@google/gemini-cli 0.67.0-preview.0 → 0.68.0-preview.0

package/bundle/{chunk-BFZQO5OI.js → chunk-B2FKXXUH.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   exitCli,
   require_source
-} from "./chunk-WTMW35TZ.js";
+} from "./chunk-JMHCFAD6.js";
 import {
   AppEvent,
   appEvents
@@ -69,16 +69,16 @@ import {
   use_stdin_default,
   use_stdout_default,
   validateCustomTheme
-} from "./chunk-QVUC4J7B.js";
+} from "./chunk-HRM7UWGB.js";
 import {
   isDevelopment,
   require_semver
-} from "./chunk-WANMK7VA.js";
+} from "./chunk-CXMHAFLN.js";
 import {
   emptyIcon,
   mapCoreStatusToDisplayStatus,
   require_react
-} from "./chunk-SAQV5Q3G.js";
+} from "./chunk-VBHMFLBY.js";
 import {
   ALL_EDITORS,
   ApprovalMode,
@@ -219,6 +219,7 @@ import {
   require_cross_spawn,
   require_is_stream,
   require_path_key,
+  require_proper_lockfile,
   require_pump,
   require_toml,
   resetBrowserSession,
@@ -239,7 +240,7 @@ import {
   uiTelemetryService,
   unescapePath,
   validateUrlDestination
-} from "./chunk-HWPQINPO.js";
+} from "./chunk-RCF66HCI.js";
 import {
   require_src
 } from "./chunk-L6PII3GR.js";
@@ -6500,7 +6501,7 @@ var require_extract_zip = __commonJS({
     var stream = __require("stream");
     var yauzl = require_yauzl();
     var openZip = promisify5(yauzl.open);
-    var pipeline2 = promisify5(stream.pipeline);
+    var pipeline3 = promisify5(stream.pipeline);
     var Extractor = class {
       constructor(zipPath, opts) {
         this.zipPath = zipPath;
@@ -6588,7 +6589,7 @@ var require_extract_zip = __commonJS({
           debug("creating symlink", link, dest);
           await fs33.symlink(link, dest);
         } else {
-          await pipeline2(readStream, createWriteStream5(dest, { mode: procMode }));
+          await pipeline3(readStream, createWriteStream5(dest, { mode: procMode }));
         }
       }
       getExtractedMode(entryMode, isDir) {
@@ -15324,11 +15325,11 @@ var require_util4 = __commonJS({
     var { isUint8Array } = __require("node:util/types");
     var { webidl } = require_webidl();
     var supportedHashes = [];
-    var crypto3;
+    var crypto4;
     try {
-      crypto3 = __require("node:crypto");
+      crypto4 = __require("node:crypto");
       const possibleRelevantHashes = ["sha256", "sha384", "sha512"];
-      supportedHashes = crypto3.getHashes().filter((hash) => possibleRelevantHashes.includes(hash));
+      supportedHashes = crypto4.getHashes().filter((hash) => possibleRelevantHashes.includes(hash));
     } catch {
     }
     function responseURL(response) {
@@ -15631,7 +15632,7 @@ var require_util4 = __commonJS({
       return isOriginPotentiallyTrustworthy(url.origin);
     }
     function bytesMatch(bytes, metadataList) {
-      if (crypto3 === void 0) {
+      if (crypto4 === void 0) {
         return true;
       }
       const parsedMetadata = parseMetadata(metadataList);
@@ -15646,7 +15647,7 @@ var require_util4 = __commonJS({
       for (const item of metadata) {
         const algorithm = item.algo;
         const expectedValue = item.hash;
-        let actualValue = crypto3.createHash(algorithm).update(bytes).digest("base64");
+        let actualValue = crypto4.createHash(algorithm).update(bytes).digest("base64");
         if (actualValue[actualValue.length - 1] === "=") {
           if (actualValue[actualValue.length - 2] === "=") {
             actualValue = actualValue.slice(0, -2);
@@ -16664,8 +16665,8 @@ var require_body = __commonJS({
     var { multipartFormDataParser } = require_formdata_parser();
     var random;
     try {
-      const crypto3 = __require("node:crypto");
-      random = (max) => crypto3.randomInt(0, max);
+      const crypto4 = __require("node:crypto");
+      random = (max) => crypto4.randomInt(0, max);
     } catch {
       random = (max) => Math.floor(Math.random() * max);
     }
@@ -18116,7 +18117,7 @@ var require_client_h2 = __commonJS({
   "packages/cli/node_modules/undici/lib/dispatcher/client-h2.js"(exports, module) {
     "use strict";
     var assert = __require("node:assert");
-    var { pipeline: pipeline2 } = __require("node:stream");
+    var { pipeline: pipeline3 } = __require("node:stream");
     var util2 = require_util3();
     var {
       RequestContentLengthMismatchError,
@@ -18611,7 +18612,7 @@ var require_client_h2 = __commonJS({
     }
     function writeStream(abort, socket, expectsPayload, h2stream, body, client, request, contentLength) {
       assert(contentLength !== 0 || client[kRunning] === 0, "stream body cannot be pipelined");
-      const pipe = pipeline2(
+      const pipe = pipeline3(
         body,
         h2stream,
         (err) => {
@@ -21505,7 +21506,7 @@ var require_api_pipeline = __commonJS({
         util2.destroy(ret, err);
       }
     };
-    function pipeline2(opts, handler2) {
+    function pipeline3(opts, handler2) {
       try {
         const pipelineHandler = new PipelineHandler(opts, handler2);
         this.dispatch({ ...opts, body: pipelineHandler.req }, pipelineHandler);
@@ -21514,7 +21515,7 @@ var require_api_pipeline = __commonJS({
         return new PassThrough().destroy(err);
       }
     }
-    module.exports = pipeline2;
+    module.exports = pipeline3;
   }
 });
 
@@ -26930,7 +26931,7 @@ var require_fetch = __commonJS({
       subresourceSet
     } = require_constants3();
     var EE = __require("node:events");
-    var { Readable, pipeline: pipeline2, finished, isErrored, isReadable } = __require("node:stream");
+    var { Readable, pipeline: pipeline3, finished, isErrored, isReadable } = __require("node:stream");
     var { addAbortListener, bufferToLowerCasedHeaderName } = require_util3();
     var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url();
     var { getGlobalDispatcher } = require_global2();
@@ -27873,7 +27874,7 @@ var require_fetch = __commonJS({
                 status,
                 statusText,
                 headersList,
-                body: decoders.length ? pipeline2(this.body, ...decoders, (err) => {
+                body: decoders.length ? pipeline3(this.body, ...decoders, (err) => {
                   if (err) {
                     this.onError(err);
                   }
@@ -29582,13 +29583,13 @@ var require_frame = __commonJS({
     "use strict";
     var { maxUnsigned16Bit, opcodes } = require_constants5();
     var BUFFER_SIZE = 8 * 1024;
-    var crypto3;
+    var crypto4;
     var buffer = null;
     var bufIdx = BUFFER_SIZE;
     try {
-      crypto3 = __require("node:crypto");
+      crypto4 = __require("node:crypto");
     } catch {
-      crypto3 = {
+      crypto4 = {
         // not full compatibility, but minimum.
         randomFillSync: function randomFillSync(buffer2, _offset, _size) {
           for (let i = 0; i < buffer2.length; ++i) {
@@ -29601,7 +29602,7 @@ var require_frame = __commonJS({
     function generateMask() {
       if (bufIdx === BUFFER_SIZE) {
         bufIdx = 0;
-        crypto3.randomFillSync(buffer ??= Buffer.allocUnsafeSlow(BUFFER_SIZE), 0, BUFFER_SIZE);
+        crypto4.randomFillSync(buffer ??= Buffer.allocUnsafeSlow(BUFFER_SIZE), 0, BUFFER_SIZE);
       }
       return [buffer[bufIdx++], buffer[bufIdx++], buffer[bufIdx++], buffer[bufIdx++]];
     }
@@ -29699,9 +29700,9 @@ var require_connection = __commonJS({
     var { getDecodeSplit } = require_util4();
     var { WebsocketFrameSend } = require_frame();
     var assert = __require("node:assert");
-    var crypto3;
+    var crypto4;
     try {
-      crypto3 = __require("node:crypto");
+      crypto4 = __require("node:crypto");
     } catch {
     }
     function establishWebSocketConnection(url, protocols, client, handler2, options) {
@@ -29721,7 +29722,7 @@ var require_connection = __commonJS({
         const headersList = getHeadersList(new Headers(options.headers));
         request.headersList = headersList;
       }
-      const keyValue = crypto3.randomBytes(16).toString("base64");
+      const keyValue = crypto4.randomBytes(16).toString("base64");
       request.headersList.append("sec-websocket-key", keyValue, true);
       request.headersList.append("sec-websocket-version", "13", true);
       for (const protocol of protocols) {
@@ -29754,7 +29755,7 @@ var require_connection = __commonJS({
             return;
           }
           const secWSAccept = response.headersList.get("Sec-WebSocket-Accept");
-          const digest = crypto3.createHash("sha1").update(keyValue + uid).digest("base64");
+          const digest = crypto4.createHash("sha1").update(keyValue + uid).digest("base64");
           if (secWSAccept !== digest) {
             failWebsocketConnection(handler2, 1002, "Incorrect hash received in Sec-WebSocket-Accept header.");
             return;
@@ -31366,7 +31367,7 @@ ${value}`;
 var require_eventsource = __commonJS({
   "packages/cli/node_modules/undici/lib/web/eventsource/eventsource.js"(exports, module) {
     "use strict";
-    var { pipeline: pipeline2 } = __require("node:stream");
+    var { pipeline: pipeline3 } = __require("node:stream");
     var { fetching } = require_fetch();
     var { makeRequest } = require_request2();
     var { webidl } = require_webidl();
@@ -31527,7 +31528,7 @@ var require_eventsource = __commonJS({
               ));
             }
           });
-          pipeline2(
+          pipeline3(
             response.body.stream,
             eventSourceStream,
             (error) => {
@@ -38661,6 +38662,7 @@ async function getMissingSettings(extensionConfig, extensionId, workspaceDir) {
 
 // packages/cli/src/config/extension-manager.ts
 var import_chalk2 = __toESM(require_source(), 1);
+var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
 import * as fs12 from "node:fs";
 import * as path9 from "node:path";
 import { stat } from "node:fs/promises";
@@ -38832,7 +38834,7 @@ var ExtensionEnablementManager = class {
 };
 
 // packages/cli/src/config/extension-manager.ts
-import { createHash as createHash2, randomUUID } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 
 // packages/cli/src/config/extension.ts
 import * as fs8 from "node:fs";
@@ -38929,10 +38931,12 @@ function extensionUpdatesReducer(state, action) {
 }
 
 // packages/cli/src/config/extensions/github.ts
+import * as crypto2 from "node:crypto";
 import * as os3 from "node:os";
 import * as https2 from "node:https";
 import * as fs10 from "node:fs";
 import * as path8 from "node:path";
+import { pipeline } from "node:stream/promises";
 
 // packages/cli/node_modules/tar/dist/esm/index.min.js
 import Hr from "events";
@@ -41847,6 +41851,14 @@ import * as https from "node:https";
 function getGitHubToken() {
   return process.env["GITHUB_TOKEN"] || void 0;
 }
+function isTrustedGitHubUrl(url) {
+  try {
+    const parsedUrl = new URL(url);
+    return parsedUrl.protocol === "https:" && (parsedUrl.hostname === "github.com" || parsedUrl.hostname.endsWith(".github.com"));
+  } catch {
+    return false;
+  }
+}
 var lookupPublicAddress = (hostname, options, callback) => safeLookup(
   hostname,
   {
@@ -41856,6 +41868,7 @@ var lookupPublicAddress = (hostname, options, callback) => safeLookup(
   callback
 );
 var REDIRECT_STATUS_CODES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var REQUEST_TIMEOUT_MS = 3e4;
 async function fetchJson(url, redirectCount = 0) {
   if (!await validateUrlDestination(url)) {
     throw new Error(`Access to blocked or private host ${url} is not allowed.`);
@@ -41864,14 +41877,8 @@ async function fetchJson(url, redirectCount = 0) {
     "User-Agent": "gemini-cli"
   };
   const token = getGitHubToken();
-  if (token) {
-    try {
-      const parsedUrl = new URL(url);
-      if (parsedUrl.protocol === "https:" && (parsedUrl.hostname === "github.com" || parsedUrl.hostname.endsWith(".github.com"))) {
-        headers.Authorization = `token ${token}`;
-      }
-    } catch {
-    }
+  if (token && isTrustedGitHubUrl(url)) {
+    headers.Authorization = `token ${token}`;
   }
   return new Promise((resolve9, reject) => {
     let settled = false;
@@ -41896,7 +41903,7 @@ async function fetchJson(url, redirectCount = 0) {
     const requestOptions = {
       headers,
       lookup: lookupPublicAddress,
-      timeout: 3e4
+      timeout: REQUEST_TIMEOUT_MS
     };
     const req = https.get(url, requestOptions, (res) => {
       res.on(
@@ -41989,7 +41996,9 @@ async function fetchJson(url, redirectCount = 0) {
     });
     req.on("error", (error) => failUnlessRedirecting(() => error));
     req.on("timeout", () => {
-      failUnlessRedirecting(() => new Error("Request timed out after 30000ms"));
+      failUnlessRedirecting(
+        () => new Error(`Request timed out after ${REQUEST_TIMEOUT_MS}ms`)
+      );
       req.destroy();
     });
   });
@@ -42059,7 +42068,7 @@ function tryParseGithubUrl(source2) {
     );
   }
   const owner = parts[0];
-  const repo = parts[1].replace(".git", "");
+  const repo = parts[1].replace(/\.git$/i, "");
   return {
     owner,
     repo
@@ -42340,39 +42349,175 @@ function findReleaseAsset(assets) {
   return void 0;
 }
 async function downloadFile(url, dest, options, redirectCount = 0) {
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(url);
+  } catch (error) {
+    throw new Error(`Invalid download URL ${url}: ${getErrorMessage(error)}`, {
+      cause: error
+    });
+  }
+  if (parsedUrl.protocol !== "https:") {
+    throw new Error(
+      `Refusing to download from insecure protocol ${parsedUrl.protocol} for URL ${url}. Only HTTPS is supported.`
+    );
+  }
+  const requestUrl = parsedUrl.toString();
+  if (!await validateUrlDestination(requestUrl)) {
+    throw new Error(
+      `Access to blocked or private host ${requestUrl} is not allowed.`
+    );
+  }
   const headers = {
     "User-agent": "gemini-cli",
     Accept: "application/octet-stream",
     ...options?.headers
   };
+  const trustedGitHubUrl = isTrustedGitHubUrl(requestUrl);
+  if (!trustedGitHubUrl) {
+    for (const key of Object.keys(headers)) {
+      if (key.toLowerCase() === "authorization") {
+        delete headers[key];
+      }
+    }
+  }
   const token = getGitHubToken();
-  if (token) {
+  if (token && trustedGitHubUrl) {
     headers["Authorization"] = `token ${token}`;
   }
-  return new Promise((resolve9, reject) => {
-    https2.get(url, { headers }, (res) => {
-      if (res.statusCode === 302 || res.statusCode === 301) {
-        if (redirectCount >= 10) {
-          return reject(new Error("Too many redirects"));
+  let tempDest;
+  let downloadPipeline;
+  try {
+    await new Promise((resolve9, reject) => {
+      let settled = false;
+      let isRedirecting = false;
+      let responseStream;
+      const settleResolve = () => {
+        if (!settled) {
+          settled = true;
+          resolve9();
         }
-        if (!res.headers.location) {
-          return reject(
-            new Error("Redirect response missing Location header")
+      };
+      const settleReject = (error) => {
+        if (!settled) {
+          settled = true;
+          reject(
+            error instanceof Error ? error : new Error(getErrorMessage(error))
           );
         }
-        downloadFile(res.headers.location, dest, options, redirectCount + 1).then(resolve9).catch(reject);
-        return;
+      };
+      const requestOptions = {
+        headers,
+        lookup: lookupPublicAddress,
+        timeout: REQUEST_TIMEOUT_MS
+      };
+      const req = https2.get(requestUrl, requestOptions, (res) => {
+        res.on("error", (error) => {
+          if (!isRedirecting) {
+            settleReject(error);
+          }
+        });
+        if (res.statusCode && REDIRECT_STATUS_CODES.has(res.statusCode)) {
+          if (redirectCount >= 10) {
+            res.resume?.();
+            settleReject(new Error("Too many redirects"));
+            return;
+          }
+          if (!res.headers.location) {
+            res.resume?.();
+            settleReject(
+              new Error("Redirect response missing Location header")
+            );
+            return;
+          }
+          let redirectUrl;
+          try {
+            redirectUrl = new URL(res.headers.location, requestUrl).toString();
+          } catch (error) {
+            res.resume?.();
+            settleReject(
+              new Error(
+                `Invalid redirect URL from ${requestUrl} (status ${res.statusCode}): ${getErrorMessage(error)}`,
+                { cause: error }
+              )
+            );
+            return;
+          }
+          isRedirecting = true;
+          res.resume?.();
+          void downloadFile(redirectUrl, dest, options, redirectCount + 1).then(
+            settleResolve,
+            settleReject
+          );
+          return;
+        }
+        if (res.statusCode !== 200) {
+          res.resume?.();
+          settleReject(
+            new Error(`Request failed with status code ${res.statusCode}`)
+          );
+          return;
+        }
+        responseStream = res;
+        const currentTempDest = `${dest}.${crypto2.randomUUID()}.tmp`;
+        tempDest = currentTempDest;
+        let file;
+        try {
+          file = fs10.createWriteStream(currentTempDest);
+        } catch (error) {
+          res.destroy?.();
+          settleReject(error);
+          return;
+        }
+        file.on("error", settleReject);
+        downloadPipeline = pipeline(res, file);
+        void downloadPipeline.then(() => {
+          if (res.complete === false) {
+            settleReject(
+              new Error(
+                `Response ended prematurely while downloading ${requestUrl}`
+              )
+            );
+            return;
+          }
+          settleResolve();
+        }, settleReject);
+      });
+      req.on("error", (error) => {
+        if (isRedirecting) {
+          return;
+        }
+        settleReject(error);
+        responseStream?.destroy?.();
+      });
+      req.on("timeout", () => {
+        if (!isRedirecting) {
+          settleReject(
+            new Error(`Request timed out after ${REQUEST_TIMEOUT_MS}ms`)
+          );
+          responseStream?.destroy?.();
+        }
+        req.destroy?.();
+      });
+    });
+    if (tempDest) {
+      await fs10.promises.rename(tempDest, dest);
+    }
+  } catch (error) {
+    if (downloadPipeline) {
+      try {
+        await downloadPipeline;
+      } catch {
       }
-      if (res.statusCode !== 200) {
-        return reject(
-          new Error(`Request failed with status code ${res.statusCode}`)
-        );
+    }
+    if (tempDest) {
+      try {
+        await fs10.promises.unlink(tempDest);
+      } catch {
       }
-      const file = fs10.createWriteStream(dest);
-      res.pipe(file);
-      file.on("finish", () => file.close(resolve9));
-    }).on("error", reject);
-  });
+    }
+    throw error;
+  }
 }
 async function extractFile(file, dest) {
   if (file.endsWith(".tar.gz")) {
@@ -42600,6 +42745,9 @@ async function removeDirectoryWithRetry(path37, options = {}) {
 }
 
 // packages/cli/src/config/extension-manager.ts
+var INSTALL_LOCK_SUFFIX = ".lock";
+var INSTALL_LOCK_STALE_MS = 15e3;
+var INSTALL_LOCK_RETRIES = { retries: 15, minTimeout: 200, maxTimeout: 500 };
 var ExtensionManager = class extends ExtensionLoader {
   extensionEnablementManager;
   integrityManager;
@@ -42620,7 +42768,7 @@ var ExtensionManager = class extends ExtensionLoader {
     this.telemetryConfig = new Config({
       telemetry: options.settings.telemetry,
       interactive: false,
-      sessionId: randomUUID(),
+      sessionId: randomUUID2(),
       clientVersion: options.clientVersion ?? "unknown",
       targetDir: options.workspaceDir,
       cwd: options.workspaceDir,
@@ -42744,6 +42892,7 @@ Would you like to attempt to install via "git clone" instead?`
       } else {
         throw new Error(`Unsupported install type: ${installMetadata.type}`);
       }
+      let releaseLock;
       try {
         newExtensionConfig = await this.loadExtensionConfig(localSourcePath);
         const newExtensionName = newExtensionConfig.name;
@@ -42792,11 +42941,19 @@ Would you like to attempt to install via "git clone" instead?`
         const destinationPath = new ExtensionStorage(
           newExtensionName
         ).getExtensionDir();
-        if ((!isUpdate || newExtensionName !== previousName) && fs12.existsSync(destinationPath)) {
-          throw new Error(
-            `Cannot install extension "${newExtensionName}" because a directory with that name already exists. Please remove it manually.`
-          );
-        }
+        const assertDestinationIsAvailable = () => {
+          if ((!isUpdate || newExtensionName !== previousName) && fs12.existsSync(destinationPath)) {
+            throw new Error(
+              `Cannot install extension "${newExtensionName}" because a directory with that name already exists. Please remove it manually.`
+            );
+          }
+        };
+        assertDestinationIsAvailable();
+        releaseLock = await acquireExtensionInstallLock(
+          destinationPath,
+          newExtensionName
+        );
+        assertDestinationIsAvailable();
         let previousSettings;
         let wasEnabledGlobally = false;
         let wasEnabledWorkspace = false;
@@ -42909,6 +43066,15 @@ Would you like to attempt to install via "git clone" instead?`
           );
         }
       } finally {
+        if (releaseLock) {
+          try {
+            await releaseLock();
+          } catch (releaseError) {
+            debugLogger.warn(
+              `Failed to release the install lock for extension "${newExtensionConfig?.name}": ${getErrorMessage(releaseError)}`
+            );
+          }
+        }
         if (tempDir) {
           try {
             await removeDirectoryWithRetry(tempDir);
@@ -43079,6 +43245,9 @@ Would you like to attempt to install via "git clone" instead?`
    * Builds an extension without side effects (does not mutate loadedExtensions or start it).
    */
   async _buildExtension(extensionDir) {
+    if (path9.basename(extensionDir).endsWith(INSTALL_LOCK_SUFFIX)) {
+      return null;
+    }
     try {
       const stats = await fs12.promises.stat(extensionDir);
       if (!stats.isDirectory()) {
@@ -43564,6 +43733,32 @@ async function copyExtension(source2, destination) {
   await fs12.promises.cp(source2, destination, { recursive: true });
   await makeWritableRecursive(destination);
 }
+async function acquireExtensionInstallLock(destinationPath, extensionName) {
+  await fs12.promises.mkdir(path9.dirname(destinationPath), { recursive: true });
+  try {
+    return await (0, import_proper_lockfile.lock)(destinationPath, {
+      // `destinationPath` usually does not exist yet. With `realpath: false`,
+      // proper-lockfile neither resolves nor stats it; it only creates and
+      // checks the `<destinationPath>.lock` directory.
+      realpath: false,
+      stale: INSTALL_LOCK_STALE_MS,
+      retries: INSTALL_LOCK_RETRIES,
+      // The default handler throws from a timer, which would crash the CLI.
+      onCompromised: (error) => {
+        debugLogger.warn(
+          `Lost the install lock for extension "${extensionName}": ${getErrorMessage(error)}`
+        );
+      }
+    });
+  } catch (error) {
+    if (isNodeError(error) && error.code === "ELOCKED") {
+      throw new Error(
+        `Cannot install extension "${extensionName}" because another installation or update of it is already in progress. Please try again later.`
+      );
+    }
+    throw error;
+  }
+}
 function getContextFileNames(config) {
   if (!config.contextFileName) {
     return ["GEMINI.md"];
@@ -44668,8 +44863,8 @@ var import_execa = __toESM(require_execa(), 1);
 
 // node_modules/crypto-random-string/index.js
 import { promisify } from "util";
-import crypto2 from "crypto";
-var randomBytesAsync = promisify(crypto2.randomBytes);
+import crypto3 from "crypto";
+var randomBytesAsync = promisify(crypto3.randomBytes);
 var urlSafeCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~".split("");
 var numericCharacters = "0123456789".split("");
 var distinguishableCharacters = "CDEHKMPRTUWXY012458".split("");
@@ -44682,7 +44877,7 @@ var generateForCustomCharacters = (length, characters) => {
   let string = "";
   let stringLength = 0;
   while (stringLength < length) {
-    const entropy = crypto2.randomBytes(entropyLength);
+    const entropy = crypto3.randomBytes(entropyLength);
     let entropyPosition = 0;
     while (entropyPosition < entropyLength && stringLength < length) {
       const entropyValue = entropy.readUInt16LE(entropyPosition);
@@ -44717,7 +44912,7 @@ var generateForCustomCharactersAsync = async (length, characters) => {
   }
   return string;
 };
-var generateRandomBytes = (byteLength, type, length) => crypto2.randomBytes(byteLength).toString(type).slice(0, length);
+var generateRandomBytes = (byteLength, type, length) => crypto3.randomBytes(byteLength).toString(type).slice(0, length);
 var generateRandomBytesAsync = async (byteLength, type, length) => {
   const buffer = await randomBytesAsync(byteLength);
   return buffer.toString(type).slice(0, length);
@@ -53254,6 +53449,7 @@ var _ExpandableText = ({
   maxWidth = MAX_WIDTH,
   maxLines
 }) => {
+  const labelCharacters = Array.from(label);
   const hasMatch = matchedIndex !== void 0 && matchedIndex >= 0 && matchedIndex < label.length && userInput.length > 0;
   if (!hasMatch) {
     let display = label;
@@ -53262,53 +53458,69 @@ var _ExpandableText = ({
         const lines = label.split("\n");
         let truncated = lines.slice(0, maxLines).join("\n");
         const hasMoreLines = lines.length > maxLines;
-        if (truncated.length > maxWidth) {
-          truncated = truncated.slice(0, maxWidth) + "...";
+        const truncatedCharacters = Array.from(truncated);
+        if (truncatedCharacters.length > maxWidth) {
+          truncated = truncatedCharacters.slice(0, maxWidth).join("") + "...";
         } else if (hasMoreLines) {
           truncated += "...";
         }
         display = truncated;
-      } else if (label.length > maxWidth) {
-        display = label.slice(0, maxWidth) + "...";
+      } else if (labelCharacters.length > maxWidth) {
+        display = labelCharacters.slice(0, maxWidth).join("") + "...";
       }
     }
     return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Text, { wrap: "wrap", color: textColor, children: display });
   }
-  const matchLength = userInput.length;
+  const matchCharactersLength = Array.from(userInput).length;
+  let matchedCharacterIndex = 0;
+  let matchedUtf16Index = 0;
+  while (matchedCharacterIndex < labelCharacters.length && matchedUtf16Index < matchedIndex) {
+    matchedUtf16Index += labelCharacters[matchedCharacterIndex].length;
+    matchedCharacterIndex += 1;
+  }
   let before = "";
   let match = "";
   let after = "";
-  if (isExpanded || label.length <= maxWidth) {
-    before = label.slice(0, matchedIndex);
-    match = label.slice(matchedIndex, matchedIndex + matchLength);
-    after = label.slice(matchedIndex + matchLength);
-  } else if (matchLength >= maxWidth) {
-    match = label.slice(matchedIndex, matchedIndex + maxWidth - 1) + "...";
+  if (isExpanded || labelCharacters.length <= maxWidth) {
+    before = labelCharacters.slice(0, matchedCharacterIndex).join("");
+    match = labelCharacters.slice(
+      matchedCharacterIndex,
+      matchedCharacterIndex + matchCharactersLength
+    ).join("");
+    after = labelCharacters.slice(matchedCharacterIndex + matchCharactersLength).join("");
+  } else if (matchCharactersLength >= maxWidth) {
+    match = labelCharacters.slice(matchedCharacterIndex, matchedCharacterIndex + maxWidth - 1).join("") + "...";
   } else {
-    const contextSpace = maxWidth - matchLength;
+    const contextSpace = maxWidth - matchCharactersLength;
     const beforeSpace = Math.floor(contextSpace / 2);
     const afterSpace = Math.ceil(contextSpace / 2);
-    let start = matchedIndex - beforeSpace;
-    let end = matchedIndex + matchLength + afterSpace;
+    let start = matchedCharacterIndex - beforeSpace;
+    let end = matchedCharacterIndex + matchCharactersLength + afterSpace;
     if (start < 0) {
       end += -start;
       start = 0;
     }
-    if (end > label.length) {
-      start -= end - label.length;
-      end = label.length;
+    if (end > labelCharacters.length) {
+      start -= end - labelCharacters.length;
+      end = labelCharacters.length;
     }
     start = Math.max(0, start);
-    const finalMatchIndex = matchedIndex - start;
-    const slicedLabel = label.slice(start, end);
-    before = slicedLabel.slice(0, finalMatchIndex);
-    match = slicedLabel.slice(finalMatchIndex, finalMatchIndex + matchLength);
-    after = slicedLabel.slice(finalMatchIndex + matchLength);
+    const finalMatchIndex = matchedCharacterIndex - start;
+    const slicedLabel = labelCharacters.slice(start, end);
+    const beforeChars = slicedLabel.slice(0, finalMatchIndex);
+    match = slicedLabel.slice(finalMatchIndex, finalMatchIndex + matchCharactersLength).join("");
+    const afterChars = slicedLabel.slice(
+      finalMatchIndex + matchCharactersLength
+    );
     if (start > 0) {
-      before = before.length >= 3 ? "..." + before.slice(3) : "...";
+      before = beforeChars.length >= 3 ? "..." + beforeChars.slice(3).join("") : "...";
+    } else {
+      before = beforeChars.join("");
     }
-    if (end < label.length) {
-      after = after.length >= 3 ? after.slice(0, -3) + "..." : "...";
+    if (end < labelCharacters.length) {
+      after = afterChars.length >= 3 ? afterChars.slice(0, -3).join("") + "..." : "...";
+    } else {
+      after = afterChars.join("");
     }
   }
   return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(Text, { color: textColor, wrap: "wrap", children: [
@@ -55018,7 +55230,7 @@ var authCommand = {
 import process12 from "node:process";
 
 // packages/cli/src/generated/git-commit.ts
-var GIT_COMMIT_INFO = "8080ea70a";
+var GIT_COMMIT_INFO = "89e9d25d6";
 
 // packages/cli/src/ui/utils/historyExportUtils.ts
 import * as fsPromises from "node:fs/promises";
@@ -55068,13 +55280,13 @@ async function exportHistoryToFile(options) {
 // packages/cli/src/ui/utils/memorySnapshot.ts
 import { createWriteStream as createWriteStream3 } from "node:fs";
 import { mkdir as mkdir3 } from "node:fs/promises";
-import { dirname as dirname4 } from "node:path";
-import { pipeline } from "node:stream/promises";
+import { dirname as dirname5 } from "node:path";
+import { pipeline as pipeline2 } from "node:stream/promises";
 import { getHeapSnapshot } from "node:v8";
 var MEMORY_SNAPSHOT_AUTO_THRESHOLD_BYTES = 2 * 1024 * 1024 * 1024;
 async function captureHeapSnapshot(filePath) {
-  await mkdir3(dirname4(filePath), { recursive: true });
-  await pipeline(getHeapSnapshot(), createWriteStream3(filePath));
+  await mkdir3(dirname5(filePath), { recursive: true });
+  await pipeline2(getHeapSnapshot(), createWriteStream3(filePath));
 }
 
 // packages/cli/src/ui/commands/bugCommand.ts
@@ -55652,7 +55864,7 @@ var chatCommand = {
 };
 
 // packages/cli/src/ui/commands/clearCommand.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 var clearCommand = {
   name: "clear",
   altNames: ["new"],
@@ -55669,7 +55881,7 @@ var clearCommand = {
     config?.injectionService.clear();
     let newSessionId;
     if (config) {
-      newSessionId = randomUUID2();
+      newSessionId = randomUUID3();
       config.resetNewSessionState(newSessionId);
     }
     if (geminiClient) {
@@ -59780,7 +59992,16 @@ async function rewindConversation(context, client, recordingService, messageId,
     const { uiHistory } = convertSessionToHistoryFormats(conversation.messages);
     const clientHistory = convertSessionToClientHistory(conversation.messages);
     client.setHistory(clientHistory);
-    await context.services.agentContext?.config.getMemoryContextManager()?.refresh();
+    client.clearCurrentSequenceModel?.();
+    const config = context.services.agentContext?.config;
+    if (config) {
+      config.getModelAvailabilityService?.()?.reset();
+      const configuredModel = config.getModel?.();
+      if (configuredModel) {
+        config.setActiveModel?.(configuredModel);
+      }
+      await config.getMemoryContextManager()?.refresh();
+    }
     const startId = 1;
     const historyWithIds = uiHistory.map(
       (item, idx) => ({
@@ -60825,7 +61046,7 @@ Use /mcp auth <server-name> to authenticate.`
         type: "info",
         text: `Starting OAuth authentication for MCP server '${serverName}'...`
       });
-      const { MCPOAuthProvider } = await import("./core-3N7UGMI2.js");
+      const { MCPOAuthProvider } = await import("./core-NQRKBS47.js");
       let oauthConfig = server.oauth;
       if (!oauthConfig) {
         oauthConfig = { enabled: false };