Release notes
If your company gives you a Gemini API key, the CLI can now use the Gemini API directly without making you sign in first. Add {"modelProvider": "gemini"} to settings.json, export GEMINI_API_KEY, and point GOOGLE_GEMINI_BASE_URL at your own endpoint when needed. The banner and /help identify the credential as a Gemini API key, while /logout explains that it came from the environment rather than ending a signed-in session. Direct API use no longer gets stuck on the sign-in screen, and requests to a custom endpoint no longer include a session field that endpoint may not support. Your staff badge opens the door without first visiting reception for a visitor pass.
When a library's index machine breaks, staff can still use the local card cabinet, while each newly delivered tool is seal-checked before it reaches the shelf. Likewise, when endpoint security blocks ripgrep, the file-content search tool, /codesearch falls back to local search instead of stopping because that binary cannot run. The embedded ripgrep also changes where it lives: extracted files go in the user cache directory rather than /tmp. Their contents are checked with SHA-256, and atomic renaming keeps the file intact and avoids races between concurrent runs.
Treat the list like a bookshop shelf: note page counts on the spine, then measure full-width titles and both shelf edges before arranging it, so browsing does not mean pulling out every book again. In a long artifact list, every arrow-key press used to reread every preview from disk. The list now caches each file's preview line count, so scrolling does not repeat that work. It also fixes garbled or overflowing previews caused by wide CJK characters and emoji; when entries disappear, the cursor no longer points past the end, and the scroll calculation includes the header and footer.
After you create a custom agent for recurring work, it can now use manage_task to list and kill its own background tasks, provided it has not opted out of fundamental components. Its tool steps now say Killed task X and Checked task X, so the outcome is visible. A separate source of loops has also gone: once work moves to the background, manage_task and manage_inbox results no longer include anti-polling reminder text, because that text itself could nudge the model into a polling loop. It is like giving the person on duty a card to inspect and cancel their own to-do list, while removing the wall note that keeps telling them to check it again.
When you ask an agent to look up information on the web, you no longer have to stare at an unexplained step while results are pending. search_web now shows the query while the search is running, so you can see what it is looking for before it returns. The search itself and its results are unchanged; information that appeared only at the end now appears earlier. It is like asking someone to visit a records room and having them name the topic before they leave, rather than showing you the index card only after they return.
When you open /resume to find an old conversation, its second tab now has a name that distinguishes it from the first. The keybinding for deleting a conversation has moved from ctrl+delete to f4, because macOS terminals report the delete key inconsistently and the old binding silently did nothing there. Switching to the second tab and back no longer makes conversations disappear with No conversations available; when a tab is empty, the tab hint also leaves the shortcut bar. It is like finally giving two drawers distinct labels and replacing a broken unlocking gesture with a button the lock can recognize.
Opening a long conversation now loads step headers in batches and no longer reads each full payload merely to learn its type. When a long conversation trims its record, the old size budget counted protected checkpoints and residue from steps that had already been cleared but could not be reclaimed, which could destroy nearly all history. The budget now counts only steps whose bytes can actually be reclaimed. When background tasks, subagents, or agent messages wake a session, the database no longer appends duplicate grants and settings to every saved row; nor can a background message corrupt the saved transcript into unparseable JSON while compaction is rewriting it. A stalled sandbox setup also no longer leaves its step registered, swallowing later messages and making the session look dead until restart. It is like clearing only boxes that free warehouse space, while keeping the night shift from duplicating labels or tearing an account book as a note is inserted.
If a storage-locker label can say “go up one level,” an attendant might put an item in the next locker; now the label is checked first and the item stays in its assigned compartment. A subagent name is no longer used directly as a directory name. Previously, if define_subagent received a model-supplied name containing .., writing agent.md could escape the conversation's artifact directory. The name is now validated both by the tool and by the handler before the file is created. This fixes existing path handling; it does not add new powers to subagents.
When you press Esc to leave the artifact viewer, reviews completed in earlier turns no longer trigger a stray submission confirmation; submitting also stops reporting those same old reviews again. Collapsed and expanded tool groups now restore the tool-call line for invoke_subagent, send_message, manage_subagents, define_subagent, and generate_image, instead of showing only (ctrl+o to expand). In Cloud Shell, the web terminal now automatically uses a conservative rendering mode to avoid a distorted startup banner caused by cursor-optimization escape sequences. It is like opening a receipt folder and seeing each receipt's heading again, while already stamped applications stay out of the submission pile.
Original changelog
Original changelogUse the Gemini API without signing in, including custom endpoints
Added support for `GEMINI_API_KEY`, so the CLI can run against the Gemini API directly without signing in. Set `modelProvider: "gemini"` in `settings.json`, export `GEMINI_API_KEY`, and point `GOOGLE_GEMINI_BASE_URL` at a custom endpoint if you need one. The banner and `/help` show `Gemini API key` as the credential, and `/logout` explains that it comes from the environment rather than appearing to end a session.
Fixed the direct Gemini API route parking on the sign-in screen instead of booting straight into the main UI, and fixed model requests failing against a custom endpoint set through `GOOGLE_GEMINI_BASE_URL` by dropping a session field such an endpoint is not guaranteed to support.
Original changelogSearch has a fallback, and bundled ripgrep files are verified
Improved `/codesearch` resilience by falling back to a local search when the `ripgrep` binary cannot be executed, such as when an endpoint security agent blocks it.
Improved embedded ripgrep reliability and security by saving extracted binaries to the user cache directory instead of /tmp. Added content-addressed SHA-256 verification and atomic renaming to guarantee binary integrity and prevent concurrent execution races.
Original changelogArtifact previews stop rereading files, and wide text stays in its panel
Improved artifact list scrolling by caching each file's preview line count, which previously re-read every listed file from disk on every keypress.
Fixed artifact list rendering, where previews produced garbled text and overflowed the panel on wide CJK or emoji characters, the cursor could point past the end of the list when entries disappeared, and the header and footer lines were left out of the scroll math so the list overflowed its viewport.
Original changelogCustom agents can manage their work without being nudged to poll
Improved custom agent support by making `manage_task` available to declarative agents that have not opted out of fundamental components, so a custom agent can list and kill its own background tasks, and reworded its step lines to read `Killed task X` and `Checked task X`.
Improved the agent's behavior after backgrounding work by removing the anti-polling reminder text from the `manage_task` and `manage_inbox` tool results, which could itself nudge the model into a polling loop.
Original changelogWeb search shows the query before results return
Improved `search_web` steps by showing the query while the search is still running rather than only after it returns.
Original changelog`/resume` tabs are clearer, and deletion moves to `f4`
Improved the `/resume` picker by relabeling its second tab, which previously carried a name that did not distinguish it from the first.
Improved deleting a conversation from the `/resume` picker by moving the keybinding from `ctrl+delete` to `f4`, since macOS terminals disagree on how they report the delete key and the old binding silently did nothing there.
Fixed conversations disappearing from the `/resume` picker after cycling to the second tab and back, which left it reporting `No conversations available`, and kept the `tab` hint in the shortcut bar even when a tab is empty.
Original changelogLong conversations keep their history, and background wakes stop bloating data
Improved the time to open a large conversation by loading step headers in batches and no longer reading each step's full payload just to read its type.
Fixed trajectory truncation destroying nearly all of a long conversation's history, by charging the size budget only against steps whose bytes can actually be reclaimed instead of against protected checkpoints and the unreclaimable residue of already-cleared steps.
Fixed unbounded growth of the on-disk conversation database in sessions woken by background tasks, subagents or agent messages, where each wake appended duplicate grants and settings to every persisted row.
Fixed corruption of the saved transcript when a background message appended to it while context compaction was rewriting it, which left malformed JSON that no longer parsed.
Fixed a hung sandbox setup killing the rest of the conversation, where the step was never unregistered so every later message was silently swallowed and the session appeared dead until a restart.
Original changelogSubagent names are checked before they can escape their own folder
Fixed `define_subagent` using a model-supplied agent name directly as a directory name, so a name containing `..` could write its `agent.md` outside the conversation's artifact directory; names are now validated at both the tool and the handler.
Original changelogTool groups show their names again, and completed reviews stay completed
Fixed a distorted startup banner in Cloud Shell, where the web terminal mishandles the cursor-optimization escape sequences the renderer emits; a conservative rendering mode now turns on automatically there.
Fixed `Esc` in the artifact viewer showing a spurious submit confirmation for reviews that had completed in earlier turns, and fixed submitting re-reporting those same reviews.
Fixed `invoke_subagent`, `send_message`, `manage_subagents`, `define_subagent`, and `generate_image` rendering with no tool call line at all in collapsed and expanded tool groups, leaving a bare `(ctrl+o to expand)` hint with no tool name.