What's Changed

• refactor(a2a-server): implement V1 to V2 settings migration logic by @jvargassanchez-dot in #29450
• fix(acp): bridge PromptResponse.usage and emit usage_update notifications (#29389) by @elberthc-byte in #29549
• Changelog for v0.63.0-preview.0 by @gemini-cli-robot in #29565
• fix(cli): propagate resolved folder trust state in headless mode (#29031) by @amelidev in #29528
• chore(release): bump version to 0.64.0-nightly.20260929.gd75234cae by @gemini-cli-robot in #29567
• fix(cli): prevent CPU hang and quote swallowing on @ within code (#29434) by @elberthc-byte in #29557
• fix(core): serialize file tool operations and make writes atomic (#29078) by @elberthc-byte in #29499
• fix(core): implement append-only delta patching and bounded history windowing in ChatRecordingService by @jvargassanchez-dot in #29568
• fix(cli): persist state atomically and recover from backup on corruption by @urielefrenvirtusa in #29558
• fix(cli): ensure Ctrl+C emergency abort reaches cancellation handler during active operations by @urielefrenvirtusa in #29586
• fix(cli): resolve @file:line references and prevent ghost text wrap hang by @jesussamuel-byte in #29581
• fix(ui): ensure Windows ConPTY forwards IME cursor position by @jesussamuel-byte in #29560
• fix(cli): retry directory removal on Windows locking errors during extension updates by @jesussamuel-byte in #29540
• fix(acp): resolve session by exact id and handle listener cleanup on session failure by @diegogodinezr in #29580
• fix(cli): preserve scroll position and partition pending height budget by @luisfelipe-alt in #29520
• fix(cli): ensure Enter and Spacebar reliably confirm selection list options by @ugorla-dev in #29502
• fix(patch): cherry-pick 2ce1a69 to release/v0.64.0-preview.0-pr-29672 to patch version v0.64.0-preview.0 and create version 0.64.0-preview.1 by @gemini-cli-robot in #29696

Full Changelog: v0.63.0...v0.64.0

What's Changed

• fix(a2a-server): add early return on unsupported store in tasks metadata endpoint by @jesussamuel-byte in #29334
• Changelog for v0.61.0-preview.0 by @gemini-cli-robot in #29344
• Changelog for v0.60.0 by @gemini-cli-robot in #29345
• fix(core,acp): format MCP tool call titles as structured signatures and segregate explanations by @jvargassanchez-dot in #29341
• chore(release): bump version to 0.62.0-nightly.20260915.gae28844fb by @gemini-cli-robot in #29346
• fix(core): retain oauth refresh token on refresh and make credential deletion idempotent by @villahernandez-coder in #29339
• fix(ui): guard against negative layout dimensions in border rendering by @diegogodinezr in #29347
• test(integration): deflake run_shell_command and file-system-interactive tests by @DavidAPierce in #29185
• fix(core): improve PTY file descriptor cleanup and execution lifecycle management by @jesussamuel-byte in #29340
• chore/release: bump version to 0.62.0-nightly.20260918.g9450ade79 by @gemini-cli-robot in #29383
• fix(core): synchronize ConPTY process exit lifecycle and harden PTY output finalization by @jvargassanchez-dot in #29379
• fix(cli): suppress uncaught AbortError logs during request cancellation by @urielefrenvirtusa in #29343
• fix(core,cli): improve terminal buffer memory management and format Windows diagnostic paths by @jesussamuel-byte in #29380
• fix(vscode-ide-companion): preserve terminal focus when closing diff tabs by @amelidev in #29378
• fix(core): update auth error documentation link to valid anchor and add fallback ( #26140 ) by @villahernandez-coder in #29377
• fix(core): normalize proxy-agent esbuild interop for environment proxy resolution by @diegogodinezr in #29401
• fix(cli): emit tool_call update prior to request_permission in ACP mode by @urielefrenvirtusa in #29439
• Feat/gemini 3.8 flash 3.5 flash lite by @DavidAPierce in #29443
• Check for vsc integration test presence when attempting to run. by @DavidAPierce in #29462

Full Changelog: v0.61.0...v0.62.0

What's Changed

• Changelog for v0.60.0-preview.0 by @gemini-cli-robot in #29251
• chore(release): bump version to 0.61.0-nightly.20260908.gc647533d6 by @gemini-cli-robot in #29254
• Changelog for v0.59.0 by @gemini-cli-robot in #29253
• fix(core): preserve explicit versioned Flash model IDs by @SandyTao520 in #29252
• fix(core): prevent indirect prompt injection via build file modifications and untrusted flags by @villahernandez-coder in #29250
• fix(sandbox): harden filesystem boundaries and isolate runtime state by @diegogodinezr in #29214
• fix(core): ensure AgentLoopContext properties are preserved across object spread by @diegogodinezr in #29335
• fix(patch): cherry-pick 62364cb to release/v0.61.0-preview.0-pr-29443 to patch version v0.61.0-preview.0 and create version 0.61.0-preview.1 by @gemini-cli-robot in #29455

Full Changelog: v0.60.0...v0.61.0

Changelog for v0.61.0-preview.1

• fix(cli): display retry progress indicator during connection recovery (#28340) by @amelidev in #29468
• Changelog for v0.61.0-preview.1 by @gemini-cli-robot in #29469
• Changelog for v0.61.0 by @gemini-cli-robot in #29472
• fix(cli): distinguish missing MCP enablement config from malformed JSON by @jesussamuel-byte in #29446
• fix(cli): restore paused stdin after capability detection by @ugorla-dev in #29487
• fix(core): bound tool output size and optimize memory lifecycle in long-running agent loops by @diegogodinezr in #29451
• fix(core): remove invalid diff.external override by @urielefrenvirtusa in #29467
• chore(release): bump version to 0.63.0-nightly.20260923.gf50ba8608 by @gemini-cli-robot in #29471
• Changelog for v0.62.0-preview.0 by @gemini-cli-robot in #29470
• fix(core): clean up temporary directory when background shell execution exits by @jesussamuel-byte in #29437
• fix(acp): resolve session before config initialization and avoid same-minute filename collisions by @jesussamuel-byte in #29463
• fix(core): align policy redirection gates, path validation, and workflow parsing by @DavidAPierce in #29506
• fix(auth): prevent infinite auth loop from file contention, headless keyring, and supervisor state drops (#28341) by @villahernandez-coder in #29448
• fix(core): enable autonomous plan execution in non-interactive mode by @urielefrenvirtusa in #29539
• fix(core): disable truncation when maxChars <= 0 in formatTruncatedToolOutput by @diegogodinezr in #29542

Full Changelog: v0.62.0...v0.63.0

What's Changed

• fix(core): improve destination validation and connection routing in web fetch utilities by @diegogodinezr in #29120
• fix(core): enforce RFC 9207 issuer identification in MCP OAuth flow by @jvargassanchez-dot in #29117
• chore(release): bump version to 0.60.0-nightly.20260901.g0bd1d4397 by @gemini-cli-robot in #29162
• Changelog for v0.58.0 by @gemini-cli-robot in #29161
• fix(cli): isolate temporary directory for macOS Seatbelt sandbox by @jvargassanchez-dot in #29171
• feat(extensions): harden path resolution and boundary validation in extension loader by @diegogodinezr in #29169
• Changelog for v0.59.0-preview.0 by @gemini-cli-robot in #29159
• fix(core): sanitize and remove hardcoded Google CrUX API key in chrome-devtools-mcp by @amelidev in #29158
• fix(extensions): prompt for consent on environment changes and sanitize runtime-altering environment variables by @amelidev in #28863
• fix(core): enhance workspace path boundary checks and symlink resolution in command safety and file discovery by @jesussamuel-byte in #29170
• fix(config): enforce strict permission and ownership checks on system-wide configuration paths by @jesussamuel-byte in #29115
• fix(core): mitigate NTFS 8.3 short name (SFN) path by @urielefrenvirtusa in #29116
• fix(cli): isolate settings directory in sandbox containers by @jvargassanchez-dot in #29216
• fix(core): enforce envelope metadata provenance for untrusted tool outputs by @luisfelipe-alt in #29215

New Contributors

• @urielefrenvirtusa made their first contribution in #29116

Full Changelog: v0.59.0...v0.60.0

What's Changed

• Changelog for v0.57.0-preview.0 by @gemini-cli-robot in #28918
• fix(core): ensure consistent symlink evaluation in ignore path handling by @luisfelipe-alt in #28915
• refactor(core): remove eslint-disable and type-asserts from shellExecutionService by @DavidAPierce in #28862
• fix(sandbox): isolate Docker and container runtime sockets and binaries in macOS Seatbelt by @josebalius in #28935
• fix(a2a-server): clear stale cancellation error on new message turns by @amelidev in #28940
• fix(core): declare top-level safety checkers in write policy configuration by @luisfelipe-alt in #28961
• (FIX) history rollback and retry nudge optimizations by @DavidAPierce in #28934

Full Changelog: v0.57.0...v0.58.0

What's Changed

• fix(core): dynamically resolve Cloud Workstations proxy redirect URI for OAuth flows by @amelidev in #28688
• fix(core): resolve swallowed directory mismatch in IDE connections by @amelidev in #28729
• Feat/eval validate by @ved015 in #28344
• feat(evals): add tool call formatter and integrate failure summaries by @ved015 in #28305
• Changelog for v0.55.1 by @gemini-cli-robot in #28779
• test(e2e): stabilize file-system-interactive test on slow runners by @DavidAPierce in #28793
• fix(core): implement context-aware silent retries and availability TTL for capacity errors ( #28761 ) by @DavidAPierce in #28790
• fix(core): rollback entire multi-turn request on cancellation or abort by @amelidev in #28801
• fix(core): normalize git environment and resolve workspace state mismatch by @luisfelipe-alt in #28792
• [SSR Agent] Issue Fix (19826): Migrate process.env to vi.stubEnv in a2a-server tests by @joneba-google in #28811
• [SSR Agent] Issue Fix (21911): Add composite flag to packages/cli tsconfig by @joneba-google in #28813
• [SSR Agent] Issue Fix (26120): Clarify privacy notice wording and selection options by @joneba-google in #28820
• [SSR Agent] Issue Fix (21919): Fix TypeScript strict-null errors in integration tests by @joneba-google in #28814
• [SSR Agent] Issue Fix (21477): Prevent indefinite TUI hang by adding execution timeouts by @joneba-google in #28812
• [SSR Agent] Issue Fix (19239): Update /clear command docs to include context reset by @joneba-google in #28847
• [SSR Agent] Issue Fix (24587): Fix misleading admin error for personal accounts by @joneba-google in #28819
• [SSR Agent] Issue Fix (19463): Format cli_help subagent output as markdown by @joneba-google in #28864
• [SSR Agent] Issue Fix (28050): Add Vertex AI locations documentation link by @joneba-google in #28865
• [SSR Agent] Issue Fix (22093): Prevent subagents from running when agents mode is disabled by @joneba-google in #28867
• [SSR Agent] Issue Fix (23954): Add trailing space to autocomplete suggestions by @joneba-google in #28868
• [SSR Agent] Issue Fix (24935): Force terminal buffer rerender after exiting external editors by @joneba-google in #28880
• [SSR Agent] Issue Fix (28518): Fix sub-agent handoff token regression on startup by @joneba-google in #28882
• fix(core): preserve empty text turns with tools or media by @DavidAPierce in #28892
• fix(patch): cherry-pick 812f7a2 to release/v0.57.0-preview.0-pr-28934 to patch version v0.57.0-preview.0 and create version 0.57.0-preview.1 by @gemini-cli-robot in #29024

Full Changelog: v0.56.0...v0.57.0

What's Changed

• fix/verify release npm ci ignore scripts by @rmedranollamas in #28116
• fix(ci): prevent workspace binary shadowing in release verification by @galdawave in #28132
• Feat/tool registry discovery by @ved015 in #28113
• fix(ci): prevent bad NPM releases and promote job crashes by @galdawave in #28147
• Changelog for v0.50.0-preview.1 by @gemini-cli-robot in #28150
• Fix no_proxy test by @jerrylin3321 in #28131
• chore(release): bump version to 0.51.0-nightly.20260625.g3fbf93e26 by @gemini-cli-robot in #28151
• Vertex base url update by @DavidAPierce in #28145
• fix(security): enforce case-insensitive sensitive path blocklist and vscode hitl by @luisfelipe-alt in #27966
• fix(core-tools): resolve defensive path resolution for at-reference files and fix macOS tests by @luisfelipe-alt in #28053
• feat(caretaker): implement Cloud Run webhook ingestion service by @chadd28 in #28015
• fix(core): resolve symbolic link directory escape in memory import processor by @luisfelipe-alt in #28233
• feat(caretaker): egress cloud run service skeleton by @chadd28 in #28167
• fix(sandbox): make ~/.gitconfig read-only in the macOS sandbox by @ompatel-aiml in #28221
• fix(core): preserve escape sequences in string literals for modern models by @luisfelipe-alt in #28299
• fix(core): strip thoughts from scrubbed history turns and resolve thought leakage by @amelidev in #27971
• Refactor: exclude transient CI configuration files from workspace context by @DavidAPierce in #28216
• feat(caretaker-triage): add triage worker core foundational modules by @chadd28 in #28163
• feat(caretaker-egress): implement octokit github action handler for egress service by @chadd28 in #28303
• chore(release): bump version to 0.52.0-nightly.20260707.g27a3da3e8 by @gemini-cli-robot in #28323
• Changelog for v0.51.0-preview.0 by @gemini-cli-robot in #28320
• Changelog for v0.50.0 by @gemini-cli-robot in #28322
• fix(core-tools): bypass LLM correction for JSON and IPYNB files in write_file and replace by @amelidev in #28223
• feat(caretaker-triage): implement main worker execution loop and egress action publisher by @chadd28 in #28306
• fix(privacy): show a clear message when the account has no Code Assist tier by @ompatel-aiml in #28304
• fix(core): enrich shared project quota limit errors with setup hint by @amelidev in #28391
• fix(a2a-server): ensure task cancellation aborts execution loop by @luisfelipe-alt in #28316
• fix(core): simplify plan mode write policy to support relative paths by @DavidAPierce in #28398
• feat(core): Bump node google-auth-library version to 10.9.0 by @jerrylin3321 in #28385
• chore/release: bump version to 0.52.0-nightly.20260715.gfa975395b by @gemini-cli-robot in #28402
• fix(core,a2a): group cancelled tool responses and coalesce consecutive roles to prevent 400 Bad Request by @luisfelipe-alt in #28407
• feat(caretaker-triage): implement LLM triage orchestrator and container build by @chadd28 in #28345
• refactor(cli): align macOS permissive Seatbelt profiles with deny-default model by @ompatel-aiml in #28424
• fix(core): mitigate infinite ReAct loops and prompt injection loops by @amelidev in #28429
• fix(a2a-server): enforce workspace trust and task isolation to prevent RCE by @luisfelipe-alt in #28470
• fix(core): sequentially verify cached credentials and restore GOOGLE_APPLICATION_CREDENTIALS fallback by @luisfelipe-alt in #28472
• feat(evals): add eval coverage report command by @ved015 in #28169
• Changelog for v0.53.0-preview.0 by @gemini-cli-robot in #28507
• Changelog for v0.52.0 by @gemini-cli-robot in #28508
• chore(release): bump version to 0.54.0-nightly.20260722.gf743ab579 by @gemini-cli-robot in #28510
• fix(caretaker): sanitize and wrap issue title in untrusted_context by @chadd28 in #28352
• chore(caretaker): update vitest to v3.2.4 and add package-lock.json files by @chadd28 in #28409
• fix(core): rotate session ID on model fallback to prevent stateful API errors by @amelidev in #28469
• feat(caretaker-triage): post comment before auto-closing issues by @chadd28 in #28411
• fix(core): enforce HTTPS for GoogleCredentialsAuthProvider to prevent cleartext leakage by @amelidev in #28517
• fix(core): filter out thought parts from getHistoryTurns when context management is disabled by @DavidAPierce in #28509
• fix(a2a-server): normalize CRLF line endings to LF in getProposedContent by @luisfelipe-alt in #28531
• fix(core): enforce explicit tag length and validation in file keychain by @luisfelipe-alt in #28523
• chore/release: bump version to 0.54.0-nightly.20260728.gbef611950 by @gemini-cli-robot in #28552
• feat(pr-generator-db): implement Firestore concurrency dual-locking and test ingestion utilities by @joneba-google in #28432
• feat(pr-generator-agent): implement Antigravity agent runner and prompt templates … by @joneba-google in #28434
• fix(core): skip merged function-response turns when finding the active loop by @adamfweidman in #28565
• chore(release): bump version to 0.55.0-nightly.20260728.gd29268d36 by @gemini-cli-robot in #28569
• Changelog for v0.54.0-preview.0 by @gemini-cli-robot in #28567
• Changelog for v0.53.0 by @gemini-cli-robot in #28568
• chore(release): bump version to 0.55.0-nightly.20260729.g3499c84f7 by @gemini-cli-robot in #28573
• fix(core): classify capacity exhaustion as terminal to prevent retry hangs by @luisfelipe-alt in #28599
• fix(core,cli): propagate InvalidStreamError details to UI for specific empty response guidance by @DavidAPierce in #28566
• fix(cli): fall back to embedded macOS seatbelt profiles if missing by @amelidev in #28551
• feat(pr-generator-core): add environment config parser, command executor, GitHub R… by @joneba-google in #28435
• feat(pr-generator-orchestrator): implement iterative bug-fixing state machine and container worker entrypoint by @joneba-google in #28433
• feat(pr-generator-infra): configure Cloud Run job, Workflows definition, and Dockerfile by @joneba-google in #28431
• fix(release): handle npm dist-tag deletion failures on registries that forbid it by @DavidAPierce in #28694
• fix(core): stop a new user message fusing into an unanswered tool response by @adamfweidman in #28700
• fix(core,cli): repair /compress session reload and quota-fallback tool response loss by @adamfweidman in #28672
• fix(core): preserve functionCall thoughtSignature when stripping thought parts by @sarbojitrana in #28607
• fix(core): unwrap and parse nested gaxios streaming errors from cause message by @luisfelipe-alt in #28689
• Changelog for v0.55.0-preview.1 by @gemini-cli-robot in #28706

Full Changelog: v0.54.0...v0.55.1

What's Changed

• Changelog for v0.53.0-preview.0 by @gemini-cli-robot in #28507
• Changelog for v0.52.0 by @gemini-cli-robot in #28508
• chore(release): bump version to 0.54.0-nightly.20260722.gf743ab579 by @gemini-cli-robot in #28510
• fix(caretaker): sanitize and wrap issue title in untrusted_context by @chadd28 in #28352
• chore(caretaker): update vitest to v3.2.4 and add package-lock.json files by @chadd28 in #28409
• fix(core): rotate session ID on model fallback to prevent stateful API errors by @amelidev in #28469
• feat(caretaker-triage): post comment before auto-closing issues by @chadd28 in #28411
• fix(core): enforce HTTPS for GoogleCredentialsAuthProvider to prevent cleartext leakage by @amelidev in #28517
• fix(core): filter out thought parts from getHistoryTurns when context management is disabled by @DavidAPierce in #28509
• fix(a2a-server): normalize CRLF line endings to LF in getProposedContent by @luisfelipe-alt in #28531
• fix(core): enforce explicit tag length and validation in file keychain by @luisfelipe-alt in #28523
• chore/release: bump version to 0.54.0-nightly.20260728.gbef611950 by @gemini-cli-robot in #28552
• feat(pr-generator-db): implement Firestore concurrency dual-locking and test ingestion utilities by @joneba-google in #28432
• feat(pr-generator-agent): implement Antigravity agent runner and prompt templates … by @joneba-google in #28434
• fix(core): skip merged function-response turns when finding the active loop by @adamfweidman in #28565
• chore(release): bump version to 0.55.0-nightly.20260729.g3499c84f7 by @gemini-cli-robot in #28573
• fix(core): classify capacity exhaustion as terminal to prevent retry hangs by @luisfelipe-alt in #28599
• fix(core,cli): propagate InvalidStreamError details to UI for specific empty response guidance by @DavidAPierce in #28566
• fix(cli): fall back to embedded macOS seatbelt profiles if missing by @amelidev in #28551

Full Changelog: v0.53.1...v0.54.0

What's Changed

• fix(core,a2a): group cancelled tool responses and coalesce consecutive roles to prevent 400 Bad Request by @luisfelipe-alt in #28407
• feat(caretaker-triage): implement LLM triage orchestrator and container build by @chadd28 in #28345
• refactor(cli): align macOS permissive Seatbelt profiles with deny-default model by @ompatel-aiml in #28424
• fix(core): mitigate infinite ReAct loops and prompt injection loops by @amelidev in #28429
• fix(a2a-server): enforce workspace trust and task isolation to prevent RCE by @luisfelipe-alt in #28470
• fix(core): sequentially verify cached credentials and restore GOOGLE_APPLICATION_CREDENTIALS fallback by @luisfelipe-alt in #28472
• feat(evals): add eval coverage report command by @ved015 in #28169

Full Changelog: v0.52.0...v0.53.0

What's Changed

• Refactor: exclude transient CI configuration files from workspace context by @DavidAPierce in #28216
• feat(caretaker-triage): add triage worker core foundational modules by @chadd28 in #28163
• feat(caretaker-egress): implement octokit github action handler for egress service by @chadd28 in #28303
• chore(release): bump version to 0.52.0-nightly.20260707.g27a3da3e8 by @gemini-cli-robot in #28323
• Changelog for v0.51.0-preview.0 by @gemini-cli-robot in #28320
• Changelog for v0.50.0 by @gemini-cli-robot in #28322
• fix(core-tools): bypass LLM correction for JSON and IPYNB files in write_file and replace by @amelidev in #28223
• feat(caretaker-triage): implement main worker execution loop and egress action publisher by @chadd28 in #28306
• fix(privacy): show a clear message when the account has no Code Assist tier by @ompatel-aiml in #28304
• fix(core): enrich shared project quota limit errors with setup hint by @amelidev in #28391
• fix(a2a-server): ensure task cancellation aborts execution loop by @luisfelipe-alt in #28316
• fix(core): simplify plan mode write policy to support relative paths by @DavidAPierce in #28398
• feat(core): Bump node google-auth-library version to 10.9.0 by @jerrylin3321 in #28385
• chore/release: bump version to 0.52.0-nightly.20260715.gfa975395b by @gemini-cli-robot in #28402

Full Changelog: v0.51.0...v0.52.0