@machina.ai/cell-cli-core 1.41.1-rc2 → 1.45.1-rc2

package/dist/src/config/config.test.js

@@ -9,6 +9,7 @@ import { createMockSandboxConfig } from '@google/gemini-cli-test-utils';
 import { DEFAULT_MAX_ATTEMPTS } from '../utils/retry.js';
 import { ExperimentFlags } from '../code_assist/experiments/flagNames.js';
 import { debugLogger } from '../utils/debugLogger.js';
+import { coreEvents } from '../utils/events.js';
 import { ApprovalMode } from '../policy/types.js';
 import { HookType, HookEventName, } from '../hooks/types.js';
 import { FileDiscoveryService } from '../services/fileDiscoveryService.js';
@@ -23,14 +24,15 @@ import { ShellTool } from '../tools/shell.js';
 import { AgentTool } from '../agents/agent-tool.js';
 import { ReadFileTool } from '../tools/read-file.js';
 import { GrepTool } from '../tools/grep.js';
-import { RipGrepTool, canUseRipgrep } from '../tools/ripGrep.js';
+import { RipGrepTool, resolveRipgrepPath } from '../tools/ripGrep.js';
 import { logRipgrepFallback, logApprovalModeDuration, } from '../telemetry/loggers.js';
 import { RipgrepFallbackEvent } from '../telemetry/types.js';
 import { ToolRegistry } from '../tools/tool-registry.js';
 import { ACTIVATE_SKILL_TOOL_NAME } from '../tools/tool-names.js';
 import { DEFAULT_MODEL_CONFIGS } from './defaultModelConfigs.js';
-import { DEFAULT_GEMINI_MODEL, PREVIEW_GEMINI_3_1_MODEL, DEFAULT_GEMINI_MODEL_AUTO, PREVIEW_GEMINI_MODEL_AUTO, PREVIEW_GEMINI_FLASH_MODEL, } from './models.js';
+import { DEFAULT_GEMINI_MODEL, PREVIEW_GEMINI_3_1_MODEL, DEFAULT_GEMINI_MODEL_AUTO, PREVIEW_GEMINI_MODEL_AUTO, PREVIEW_GEMINI_FLASH_MODEL, DEFAULT_GEMINI_FLASH_MODEL, } from './models.js';
 import { Storage } from './storage.js';
+import { runWithScopedAutoMemoryExtractionWriteAccess, runWithScopedMemoryInboxAccess, } from './scoped-config.js';
 vi.mock('fs', async (importOriginal) => {
     const actual = await importOriginal();
     return {
@@ -42,6 +44,19 @@ vi.mock('fs', async (importOriginal) => {
         realpathSync: vi.fn((path) => path),
     };
 });
+vi.mock('../utils/paths.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        resolveToRealPath: vi.fn((p) => p),
+    };
+});
+vi.mock('../utils/fileUtils.js', () => ({
+    fileExists: vi.fn(),
+}));
+vi.mock('../utils/shell-utils.js', () => ({
+    resolveExecutable: vi.fn(),
+}));
 // Mock dependencies that might be called during Config construction or createServerConfig
 vi.mock('../tools/tool-registry', () => {
     const ToolRegistryMock = vi.fn();
@@ -62,15 +77,12 @@ vi.mock('../tools/mcp-client-manager.js', () => ({
         setMainRegistries: vi.fn(),
     })),
 }));
-vi.mock('../utils/memoryDiscovery.js', () => ({
-    loadServerHierarchicalMemory: vi.fn(),
-}));
 // Mock individual tools if their constructors are complex or have side effects
 vi.mock('../tools/ls');
 vi.mock('../tools/read-file');
 vi.mock('../tools/grep.js');
 vi.mock('../tools/ripGrep.js', () => ({
-    canUseRipgrep: vi.fn(),
+    resolveRipgrepPath: vi.fn(),
     RipGrepTool: class MockRipGrepTool {
     },
 }));
@@ -80,13 +92,14 @@ vi.mock('../tools/shell');
 vi.mock('../tools/write-file');
 vi.mock('../tools/web-fetch');
 vi.mock('../tools/read-many-files');
-vi.mock('../tools/memoryTool', () => ({
-    MemoryTool: vi.fn(),
-    setGeminiMdFilename: vi.fn(),
-    getCurrentGeminiMdFilename: vi.fn(() => 'GEMINI.md'), // Mock the original filename
-    DEFAULT_CONTEXT_FILENAME: 'GEMINI.md',
-    CELL_DIR: '.cell-cli',
-}));
+vi.mock('../tools/memoryTool', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        setGeminiMdFilename: vi.fn(),
+        getCurrentGeminiMdFilename: vi.fn(() => 'GEMINI.md'),
+    };
+});
 vi.mock('../core/contentGenerator.js');
 vi.mock('../core/client.js', () => ({
     GeminiClient: vi.fn().mockImplementation(() => ({
@@ -148,6 +161,7 @@ const mockCoreEvents = vi.hoisted(() => ({
     emitConsoleLog: vi.fn(),
     emitQuotaChanged: vi.fn(),
     on: vi.fn(),
+    emit: vi.fn(),
 }));
 const mockSetGlobalProxy = vi.hoisted(() => vi.fn());
 vi.mock('../utils/events.js', async (importOriginal) => {
@@ -532,7 +546,13 @@ describe('Server Config (config.ts)', () => {
             });
         });
         describe('getGemini31LaunchedSync', () => {
-            it.each([AuthType.USE_GEMINI, AuthType.USE_VERTEX_AI, AuthType.GATEWAY])('should return true for %s', async (authType) => {
+            it.each([
+                AuthType.USE_GEMINI,
+                AuthType.USE_VERTEX_AI,
+                AuthType.GATEWAY,
+                AuthType.LOGIN_WITH_GOOGLE,
+                AuthType.KEYCLOAK,
+            ])('should return true for %s', async (authType) => {
                 const config = new Config(baseParams);
                 vi.mocked(createContentGeneratorConfig).mockResolvedValue({
                     authType,
@@ -558,16 +578,6 @@ describe('Server Config (config.ts)', () => {
                 expect(config.getGemini31LaunchedSync()).toBe(true);
             });
         });
-        describe('getGemini31FlashLiteLaunchedSync', () => {
-            it.each([AuthType.USE_GEMINI, AuthType.USE_VERTEX_AI, AuthType.GATEWAY])('should return true for %s', async (authType) => {
-                const config = new Config(baseParams);
-                vi.mocked(createContentGeneratorConfig).mockResolvedValue({
-                    authType,
-                });
-                await config.refreshAuth(authType);
-                expect(config.getGemini31FlashLiteLaunchedSync()).toBe(true);
-            });
-        });
         describe('getProModelNoAccessSync', () => {
             it('should return experiment value for AuthType.LOGIN_WITH_GOOGLE', async () => {
                 vi.mocked(getExperiments).mockResolvedValue({
@@ -685,6 +695,13 @@ describe('Server Config (config.ts)', () => {
             expect(config.getContentGeneratorConfig()).toEqual(mockContentConfig);
             expect(GeminiClient).toHaveBeenCalledWith(config);
         });
+        it('should clear fallback overrides when refreshing auth', async () => {
+            const config = new Config(baseParams);
+            config.activateFallbackMode('fallback-model', 'failed-model');
+            expect(config.getFallbackOverride('failed-model')).toBe('fallback-model');
+            await config.refreshAuth(AuthType.USE_GEMINI);
+            expect(config.getFallbackOverride('failed-model')).toBeUndefined();
+        });
         it('should pass Vertex AI routing settings when refreshing auth', async () => {
             const vertexAiRouting = {
                 requestType: 'shared',
@@ -1173,28 +1190,6 @@ describe('Server Config (config.ts)', () => {
             expect(config.getShellToolInactivityTimeout()).toBe(10000);
         });
     });
-    describe('ContinueOnFailedApiCall Configuration', () => {
-        it('should default continueOnFailedApiCall to false when not provided', () => {
-            const config = new Config(baseParams);
-            expect(config.getContinueOnFailedApiCall()).toBe(true);
-        });
-        it('should set continueOnFailedApiCall to true when provided as true', () => {
-            const paramsWithContinueOnFailedApiCall = {
-                ...baseParams,
-                continueOnFailedApiCall: true,
-            };
-            const config = new Config(paramsWithContinueOnFailedApiCall);
-            expect(config.getContinueOnFailedApiCall()).toBe(true);
-        });
-        it('should set continueOnFailedApiCall to false when explicitly provided as false', () => {
-            const paramsWithContinueOnFailedApiCall = {
-                ...baseParams,
-                continueOnFailedApiCall: false,
-            };
-            const config = new Config(paramsWithContinueOnFailedApiCall);
-            expect(config.getContinueOnFailedApiCall()).toBe(false);
-        });
-    });
     describe('createToolRegistry', () => {
         it('should register a tool if coreTools contains an argument-specific pattern', async () => {
             const params = {
@@ -1512,6 +1507,17 @@ describe('Server Config (config.ts)', () => {
         expect(config.getTrackerService().trackerDir).toBe(path.join(tempDir, 'session-two', 'tracker'));
         expect(config.getWorkspaceContext().getDirectories()).not.toContain(oldPlansDir);
     });
+    it('clears fallback overrides when session changes', async () => {
+        const config = new Config({
+            ...baseParams,
+            sessionId: 'session-one',
+        });
+        await config.initialize();
+        config.activateFallbackMode('fallback-model', 'failed-model');
+        expect(config.getFallbackOverride('failed-model')).toBe('fallback-model');
+        config.setSessionId('session-two');
+        expect(config.getFallbackOverride('failed-model')).toBeUndefined();
+    });
     it('does not throw when changing sessions before the previous plans dir exists', async () => {
         const config = new Config({
             ...baseParams,
@@ -1563,6 +1569,49 @@ describe('Server Config (config.ts)', () => {
         expect(config.getSessionId()).toBe('session-two');
         expect(config.getApprovedPlanPath()).toBeUndefined();
     });
+    it('performs a comprehensive reset of all session-scoped state when sessionId changes', async () => {
+        const config = new Config({
+            ...baseParams,
+            sessionId: 'session-one',
+            plan: true,
+            tracker: true,
+        });
+        await config.initialize();
+        // 1. "Dirty" the session state
+        const oldTrackerService = config.getTrackerService();
+        config.setApprovedPlanPath('/tmp/plan.md');
+        config.topicState.setTopic('Old Topic', 'Old Intent');
+        config.getSkillManager().activateSkill('old-skill');
+        config.getModelAvailabilityService().markTerminal('model-1', 'quota');
+        config.setLatestApiRequest({});
+        const configInternal = config;
+        // Mock internal quota state
+        configInternal.modelQuotas.set('model-1', { remaining: 0, limit: 100 });
+        configInternal.lastEmittedQuotaRemaining = 0;
+        configInternal.lastEmittedQuotaLimit = 100;
+        configInternal.lastQuotaFetchTime = 12345;
+        configInternal.hasAccessToPreviewModel = true;
+        // Listen for quota event
+        const emitQuotaSpy = vi.spyOn(coreEvents, 'emitQuotaChanged');
+        // 2. Trigger session change
+        config.setSessionId('session-two');
+        // 3. Verify EVERYTHING is reset
+        expect(config.getSessionId()).toBe('session-two');
+        expect(config.getApprovedPlanPath()).toBeUndefined();
+        expect(config.topicState.getTopic()).toBeUndefined();
+        expect(config.topicState.getIntent()).toBeUndefined();
+        expect(config.getSkillManager().isSkillActive('old-skill')).toBe(false);
+        expect(config.getTrackerService()).not.toBe(oldTrackerService);
+        expect(config.getModelAvailabilityService().snapshot('model-1').available).toBe(true);
+        expect(config.getLatestApiRequest()).toBeUndefined();
+        // Quota resets
+        expect(configInternal.modelQuotas.size).toBe(0);
+        expect(configInternal.lastEmittedQuotaRemaining).toBeUndefined();
+        expect(configInternal.lastEmittedQuotaLimit).toBeUndefined();
+        expect(configInternal.lastQuotaFetchTime).toBe(0);
+        // Event emission
+        expect(emitQuotaSpy).toHaveBeenCalledWith(undefined, undefined, undefined);
+    });
 });
 describe('GemmaModelRouterSettings', () => {
     const MODEL = DEFAULT_GEMINI_MODEL;
@@ -1788,7 +1837,7 @@ describe('setApprovalMode with folder trust', () => {
             vi.clearAllMocks();
         });
         it('should register RipGrepTool when useRipgrep is true and it is available', async () => {
-            vi.mocked(canUseRipgrep).mockResolvedValue(true);
+            vi.mocked(resolveRipgrepPath).mockResolvedValue('/mock/rg');
             const config = new Config({ ...baseParams, useRipgrep: true });
             await config.initialize();
             const calls = vi.mocked(ToolRegistry.prototype.registerTool).mock.calls;
@@ -1799,7 +1848,7 @@ describe('setApprovalMode with folder trust', () => {
             expect(logRipgrepFallback).not.toHaveBeenCalled();
         });
         it('should register GrepTool as a fallback when useRipgrep is true but it is not available', async () => {
-            vi.mocked(canUseRipgrep).mockResolvedValue(false);
+            vi.mocked(resolveRipgrepPath).mockResolvedValue(null);
             const config = new Config({ ...baseParams, useRipgrep: true });
             await config.initialize();
             const calls = vi.mocked(ToolRegistry.prototype.registerTool).mock.calls;
@@ -1813,7 +1862,7 @@ describe('setApprovalMode with folder trust', () => {
         });
         it('should register GrepTool as a fallback when canUseRipgrep throws an error', async () => {
             const error = new Error('ripGrep check failed');
-            vi.mocked(canUseRipgrep).mockRejectedValue(error);
+            vi.mocked(resolveRipgrepPath).mockRejectedValue(error);
             const config = new Config({ ...baseParams, useRipgrep: true });
             await config.initialize();
             const calls = vi.mocked(ToolRegistry.prototype.registerTool).mock.calls;
@@ -1833,7 +1882,7 @@ describe('setApprovalMode with folder trust', () => {
             const wasGrepRegistered = calls.some((call) => call[0] instanceof vi.mocked(GrepTool));
             expect(wasRipGrepRegistered).toBe(false);
             expect(wasGrepRegistered).toBe(true);
-            expect(canUseRipgrep).not.toHaveBeenCalled();
+            expect(resolveRipgrepPath).not.toHaveBeenCalled();
             expect(logRipgrepFallback).not.toHaveBeenCalled();
         });
     });
@@ -2102,6 +2151,13 @@ describe('Config getHooks', () => {
             expect(mockCoreEvents.emitModelChanged).toHaveBeenCalledWith('auto');
             expect(spy).toHaveBeenCalled();
         });
+        it('should preserve fallback overrides when setting a new model', () => {
+            const config = new Config(baseParams);
+            config.activateFallbackMode('fallback-model', 'failed-model');
+            expect(config.getFallbackOverride('failed-model')).toBe('fallback-model');
+            config.setModel('new-model');
+            expect(config.getFallbackOverride('failed-model')).toBe('fallback-model');
+        });
         it('should allow setting auto model from auto model and reset availability', () => {
             const config = new Config({
                 cwd: '/tmp',
@@ -2534,15 +2590,15 @@ describe('Config Quota & Preview Model Access', () => {
             vi.mocked(getCodeAssistServer).mockReturnValue(undefined);
             const result = await config.refreshUserQuota();
             expect(result).toBeUndefined();
-            // Never set => stays null (unknown); getter returns true so UI shows preview
-            expect(config.getHasAccessToPreviewModel()).toBe(true);
+            // Never set => stays null (unknown); getter returns false by default
+            expect(config.getHasAccessToPreviewModel()).toBe(false);
         });
         it('should return undefined if retrieveUserQuota fails', async () => {
             mockCodeAssistServer.retrieveUserQuota.mockRejectedValue(new Error('Network error'));
             const result = await config.refreshUserQuota();
             expect(result).toBeUndefined();
-            // Never set => stays null (unknown); getter returns true so UI shows preview
-            expect(config.getHasAccessToPreviewModel()).toBe(true);
+            // Never set => stays null (unknown); getter returns false by default
+            expect(config.getHasAccessToPreviewModel()).toBe(false);
         });
         it('should derive quota from remainingFraction when remainingAmount is missing', async () => {
             mockCodeAssistServer.retrieveUserQuota.mockResolvedValue({
@@ -2714,6 +2770,39 @@ describe('Config Quota & Preview Model Access', () => {
             expect(await config.getPlanModeRoutingEnabled()).toBe(false);
         });
     });
+    describe('validatePathAccess (PathValidator integration)', () => {
+        it('should reject pathologically long paths', () => {
+            const config = new Config(baseParams);
+            const longPath = path.join(baseParams.targetDir, 'a'.repeat(5000));
+            const result = config.validatePathAccess(longPath, 'read');
+            expect(result).toContain('Invalid path: Path is too long');
+        });
+        it('should reject paths with log markers', () => {
+            const config = new Config(baseParams);
+            const logPath = path.join(baseParams.targetDir, 'AssertionError: expected true to be false');
+            const result = config.validatePathAccess(logPath, 'read');
+            expect(result).toContain('Invalid path: Path appears to be a misinterpreted log fragment');
+        });
+        it('should reject paths with control characters', () => {
+            const config = new Config(baseParams);
+            const malformedPath = path.join(baseParams.targetDir, 'file\nwith\nnewline.txt');
+            const result = config.validatePathAccess(malformedPath, 'read');
+            expect(result).toContain('Invalid path: Path contains invalid characters');
+        });
+        it('should allow normal paths', () => {
+            const config = new Config(baseParams);
+            const normalPath = path.resolve(baseParams.targetDir, 'src/index.ts');
+            const result = config.validatePathAccess(normalPath, 'read');
+            // It might return "Path not in workspace" or similar if not authorized,
+            // but it should NOT return the "Invalid path" prefix from PathValidator.
+            if (result) {
+                expect(result).not.toContain('Invalid path:');
+            }
+            else {
+                expect(result).toBeNull();
+            }
+        });
+    });
 });
 describe('Config JIT Initialization', () => {
     let config;
@@ -2732,13 +2821,12 @@ describe('Config JIT Initialization', () => {
         };
         MemoryContextManager.mockImplementation(() => mockMemoryContextManager);
     });
-    it('should initialize MemoryContextManager, load memory, and delegate to it when experimentalJitContext is enabled', async () => {
+    it('should initialize MemoryContextManager, load memory, and delegate to it', async () => {
         const params = {
             sessionId: 'test-session',
             targetDir: '/tmp/test',
             debugMode: false,
             model: 'test-model',
-            experimentalJitContext: true,
             userMemory: 'Initial Memory',
             cwd: '/tmp/test',
         };
@@ -2765,27 +2853,24 @@ describe('Config JIT Initialization', () => {
         expect(sessionMemory).toContain('MCP Instructions');
         expect(sessionMemory).toContain('</project_context>');
         expect(sessionMemory).toContain('</loaded_context>');
+        const sessionMemoryWithoutExtension = config.getSessionMemory({
+            includeExtensionContext: false,
+        });
+        expect(sessionMemoryWithoutExtension).toContain('<loaded_context>');
+        expect(sessionMemoryWithoutExtension).not.toContain('<extension_context>');
+        expect(sessionMemoryWithoutExtension).not.toContain('Extension Memory');
+        expect(sessionMemoryWithoutExtension).toContain('<project_context>');
+        expect(sessionMemoryWithoutExtension).toContain('Environment Memory');
+        expect(sessionMemoryWithoutExtension).toContain('</loaded_context>');
         // Verify state update (delegated to MemoryContextManager)
         expect(config.getGeminiMdFileCount()).toBe(1);
         expect(config.getGeminiMdFilePaths()).toEqual(['/path/to/GEMINI.md']);
     });
-    it('should NOT initialize MemoryContextManager when experimentalJitContext is disabled', async () => {
-        const params = {
-            sessionId: 'test-session',
-            targetDir: '/tmp/test',
-            debugMode: false,
-            model: 'test-model',
-            experimentalJitContext: false,
-            userMemory: 'Initial Memory',
-            cwd: '/tmp/test',
-        };
-        config = new Config(params);
-        await config.initialize();
-        expect(MemoryContextManager).not.toHaveBeenCalled();
-        expect(config.getUserMemory()).toBe('Initial Memory');
-    });
-    describe('isMemoryV2Enabled', () => {
-        it('should default to true', () => {
+    describe('memory path access', () => {
+        it('should NOT add the global ~/.cell-cli directory to the workspace', async () => {
+            // Memory does not broaden the workspace to include the global ~/.cell-cli/
+            // directory. Cross-project personal preferences are routed to
+            // ~/.cell-cli/GEMINI.md via the surgical isPathAllowed allowlist instead.
             const params = {
                 sessionId: 'test-session',
                 targetDir: '/tmp/test',
@@ -2794,84 +2879,151 @@ describe('Config JIT Initialization', () => {
                 cwd: '/tmp/test',
             };
             config = new Config(params);
-            expect(config.isMemoryV2Enabled()).toBe(true);
+            await config.initialize();
+            const directories = config.getWorkspaceContext().getDirectories();
+            expect(directories).not.toContain(Storage.getGlobalGeminiDir());
         });
-        it('should return false when experimentalMemoryV2 is explicitly false', () => {
+        it('should allow isPathAllowed to write the global ~/.cell-cli/GEMINI.md file', async () => {
+            // Surgical allowlist: the prompt routes cross-project personal
+            // preferences to ~/.cell-cli/GEMINI.md, so the agent must be able to edit
+            // that exact file via edit/write_file.
             const params = {
                 sessionId: 'test-session',
                 targetDir: '/tmp/test',
                 debugMode: false,
                 model: 'test-model',
                 cwd: '/tmp/test',
-                experimentalMemoryV2: false,
             };
             config = new Config(params);
-            expect(config.isMemoryV2Enabled()).toBe(false);
+            await config.initialize();
+            const globalGeminiMdPath = path.join(Storage.getGlobalGeminiDir(), 'GEMINI.md');
+            expect(config.isPathAllowed(globalGeminiMdPath)).toBe(true);
         });
-        it('should return true when experimentalMemoryV2 is true', () => {
+        it('should NOT allow isPathAllowed to write other files under ~/.cell-cli/ (least privilege)', async () => {
+            // The allowlist is surgical: only ~/.cell-cli/GEMINI.md is reachable.
+            // settings.json, keybindings.json, credentials, etc. remain disallowed.
             const params = {
                 sessionId: 'test-session',
                 targetDir: '/tmp/test',
                 debugMode: false,
                 model: 'test-model',
                 cwd: '/tmp/test',
-                experimentalMemoryV2: true,
             };
             config = new Config(params);
-            expect(config.isMemoryV2Enabled()).toBe(true);
+            await config.initialize();
+            const globalDir = Storage.getGlobalGeminiDir();
+            expect(config.isPathAllowed(path.join(globalDir, 'settings.json'))).toBe(false);
+            expect(config.isPathAllowed(path.join(globalDir, 'keybindings.json'))).toBe(false);
+            expect(config.isPathAllowed(path.join(globalDir, 'oauth_creds.json'))).toBe(false);
         });
-        it('should NOT add the global ~/.cell-cli directory to the workspace when enabled', async () => {
-            // The prompt-driven memoryV2 mode does not broaden the workspace
-            // to include the global ~/.cell-cli/ directory. Cross-project personal
-            // preferences are routed to ~/.cell-cli/GEMINI.md via the surgical
-            // isPathAllowed allowlist instead — see the next two tests.
+        it('should NOT allow isPathAllowed to write into the auto-memory inbox', () => {
+            // <projectMemoryDir>/.inbox/ is owned by the extraction agent and the
+            // /memory inbox review flow. The main agent must not be able to drop
+            // patches in there directly, even though it falls inside <projectTempDir>.
+            // We bypass Config.initialize() (the GitService init path is independently
+            // flaky in this suite) by spying on the storage methods isPathAllowed
+            // actually consults.
             const params = {
                 sessionId: 'test-session',
                 targetDir: '/tmp/test',
                 debugMode: false,
                 model: 'test-model',
                 cwd: '/tmp/test',
-                experimentalMemoryV2: true,
             };
             config = new Config(params);
-            await config.initialize();
-            const directories = config.getWorkspaceContext().getDirectories();
-            expect(directories).not.toContain(Storage.getGlobalGeminiDir());
-        });
-        it('should allow isPathAllowed to write the global ~/.cell-cli/GEMINI.md file', async () => {
-            // Surgical allowlist: when memoryV2 is on, the prompt routes
-            // cross-project personal preferences to ~/.cell-cli/GEMINI.md, so the
-            // agent must be able to edit that exact file via edit/write_file.
+            const fakeMemoryTempDir = '/tmp/test-fake-temp/memory';
+            const fakeProjectTempDir = '/tmp/test-fake-temp';
+            vi.spyOn(config.storage, 'getProjectMemoryTempDir').mockReturnValue(fakeMemoryTempDir);
+            vi.spyOn(config.storage, 'getProjectTempDir').mockReturnValue(fakeProjectTempDir);
+            const inboxRoot = path.join(fakeMemoryTempDir, '.inbox');
+            // The inbox directory itself and any path under it are denied.
+            expect(config.isPathAllowed(inboxRoot)).toBe(false);
+            expect(config.isPathAllowed(path.join(inboxRoot, 'private', 'foo.patch'))).toBe(false);
+            expect(config.isPathAllowed(path.join(inboxRoot, 'global', 'bar.patch'))).toBe(false);
+            // Sibling files under <projectMemoryDir> stay reachable so the main
+            // agent can edit MEMORY.md and topic notes directly.
+            expect(config.isPathAllowed(path.join(fakeMemoryTempDir, 'MEMORY.md'))).toBe(true);
+            expect(config.isPathAllowed(path.join(fakeMemoryTempDir, 'some-topic.md'))).toBe(true);
+        });
+        it('should allow scoped extraction access only to canonical inbox patches', () => {
             const params = {
                 sessionId: 'test-session',
                 targetDir: '/tmp/test',
                 debugMode: false,
                 model: 'test-model',
                 cwd: '/tmp/test',
-                experimentalMemoryV2: true,
             };
             config = new Config(params);
-            await config.initialize();
-            const globalGeminiMdPath = path.join(Storage.getGlobalGeminiDir(), 'GEMINI.md');
-            expect(config.isPathAllowed(globalGeminiMdPath)).toBe(true);
-        });
-        it('should NOT allow isPathAllowed to write other files under ~/.cell-cli/ (least privilege)', async () => {
-            // The allowlist is surgical: only ~/.cell-cli/GEMINI.md is reachable.
-            // settings.json, keybindings.json, credentials, etc. remain disallowed.
+            const fakeMemoryTempDir = '/tmp/test-fake-temp/memory';
+            const fakeProjectTempDir = '/tmp/test-fake-temp';
+            vi.spyOn(config.storage, 'getProjectMemoryTempDir').mockReturnValue(fakeMemoryTempDir);
+            vi.spyOn(config.storage, 'getProjectTempDir').mockReturnValue(fakeProjectTempDir);
+            const inboxRoot = path.join(fakeMemoryTempDir, '.inbox');
+            const privateExtractionPatch = path.join(inboxRoot, 'private', 'extraction.patch');
+            const globalExtractionPatch = path.join(inboxRoot, 'global', 'extraction.patch');
+            expect(config.isPathAllowed(privateExtractionPatch)).toBe(false);
+            runWithScopedMemoryInboxAccess(() => {
+                expect(config.isPathAllowed(privateExtractionPatch)).toBe(true);
+                expect(config.validatePathAccess(privateExtractionPatch)).toBeNull();
+                expect(config.isPathAllowed(globalExtractionPatch)).toBe(true);
+                // Writes (the default checkType for isPathAllowed) remain restricted
+                // to the canonical extraction.patch filenames.
+                expect(config.isPathAllowed(path.join(inboxRoot, 'private', 'other.patch'))).toBe(false);
+                expect(config.isPathAllowed(path.join(inboxRoot, 'private', 'nested', 'extraction.patch'))).toBe(false);
+                // Reads are broadened to the .inbox/{private,global}/ subtree so the
+                // extractor can list and inspect prior patches before consolidating.
+                const privateOtherPatch = path.join(inboxRoot, 'private', 'other.patch');
+                const globalLeftover = path.join(inboxRoot, 'global', 'topic-a.patch');
+                const nestedReadPath = path.join(inboxRoot, 'private', 'nested', 'extraction.patch');
+                expect(config.validatePathAccess(privateOtherPatch, 'read')).toBeNull();
+                expect(config.validatePathAccess(globalLeftover, 'read')).toBeNull();
+                expect(config.validatePathAccess(nestedReadPath, 'read')).toBeNull();
+                expect(config.validatePathAccess(inboxRoot, 'read')).toBeNull();
+                expect(config.validatePathAccess(path.join(inboxRoot, 'private'), 'read')).toBeNull();
+                expect(config.validatePathAccess(path.join(inboxRoot, 'global'), 'read')).toBeNull();
+                // Writes to the same broadened paths are still rejected.
+                expect(config.validatePathAccess(privateOtherPatch)).toContain('Path not in workspace');
+                expect(config.validatePathAccess(nestedReadPath)).toContain('Path not in workspace');
+            });
+            expect(config.isPathAllowed(privateExtractionPatch)).toBe(false);
+            // Outside the scope, reads of inbox files are denied again.
+            expect(config.validatePathAccess(path.join(inboxRoot, 'private', 'other.patch'), 'read')).toContain('Path not in workspace');
+        });
+        it('should restrict scoped auto-memory extraction writes to generated artifacts', () => {
             const params = {
                 sessionId: 'test-session',
                 targetDir: '/tmp/test',
                 debugMode: false,
                 model: 'test-model',
                 cwd: '/tmp/test',
-                experimentalMemoryV2: true,
             };
             config = new Config(params);
-            await config.initialize();
-            const globalDir = Storage.getGlobalGeminiDir();
-            expect(config.isPathAllowed(path.join(globalDir, 'settings.json'))).toBe(false);
-            expect(config.isPathAllowed(path.join(globalDir, 'keybindings.json'))).toBe(false);
-            expect(config.isPathAllowed(path.join(globalDir, 'oauth_creds.json'))).toBe(false);
+            const fakeMemoryTempDir = '/tmp/test-fake-temp/memory';
+            const fakeProjectTempDir = '/tmp/test-fake-temp';
+            const fakeSkillsMemoryDir = path.join(fakeMemoryTempDir, 'skills');
+            vi.spyOn(config.storage, 'getProjectMemoryTempDir').mockReturnValue(fakeMemoryTempDir);
+            vi.spyOn(config.storage, 'getProjectTempDir').mockReturnValue(fakeProjectTempDir);
+            vi.spyOn(config.storage, 'getProjectSkillsMemoryDir').mockReturnValue(fakeSkillsMemoryDir);
+            const inboxRoot = path.join(fakeMemoryTempDir, '.inbox');
+            const privateExtractionPatch = path.join(inboxRoot, 'private', 'extraction.patch');
+            const skillArtifact = path.join(fakeSkillsMemoryDir, 'my-skill', 'SKILL.md');
+            const activeMemoryPath = path.join(fakeMemoryTempDir, 'MEMORY.md');
+            const projectTempPath = path.join(fakeProjectTempDir, 'logs', 'run.log');
+            const workspaceMemoryPath = path.join('/tmp/test', 'GEMINI.md');
+            expect(config.validatePathAccess(activeMemoryPath)).toBeNull();
+            runWithScopedAutoMemoryExtractionWriteAccess(() => {
+                expect(config.validatePathAccess(skillArtifact)).toBeNull();
+                expect(config.validatePathAccess(activeMemoryPath)).toContain('Auto-memory extraction write denied');
+                expect(config.validatePathAccess(projectTempPath)).toContain('Auto-memory extraction write denied');
+                expect(config.validatePathAccess(workspaceMemoryPath)).toContain('Auto-memory extraction write denied');
+                // Reads still use the normal workspace/temp allowlists.
+                expect(config.validatePathAccess(activeMemoryPath, 'read')).toBeNull();
+            });
+            runWithScopedMemoryInboxAccess(() => {
+                runWithScopedAutoMemoryExtractionWriteAccess(() => {
+                    expect(config.validatePathAccess(privateExtractionPatch)).toBeNull();
+                });
+            });
         });
     });
     describe('isAutoMemoryEnabled', () => {
@@ -2922,7 +3074,7 @@ describe('Config JIT Initialization', () => {
             config = new Config(params);
             expect(config.getExperimentalGemma()).toBe(false);
         });
-        it('should return false when experimentalGemma is not provided', () => {
+        it('should return true when experimentalGemma is not provided', () => {
             const params = {
                 sessionId: 'test-session',
                 targetDir: '/tmp/test',
@@ -2931,19 +3083,17 @@ describe('Config JIT Initialization', () => {
                 cwd: '/tmp/test',
             };
             config = new Config(params);
-            expect(config.getExperimentalGemma()).toBe(false);
+            expect(config.getExperimentalGemma()).toBe(true);
         });
-        it('should be independent of experimentalMemoryV2', () => {
+        it('should default to disabled', () => {
             const params = {
                 sessionId: 'test-session',
                 targetDir: '/tmp/test',
                 debugMode: false,
                 model: 'test-model',
                 cwd: '/tmp/test',
-                experimentalMemoryV2: true,
             };
             config = new Config(params);
-            expect(config.isMemoryV2Enabled()).toBe(true);
             expect(config.isAutoMemoryEnabled()).toBe(false);
         });
     });
@@ -3088,6 +3238,27 @@ describe('Plans Directory Initialization', () => {
         const context = config.getWorkspaceContext();
         expect(context.getDirectories()).not.toContain(plansDir);
     });
+    it('should gracefully fallback to default plans directory if retrieving custom directory throw an error', async () => {
+        vi.spyOn(coreEvents, 'emitFeedback');
+        vi.spyOn(fs.promises, 'access').mockResolvedValue(undefined);
+        const config = new Config({
+            ...baseParams,
+            plan: true,
+            planSettings: {
+                directory: '/outside/project/root',
+            },
+        });
+        await config.initialize();
+        const plansDir = config.storage.getPlansDir();
+        // Should fallback to default project temp plans dir
+        expect(plansDir).toContain('plans');
+        expect(plansDir).not.toContain('/outside/project/root');
+        // Should emit a warning feedback
+        expect(coreEvents.emitFeedback).toHaveBeenCalledWith('warning', expect.stringContaining('Invalid custom plans directory'), expect.any(Error));
+        // Should still add the fallback plans directory to workspace context if it exists
+        const context = config.getWorkspaceContext();
+        expect(context.getDirectories()).toContain(plansDir);
+    });
     it('should NOT create plans directory or add it to workspace context when plan is disabled', async () => {
         const config = new Config({
             ...baseParams,
@@ -3216,4 +3387,85 @@ describe('ADKSettings', () => {
         expect(config.getAgentSessionNoninteractiveEnabled()).toBe(true);
     });
 });
+describe('hasGemini35FlashGAAccess model setting', () => {
+    const baseParams = {
+        sessionId: 'test',
+        targetDir: '.',
+        debugMode: false,
+        model: 'test-model',
+        cwd: '.',
+    };
+    it('should set DEFAULT_GEMINI_FLASH_MODEL to gemini-3.5-flash and PREVIEW_GEMINI_FLASH_MODEL to gemini-3-flash-preview if hasGemini35FlashGAAccess returns true and authType is USE_GEMINI', () => {
+        const config = new Config(baseParams);
+        config['contentGeneratorConfig'] = { authType: AuthType.USE_GEMINI };
+        // Set experiment to return true for GEMINI_3_5_FLASH_GA_LAUNCHED
+        config.setExperiments({
+            experimentIds: [],
+            flags: {
+                [ExperimentFlags.GEMINI_3_5_FLASH_GA_LAUNCHED]: {
+                    boolValue: true,
+                },
+            },
+        });
+        // Call the method
+        const result = config.hasGemini35FlashGAAccess();
+        expect(result).toBe(true);
+        expect(DEFAULT_GEMINI_FLASH_MODEL).toBe('gemini-3.5-flash');
+        expect(PREVIEW_GEMINI_FLASH_MODEL).toBe('gemini-3-flash-preview');
+    });
+    it('should set DEFAULT_GEMINI_FLASH_MODEL to gemini-3.5-flash and PREVIEW_GEMINI_FLASH_MODEL to gemini-3-flash-preview if hasGemini35FlashGAAccess returns true and authType is LOGIN_WITH_GOOGLE', () => {
+        const config = new Config(baseParams);
+        config['contentGeneratorConfig'] = { authType: AuthType.LOGIN_WITH_GOOGLE };
+        // Set experiment to return true for GEMINI_3_5_FLASH_GA_LAUNCHED
+        config.setExperiments({
+            experimentIds: [],
+            flags: {
+                [ExperimentFlags.GEMINI_3_5_FLASH_GA_LAUNCHED]: {
+                    boolValue: true,
+                },
+            },
+        });
+        // Call the method
+        const result = config.hasGemini35FlashGAAccess();
+        expect(result).toBe(true);
+        expect(DEFAULT_GEMINI_FLASH_MODEL).toBe('gemini-3.5-flash');
+        expect(PREVIEW_GEMINI_FLASH_MODEL).toBe('gemini-3-flash-preview');
+    });
+    it('should set DEFAULT_GEMINI_FLASH_MODEL to gemini-3.5-flash and PREVIEW_GEMINI_FLASH_MODEL to gemini-3-flash-preview if hasGemini35FlashGAAccess returns true and authType is KEYCLOAK', () => {
+        const config = new Config(baseParams);
+        config['contentGeneratorConfig'] = { authType: AuthType.KEYCLOAK };
+        // Set experiment to return true for GEMINI_3_5_FLASH_GA_LAUNCHED
+        config.setExperiments({
+            experimentIds: [],
+            flags: {
+                [ExperimentFlags.GEMINI_3_5_FLASH_GA_LAUNCHED]: {
+                    boolValue: true,
+                },
+            },
+        });
+        // Call the method
+        const result = config.hasGemini35FlashGAAccess();
+        expect(result).toBe(true);
+        expect(DEFAULT_GEMINI_FLASH_MODEL).toBe('gemini-3.5-flash');
+        expect(PREVIEW_GEMINI_FLASH_MODEL).toBe('gemini-3-flash-preview');
+    });
+    it('should set DEFAULT_GEMINI_FLASH_MODEL and PREVIEW_GEMINI_FLASH_MODEL to gemini-3-flash if hasGemini35FlashGAAccess returns true and authType is USE_VERTEX_AI', () => {
+        const config = new Config(baseParams);
+        config['contentGeneratorConfig'] = { authType: AuthType.USE_VERTEX_AI };
+        // Set experiment to return true for GEMINI_3_5_FLASH_GA_LAUNCHED
+        config.setExperiments({
+            experimentIds: [],
+            flags: {
+                [ExperimentFlags.GEMINI_3_5_FLASH_GA_LAUNCHED]: {
+                    boolValue: true,
+                },
+            },
+        });
+        // Call the method
+        const result = config.hasGemini35FlashGAAccess();
+        expect(result).toBe(true);
+        expect(DEFAULT_GEMINI_FLASH_MODEL).toBe('gemini-3-flash');
+        expect(PREVIEW_GEMINI_FLASH_MODEL).toBe('gemini-3-flash');
+    });
+});
 //# sourceMappingURL=config.test.js.map