Release notes
If your company gives you a Gemini Enterprise account, you can now sign in through a Google Cloud project, use an assigned or automatically assigned GE-Standard or GE-Plus license seat, choose the region where inference runs, and retain the controls set by your administrator. If your organization uses an outside identity provider, choose Use advanced SSO config on the Google Cloud sign-in screen for Workforce Identity Federation. Application Default Credentials is another route for using Agent Platform. Think of one office building adding three entrances for different badges while keeping the same company access rules.
If you open another CLI window on the same machine and load the same conversation, you now get an advisory that does not interrupt your work. It points to /fork, which creates a new branch of the conversation before you continue. Previously, both windows could write into the same conversation trajectory, like two people sharing one pen on the same line and mixing their sentences together. Now there is a signpost before that happens, so you can choose separate lines.
When an agent works in a Git repository, the .git directory is now read-only: it can be inspected but not changed. That directory holds version-control information such as commits and branches, so the agent can still understand the project's history while being unable to rewrite it from inside the sandbox, an isolated execution area. It is like replacing a filing cabinet door with a display case: you can read the records inside, but cannot reach in and alter a page.
If you add hooks, small programs triggered by particular events, to record or finish a workflow, the final step no longer slips past them. Hooks defined in hooks.json now run before the built-in termination checks. That lets PostInvocation observe the final call in a turn, and lets Stop run instead of remaining unreachable behind those checks. It is like placing the timekeeper beside the track before the last relay runner arrives; only then can the stopwatch be pressed at the finish.
When a model calls the schedule tool, DurationSeconds and MaxIterations no longer fail just because they arrive as JSON, a text format for exchanging data, numbers without quotation marks. Integral values are now accepted, so a duration in seconds or a maximum iteration count can be written as a number. Decimal values get a clear error because these fields require whole numbers. It is like a reservation form finally understanding “3 people” without demanding that 3 be turned into a text label, while still rejecting the nonsensical “3.5 people.”
You may have specified --model or --effort yet found an interactive session or headless -p run quietly using the saved or default model. That is fixed: the flags are applied before model configuration is initialized. A bare --effort is also resolved against the model you selected, rather than the default model that could move you elsewhere. Effort is the setting for how much reasoning work a model uses. It is like ordering both a main dish and its portion size; the kitchen now follows the order you gave instead of serving the back-office default.
When coordinating several subagents, stopping no longer ends only the current conversation while descendant subagents and their background tasks keep running. The whole subagent tree now stops together. A coordinator waiting for active work also no longer keeps injecting empty continue steps, wasting tokens, units of AI processing and billing, and blocking progress. Another fix makes tools that an MCP server marks as always-background genuinely avoid blocking a turn. It is like switching off a power strip and cutting power to every connected appliance, rather than darkening only the first lamp.
In multi-select prompts, the spacebar can select an option again, including in the ask_question dialog and the onboarding import checkbox; the hint bar now says so instead of leaving x as the only toggle. When the input box shows a suggestion dropdown, Left and Right no longer get captured by that dropdown, so you can move the cursor and edit text. If the model picker has no models available, it now still shows its header, footer, and an esc hint to return. It is like putting three everyday buttons back on a control panel so they do not disappear when you reach for them.
When an MCP server, using the Model Context Protocol that lets AI connect to external tools, drops its connection unexpectedly, it no longer leaves an unclosed process behind. Such a process may be invisible on screen yet keep using computer resources; this fix handles that leak when the connection falls away. It is like a customer-service call dropping without leaving an operator at the other end still wearing a headset and waiting for an answer.
When you open a plain document in the artifact viewer, it no longer gets horizontally clipped by default. Only diagram artifacts, viewable output pieces, need that treatment, so ordinary documents now display normally. Another fix fills in the sandbox network record: even if the command itself ends successfully, a network request denied by the sandbox is recorded. It is like a gallery no longer trimming every work to poster proportions while the entrance desk also logs every visitor denied admission.
Original changelog
Original changelogThree new sign-in routes for enterprise accounts
Added Business sign-in for Gemini Enterprise accounts, so you can authenticate with a Google Cloud project under Google Cloud terms, use a license seat allocated or auto-assigned from your organization's GE-Standard or GE-Plus subscription, run inference in a chosen region, and have your organization's administrator controls applied to various features.
Added Workforce Identity Federation sign-in for enterprise users, available as the `Use advanced SSO config` option on the Google Cloud sign-in screen, so organizations that federate identity through an external provider can authenticate with their own identity provider.
Added sign-in with Application Default Credentials so you can use Agent Platform.
Original changelogA warning before two sessions write into one conversation
Added a non-blocking advisory banner when the same conversation is already open in another CLI instance on the same machine, pointing at `/fork` so two sessions no longer interleave writes into one trajectory.
Original changelogThe sandbox can inspect Git, but cannot rewrite it
Improved the terminal sandbox by granting read-only rather than writable access to a Git repository's `.git` directory, so the agent can inspect repository metadata without being able to rewrite it from inside the sandbox.
Original changelogHooks can finally catch the final handoff
Improved hook ordering so hooks defined in `hooks.json` run before the built-in termination checks, which lets `PostInvocation` hooks observe the final invocation of a turn and lets `Stop` hooks run at all instead of sitting unreachable behind the built-ins.
Original changelogThe scheduler now understands numeric values
Improved the `schedule` tool to accept `DurationSeconds` and `MaxIterations` when a model emits them as bare JSON numbers rather than strings, accepting integral values and rejecting non-integral ones with a clear error instead of failing the call.
Original changelogYour selected model and effort no longer get quietly replaced
Fixed `--model` and `--effort` being ignored in interactive sessions and in headless `-p` runs, where the flags were applied after model configuration had already been initialized so the run silently fell back to the persisted or default model.
Fixed a bare `--effort` resolving against the default model instead of the model you actually have selected, which could silently move you to a different model.
Original changelogBackground work can now actually stop or stay in the background
Fixed stopping a subagent tree stopping only the conversation it was invoked from, while every descendant subagent and the background tasks they owned kept running and the CLI still reported them as killed.
Fixed a forced-continuation deadlock where a coordinator waiting on active subagents or background tasks would loop injecting empty continue steps until it hit the invocation limit, wasting tokens and blocking progress.
Fixed tools that an MCP server marks to always run in the background executing as blocking calls that stalled the turn.
Original changelogOptions, cursor keys, and the model picker work normally again
Fixed the spacebar not toggling an option in multi-select prompts, including the `ask_question` dialog and the onboarding import checkbox, which left `x` as the only working toggle; the hint bar now advertises it.
Fixed the Left and Right arrow keys being captured to navigate the input box suggestion dropdown, so you can move the cursor and edit text again while suggestions are showing.
Fixed the model picker's "No models available" state rendering without its header and footer, so it now shows the standard chrome and an `esc` hint to go back.
Original changelogA dropped MCP connection no longer leaves a process behind
Fixed an MCP process leak when a server connection dropped unexpectedly.
Original changelogDocuments and denied network requests are no longer hidden
Fixed the artifact viewer corrupting plain documents by horizontally clipping every document rather than only the diagram artifacts that need it.
Fixed the sandbox not recording blocked network requests when the command itself exited successfully, which hid the fact that a request had been denied.