        }
+        copy[k] = collapsed;
+      }
+      return objModified ? copy : val;
+    }
+    return val;
+  };
+  let modified = false;
+  const newHistory = history.map((content, idx) => {
+    if (idx >= cutoffToolIndex || content.role !== "user" || !content.parts) {
+      return content;
+    }
+    let partsModified = false;
+    const newParts = content.parts.map((part) => {
+      if (!part.functionResponse?.response) {
+        return part;
+      }
+      if (isExemptRetrievalTool(part.functionResponse.name, exemptTools)) {
+        return part;
+      }
+      const resp = part.functionResponse.response;
+      const newResp = collapseValue(resp);
+      if (newResp !== resp) {
+        partsModified = true;
+        return {
+          ...part,
+          functionResponse: {
+            // eslint-disable-next-line @typescript-eslint/no-misused-spread
+            ...part.functionResponse,
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+            response: newResp
+          }
+        };
+      }
+      return part;
+    });
+    if (partsModified) {
+      modified = true;
+      return { ...content, parts: newParts };
+    }
+    return content;
+  });
+  return modified ? newHistory : history;
+}
 var COMPRESSION_PRESERVE_THRESHOLD = 0.3;
 var COMPRESSION_FUNCTION_RESPONSE_TOKEN_BUDGET = 5e4;
 function findCompressSplitPoint(contents, fraction) {
@@ -338630,10 +338884,12 @@ var ChatCompressionService = class {
     }
     const trigger = force ? "manual" /* Manual */ : "auto" /* Auto */;
     await config2.getHookSystem()?.firePreCompressEvent(trigger);
-    const originalTokenCount = chat.getLastPromptTokenCount();
+    const lastPromptTokenCount = chat.getLastPromptTokenCount();
+    const originalTokenCount = lastPromptTokenCount > 0 ? lastPromptTokenCount : estimateTokenCountSync(curatedHistory.flatMap((c4) => c4.parts || []));
     if (!force) {
       const threshold = await config2.getCompressionThreshold() ?? DEFAULT_COMPRESSION_TOKEN_THRESHOLD;
-      if (originalTokenCount < threshold * tokenLimit(model)) {
+      const isOverModelThreshold = originalTokenCount >= threshold * tokenLimit(model);
+      if (!isOverModelThreshold) {
         return {
           newHistory: null,
           info: {
@@ -338795,6 +339051,8 @@ First, reason in your scratchpad. Then, generate the updated <state_snapshot>.`
         }
       };
     } else {
+      historyToCompressTruncated.length = 0;
+      originalHistoryToCompress.length = 0;
       return {
         newHistory: extraHistory,
         info: {
@@ -338807,6 +339065,173 @@ First, reason in your scratchpad. Then, generate the updated <state_snapshot>.`
   }
 };
 
+// packages/core/src/utils/tool-utils.ts
+var import_fast_levenshtein2 = __toESM(require_levenshtein(), 1);
+function isToolCallResponseInfo(data) {
+  return typeof data === "object" && data !== null && "callId" in data && "responseParts" in data;
+}
+function getToolSuggestion(unknownToolName, allToolNames, topN = 3) {
+  const matches = allToolNames.map((toolName) => ({
+    name: toolName,
+    distance: import_fast_levenshtein2.default.get(unknownToolName, toolName)
+  }));
+  matches.sort((a2, b) => a2.distance - b.distance);
+  const topNResults = matches.slice(0, topN);
+  if (topNResults.length === 0) {
+    return "";
+  }
+  const suggestedNames = topNResults.map((match2) => `"${match2.name}"`).join(", ");
+  if (topNResults.length > 1) {
+    return ` Did you mean one of: ${suggestedNames}?`;
+  } else {
+    return ` Did you mean ${suggestedNames}?`;
+  }
+}
+function doesToolInvocationMatch(toolOrToolName, invocation, patterns) {
+  let toolNames;
+  if (isTool(toolOrToolName)) {
+    toolNames = [toolOrToolName.name, toolOrToolName.constructor.name];
+  } else {
+    toolNames = [toolOrToolName];
+  }
+  if (toolNames.some((name3) => SHELL_TOOL_NAMES.includes(name3))) {
+    toolNames = [.../* @__PURE__ */ new Set([...toolNames, ...SHELL_TOOL_NAMES])];
+  }
+  for (const pattern of patterns) {
+    const openParen = pattern.indexOf("(");
+    if (openParen === -1) {
+      if (toolNames.includes(pattern)) {
+        return true;
+      }
+      continue;
+    }
+    const patternToolName = pattern.substring(0, openParen);
+    if (!toolNames.includes(patternToolName)) {
+      continue;
+    }
+    if (!pattern.endsWith(")")) {
+      continue;
+    }
+    const argPattern = pattern.substring(openParen + 1, pattern.length - 1);
+    let command;
+    if (typeof invocation === "string") {
+      command = invocation;
+    } else {
+      if (!("command" in invocation.params)) {
+        continue;
+      }
+      command = String(invocation.params.command);
+    }
+    if (toolNames.some((name3) => SHELL_TOOL_NAMES.includes(name3))) {
+      if (command === argPattern || command.startsWith(argPattern + " ")) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+var segmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+function truncateToolOutput(text, maxBytes = MAX_STORED_TOOL_OUTPUT_BYTES, savedFilePath) {
+  if (Buffer.byteLength(text, "utf8") <= maxBytes) {
+    return text;
+  }
+  const suffix = savedFilePath ? `
+... [Tool output truncated to conserve memory. For full output see: ${savedFilePath}]` : "\n... [Tool output truncated to conserve memory]";
+  const targetBytes = Math.max(0, maxBytes - Buffer.byteLength(suffix, "utf8"));
+  let accumulatedBytes = 0;
+  let truncatedText = "";
+  for (const { segment } of segmenter.segment(text)) {
+    const segmentBytes = Buffer.byteLength(segment, "utf8");
+    if (accumulatedBytes + segmentBytes > targetBytes) {
+      break;
+    }
+    accumulatedBytes += segmentBytes;
+    truncatedText += segment;
+  }
+  return truncatedText + suffix;
+}
+function truncateFunctionResponsePart(part, maxBytes = MAX_STORED_TOOL_OUTPUT_BYTES, savedFilePath) {
+  if (part.text && Buffer.byteLength(part.text, "utf8") > maxBytes) {
+    return {
+      ...part,
+      text: truncateToolOutput(part.text, maxBytes, savedFilePath)
+    };
+  }
+  if (!part.functionResponse?.response) {
+    return part;
+  }
+  const resp = part.functionResponse.response;
+  if (typeof resp === "string") {
+    if (Buffer.byteLength(resp, "utf8") > maxBytes) {
+      return {
+        ...part,
+        functionResponse: {
+          // eslint-disable-next-line @typescript-eslint/no-misused-spread
+          ...part.functionResponse,
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+          response: truncateToolOutput(
+            resp,
+            maxBytes,
+            savedFilePath
+          )
+        }
+      };
+    }
+    return part;
+  }
+  if (typeof resp === "object" && resp !== null) {
+    const truncateValue = (val) => {
+      if (typeof val === "string") {
+        if (Buffer.byteLength(val, "utf8") > maxBytes) {
+          return truncateToolOutput(val, maxBytes, savedFilePath);
+        }
+        return val;
+      }
+      if (Array.isArray(val)) {
+        let arrayModified = false;
+        const newVal = val.map((item) => {
+          const truncated = truncateValue(item);
+          if (truncated !== item) {
+            arrayModified = true;
+          }
+          return truncated;
+        });
+        return arrayModified ? newVal : val;
+      }
+      if (typeof val === "object" && val !== null) {
+        const proto = Object.getPrototypeOf(val);
+        if (proto !== Object.prototype && proto !== null) {
+          return val;
+        }
+        let objModified = false;
+        const copy = {};
+        for (const [k, v] of Object.entries(val)) {
+          const truncated = truncateValue(v);
+          if (truncated !== v) {
+            objModified = true;
+          }
+          copy[k] = truncated;
+        }
+        return objModified ? copy : val;
+      }
+      return val;
+    };
+    const newResp = truncateValue(resp);
+    if (newResp !== resp) {
+      return {
+        ...part,
+        functionResponse: {
+          // eslint-disable-next-line @typescript-eslint/no-misused-spread
+          ...part.functionResponse,
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+          response: newResp
+        }
+      };
+    }
+  }
+  return part;
+}
+
 // packages/core/src/agents/types.ts
 var AgentTerminateMode = /* @__PURE__ */ ((AgentTerminateMode2) => {
   AgentTerminateMode2["ERROR"] = "ERROR";
@@ -343369,7 +343794,7 @@ var A2AAuthProviderFactory = class _A2AAuthProviderFactory {
         return provider;
       }
       case "oauth2": {
-        const { OAuth2AuthProvider } = await import("./oauth2-provider-UY26FDAA.js");
+        const { OAuth2AuthProvider } = await import("./oauth2-provider-KPLVYPVA.js");
         const provider = new OAuth2AuthProvider(
           authConfig,
           options.agentName ?? "unknown",
@@ -344616,72 +345041,6 @@ function getToolCallContext() {
   return toolCallContext.getStore();
 }
 
-// packages/core/src/utils/tool-utils.ts
-var import_fast_levenshtein2 = __toESM(require_levenshtein(), 1);
-function isToolCallResponseInfo(data) {
-  return typeof data === "object" && data !== null && "callId" in data && "responseParts" in data;
-}
-function getToolSuggestion(unknownToolName, allToolNames, topN = 3) {
-  const matches = allToolNames.map((toolName) => ({
-    name: toolName,
-    distance: import_fast_levenshtein2.default.get(unknownToolName, toolName)
-  }));
-  matches.sort((a2, b) => a2.distance - b.distance);
-  const topNResults = matches.slice(0, topN);
-  if (topNResults.length === 0) {
-    return "";
-  }
-  const suggestedNames = topNResults.map((match2) => `"${match2.name}"`).join(", ");
-  if (topNResults.length > 1) {
-    return ` Did you mean one of: ${suggestedNames}?`;
-  } else {
-    return ` Did you mean ${suggestedNames}?`;
-  }
-}
-function doesToolInvocationMatch(toolOrToolName, invocation, patterns) {
-  let toolNames;
-  if (isTool(toolOrToolName)) {
-    toolNames = [toolOrToolName.name, toolOrToolName.constructor.name];
-  } else {
-    toolNames = [toolOrToolName];
-  }
-  if (toolNames.some((name3) => SHELL_TOOL_NAMES.includes(name3))) {
-    toolNames = [.../* @__PURE__ */ new Set([...toolNames, ...SHELL_TOOL_NAMES])];
-  }
-  for (const pattern of patterns) {
-    const openParen = pattern.indexOf("(");
-    if (openParen === -1) {
-      if (toolNames.includes(pattern)) {
-        return true;
-      }
-      continue;
-    }
-    const patternToolName = pattern.substring(0, openParen);
-    if (!toolNames.includes(patternToolName)) {
-      continue;
-    }
-    if (!pattern.endsWith(")")) {
-      continue;
-    }
-    const argPattern = pattern.substring(openParen + 1, pattern.length - 1);
-    let command;
-    if (typeof invocation === "string") {
-      command = invocation;
-    } else {
-      if (!("command" in invocation.params)) {
-        continue;
-      }
-      command = String(invocation.params.command);
-    }
-    if (toolNames.some((name3) => SHELL_TOOL_NAMES.includes(name3))) {
-      if (command === argPattern || command.startsWith(argPattern + " ")) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-
 // packages/core/src/scheduler/state-manager.ts
 var SchedulerStateManager = class {
   constructor(messageBus, schedulerId = ROOT_SCHEDULER_ID, onTerminalCall) {
@@ -346573,7 +346932,7 @@ ${summary}
 
 // packages/core/src/context/toolOutputMaskingService.ts
 import path68 from "node:path";
-import * as fsPromises10 from "node:fs/promises";
+import * as fsPromises11 from "node:fs/promises";
 var DEFAULT_TOOL_PROTECTION_THRESHOLD = 5e4;
 var DEFAULT_MIN_PRUNABLE_TOKENS_THRESHOLD = 3e4;
 var DEFAULT_PROTECT_LATEST_TURN = true;
@@ -346654,7 +347013,7 @@ var ToolOutputMaskingService = class {
       const safeSessionId = sanitizeFilenamePart(sessionId);
       toolOutputsDir = path68.join(toolOutputsDir, `session-${safeSessionId}`);
     }
-    await fsPromises10.mkdir(toolOutputsDir, { recursive: true });
+    await fsPromises11.mkdir(toolOutputsDir, { recursive: true });
     for (const item of prunableParts) {
       const { contentIndex, partIndex, content, tokens } = item;
       const contentRecord = newHistory[contentIndex];
@@ -346666,7 +347025,7 @@ var ToolOutputMaskingService = class {
       const safeCallId = sanitizeFilenamePart(callId).toLowerCase();
       const fileName = `${safeToolName}_${safeCallId}_${Math.random().toString(36).substring(7)}.txt`;
       const filePath = path68.join(toolOutputsDir, fileName);
-      await fsPromises10.writeFile(filePath, content, "utf-8");
+      await fsPromises11.writeFile(filePath, content, "utf-8");
       const originalResponse = (
         // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
         part.functionResponse.response || {}
@@ -350239,6 +350598,15 @@ var GeminiClient = class {
     );
   }
   async resumeChat(history, resumedSessionData) {
+    if (resumedSessionData?.filePath) {
+      const previousRecordingService = this.chat?.getChatRecordingService?.();
+      if (previousRecordingService && previousRecordingService.getConversationFilePath?.() !== resumedSessionData.filePath) {
+        try {
+          await previousRecordingService.deleteCurrentSessionIfNotResumableAsync?.();
+        } catch {
+        }
+      }
+    }
     this.chat = await this.startChat(history, resumedSessionData);
     this.updateTelemetryTokenCount();
   }
@@ -351311,7 +351679,7 @@ var ToolExecutor = class {
           this.context.promptId
         );
         outputFile = savedPath;
-        const truncatedContent = formatTruncatedToolOutput(
+        let truncatedContent = formatTruncatedToolOutput(
           content,
           outputFile,
           threshold
@@ -351325,6 +351693,12 @@ var ToolExecutor = class {
             threshold
           })
         );
+        if (typeof truncatedContent === "string" && Buffer.byteLength(truncatedContent, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+          truncatedContent = truncateToolOutput(
+            truncatedContent,
+            MAX_STORED_TOOL_OUTPUT_BYTES
+          );
+        }
         return { truncatedContent, outputFile };
       }
     } else if (Array.isArray(content) && content.length === 1 && "tool" in call && call.tool instanceof DiscoveredMCPTool) {
@@ -351342,11 +351716,17 @@ var ToolExecutor = class {
             this.context.promptId
           );
           outputFile = savedPath;
-          const truncatedText = formatTruncatedToolOutput(
+          let truncatedText = formatTruncatedToolOutput(
             textContent2,
             outputFile,
             threshold
           );
+          if (typeof truncatedText === "string" && Buffer.byteLength(truncatedText, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+            truncatedText = truncateToolOutput(
+              truncatedText,
+              MAX_STORED_TOOL_OUTPUT_BYTES
+            );
+          }
           const truncatedContent = [
             { ...firstPart, text: truncatedText }
           ];
@@ -351363,7 +351743,69 @@ var ToolExecutor = class {
         }
       }
     }
-    return { truncatedContent: content, outputFile };
+    const ensureOutputFile = async (rawText) => {
+      if (!outputFile) {
+        try {
+          const { outputFile: savedPath } = await saveTruncatedToolOutput(
+            rawText,
+            toolName,
+            callId,
+            this.config.storage.getProjectTempDir(),
+            this.context.promptId
+          );
+          outputFile = savedPath;
+        } catch {
+        }
+      }
+      return outputFile;
+    };
+    let finalContent = content;
+    if (typeof finalContent === "string") {
+      if (Buffer.byteLength(finalContent, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+        const savedPath = await ensureOutputFile(finalContent);
+        finalContent = truncateToolOutput(
+          finalContent,
+          MAX_STORED_TOOL_OUTPUT_BYTES,
+          savedPath
+        );
+      }
+    } else if (Array.isArray(finalContent)) {
+      finalContent = await Promise.all(
+        finalContent.map(async (part) => {
+          if (typeof part === "string" && Buffer.byteLength(part, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+            const savedPath = await ensureOutputFile(part);
+            return truncateToolOutput(
+              part,
+              MAX_STORED_TOOL_OUTPUT_BYTES,
+              savedPath
+            );
+          }
+          if (typeof part === "object" && part !== null && "text" in part && typeof part.text === "string" && Buffer.byteLength(part.text, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+            const savedPath = await ensureOutputFile(part.text);
+            return {
+              ...part,
+              text: truncateToolOutput(
+                part.text,
+                MAX_STORED_TOOL_OUTPUT_BYTES,
+                savedPath
+              )
+            };
+          }
+          return part;
+        })
+      );
+    } else if (typeof finalContent === "object" && finalContent !== null && "text" in finalContent && typeof finalContent.text === "string" && Buffer.byteLength(finalContent.text, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+      const savedPath = await ensureOutputFile(finalContent.text);
+      finalContent = {
+        ...finalContent,
+        text: truncateToolOutput(
+          finalContent.text,
+          MAX_STORED_TOOL_OUTPUT_BYTES,
+          savedPath
+        )
+      };
+    }
+    return { truncatedContent: finalContent, outputFile };
   }
   async createCancelledResult(call, reason, toolResult) {
     const errorMessage = `[Operation Cancelled] ${reason}`;
@@ -351564,6 +352006,9 @@ var ToolModificationHandler = class {
 };
 
 // packages/core/src/scheduler/scheduler.ts
+function isTaintRiskDetectable(invocation) {
+  return typeof invocation === "object" && invocation !== null && "hasTaintedOrBuildFileRisk" in invocation && typeof invocation.hasTaintedOrBuildFileRisk === "function";
+}
 var createErrorResponse = (request, error40, errorType) => ({
   callId: request.callId,
   error: error40,
@@ -352004,6 +352449,10 @@ var Scheduler = class {
     if (hookDecision === "ask") {
       decision = "ask_user" /* ASK_USER */;
     }
+    const hasTaintRisk = isTaintRiskDetectable(toolCall.invocation) && toolCall.invocation.hasTaintedOrBuildFileRisk();
+    if (decision === "allow" /* ALLOW */ && hasTaintRisk) {
+      decision = this.config.isInteractive?.() ?? true ? "ask_user" /* ASK_USER */ : "deny" /* DENY */;
+    }
     if (decision === "deny" /* DENY */) {
       const { errorMessage, errorType } = getPolicyDenialError(
         this.config,
@@ -352023,6 +352472,7 @@ var Scheduler = class {
     let outcome = "proceed_once" /* ProceedOnce */;
     let lastDetails;
     if (decision === "ask_user" /* ASK_USER */) {
+      const forcedDecision = hookDecision === "ask" || policyDecision === "allow" /* ALLOW */ && hasTaintRisk ? "ask_user" : void 0;
       const result2 = await resolveConfirmation(toolCall, signal, {
         config: this.config,
         messageBus: this.messageBus,
@@ -352032,7 +352482,7 @@ var Scheduler = class {
         schedulerId: this.schedulerId,
         onWaitingForConfirmation: this.onWaitingForConfirmation,
         systemMessage: hookSystemMessage,
-        forcedDecision: hookDecision === "ask" ? "ask_user" : void 0
+        forcedDecision
       });
       outcome = result2.outcome;
       lastDetails = result2.lastDetails;
@@ -352360,14 +352810,14 @@ function normalizeSpace(text) {
   return text.replace(/\s+/g, " ").trim();
 }
 function safeSlice(text, start2, end) {
-  const segmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
-  const segments = Array.from(segmenter.segment(text));
+  const segmenter2 = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+  const segments = Array.from(segmenter2.segment(text));
   return segments.slice(start2, end).map((s2) => s2.segment).join("");
 }
 function safeLength(text) {
-  const segmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+  const segmenter2 = new Intl.Segmenter(void 0, { granularity: "grapheme" });
   let count2 = 0;
-  for (const _ of segmenter.segment(text)) {
+  for (const _ of segmenter2.segment(text)) {
     count2++;
   }
   return count2;
@@ -353616,6 +354066,22 @@ var LocalAgentExecutor = class _LocalAgentExecutor {
   }
   async tryCompressChat(chat, prompt_id, abortSignal) {
     const model = this.definition.modelConfig.model ?? DEFAULT_GEMINI_MODEL;
+    const threshold = await this.context.config.getCompressionThreshold() ?? DEFAULT_COMPRESSION_TOKEN_THRESHOLD;
+    const modelLimit = tokenLimit(model);
+    const lastPromptTokenCount = chat.getLastPromptTokenCount();
+    const currentHistory = chat.getHistory(false);
+    const originalTokenCount = lastPromptTokenCount > 0 ? lastPromptTokenCount : estimateTokenCountSync(currentHistory.flatMap((c4) => c4.parts || []));
+    if (originalTokenCount >= threshold * modelLimit) {
+      const collapsedHistory = collapseOlderFunctionResponses(currentHistory);
+      if (collapsedHistory !== currentHistory) {
+        const existingTurns = chat.getHistoryTurns?.(false) ?? [];
+        const turns = collapsedHistory.map((c4, idx) => ({
+          id: existingTurns[idx]?.id ?? randomUUID13(),
+          content: c4
+        }));
+        chat.setHistory(turns);
+      }
+    }
     const { newHistory, info: info2 } = await this.compressionService.compress(
       chat,
       prompt_id,
@@ -353629,8 +354095,9 @@ var LocalAgentExecutor = class _LocalAgentExecutor {
       this.hasFailedCompressionAttempt = true;
     } else if (info2.compressionStatus === 1 /* COMPRESSED */) {
       if (newHistory) {
-        const turns = newHistory.map((c4) => ({
-          id: randomUUID13(),
+        const existingTurns = chat.getHistoryTurns?.(false) ?? [];
+        const turns = newHistory.map((c4, idx) => ({
+          id: existingTurns[idx]?.id ?? randomUUID13(),
           content: c4
         }));
         chat.setHistory(turns);
@@ -353638,8 +354105,9 @@ var LocalAgentExecutor = class _LocalAgentExecutor {
       }
     } else if (info2.compressionStatus === 6 /* CONTENT_TRUNCATED */) {
       if (newHistory) {
-        const turns = newHistory.map((c4) => ({
-          id: randomUUID13(),
+        const existingTurns = chat.getHistoryTurns?.(false) ?? [];
+        const turns = newHistory.map((c4, idx) => ({
+          id: existingTurns[idx]?.id ?? randomUUID13(),
           content: c4
         }));
         chat.setHistory(turns);
@@ -353850,6 +354318,25 @@ var LocalAgentExecutor = class _LocalAgentExecutor {
           onWaitingForConfirmation
         }
       );
+      for (const call of completedCalls) {
+        const outputFile = call.response?.outputFile;
+        if (call.response?.responseParts) {
+          call.response.responseParts = call.response.responseParts.map(
+            (p) => truncateFunctionResponsePart(
+              p,
+              MAX_STORED_TOOL_OUTPUT_BYTES,
+              outputFile
+            )
+          );
+        }
+        if (typeof call.response?.resultDisplay === "string" && Buffer.byteLength(call.response.resultDisplay, "utf8") > MAX_STORED_TOOL_OUTPUT_BYTES) {
+          call.response.resultDisplay = truncateToolOutput(
+            call.response.resultDisplay,
+            MAX_STORED_TOOL_OUTPUT_BYTES,
+            outputFile
+          );
+        }
+      }
       chat.recordCompletedToolCalls(model, completedCalls);
       for (const call of completedCalls) {
         const toolName = toolNameMap.get(call.request.callId) || call.request.name;
@@ -353915,7 +354402,9 @@ var LocalAgentExecutor = class _LocalAgentExecutor {
       const callId = functionCall.id ?? `${promptId}-${index}`;
       const part = syncResults.get(callId);
       if (part) {
-        toolResponseParts.push(part);
+        toolResponseParts.push(
+          truncateFunctionResponsePart(part, MAX_STORED_TOOL_OUTPUT_BYTES)
+        );
         continue;
       }
       const isAborted2 = signal.aborted;
@@ -367717,9 +368206,12 @@ var PolicyEngine = class {
   isAlwaysAllowRule(rule) {
     return rule.priority !== void 0 && Math.round(rule.priority % 1 * 1e3) === ALWAYS_ALLOW_PRIORITY_FRACTION;
   }
-  shouldDowngradeForRedirection(command, allowRedirection) {
+  shouldDowngradeForRedirection(command, allowRedirection, rule) {
     if (allowRedirection) return false;
     if (!hasRedirection(command)) return false;
+    if (rule?.argsPattern && !allowRedirection) {
+      return true;
+    }
     if (this.approvalMode === "autoEdit" /* AUTO_EDIT */ || this.approvalMode === "yolo" /* YOLO */) {
       return false;
     }
@@ -367826,7 +368318,7 @@ var PolicyEngine = class {
     }
     let aggregateDecision = ruleDecision;
     let responsibleRule = rule && ruleDecision === rule.decision ? rule : void 0;
-    if (this.shouldDowngradeForRedirection(command, allowRedirection)) {
+    if (this.shouldDowngradeForRedirection(command, allowRedirection, rule)) {
       if (aggregateDecision === "allow" /* ALLOW */) {
         debugLogger.debug(
           `[PolicyEngine.check] Downgrading ALLOW to ASK_USER for redirected command: ${command}`
@@ -367878,7 +368370,11 @@ var PolicyEngine = class {
           }
           aggregateDecision = "ask_user" /* ASK_USER */;
         }
-        if (subResult.decision === "allow" /* ALLOW */ && this.shouldDowngradeForRedirection(subCmd, allowRedirection)) {
+        if (subResult.decision === "allow" /* ALLOW */ && this.shouldDowngradeForRedirection(
+          subCmd,
+          subResult.rule?.allowRedirection ?? allowRedirection,
+          subResult.rule
+        )) {
           if (aggregateDecision === "allow" /* ALLOW */) {
             aggregateDecision = "ask_user" /* ASK_USER */;
             responsibleRule = void 0;
@@ -368134,6 +368630,9 @@ var PolicyEngine = class {
         }
       }
     }
+    if (this.nonInteractive && decision === "ask_user" /* ASK_USER */) {
+      decision = "deny" /* DENY */;
+    }
     return {
       decision,
       rule: matchedRule
@@ -371042,7 +371541,7 @@ var SecurityValidator = class {
 };
 function getWindowsPowerShellPath() {
   let systemRoot = process.env["SystemRoot"] || process.env["systemroot"] || process.env["windir"] || process.env["WINDIR"] || "C:\\Windows";
-  if (!/^[a-zA-Z]:\\/.test(systemRoot)) {
+  if (!/^[a-zA-Z]:\\Windows\\?$/i.test(systemRoot) || systemRoot.includes("..")) {
     systemRoot = "C:\\Windows";
   }
   const pathModule = os33.platform() === "win32" ? path87.win32 : path87.posix;
@@ -372379,7 +372878,8 @@ import * as fs77 from "node:fs";
 
 // packages/core/src/safety/built-in.ts
 import * as path89 from "node:path";
-var VSCODE_SFN_REGEX = /^(vscode|vs[0-9a-f]{4})~\d+$/;
+var VSCODE_SFN_REGEX = /^(vscode|vs[0-9a-f]{4})~\d+(\..+)?$/i;
+var GEMINI_SFN_REGEX = /^(gemini|ge[0-9a-f]{4})~\d+(\..+)?$/i;
 var AllowedPathChecker = class {
   async check(input) {
     const { toolCall, context: context2 } = input;
@@ -372406,6 +372906,7 @@ var AllowedPathChecker = class {
       }
       let hasBlockedSegment = false;
       let isVscodePath = false;
+      let isGeminiPath = false;
       for (const resolvedDir of resolvedAllowedDirs) {
         if (!this.isPathAllowed(resolvedPath, resolvedDir)) continue;
         const relative12 = path89.relative(resolvedDir, resolvedPath);
@@ -372420,6 +372921,9 @@ var AllowedPathChecker = class {
           if (clean === ".vscode" || VSCODE_SFN_REGEX.test(clean)) {
             isVscodePath = true;
           }
+          if (clean === ".gemini" || GEMINI_SFN_REGEX.test(clean)) {
+            isGeminiPath = true;
+          }
         }
       }
       if (hasBlockedSegment) {
@@ -372428,6 +372932,12 @@ var AllowedPathChecker = class {
           reason: `Access to sensitive path "${p}" in argument "${argName}" is blocked.`
         };
       }
+      if (isGeminiPath) {
+        return {
+          decision: "ask_user" /* ASK_USER */,
+          reason: `Modifying .gemini configuration files requires explicit user confirmation.`
+        };
+      }
       if (isVscodePath) {
         return {
           decision: "ask_user" /* ASK_USER */,
@@ -397080,7 +397590,7 @@ var LegacyAgentSession = class extends AgentSession {
 };
 
 // packages/core/src/tools/read-many-files.ts
-import * as fsPromises11 from "node:fs/promises";
+import * as fsPromises12 from "node:fs/promises";
 import * as path107 from "node:path";
 function getDefaultExcludes(config2) {
   return config2?.getFileExclusions().getReadManyFilesExcludes() ?? [];
@@ -397133,7 +397643,7 @@ ${finalExclusionPatternsForDescription.slice(0, 2).join(
           const fullPath = path107.join(dir, normalizedP);
           let exists2 = false;
           try {
-            const st = await fsPromises11.stat(fullPath);
+            const st = await fsPromises12.stat(fullPath);
             exists2 = st.isFile();
           } catch {
             exists2 = false;
@@ -405236,6 +405746,7 @@ export {
   DEFAULT_MAX_LINES_TEXT_FILE,
   MAX_LINE_LENGTH_TEXT_FILE,
   MAX_FILE_SIZE_MB,
+  MAX_STORED_TOOL_OUTPUT_BYTES,
   EMPTY_RESPONSE_COMPRESS_SUGGESTION,
   THINKING_ONLY_COMPRESS_SUGGESTION,
   MAX_TOKENS_EXCEEDED_SUGGESTION,
@@ -405247,6 +405758,7 @@ export {
   loadWasmBinary,
   DEFAULT_ENCODING,
   detectBOM,
+  readSecureFileBuffer,
   readFileWithEncoding,
   getSpecificMimeType,
   canonicalizeMacosPath,
@@ -406009,6 +406521,11 @@ export {
   SessionStartSource,
   SessionEndReason,
   PreCompressTrigger,
+  isToolCallResponseInfo,
+  getToolSuggestion,
+  doesToolInvocationMatch,
+  truncateToolOutput,
+  truncateFunctionResponsePart,
   AgentTerminateMode,
   DEFAULT_QUERY_STRING,
   DEFAULT_MAX_TURNS,
@@ -406043,9 +406560,6 @@ export {
   exchangeCodeForToken,
   refreshAccessToken,
   ModelConfigService,
-  isToolCallResponseInfo,
-  getToolSuggestion,
-  doesToolInvocationMatch,
   getPolicyDenialError,
   checkPolicy,
   updatePolicy,
@@ -406155,6 +406669,7 @@ export {
   createPathSecurityCache,
   clearSecurityCacheForTesting,
   SecurityValidator,
+  getWindowsPowerShellPath,
   isDirectorySecure,
   normalizeSecurityPath,
   isPathSecureSync,