@google/gemini-cli 0.64.0-preview.0 → 0.64.0-preview.1

package/bundle/{chunk-ZQW7OGUO.js → chunk-MN5WGELB.js}

@@ -283529,7 +283529,7 @@ function isValidToolName(name3, options = {}) {
 }
 
 // packages/core/dist/src/generated/git-commit.js
-var GIT_COMMIT_INFO = "fb972b2f8";
+var GIT_COMMIT_INFO = "581fdbbfa";
 var CLI_VERSION = "0.64.0-preview.0";
 
 // packages/core/dist/src/ide/detect-ide.js
@@ -307310,7 +307310,7 @@ function getVersion() {
   }
   versionPromise = (async () => {
     const pkgJson = await getPackageJson(__dirname4);
-    return "0.64.0-preview.0";
+    return "0.64.0-preview.1";
   })();
   return versionPromise;
 }
@@ -309438,6 +309438,142 @@ var BENIGN_SUBCOMMAND_TOKENS = /* @__PURE__ */ new Set([
   "restart",
   "status"
 ]);
+var SAFE_SHORT_FLAGS = /* @__PURE__ */ new Set([
+  "-a",
+  "-A",
+  "-b",
+  "-B",
+  "-C",
+  "-d",
+  "-D",
+  "-E",
+  "-F",
+  "-g",
+  "-G",
+  "-h",
+  "-H",
+  "-i",
+  "-I",
+  "-l",
+  "-L",
+  "-m",
+  "-n",
+  "-N",
+  "-p",
+  "-P",
+  "-q",
+  "-r",
+  "-R",
+  "-s",
+  "-S",
+  "-t",
+  "-T",
+  "-u",
+  "-U",
+  "-v",
+  "-V",
+  "-w",
+  "-W",
+  "-x",
+  "-z",
+  "-1",
+  // Common combined POSIX inspection flags (ls, grep, ps, git)
+  "-la",
+  "-al",
+  "-ld",
+  "-dl",
+  "-lh",
+  "-hl",
+  "-lah",
+  "-alh",
+  "-lrt",
+  "-ltr",
+  "-rn",
+  "-nr",
+  "-ri",
+  "-ir",
+  "-rni",
+  "-rin",
+  "-ni",
+  "-in",
+  "-ef",
+  "-aux"
+]);
+var SAFE_LONG_FLAGS = /* @__PURE__ */ new Set([
+  "--all",
+  "--oneline",
+  "--stat",
+  "--numstat",
+  "--shortstat",
+  "--name-only",
+  "--name-status",
+  "--graph",
+  "--decorate",
+  "--no-pager",
+  "--color",
+  "--no-color",
+  "--grep",
+  "--author",
+  "--since",
+  "--until",
+  "--before",
+  "--after",
+  "--pretty",
+  "--format",
+  "--abbrev-commit",
+  "--max-count",
+  "--cached",
+  "--staged",
+  "--short",
+  "--branch",
+  "--porcelain",
+  "--help",
+  "--version",
+  "--quiet",
+  "--verbose",
+  "--dry-run",
+  "--ignore-case",
+  "--line-number",
+  "--recursive",
+  "--extended-regexp",
+  "--fixed-strings",
+  "--files-with-matches",
+  "--count",
+  "--context",
+  "--before-context",
+  "--after-context"
+]);
+var HIGH_RISK_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-c",
+  "-e",
+  "--eval",
+  "--exec",
+  "-exec",
+  "-execdir",
+  "--run_under",
+  "--test_strategy",
+  "--test_arg",
+  "--test_env",
+  "--action_env",
+  "--jvmopt",
+  "--host_jvm_args",
+  "--wrapper_script_flag",
+  "--upload-pack",
+  "--receive-pack",
+  "--require",
+  "--import",
+  "--loader"
+]);
+var FILE_MODE_STRING_REGEX = /^[dcbpsl-][rwxstST-]{9}[+@.]?$/i;
+var BARE_DASHES_REGEX = /^--+$/;
+var BARE_SHELL_VARIABLE_REGEX = /^\$(?:[a-zA-Z_][a-zA-Z0-9_]*|\{[a-zA-Z_][a-zA-Z0-9_]*\})$/;
+function isHighRiskPatternToken(token2) {
+  return token2.startsWith("http://") || token2.startsWith("https://") || token2.startsWith("/") || token2.startsWith("\\") || token2.startsWith("./") || token2.startsWith("../") || /^[a-zA-Z]:[\\/]/.test(token2) || /\.(sh|bash|zsh|ps1|bat|cmd|exe)$/i.test(token2);
+}
+function hasUntrustedSubstring(untrustedContext, value) {
+  const normalized2 = value.toLowerCase().replace(/\\/g, "/");
+  return untrustedContext.untrustedTexts.some((text) => text.toLowerCase().includes(normalized2));
+}
 function extractUntrustedContext(history) {
   const untrustedTexts = [];
   const untrustedTokens = /* @__PURE__ */ new Set();
@@ -309468,35 +309604,19 @@ function extractUntrustedContext(history) {
         if (untrustedContent) {
           const normalizedContent = untrustedContent.replace(/\\/g, "/");
           untrustedTexts.push(normalizedContent);
-          const tokens = normalizedContent.split(/[\s,`"';()|&[\]{}<>]+/).map((t2) => t2.trim()).filter((t2) => t2.length > 1).filter((t2) => !BENIGN_SUBCOMMAND_TOKENS.has(t2.toLowerCase()));
+          const contentWithoutShellMetadata = normalizedContent.replace(/^\s*Output:\s*(\(empty\))?\s*/i, "").replace(/\n(?:Exit Code|Signal|Background PIDs|Process Group PGID):.*$/gim, "");
+          const tokens = contentWithoutShellMetadata.split(/[\s,`"';()|&[\]{}<>]+/).map((t2) => t2.trim()).filter((t2) => t2.length > 1).filter((t2) => !BARE_DASHES_REGEX.test(t2)).filter((t2) => !FILE_MODE_STRING_REGEX.test(t2)).filter((t2) => !BENIGN_SUBCOMMAND_TOKENS.has(t2.toLowerCase())).filter((t2) => !SAFE_SHORT_FLAGS.has(t2)).filter((t2) => !SAFE_LONG_FLAGS.has(t2.toLowerCase()));
           for (const token2 of tokens) {
-            const lowerToken = token2.toLowerCase();
-            untrustedTokens.add(lowerToken);
-            if (lowerToken.startsWith("--")) {
-              untrustedTokens.add(lowerToken.substring(2));
-            } else if (lowerToken.startsWith("-")) {
-              untrustedTokens.add(lowerToken.substring(1));
-            }
-            if (lowerToken.includes("=")) {
-              const eqParts = lowerToken.split("=");
+            const isShortFlag = token2.startsWith("-") && !token2.startsWith("--");
+            const tokenToStore = isShortFlag ? token2 : token2.toLowerCase();
+            untrustedTokens.add(tokenToStore);
+            if (token2.includes("=")) {
+              const eqParts = token2.split("=");
               for (const eqPart of eqParts) {
                 const trimmedPart = eqPart.trim();
-                if (trimmedPart.length > 1) {
-                  untrustedTokens.add(trimmedPart);
-                  if (trimmedPart.startsWith("--")) {
-                    untrustedTokens.add(trimmedPart.substring(2));
-                  } else if (trimmedPart.startsWith("-")) {
-                    untrustedTokens.add(trimmedPart.substring(1));
-                  }
-                }
-              }
-            }
-            if (lowerToken.includes("/")) {
-              const pathParts = lowerToken.split("/");
-              for (const part2 of pathParts) {
-                const trimmedPart = part2.trim();
-                if (trimmedPart.length > 1) {
-                  untrustedTokens.add(trimmedPart);
+                if (trimmedPart.length > 1 && !BARE_DASHES_REGEX.test(trimmedPart) && !SAFE_SHORT_FLAGS.has(trimmedPart) && !SAFE_LONG_FLAGS.has(trimmedPart.toLowerCase())) {
+                  const isPartShortFlag = trimmedPart.startsWith("-") && !trimmedPart.startsWith("--");
+                  untrustedTokens.add(isPartShortFlag ? trimmedPart : trimmedPart.toLowerCase());
                 }
               }
             }
@@ -309515,7 +309635,7 @@ function findUntrustedFlags(command, untrustedContext) {
   let parsed;
   try {
     const normalizedCommand = process.platform === "win32" ? command.replace(/\\(?!")/g, "/") : command;
-    parsed = (0, import_shell_quote5.parse)(normalizedCommand);
+    parsed = (0, import_shell_quote5.parse)(normalizedCommand, (key) => `$${key}`);
   } catch {
     parsed = command.trim().split(/\s+/);
   }
@@ -309538,45 +309658,57 @@ function findUntrustedFlags(command, untrustedContext) {
     const token2 = rawTokens[i3];
     const lowerToken = token2.toLowerCase();
     if (token2.startsWith("-")) {
+      if (/^--?$/.test(token2)) {
+        continue;
+      }
+      let rawFlagName = token2;
       let flagToCheck = lowerToken;
+      let rawValToCheck;
       let valToCheck;
       if (token2.includes("=")) {
-        const eqIdx = lowerToken.indexOf("=");
+        const eqIdx = token2.indexOf("=");
+        rawFlagName = token2.substring(0, eqIdx);
         flagToCheck = lowerToken.substring(0, eqIdx);
+        rawValToCheck = token2.substring(eqIdx + 1);
         valToCheck = lowerToken.substring(eqIdx + 1);
       }
-      if (untrustedContext.untrustedTokens.has(lowerToken) || untrustedContext.untrustedTokens.has(flagToCheck)) {
+      const isSafeFlag = SAFE_SHORT_FLAGS.has(rawFlagName) || SAFE_LONG_FLAGS.has(flagToCheck);
+      const isHighRiskFlag = HIGH_RISK_VALUE_FLAGS.has(rawFlagName) || rawFlagName.startsWith("--") && HIGH_RISK_VALUE_FLAGS.has(flagToCheck);
+      const isShortFlag = rawFlagName.startsWith("-") && !rawFlagName.startsWith("--");
+      const tokenToLookup = isShortFlag ? rawFlagName : lowerToken;
+      const flagToLookup = isShortFlag ? rawFlagName : flagToCheck;
+      if (!isSafeFlag && (untrustedContext.untrustedTokens.has(tokenToLookup) || untrustedContext.untrustedTokens.has(flagToLookup))) {
         detected.add(token2);
-        continue;
+        if (token2.includes("=") || !isHighRiskFlag) {
+          continue;
+        }
       }
-      if (valToCheck && untrustedContext.untrustedTokens.has(valToCheck)) {
-        detected.add(token2);
-        continue;
+      if (valToCheck && rawValToCheck) {
+        const isValUntrusted = untrustedContext.untrustedTokens.has(valToCheck) && (isHighRiskFlag || !isSafeFlag && isHighRiskPatternToken(rawValToCheck));
+        const isHighRiskValSubstring = (!isSafeFlag || isHighRiskFlag) && isHighRiskPatternToken(rawValToCheck) && hasUntrustedSubstring(untrustedContext, valToCheck);
+        if (isValUntrusted || isHighRiskValSubstring) {
+          detected.add(token2);
+          continue;
+        }
       }
-      const nextToken = rawTokens[i3 + 1];
-      if (nextToken && !nextToken.startsWith("-") && untrustedContext.untrustedTokens.has(nextToken.toLowerCase())) {
-        detected.add(token2);
-        detected.add(nextToken);
+      if (!token2.includes("=") && isHighRiskFlag) {
+        const nextToken = rawTokens[i3 + 1];
+        if (nextToken && !nextToken.startsWith("-") && !BARE_SHELL_VARIABLE_REGEX.test(nextToken) && !BENIGN_SUBCOMMAND_TOKENS.has(nextToken.toLowerCase()) && (untrustedContext.untrustedTokens.has(nextToken.toLowerCase()) || isHighRiskPatternToken(nextToken) && hasUntrustedSubstring(untrustedContext, nextToken))) {
+          detected.add(token2);
+          detected.add(nextToken);
+        }
       }
     } else {
-      if (token2.length <= 1) {
+      if (token2.length <= 1 || BARE_SHELL_VARIABLE_REGEX.test(token2)) {
         continue;
       }
-      const isSensitiveWord = token2.includes("/") || token2.includes(".") || token2.includes(":");
-      const isHighRiskPattern = token2.startsWith("http://") || token2.startsWith("https://") || token2.startsWith("/") || token2.startsWith("\\") || /^[a-zA-Z]:[\\/]/.test(token2);
-      if (isSensitiveWord) {
+      if (isHighRiskPatternToken(token2)) {
         if (untrustedContext.untrustedTokens.has(lowerToken)) {
           detected.add(token2);
           continue;
         }
-        if (isHighRiskPattern) {
-          const normalizedLowerToken = lowerToken.replace(/\\/g, "/");
-          for (const text of untrustedContext.untrustedTexts) {
-            if (text.toLowerCase().includes(normalizedLowerToken)) {
-              detected.add(token2);
-              break;
-            }
-          }
+        if (hasUntrustedSubstring(untrustedContext, lowerToken)) {
+          detected.add(token2);
         }
       }
     }
@@ -332836,6 +332968,9 @@ function scrubPart(part) {
     if (part.functionResponse.id) {
       scrubbedResp["id"] = part.functionResponse.id;
     }
+    if ("parts" in part.functionResponse && Array.isArray(part.functionResponse.parts)) {
+      scrubbedResp["parts"] = part.functionResponse.parts.map(scrubPart);
+    }
     scrubbed["functionResponse"] = scrubbedResp;
   }
   if ("fileData" in part) {
@@ -332866,6 +333001,8 @@ var MID_STREAM_RETRY_OPTIONS = {
 };
 var SYNTHETIC_THOUGHT_SIGNATURE2 = "skip_thought_signature_validator";
 var INTERRUPTED_RESPONSE_PLACEHOLDER = "[The previous response was interrupted before it completed.]";
+var INTERRUPTED_TOOL_RESPONSE_ERROR = "Response was lost or interrupted.";
+var CONTINUE_PROMPT_TEXT = "Please continue.";
 function isIndexedPart(part) {
   return "callIndex" in part;
 }
@@ -333107,6 +333244,7 @@ var GeminiChat = class {
     let userContent = createUserContent(message);
     const isOriginalFunctionResponse = isFunctionResponse(userContent);
     if (!isOriginalFunctionResponse) {
+      this.closeUnansweredToolCallsTurn();
       this.closeUnansweredToolResponseTurn();
     }
     const { model } = this.context.config.modelConfigService.getResolvedConfig(modelConfigKey);
@@ -333133,7 +333271,7 @@ var GeminiChat = class {
       } else {
         const history = this.agentHistory.get();
         const lastTurn = history[history.length - 1];
-        if (!lastTurn || partListUnionToString(lastTurn.content.parts || []) !== userMessageContent) {
+        if (!lastTurn || lastTurn.content.role !== "user" || partListUnionToString(lastTurn.content.parts || []) !== userMessageContent) {
           const id = this.chatRecordingService.recordMessage({
             model,
             type: "user",
@@ -333181,11 +333319,12 @@ var GeminiChat = class {
       } else {
         const history = this.agentHistory.get();
         const lastTurn = history[history.length - 1];
-        if (!lastTurn || partListUnionToString(lastTurn.content.parts || []) !== partListUnionToString(userContent.parts || [])) {
+        if (!lastTurn || lastTurn.content.role !== "user" || partListUnionToString(lastTurn.content.parts || []) !== partListUnionToString(userContent.parts || [])) {
           this.agentHistory.push({ id, content: userContent });
         }
       }
     }
+    this.replaceEmptyTrailingUserTurn();
     const requestHistory = this.getHistoryTurns(true);
     const streamWithRetries = async function* () {
       let isSuccess = false;
@@ -333297,23 +333436,77 @@ var GeminiChat = class {
     return streamWithRetries.call(this);
   }
   /**
-   * Appends a closing model turn when history ends with an unanswered tool
-   * response, so the next user message stays a turn of its own.
+   * Appends a dedicated synthetic user turn with matching functionResponse
+   * parts when history ends with an unclosed model functionCall. The
+   * subsequent user prompt is then recorded as a clean turn of its own (after
+   * `closeUnansweredToolResponseTurn` adds the closing model turn).
    */
-  closeUnansweredToolResponseTurn() {
+  closeUnansweredToolCallsTurn() {
     const turns = this.agentHistory.get();
     const last2 = turns[turns.length - 1];
-    if (last2?.content.role !== "user" || !last2.content.parts?.some((part) => !!part.functionResponse)) {
+    if (last2?.content.role !== "model") {
       return;
     }
+    const missingResponses = buildInterruptedToolResponseParts(last2.content.parts ?? []);
+    if (missingResponses.length === 0) {
+      return;
+    }
+    const id = this.chatRecordingService.recordSyntheticMessage("user", missingResponses);
     this.agentHistory.push({
-      id: randomUUID6(),
-      content: {
-        role: "model",
-        parts: [{ text: INTERRUPTED_RESPONSE_PLACEHOLDER }]
-      }
+      id,
+      content: { role: "user", parts: missingResponses }
     });
   }
+  /**
+   * Replaces the parts of a trailing user turn that carries no content (e.g.
+   * only empty text parts) with a continuation prompt, keeping the in-memory
+   * history and the session log in sync. Runs once per send so that the
+   * persisted history never keeps an empty user turn between model turns.
+   */
+  replaceEmptyTrailingUserTurn() {
+    const turns = this.agentHistory.get();
+    const last2 = turns[turns.length - 1];
+    if (last2?.content.role !== "user" || hasNonEmptyParts(last2.content)) {
+      return;
+    }
+    this.agentHistory.set([
+      ...turns.slice(0, -1),
+      {
+        id: last2.id,
+        content: { ...last2.content, parts: [{ text: CONTINUE_PROMPT_TEXT }] }
+      }
+    ]);
+    this.chatRecordingService.updateMessagesFromHistory(this.agentHistory.get());
+  }
+  /**
+   * Appends a closing model turn when history ends with an unanswered tool
+   * response, so the next user message stays a turn of its own.
+   */
+  closeUnansweredToolResponseTurn() {
+    const turns = this.agentHistory.get();
+    let targetTurn = turns[turns.length - 1];
+    let hadEmptyTrailingModelTurn = false;
+    if (targetTurn?.content.role === "model" && (!targetTurn.content.parts || targetTurn.content.parts.length === 0)) {
+      hadEmptyTrailingModelTurn = true;
+      targetTurn = turns[turns.length - 2];
+    }
+    if (targetTurn?.content.role !== "user" || !targetTurn.content.parts?.some((part) => !!part.functionResponse)) {
+      return;
+    }
+    if (hadEmptyTrailingModelTurn) {
+      const lastTurn = turns[turns.length - 1];
+      lastTurn.content.parts = [{ text: INTERRUPTED_RESPONSE_PLACEHOLDER }];
+      this.chatRecordingService.updateMessagesFromHistory(turns);
+    } else {
+      this.agentHistory.push({
+        id: randomUUID6(),
+        content: {
+          role: "model",
+          parts: [{ text: INTERRUPTED_RESPONSE_PLACEHOLDER }]
+        }
+      });
+    }
+  }
   extractBinaryInjections(parts2) {
     const binaryParts = [];
     if (parts2) {
@@ -333430,10 +333623,14 @@ var GeminiChat = class {
       if (this.onModelChanged) {
         this.tools = await this.onModelChanged(modelToUse);
       }
+      const normalizedContents = ensureTerminalUserTurn(contentsToUse);
+      if (normalizedContents !== contentsToUse) {
+        debugLogger.warn("Final contents do not end with a valid user turn. Normalizing contents to satisfy Gemini API invariant.");
+      }
       lastModelToUse = modelToUse;
       lastConfig = config2;
-      lastContentsToUse = contentsToUse;
-      const finalContents = stripToolCallIdPrefixes(contentsToUse);
+      lastContentsToUse = normalizedContents;
+      const finalContents = stripToolCallIdPrefixes(normalizedContents);
       return this.context.config.getContentGenerator().generateContentStream({
         model: modelToUse,
         contents: finalContents,
@@ -333531,6 +333728,25 @@ var GeminiChat = class {
     }
     ensureStableToolIds(this.agentHistory.get());
   }
+  /**
+   * Removes the trailing model turn when it holds function calls that were
+   * never answered (e.g. every call in the batch was declined). Earlier
+   * completed tool rounds and the originating user prompt are kept, and the
+   * durable IDs of the remaining turns are preserved.
+   *
+   * @returns true when a turn was removed.
+   */
+  discardTrailingUnansweredToolCallTurn() {
+    const turns = this.agentHistory.get();
+    const last2 = turns[turns.length - 1];
+    if (last2?.content.role !== "model" || !last2.content.parts?.some((part) => !!part.functionCall)) {
+      return false;
+    }
+    this.agentHistory.rollback(turns.length - 1);
+    this.lastPromptTokenCount = estimateTokenCountSync(this.agentHistory.flatMap((c4) => c4.content.parts || []));
+    this.chatRecordingService.updateMessagesFromHistory(this.agentHistory.get());
+    return true;
+  }
   setHistory(history) {
     const wrappedHistory = history.map((item) => {
       if ("id" in item && "content" in item) {
@@ -333884,8 +334100,41 @@ function isSchemaDepthError(errorMessage) {
 function isInvalidArgumentError(errorMessage) {
   return errorMessage.includes("Request contains an invalid argument");
 }
+function isEmptyTextPart(part) {
+  if (part.text !== "") {
+    return false;
+  }
+  return !Object.keys(part).some((key) => key !== "text" && key !== "thought" && key !== "callIndex");
+}
+function hasNonEmptyParts(content) {
+  return (content.parts ?? []).some((part) => !isEmptyTextPart(part));
+}
+function buildInterruptedToolResponseParts(parts2) {
+  return parts2.filter((part) => !!part?.functionCall).map((part) => ({
+    functionResponse: {
+      name: part.functionCall.name?.trim() || "generic_tool",
+      id: part.functionCall.id,
+      response: { error: INTERRUPTED_TOOL_RESPONSE_ERROR }
+    }
+  }));
+}
+function ensureTerminalUserTurn(contents) {
+  const last2 = contents.at(-1);
+  if (last2?.role === "user" && hasNonEmptyParts(last2)) {
+    return contents;
+  }
+  if (last2?.role === "user") {
+    return [
+      ...contents.slice(0, -1),
+      { ...last2, parts: [{ text: CONTINUE_PROMPT_TEXT }] }
+    ];
+  }
+  const missingResponses = buildInterruptedToolResponseParts(last2?.parts ?? []);
+  const parts2 = missingResponses.length > 0 ? missingResponses : [{ text: CONTINUE_PROMPT_TEXT }];
+  return [...contents, { role: "user", parts: parts2 }];
+}
 function stripToolCallIdPrefixes(contents) {
-  return contents.map((content) => {
+  const stripped = contents.map((content) => {
     const parts2 = (content.parts || []).map((part) => {
       const newPart = { ...part };
       if (newPart.functionCall) {
@@ -333893,8 +334142,7 @@ function stripToolCallIdPrefixes(contents) {
         const name3 = fc.name?.trim() || "generic_tool";
         if (fc.id && fc.id.startsWith(`${name3}__`)) {
           newPart.functionCall = {
-            name: fc.name,
-            args: fc.args,
+            ...fc,
             id: fc.id.substring(name3.length + 2)
           };
         }
@@ -333904,8 +334152,9 @@ function stripToolCallIdPrefixes(contents) {
         const name3 = fr.name?.trim() || "generic_tool";
         if (fr.id && fr.id.startsWith(`${name3}__`)) {
           newPart.functionResponse = {
-            name: fr.name,
-            response: fr.response,
+            // History parts are plain JSON objects, not class instances.
+            // eslint-disable-next-line @typescript-eslint/no-misused-spread
+            ...fr,
             id: fr.id.substring(name3.length + 2)
           };
         }
@@ -333915,18 +334164,30 @@ function stripToolCallIdPrefixes(contents) {
         delete newPart.text;
       }
       return newPart;
-    }).filter((part) => {
-      const hasOtherKeys = Object.keys(part).some((key) => key !== "text" && key !== "thought" && key !== "callIndex");
-      if (part.text !== void 0 && part.text === "" && !hasOtherKeys) {
-        return false;
-      }
-      return true;
-    });
+    }).filter((part) => !isEmptyTextPart(part));
     return {
       ...content,
       parts: parts2
     };
-  });
+  }).filter((content) => content.parts.length > 0);
+  return coalesceConsecutiveContents(stripped);
+}
+function coalesceConsecutiveContents(contents) {
+  const result2 = [];
+  for (const item of contents) {
+    const lastIdx = result2.length - 1;
+    const last2 = result2[lastIdx];
+    if (last2 && last2.role && last2.role === item.role) {
+      const hasParts = last2.parts || item.parts;
+      result2[lastIdx] = {
+        ...last2,
+        parts: hasParts ? [...last2.parts || [], ...item.parts || []] : void 0
+      };
+    } else {
+      result2.push({ ...item });
+    }
+  }
+  return result2;
 }
 function coalesceConsecutiveRoles(history) {
   const result2 = [];
@@ -341235,7 +341496,13 @@ var OAuthUtils = class {
       issuer: metadata2.issuer,
       tokenUrl: metadata2.token_endpoint,
       scopes: metadata2.scopes_supported || [],
-      registrationUrl: metadata2.registration_endpoint
+      registrationUrl: metadata2.registration_endpoint,
+      // RFC 9207 Section 3: the flag defaults to false when omitted. Discovered
+      // configurations therefore always carry an explicit boolean, which lets
+      // the callback policy distinguish them from an explicitly configured issuer.
+      // Only a literal boolean `true` enables the flag, so loosely typed values
+      // returned by some servers (e.g. "false" or "0") are not coerced to true.
+      authorizationResponseIssParameterSupported: metadata2.authorization_response_iss_parameter_supported === true
     };
   }
   /**
@@ -341559,7 +341826,7 @@ var A2AAuthProviderFactory = class _A2AAuthProviderFactory {
         return provider;
       }
       case "oauth2": {
-        const { OAuth2AuthProvider } = await import("./oauth2-provider-FVTRRJZR.js");
+        const { OAuth2AuthProvider } = await import("./oauth2-provider-I3CU23H3.js");
         const provider = new OAuth2AuthProvider(authConfig, options.agentName ?? "unknown", agentCard, options.agentCardUrl);
         await provider.initialize();
         return provider;
@@ -347707,6 +347974,21 @@ var GeminiClient = class {
     this.updateTelemetryTokenCount();
     this.forceFullIdeContext = true;
   }
+  /**
+   * Removes the trailing model turn when it only holds unanswered function
+   * calls. See {@link GeminiChat.discardTrailingUnansweredToolCallTurn}.
+   * Returns false without side effects when the chat is not initialized.
+   */
+  discardTrailingUnansweredToolCallTurn() {
+    if (!this.isInitialized()) {
+      return false;
+    }
+    const removed = this.getChat().discardTrailingUnansweredToolCallTurn();
+    if (removed) {
+      this.updateTelemetryTokenCount();
+    }
+    return removed;
+  }
   lastUsedModelId;
   async setTools(modelId) {
     if (!this.chat) {
@@ -363984,7 +364266,7 @@ var PolicyEngine = class {
     }
     return decision;
   }
-  async checkShellCommand(toolName, command, ruleDecision, serverName, dir_path, allowRedirection, rule, toolAnnotations, subagent) {
+  async checkShellCommand(toolName, command, ruleDecision, serverName, dir_path, allowRedirection, rule, toolAnnotations, subagent, hasTopLevelHeuristicDowngrade = false) {
     if (!command) {
       return {
         decision: ruleDecision,
@@ -364020,13 +364302,17 @@ var PolicyEngine = class {
     }
     let aggregateDecision = ruleDecision;
     let responsibleRule = rule && ruleDecision === rule.decision ? rule : void 0;
-    if (this.shouldDowngradeForRedirection(command, allowRedirection, rule)) {
+    const hasTopLevelRedirectionDowngrade = this.shouldDowngradeForRedirection(command, allowRedirection, rule);
+    if (hasTopLevelRedirectionDowngrade) {
       if (aggregateDecision === PolicyDecision.ALLOW) {
         debugLogger.debug(`[PolicyEngine.check] Downgrading ALLOW to ASK_USER for redirected command: ${command}`);
         aggregateDecision = PolicyDecision.ASK_USER;
         responsibleRule = void 0;
       }
     }
+    let evaluatedSubCommands = 0;
+    let allSubCommandsExplicitlyAllowed = true;
+    let lastAllowedSubRule;
     for (const detail of subCommands) {
       if (REDIRECTION_NAMES.has(detail.name)) {
         continue;
@@ -364035,23 +364321,31 @@ var PolicyEngine = class {
       const isAtomic = subCmd === command || detail.startIndex === 0 && detail.text.length === command.length;
       const stripped = stripShellWrapper(subCmd);
       if (stripped !== subCmd) {
+        evaluatedSubCommands++;
         const wrapperResult = await this.check({ name: toolName, args: { command: stripped, dir_path } }, serverName, toolAnnotations, subagent, true);
         if (wrapperResult.decision === PolicyDecision.DENY)
           return wrapperResult;
         if (wrapperResult.decision === PolicyDecision.ASK_USER) {
+          allSubCommandsExplicitlyAllowed = false;
           if (aggregateDecision === PolicyDecision.ALLOW) {
             responsibleRule = wrapperResult.rule;
           } else {
             responsibleRule ??= wrapperResult.rule;
           }
           aggregateDecision = PolicyDecision.ASK_USER;
+        } else if (wrapperResult.decision === PolicyDecision.ALLOW && wrapperResult.rule?.decision === PolicyDecision.ALLOW && Boolean(wrapperResult.rule?.argsPattern)) {
+          lastAllowedSubRule = wrapperResult.rule;
+        } else {
+          allSubCommandsExplicitlyAllowed = false;
         }
       }
       if (!isAtomic) {
+        evaluatedSubCommands++;
         const subResult = await this.check({ name: toolName, args: { command: subCmd, dir_path } }, serverName, toolAnnotations, subagent, true);
         if (subResult.decision === PolicyDecision.DENY)
           return subResult;
         if (subResult.decision === PolicyDecision.ASK_USER) {
+          allSubCommandsExplicitlyAllowed = false;
           if (aggregateDecision === PolicyDecision.ALLOW) {
             responsibleRule = subResult.rule;
           } else {
@@ -364060,13 +364354,31 @@ var PolicyEngine = class {
           aggregateDecision = PolicyDecision.ASK_USER;
         }
         if (subResult.decision === PolicyDecision.ALLOW && this.shouldDowngradeForRedirection(subCmd, subResult.rule?.allowRedirection ?? allowRedirection, subResult.rule)) {
+          allSubCommandsExplicitlyAllowed = false;
           if (aggregateDecision === PolicyDecision.ALLOW) {
             aggregateDecision = PolicyDecision.ASK_USER;
             responsibleRule = void 0;
           }
+        } else if (subResult.decision === PolicyDecision.ALLOW && subResult.rule?.decision === PolicyDecision.ALLOW && Boolean(subResult.rule?.argsPattern)) {
+          lastAllowedSubRule = subResult.rule;
+        } else {
+          allSubCommandsExplicitlyAllowed = false;
         }
+      } else if (stripped === subCmd) {
+        allSubCommandsExplicitlyAllowed = false;
       }
     }
+    const workspace = typeof this.sandboxManager.getWorkspace === "function" ? this.sandboxManager.getWorkspace() : process.cwd();
+    const effectiveCwd = dir_path ? path83.resolve(workspace, dir_path) : workspace;
+    const isOutsideWorkspace = effectiveCwd !== workspace && !isSubpath(workspace, effectiveCwd) && this.approvalMode !== ApprovalMode.YOLO;
+    const parsedObjArgs = (0, import_shell_quote7.parse)(command);
+    const parsedArgs = parsedObjArgs.map(extractStringFromParseEntry);
+    const isUntrustedGit = containsGitCommand(parsedArgs) && !this.isTrustedFolder();
+    const isDangerous = this.approvalMode !== ApprovalMode.YOLO && this.sandboxManager.isDangerousCommand(parsedArgs, effectiveCwd);
+    if (aggregateDecision === PolicyDecision.ASK_USER && !rule?.argsPattern && !hasTopLevelRedirectionDowngrade && !hasTopLevelHeuristicDowngrade && !isOutsideWorkspace && !isUntrustedGit && !isDangerous && evaluatedSubCommands > 0 && allSubCommandsExplicitlyAllowed) {
+      aggregateDecision = PolicyDecision.ALLOW;
+      responsibleRule = lastAllowedSubRule;
+    }
     return {
       decision: aggregateDecision,
       rule: aggregateDecision === ruleDecision ? rule : responsibleRule
@@ -364124,11 +364436,16 @@ var PolicyEngine = class {
       if (match2) {
         debugLogger.debug(`[PolicyEngine.check] MATCHED rule: toolName=${rule.toolName}, decision=${rule.decision}, priority=${rule.priority}, argsPattern=${rule.argsPattern?.source || "none"}`);
         let ruleDecision = rule.decision;
+        let hasTopLevelHeuristicDowngrade = false;
         if (!skipHeuristics && isShellCommand && command && !("commandPrefix" in rule) && !rule.argsPattern) {
+          const prevDecision = ruleDecision;
           ruleDecision = await this.applyShellHeuristics(command, ruleDecision, shellDirPath);
+          if (prevDecision === PolicyDecision.ALLOW && ruleDecision === PolicyDecision.ASK_USER) {
+            hasTopLevelHeuristicDowngrade = true;
+          }
         }
         if (isShellCommand && toolName) {
-          const shellResult = await this.checkShellCommand(toolName, command, ruleDecision, serverName, shellDirPath, rule.allowRedirection, rule, toolAnnotations, subagent);
+          const shellResult = await this.checkShellCommand(toolName, command, ruleDecision, serverName, shellDirPath, rule.allowRedirection, rule, toolAnnotations, subagent, hasTopLevelHeuristicDowngrade);
           decision = shellResult.decision;
           matchedRule = shellResult.rule;
           break;
@@ -364147,10 +364464,15 @@ var PolicyEngine = class {
         debugLogger.debug(`[PolicyEngine.check] NO MATCH - using default decision: ${this.defaultDecision}`);
         if (toolName && SHELL_TOOL_NAMES.includes(toolName)) {
           let heuristicDecision = this.defaultDecision;
+          let hasTopLevelHeuristicDowngrade = false;
           if (!skipHeuristics && command) {
+            const prevDecision = heuristicDecision;
             heuristicDecision = await this.applyShellHeuristics(command, heuristicDecision, shellDirPath);
+            if (prevDecision === PolicyDecision.ALLOW && heuristicDecision === PolicyDecision.ASK_USER) {
+              hasTopLevelHeuristicDowngrade = true;
+            }
           }
-          const shellResult = await this.checkShellCommand(toolName, command, heuristicDecision, serverName, shellDirPath, false, void 0, toolAnnotations, subagent);
+          const shellResult = await this.checkShellCommand(toolName, command, heuristicDecision, serverName, shellDirPath, false, void 0, toolAnnotations, subagent, hasTopLevelHeuristicDowngrade);
           decision = shellResult.decision;
           matchedRule = shellResult.rule;
         } else {
@@ -369889,7 +370211,7 @@ function areIssuersEqual(issuerA, issuerB) {
   }
   return normA === normB;
 }
-function startCallbackServer(expectedState, port, expectedIssuer) {
+function startCallbackServer(expectedState, port, expectedIssuer, requireIssInResponse) {
   let portResolve;
   let portReject;
   const portPromise = new Promise((resolve29, reject) => {
@@ -369943,8 +370265,9 @@ function startCallbackServer(expectedState, port, expectedIssuer) {
           return;
         }
         if (expectedIssuer) {
-          if (!iss) {
-            debugLogger.error('OAuth callback rejected: Missing required "iss" parameter when an expected issuer is configured. Possible IdP mix-up attack (RFC 9207).');
+          const requireIss = requireIssInResponse ?? true;
+          if (requireIss && !iss) {
+            debugLogger.error('OAuth callback rejected: Missing required "iss" parameter for the expected authorization server (RFC 9207).');
             res.writeHead(400, { "Content-Type": "text/html" });
             res.end(`
                 <html>
@@ -369959,7 +370282,7 @@ function startCallbackServer(expectedState, port, expectedIssuer) {
             reject(new Error('Missing "iss" parameter in authorization response per RFC 9207'));
             return;
           }
-          if (!areIssuersEqual(iss, expectedIssuer)) {
+          if (iss && !areIssuersEqual(iss, expectedIssuer)) {
             debugLogger.error("OAuth callback rejected: Issuer mismatch between authorization response and expected authorization server. Possible IdP mix-up attack (RFC 9207).");
             res.writeHead(400, { "Content-Type": "text/html" });
             res.end(`
@@ -369975,7 +370298,9 @@ function startCallbackServer(expectedState, port, expectedIssuer) {
             reject(new Error("Issuer mismatch in authorization response - possible OAuth mix-up attack"));
             return;
           }
-          debugLogger.debug("\u2713 OAuth callback issuer validated successfully.");
+          if (iss) {
+            debugLogger.debug("\u2713 OAuth callback issuer validated successfully.");
+          }
         } else if (iss) {
           debugLogger.debug('OAuth callback received "iss" parameter (no expected issuer was configured).');
         }
@@ -370379,6 +370704,7 @@ var MCPOAuthProvider = class {
                 issuer: discoveredConfig.issuer,
                 tokenUrl: discoveredConfig.tokenUrl,
                 scopes: config2.scopes || discoveredConfig.scopes || [],
+                authorizationResponseIssParameterSupported: config2.authorizationResponseIssParameterSupported ?? discoveredConfig.authorizationResponseIssParameterSupported,
                 // Preserve existing client credentials
                 clientId: config2.clientId,
                 clientSecret: config2.clientSecret
@@ -370402,6 +370728,7 @@ var MCPOAuthProvider = class {
             issuer: discoveredConfig.issuer,
             scopes: config2.scopes || discoveredConfig.scopes || [],
             registrationUrl: discoveredConfig.registrationUrl,
+            authorizationResponseIssParameterSupported: config2.authorizationResponseIssParameterSupported ?? discoveredConfig.authorizationResponseIssParameterSupported,
             // Preserve existing client credentials
             clientId: config2.clientId,
             clientSecret: config2.clientSecret
@@ -370414,7 +370741,8 @@ var MCPOAuthProvider = class {
     const pkceParams = generatePKCEParams();
     const preferredPort = getPortFromUrl(config2.redirectUri);
     debugLogger.debug(`Starting callback server for "${serverName}" (expected issuer: ${config2.issuer || "none"})...`);
-    const callbackServer = startCallbackServer(pkceParams.state, preferredPort, config2.issuer);
+    const requireIssInResponse = config2.authorizationResponseIssParameterSupported ?? Boolean(config2.issuer);
+    const callbackServer = startCallbackServer(pkceParams.state, preferredPort, config2.issuer, requireIssInResponse);
     const redirectPort = await callbackServer.port;
     debugLogger.debug(`Callback server listening on port ${redirectPort}`);
     if (!config2.clientId) {
@@ -371163,7 +371491,8 @@ async function handleAutomaticOAuth(mcpServerName, mcpServerConfig, wwwAuthentic
       authorizationUrl: oauthConfig.authorizationUrl,
       issuer: oauthConfig.issuer,
       tokenUrl: oauthConfig.tokenUrl,
-      scopes: oauthConfig.scopes || []
+      scopes: oauthConfig.scopes || [],
+      authorizationResponseIssParameterSupported: mcpServerConfig.oauth?.authorizationResponseIssParameterSupported ?? oauthConfig.authorizationResponseIssParameterSupported
     };
     debugLogger.log(`Starting OAuth authentication for server '${mcpServerName}'...`);
     const authProvider = new MCPOAuthProvider(new MCPOAuthTokenStorage());
@@ -371707,7 +372036,8 @@ async function connectToMcpServer(clientVersion, mcpServerName, mcpServerConfig,
               authorizationUrl: oauthConfig.authorizationUrl,
               issuer: oauthConfig.issuer,
               tokenUrl: oauthConfig.tokenUrl,
-              scopes: oauthConfig.scopes || []
+              scopes: oauthConfig.scopes || [],
+              authorizationResponseIssParameterSupported: mcpServerConfig.oauth?.authorizationResponseIssParameterSupported ?? oauthConfig.authorizationResponseIssParameterSupported
             };
             const authServerUrl = mcpServerConfig.httpUrl || mcpServerConfig.url;
             debugLogger.log(`Starting OAuth authentication for server '${mcpServerName}'...`);
@@ -400210,6 +400540,8 @@ export {
   StreamEventType,
   SYNTHETIC_THOUGHT_SIGNATURE2 as SYNTHETIC_THOUGHT_SIGNATURE,
   INTERRUPTED_RESPONSE_PLACEHOLDER,
+  INTERRUPTED_TOOL_RESPONSE_ERROR,
+  CONTINUE_PROMPT_TEXT,
   isValidNonThoughtTextPart,
   THINKING_ONLY_NUDGE_MESSAGE,
   NO_RESPONSE_TEXT_NUDGE_MESSAGE,
@@ -400220,7 +400552,10 @@ export {
   GeminiChat,
   isSchemaDepthError,
   isInvalidArgumentError,
+  buildInterruptedToolResponseParts,
+  ensureTerminalUserTurn,
   stripToolCallIdPrefixes,
+  coalesceConsecutiveContents,
   coalesceConsecutiveRoles,
   stripThoughts2 as stripThoughts,
   populateToolDisplay,