@google/gemini-cli 0.67.0-preview.0 → 0.68.0-preview.0

package/bundle/docs/cli/themes.md

@@ -97,7 +97,6 @@ nested configuration objects. For example:
   - `diff.removed`: Background for removed lines in diffs.
 - **`border`**: Defines border colors.
   - `default`: The standard border color.
-  - `focused`: Border color when an element is focused.
 - **`status`**: Colors for status indicators.
   - `success`: Used for successful operations.
   - `warning`: Used for warnings.
@@ -105,6 +104,9 @@ nested configuration objects. For example:
 - **`ui`**: Other UI elements.
   - `comment`: Color for code comments.
   - `symbol`: Color for code symbols and operators.
+  - `active`: Border and text color for active or running elements.
+  - `focus`: Color for focused elements, such as selected menu items and focused
+    borders.
   - `gradient`: An array of colors used for gradient effects.
 
 **Required properties:**
@@ -166,8 +168,7 @@ custom theme defined in `settings.json`.
     "accent": "#d3869b"
   },
   "border": {
-    "default": "#3c3836",
-    "focused": "#458588"
+    "default": "#3c3836"
   },
   "status": {
     "success": "#b8bb26",
@@ -177,6 +178,8 @@ custom theme defined in `settings.json`.
   "ui": {
     "comment": "#928374",
     "symbol": "#8ec07c",
+    "active": "#83a598",
+    "focus": "#b8bb26",
     "gradient": ["#cc241d", "#d65d0e", "#d79921"]
   }
 }

package/bundle/docs/extensions/releasing.md

@@ -29,6 +29,38 @@ To have your extension automatically discovered and listed:
 Our system crawls tagged repositories daily. Once you tag your repository, your
 extension will appear in the gallery if it passes validation.
 
+### Troubleshooting gallery indexing
+
+If your extension doesn't appear in the gallery after 24 to 48 hours despite
+meeting the listing requirements, GitHub Code Search may not have indexed your
+repository's manifest file yet.
+
+The gallery crawler relies on GitHub Code Search to discover
+`gemini-extension.json` files across public repositories. Newly created or
+recently pushed repositories are often indexed lazily by GitHub.
+
+To check whether GitHub has indexed your repository's manifest, run the
+following command using the GitHub CLI:
+
+```bash
+gh api 'search/code?q=repo:<owner>/<repo>+filename:gemini-extension.json' --jq .total_count
+```
+
+If the count is `0`, or if you don't use the GitHub CLI, trigger indexing
+manually in your web browser:
+
+1.  Sign in to GitHub.
+2.  Navigate to
+    `https://github.com/search?q=repo%3A<owner>%2F<repo>+gemini-extension.json&type=code`
+    (replace `<owner>/<repo>` with your repository path).
+3.  If GitHub displays "This repository's code is being indexed right now", wait
+    15 to 30 minutes for indexing to finish.
+4.  Re-run the search until `gemini-extension.json` appears in the search
+    results.
+
+Once GitHub indexes the manifest file, the crawler will discover and index your
+extension during its next scheduled cycle.
+
 ## Release through a Git repository
 
 Releasing through Git is the most flexible option. Create a public Git

package/bundle/docs/reference/configuration.md

@@ -1056,7 +1056,7 @@ their corresponding top-level category object in your `settings.json` file.
       "auto": {
         "displayName": "Auto",
         "tier": "auto",
-        "isPreview": true,
+        "isPreview": false,
         "isVisible": true,
         "features": {
           "thinking": true,
@@ -1191,15 +1191,7 @@ their corresponding top-level category object in your `settings.json` file.
         ]
       },
       "gemini-2.5-flash": {
-        "default": "gemini-2.5-flash",
-        "contexts": [
-          {
-            "condition": {
-              "useLatestFlash": true
-            },
-            "target": "gemini-3.8-flash"
-          }
-        ]
+        "default": "gemini-2.5-flash"
       },
       "gemini-3-pro-preview": {
         "default": "gemini-3-pro-preview",

package/bundle/{gemini-K3EMSEQ5.js → gemini-2P73372G.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   startCommand,
   startServer
-} from "./chunk-RNBD6XQX.js";
+} from "./chunk-YPPJDFYP.js";
 import {
   BuiltinCommandLoader,
   CommandService,
@@ -45,11 +45,11 @@ import {
   updateExtension,
   validateAuthMethod,
   validateContextFilePath
-} from "./chunk-76P7AV5J.js";
+} from "./chunk-G7EMTV2Q.js";
 import {
   exitCli,
   require_source
-} from "./chunk-SJ64DOGM.js";
+} from "./chunk-ODU7Z2RJ.js";
 import {
   appEvents
 } from "./chunk-5PS3AYFU.js";
@@ -89,12 +89,12 @@ import {
   saveModelChange,
   setAmbiguousCharactersWide,
   stripAnsi
-} from "./chunk-2BG2OMW3.js";
+} from "./chunk-VCO4TMD6.js";
 import {
   RELAUNCH_EXIT_CODE,
   require_semver
-} from "./chunk-6HF2HP2S.js";
-import "./chunk-4HG5TEPY.js";
+} from "./chunk-KKKD4FID.js";
+import "./chunk-44PCK4QK.js";
 import {
   cleanupCheckpoints,
   registerCleanup,
@@ -103,7 +103,7 @@ import {
   runExitCleanup,
   runSyncCleanup,
   setupSignalHandlers
-} from "./chunk-THOV46FY.js";
+} from "./chunk-WEP47ZZU.js";
 import {
   ASK_USER_TOOL_NAME,
   AjvJsonSchemaValidator,
@@ -289,7 +289,7 @@ import {
   updatePolicy,
   writeToStderr,
   writeToStdout
-} from "./chunk-5FYAQBC3.js";
+} from "./chunk-L57AYV6U.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";
@@ -6512,6 +6512,57 @@ async function validateExtension(args) {
       `Warning: Version '${extensionConfig.version}' does not appear to be standard semver (e.g., 1.0.0).`
     );
   }
+  if (extensionConfig.mcpServers) {
+    if (typeof extensionConfig.mcpServers !== "object" || extensionConfig.mcpServers === null || Array.isArray(extensionConfig.mcpServers)) {
+      errors.push('The "mcpServers" field must be an object.');
+    } else {
+      for (const [serverName, serverConfig] of Object.entries(
+        extensionConfig.mcpServers
+      )) {
+        if (typeof serverConfig !== "object" || serverConfig === null || Array.isArray(serverConfig)) {
+          errors.push(
+            `MCP server configuration for "${serverName}" must be an object.`
+          );
+          continue;
+        }
+        const hasCommand = typeof serverConfig.command === "string" && serverConfig.command.trim().length > 0;
+        const hasUrl = typeof serverConfig.url === "string" && serverConfig.url.trim().length > 0;
+        const hasHttpUrl = typeof serverConfig.httpUrl === "string" && serverConfig.httpUrl.trim().length > 0;
+        const hasTcp = typeof serverConfig.tcp === "string" && serverConfig.tcp.trim().length > 0 || typeof serverConfig.tcp === "number";
+        if (!hasCommand && !hasUrl && !hasHttpUrl && !hasTcp) {
+          errors.push(
+            `MCP server "${serverName}" must specify a transport (e.g., "command", "url", or "httpUrl").`
+          );
+        }
+        if (hasHttpUrl) {
+          warnings.push(
+            `MCP server "${serverName}" uses deprecated "httpUrl". Consider using "url" with "type": "http" instead.`
+          );
+        }
+        const errorPrefix = `MCP server "${serverName}" specifies an invalid `;
+        if (hasUrl && serverConfig.url) {
+          const hasPlaceholder = serverConfig.url.includes("$");
+          if (!hasPlaceholder) {
+            try {
+              new URL(serverConfig.url);
+            } catch {
+              errors.push(`${errorPrefix}URL: "${serverConfig.url}".`);
+            }
+          }
+        }
+        if (hasHttpUrl && serverConfig.httpUrl) {
+          const hasPlaceholder = serverConfig.httpUrl.includes("$");
+          if (!hasPlaceholder) {
+            try {
+              new URL(serverConfig.httpUrl);
+            } catch {
+              errors.push(`${errorPrefix}httpUrl: "${serverConfig.httpUrl}".`);
+            }
+          }
+        }
+      }
+    }
+  }
   if (warnings.length > 0) {
     debugLogger.warn("Validation warnings:");
     for (const warning of warnings) {
@@ -6956,8 +7007,10 @@ var EVENT_MAPPING = {
   PostToolUse: "AfterTool",
   UserPromptSubmit: "BeforeAgent",
   Stop: "AfterAgent",
-  SubAgentStop: "AfterAgent",
+  SubagentStop: "AfterAgent",
   // Gemini doesn't have sub-agents, map to AfterAgent
+  SubAgentStop: "AfterAgent",
+  // Fallback for alternate casing
   SessionStart: "SessionStart",
   SessionEnd: "SessionEnd",
   PreCompact: "PreCompress",
@@ -7045,7 +7098,10 @@ function migrateClaudeHooks(claudeConfig) {
       }
       return migratedDef;
     });
-    geminiHooks[geminiEventName] = migratedDefinitions;
+    geminiHooks[geminiEventName] = [
+      ...geminiHooks[geminiEventName] || [],
+      ...migratedDefinitions
+    ];
   }
   return geminiHooks;
 }
@@ -8324,7 +8380,7 @@ async function loadSandboxConfig(settings, argv) {
   }
   const command2 = getSandboxCommand(sandboxValue);
   const packageJson = await getPackageJson(__dirname3);
-  const image = process.env["GEMINI_SANDBOX_IMAGE"] ?? "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.67.0-preview.0" ?? customImage ?? packageJson?.config?.sandboxImageUri;
+  const image = process.env["GEMINI_SANDBOX_IMAGE"] ?? "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.68.0-preview.0" ?? customImage ?? packageJson?.config?.sandboxImageUri;
   const isNative = command2 === "windows-native" || command2 === "sandbox-exec" || command2 === "lxc";
   return command2 && (image || isNative) ? { enabled: true, allowedPaths, networkAccess, command: command2, image } : void 0;
 }
@@ -11392,6 +11448,45 @@ function isRecord3(value) {
 }
 var execAsync = promisify(exec);
 var execFileAsync = promisify(execFile);
+var PODMAN_INFO_TIMEOUT_MS = 5e3;
+async function isPodmanRootless() {
+  const formats = [
+    "{{.Host.Security.Rootless}}",
+    "{{.Host.ServiceIsRootless}}"
+  ];
+  for (const format3 of formats) {
+    try {
+      const { stdout } = await execFileAsync(
+        "podman",
+        ["info", "--format", format3],
+        {
+          encoding: "utf-8",
+          timeout: PODMAN_INFO_TIMEOUT_MS,
+          killSignal: "SIGKILL"
+        }
+      );
+      const trimmed = String(stdout ?? "").trim().toLowerCase();
+      if (trimmed === "true") {
+        return true;
+      }
+      if (trimmed === "false") {
+        return false;
+      }
+    } catch (err) {
+      const isMissingBinary = isNodeError(err) && err.code === "ENOENT";
+      const timedOut = isRecord3(err) && err["killed"] === true;
+      if (isMissingBinary || timedOut) {
+        break;
+      }
+    }
+  }
+  return false;
+}
+function hasUsernsFlag(flags) {
+  return flags.some(
+    (flag) => flag === "--userns" || flag.startsWith("--userns=")
+  );
+}
 async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
   const patcher = new ConsolePatcher({
     debugMode: cliConfig?.getDebugMode() || !!process.env["DEBUG"],
@@ -11730,12 +11825,10 @@ async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
     if (config.command === "runsc") {
       args.push("--runtime=runsc");
     }
-    if (process.env["SANDBOX_FLAGS"]) {
-      const flags = (0, import_shell_quote2.parse)(process.env["SANDBOX_FLAGS"], process.env).filter(
-        (f) => typeof f === "string"
-      );
-      args.push(...flags);
-    }
+    const customFlags = process.env["SANDBOX_FLAGS"] ? (0, import_shell_quote2.parse)(process.env["SANDBOX_FLAGS"], process.env).filter(
+      (f) => typeof f === "string"
+    ) : [];
+    args.push(...customFlags);
     if (process.stdin.isTTY) {
       args.push("-t");
     }
@@ -12048,6 +12141,9 @@ async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
       userFlag = "--user root";
     } else if (await shouldUseCurrentUserInSandbox()) {
       args.push("--user", "root");
+      if (command2 === "podman" && !hasUsernsFlag(customFlags) && await isPodmanRootless()) {
+        args.push("--userns=keep-id");
+      }
       const uid = (await execAsync("id -u")).stdout.trim();
       const gid = (await execAsync("id -g")).stdout.trim();
       const username = "gemini";
@@ -12952,7 +13048,7 @@ async function runNonInteractive({
       }
     });
     if (process.env["GEMINI_CLI_ACTIVITY_LOG_TARGET"]) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-ALST4BXH.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-V3OEHE5V.js");
       setupInitialActivityLogger(config);
     }
     const { stdout: workingStdout } = createWorkingStdio();
@@ -13480,7 +13576,7 @@ async function runNonInteractive2(params) {
       }
     });
     if (process.env["GEMINI_CLI_ACTIVITY_LOG_TARGET"]) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-ALST4BXH.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-V3OEHE5V.js");
       setupInitialActivityLogger(config);
     }
     const { stdout: workingStdout } = createWorkingStdio();
@@ -17730,9 +17826,11 @@ var AcpSessionManager = class {
           currentModelId
         }
       };
-      session.streamHistory(messages).catch((err) => {
+      try {
+        await session.streamHistory(messages);
+      } catch (err) {
         debugLogger.error(`Error streaming history: ${err}`);
-      });
+      }
       setTimeout(() => {
         session?.sendAvailableCommands().catch((err) => {
           debugLogger.error(`Error sending available commands: ${err}`);
@@ -18641,7 +18739,7 @@ async function resolveSessionId(resumeArg, sessionIdArg, sessionFileArg) {
   }
 }
 async function startInteractiveUI(config, settings, startupWarnings, workspaceRoot = process.cwd(), resumedSessionData, initializationResult) {
-  const { startInteractiveUI: doStartUI } = await import("./interactiveCli-3B2SSFOJ.js");
+  const { startInteractiveUI: doStartUI } = await import("./interactiveCli-F5RRE2VJ.js");
   await doStartUI(
     config,
     settings,
@@ -18866,7 +18964,7 @@ ${finalArgs[promptIndex + 1]}`;
     await config.storage.initialize();
     adminControlsListner.setConfig(config);
     if (config.isInteractive() && settings.merged.general.devtools) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-ALST4BXH.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-V3OEHE5V.js");
       setupInitialActivityLogger(config);
     }
     registerTelemetryConfig(config);
@@ -18925,7 +19023,7 @@ ${finalArgs[promptIndex + 1]}`;
     const initAppHandle = startupProfiler.start("initialize_app");
     const initializationResult = await initializeApp(config, settings);
     initAppHandle?.end();
-    import("./liteRtServerManager-M6NTFF5C.js").then(({ LiteRtServerManager }) => {
+    import("./liteRtServerManager-JTOIS4KU.js").then(({ LiteRtServerManager }) => {
       const mergedGemma = settings.merged.experimental?.gemmaModelRouter;
       if (!mergedGemma) return;
       const userGemma = settings.forScope("User" /* User */).settings.experimental?.gemmaModelRouter;

package/bundle/{gemini-MWKDIT7M.js → gemini-FSHMUCSM.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   startCommand,
   startServer
-} from "./chunk-FPCAOQBY.js";
+} from "./chunk-XPTXBYQQ.js";
 import {
   BuiltinCommandLoader,
   CommandService,
@@ -45,11 +45,11 @@ import {
   updateExtension,
   validateAuthMethod,
   validateContextFilePath
-} from "./chunk-BFZQO5OI.js";
+} from "./chunk-BKVNBJ5C.js";
 import {
   exitCli,
   require_source
-} from "./chunk-WTMW35TZ.js";
+} from "./chunk-XVNEFQR3.js";
 import {
   appEvents
 } from "./chunk-5PS3AYFU.js";
@@ -89,12 +89,12 @@ import {
   saveModelChange,
   setAmbiguousCharactersWide,
   stripAnsi
-} from "./chunk-QVUC4J7B.js";
+} from "./chunk-6A5BTTNC.js";
 import {
   RELAUNCH_EXIT_CODE,
   require_semver
-} from "./chunk-WANMK7VA.js";
-import "./chunk-SAQV5Q3G.js";
+} from "./chunk-LQDISFTJ.js";
+import "./chunk-ZEK4UYYW.js";
 import {
   cleanupCheckpoints,
   registerCleanup,
@@ -103,7 +103,7 @@ import {
   runExitCleanup,
   runSyncCleanup,
   setupSignalHandlers
-} from "./chunk-FYX6LSG6.js";
+} from "./chunk-OZOUOK43.js";
 import {
   ASK_USER_TOOL_NAME,
   AjvJsonSchemaValidator,
@@ -273,7 +273,7 @@ import {
   updatePolicy,
   writeToStderr,
   writeToStdout
-} from "./chunk-HWPQINPO.js";
+} from "./chunk-ZZOOHVBL.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";
@@ -6496,6 +6496,57 @@ async function validateExtension(args) {
       `Warning: Version '${extensionConfig.version}' does not appear to be standard semver (e.g., 1.0.0).`
     );
   }
+  if (extensionConfig.mcpServers) {
+    if (typeof extensionConfig.mcpServers !== "object" || extensionConfig.mcpServers === null || Array.isArray(extensionConfig.mcpServers)) {
+      errors.push('The "mcpServers" field must be an object.');
+    } else {
+      for (const [serverName, serverConfig] of Object.entries(
+        extensionConfig.mcpServers
+      )) {
+        if (typeof serverConfig !== "object" || serverConfig === null || Array.isArray(serverConfig)) {
+          errors.push(
+            `MCP server configuration for "${serverName}" must be an object.`
+          );
+          continue;
+        }
+        const hasCommand = typeof serverConfig.command === "string" && serverConfig.command.trim().length > 0;
+        const hasUrl = typeof serverConfig.url === "string" && serverConfig.url.trim().length > 0;
+        const hasHttpUrl = typeof serverConfig.httpUrl === "string" && serverConfig.httpUrl.trim().length > 0;
+        const hasTcp = typeof serverConfig.tcp === "string" && serverConfig.tcp.trim().length > 0 || typeof serverConfig.tcp === "number";
+        if (!hasCommand && !hasUrl && !hasHttpUrl && !hasTcp) {
+          errors.push(
+            `MCP server "${serverName}" must specify a transport (e.g., "command", "url", or "httpUrl").`
+          );
+        }
+        if (hasHttpUrl) {
+          warnings.push(
+            `MCP server "${serverName}" uses deprecated "httpUrl". Consider using "url" with "type": "http" instead.`
+          );
+        }
+        const errorPrefix = `MCP server "${serverName}" specifies an invalid `;
+        if (hasUrl && serverConfig.url) {
+          const hasPlaceholder = serverConfig.url.includes("$");
+          if (!hasPlaceholder) {
+            try {
+              new URL(serverConfig.url);
+            } catch {
+              errors.push(`${errorPrefix}URL: "${serverConfig.url}".`);
+            }
+          }
+        }
+        if (hasHttpUrl && serverConfig.httpUrl) {
+          const hasPlaceholder = serverConfig.httpUrl.includes("$");
+          if (!hasPlaceholder) {
+            try {
+              new URL(serverConfig.httpUrl);
+            } catch {
+              errors.push(`${errorPrefix}httpUrl: "${serverConfig.httpUrl}".`);
+            }
+          }
+        }
+      }
+    }
+  }
   if (warnings.length > 0) {
     debugLogger.warn("Validation warnings:");
     for (const warning of warnings) {
@@ -6940,8 +6991,10 @@ var EVENT_MAPPING = {
   PostToolUse: "AfterTool",
   UserPromptSubmit: "BeforeAgent",
   Stop: "AfterAgent",
-  SubAgentStop: "AfterAgent",
+  SubagentStop: "AfterAgent",
   // Gemini doesn't have sub-agents, map to AfterAgent
+  SubAgentStop: "AfterAgent",
+  // Fallback for alternate casing
   SessionStart: "SessionStart",
   SessionEnd: "SessionEnd",
   PreCompact: "PreCompress",
@@ -7029,7 +7082,10 @@ function migrateClaudeHooks(claudeConfig) {
       }
       return migratedDef;
     });
-    geminiHooks[geminiEventName] = migratedDefinitions;
+    geminiHooks[geminiEventName] = [
+      ...geminiHooks[geminiEventName] || [],
+      ...migratedDefinitions
+    ];
   }
   return geminiHooks;
 }
@@ -8308,7 +8364,7 @@ async function loadSandboxConfig(settings, argv) {
   }
   const command2 = getSandboxCommand(sandboxValue);
   const packageJson = await getPackageJson(__dirname3);
-  const image = process.env["GEMINI_SANDBOX_IMAGE"] ?? "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.67.0-preview.0" ?? customImage ?? packageJson?.config?.sandboxImageUri;
+  const image = process.env["GEMINI_SANDBOX_IMAGE"] ?? "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.68.0-preview.0" ?? customImage ?? packageJson?.config?.sandboxImageUri;
   const isNative = command2 === "windows-native" || command2 === "sandbox-exec" || command2 === "lxc";
   return command2 && (image || isNative) ? { enabled: true, allowedPaths, networkAccess, command: command2, image } : void 0;
 }
@@ -11376,6 +11432,45 @@ function isRecord3(value) {
 }
 var execAsync = promisify(exec);
 var execFileAsync = promisify(execFile);
+var PODMAN_INFO_TIMEOUT_MS = 5e3;
+async function isPodmanRootless() {
+  const formats = [
+    "{{.Host.Security.Rootless}}",
+    "{{.Host.ServiceIsRootless}}"
+  ];
+  for (const format3 of formats) {
+    try {
+      const { stdout } = await execFileAsync(
+        "podman",
+        ["info", "--format", format3],
+        {
+          encoding: "utf-8",
+          timeout: PODMAN_INFO_TIMEOUT_MS,
+          killSignal: "SIGKILL"
+        }
+      );
+      const trimmed = String(stdout ?? "").trim().toLowerCase();
+      if (trimmed === "true") {
+        return true;
+      }
+      if (trimmed === "false") {
+        return false;
+      }
+    } catch (err) {
+      const isMissingBinary = isNodeError(err) && err.code === "ENOENT";
+      const timedOut = isRecord3(err) && err["killed"] === true;
+      if (isMissingBinary || timedOut) {
+        break;
+      }
+    }
+  }
+  return false;
+}
+function hasUsernsFlag(flags) {
+  return flags.some(
+    (flag) => flag === "--userns" || flag.startsWith("--userns=")
+  );
+}
 async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
   const patcher = new ConsolePatcher({
     debugMode: cliConfig?.getDebugMode() || !!process.env["DEBUG"],
@@ -11714,12 +11809,10 @@ async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
     if (config.command === "runsc") {
       args.push("--runtime=runsc");
     }
-    if (process.env["SANDBOX_FLAGS"]) {
-      const flags = (0, import_shell_quote2.parse)(process.env["SANDBOX_FLAGS"], process.env).filter(
-        (f) => typeof f === "string"
-      );
-      args.push(...flags);
-    }
+    const customFlags = process.env["SANDBOX_FLAGS"] ? (0, import_shell_quote2.parse)(process.env["SANDBOX_FLAGS"], process.env).filter(
+      (f) => typeof f === "string"
+    ) : [];
+    args.push(...customFlags);
     if (process.stdin.isTTY) {
       args.push("-t");
     }
@@ -12032,6 +12125,9 @@ async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
       userFlag = "--user root";
     } else if (await shouldUseCurrentUserInSandbox()) {
       args.push("--user", "root");
+      if (command2 === "podman" && !hasUsernsFlag(customFlags) && await isPodmanRootless()) {
+        args.push("--userns=keep-id");
+      }
       const uid = (await execAsync("id -u")).stdout.trim();
       const gid = (await execAsync("id -g")).stdout.trim();
       const username = "gemini";
@@ -12936,7 +13032,7 @@ async function runNonInteractive({
       }
     });
     if (process.env["GEMINI_CLI_ACTIVITY_LOG_TARGET"]) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-GPRO4RRU.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-3G5ZA3JV.js");
       setupInitialActivityLogger(config);
     }
     const { stdout: workingStdout } = createWorkingStdio();
@@ -13464,7 +13560,7 @@ async function runNonInteractive2(params) {
       }
     });
     if (process.env["GEMINI_CLI_ACTIVITY_LOG_TARGET"]) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-GPRO4RRU.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-3G5ZA3JV.js");
       setupInitialActivityLogger(config);
     }
     const { stdout: workingStdout } = createWorkingStdio();
@@ -17714,9 +17810,11 @@ var AcpSessionManager = class {
           currentModelId
         }
       };
-      session.streamHistory(messages).catch((err) => {
+      try {
+        await session.streamHistory(messages);
+      } catch (err) {
         debugLogger.error(`Error streaming history: ${err}`);
-      });
+      }
       setTimeout(() => {
         session?.sendAvailableCommands().catch((err) => {
           debugLogger.error(`Error sending available commands: ${err}`);
@@ -18625,7 +18723,7 @@ async function resolveSessionId(resumeArg, sessionIdArg, sessionFileArg) {
   }
 }
 async function startInteractiveUI(config, settings, startupWarnings, workspaceRoot = process.cwd(), resumedSessionData, initializationResult) {
-  const { startInteractiveUI: doStartUI } = await import("./interactiveCli-QUIZ4FA2.js");
+  const { startInteractiveUI: doStartUI } = await import("./interactiveCli-I75IWUIA.js");
   await doStartUI(
     config,
     settings,
@@ -18850,7 +18948,7 @@ ${finalArgs[promptIndex + 1]}`;
     await config.storage.initialize();
     adminControlsListner.setConfig(config);
     if (config.isInteractive() && settings.merged.general.devtools) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-GPRO4RRU.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-3G5ZA3JV.js");
       setupInitialActivityLogger(config);
     }
     registerTelemetryConfig(config);
@@ -18909,7 +19007,7 @@ ${finalArgs[promptIndex + 1]}`;
     const initAppHandle = startupProfiler.start("initialize_app");
     const initializationResult = await initializeApp(config, settings);
     initAppHandle?.end();
-    import("./liteRtServerManager-AQUTLRTC.js").then(({ LiteRtServerManager }) => {
+    import("./liteRtServerManager-UVQ2I6NL.js").then(({ LiteRtServerManager }) => {
       const mergedGemma = settings.merged.experimental?.gemmaModelRouter;
       if (!mergedGemma) return;
       const userGemma = settings.forScope("User" /* User */).settings.experimental?.gemmaModelRouter;