Gemini CLI

Operator Read

Gemini CLI is turning agent state into explicit, reviewable operating material: memory, trust, sessions, output contracts, and subagent boundaries are becoming things an operator can inspect, move, and police, while remote delegation and long-horizon intent remain unproven. The direction is consistent -- make hidden context into named state -- and the gap is where that state lives once it leaves the local process.

Two things shifted the standing read as of v0.47.0 stable, and both cut against treating Gemini CLI as a settled first-party Google CLI. First, this is no longer an unconditionally durable home for the free/unpaid tier: Google has shipped, to stable, an in-product funnel that steers Google One and Gemini Code Assist for individuals users toward a successor product, Antigravity CLI. Read it as managed succession for that tier, not deprecation of the tool overall, and provision accordingly. Second, the channel split is now a trust fact: a skill-path security fix has been preview-only for two consecutive windows while the migration funnel reached stable, so what an operator runs (stable) and what is fixed (preview) diverge in a way that matters for third-party skill installs.

State Becomes Reviewable

Read what an agent wants to remember before it sticks. The Auto Memory inbox proposes durable updates as patches with a canonical contract surfaced through docs, settings schema, memory commands, inbox UI, local executor behavior, skill extraction, and evals. Private memory patches sit behind a tightened allowlist separating personal-scope memory from project-scope.

Move sessions between machines as data, not state. An operator can export a session to a file and import it via flag -- session state is a serializable artifact, not ambient context. Session resume is now reliable for legacy session formats: legacy chat JSON appears in /resume and --list-sessions, and --resume <sessionId> failures surface an error instead of silently starting fresh. If you've archived sessions, the resume path now works on them; if you depended on silent-fresh-on-failure, your error path needs revisiting.

When you call Gemini CLI from CI or any non-interactive caller, parse the end-of-run signal. AgentExecutionStopped emits as structured JSON, giving callers a stable parse target instead of free-form output.

Authority Follows Headless And Delegated Runs

Non-interactive contexts no longer bypass workspace trust by being non-interactive. Workspace trust enforces in headless mode through a new trust-utility module and CI-workflow integration. If you've been relying on --non-interactive to silently skip the trust prompt, that path is closed -- run the trust grant explicitly or fail loudly. Trust state is also visible in the MCP listing UX so the boundary is inspectable, not implicit.

Shell command execution carries safety evals on the path between the agent and the host, and shell validation now uses a core-tools allowlist in the policy engine -- explicit allowed-tool mapping in addition to pattern-based evals.

Subagents Are A Boundary, And Now Have A Stable Remote Surface

Subagents are approval-mode aware -- delegated work inherits the active approval posture rather than escaping it. As of v0.44.0 (stable, 2026-05-27), LocalSessionInvocation and RemoteSessionInvocation ship as the session-invocation protocols, replacing the prior preview-only state of the abstraction. The "tests but no observed remote target" gap from the 2026-05-11 finding closed at the protocol layer; where the remote target actually runs (Google-hosted, operator-hosted, both) remains undocumented. Agent registration also moves to first-wins prioritize-project -- when the same agent name is defined at multiple scopes, project wins.

Treat delegated workflows as testable against v0.44.0 stable; do not yet depend on the remote path for production until Google documents where remote invocations run.

Default-On Autonomy

v0.44.0 collapses the prior fan of Auto variants into a single Auto mode and adds shell-redirect auto-approval in AUTO_EDIT. PolicyEngine integrates into ACP sessions (framed as a deadlock fix; the structural effect is that enforcement reaches the protocol-session layer). Operators on previous Auto variants must re-audit what the consolidated Auto mode treats as safe -- the release notes do not enumerate which prior-mode constraint survived the merger. AUTO_EDIT users should explicitly decide whether shell-redirect auto-approval is acceptable for their environment; redirects are a write surface if the agent is steered toward sensitive paths.

Managed Succession For The Free Tier

Gemini CLI now steers some of its own users toward a successor product from inside the tool. The Antigravity migration funnel reached stable v0.47.0 (commit 452356027, ancestor of the stable tag): /help install antigravity and a migrate command print a platform-aware install command, and a built-in antigravity-support skill auto-fires whenever a user "asks questions, seeks help, or requests instructions related to installing, setting up, or migrating to Antigravity CLI." The skill hands the user a curl ... | bash (or PowerShell irm ... | iex) one-liner that installs the agy binary. Two authority notes: the steered install is a pipe-to-shell of a remote script presented inside a trusted CLI surface, normalizing unverified remote installs from inside the agent; and the steering points at a different product. This is a product-posture signal -- read Gemini CLI as entering a managed succession for the affected tier, not as a settled indefinite home for it.

The intrusiveness escalated in the same release. The "Gemini CLI is transitioning to the new Antigravity CLI ..." banner's five-show cap was deliberately bypassed by keyword (commit f40498db6, ancestor of stable v0.47.0): a new || activeText.includes('Antigravity') clause exempts the transition banner from DEFAULT_MAX_BANNER_SHOWN_COUNT, so it shows every session with no way to age it out. Precision on scope: the affected audience is the free/unpaid tier -- Google One and Gemini Code Assist for individuals -- per the PR's own validation note ("Log in with a free tier account 5 or more times ..."); paid tiers are not the target. Operators standardizing free/unpaid-tier workflows on Gemini CLI should expect an unavoidable every-session reroute nag and plan for the managed-succession direction rather than against it.

Findings: 2026-06-23-gemini-antigravity-migration-to-stable, 2026-06-23-gemini-antigravity-banner-uncapped-in-stable.

A Security Fix Stranded In Preview

A skill-path security fix that an operator running stable does not have. The skill install/link/uninstall path-traversal fix (commit bca5667fc / PR #27767) is, for the second consecutive window, in no stable release. It is present only on the preview channel: it is an ancestor of v0.48.0-preview.0 (compare v0.48.0-preview.0...bca5667fc → status: behind) but diverged from stable v0.47.0 (compare v0.47.0...bca5667fc → status: diverged, ahead_by 7, behind_by 2). Do not read this as shipped: channel is preview-or-beta only. The operator consequence is concrete -- a malicious .skill package can write outside the skills directory on stable v0.47.0, so treat third-party skill installs as untrusted until the carrying stable tag lands. Two stable releases (v0.46.0, v0.47.0) have now shipped without this fix while a growth funnel went through the same gate to stable; the channel-priority contrast is the operating fact.

Findings: 2026-06-23-gemini-skill-path-traversal-stranded-in-preview.

Posture basis: 2026-05-07-gemini-reviewable-memory-and-trust, 2026-05-11-gemini-subagent-protocol-and-session-portability, 2026-05-12-gemini-session-resume-reliability, 2026-05-27-gemini-session-invocation-protocols-stable, 2026-05-27-gemini-auto-modes-merged-and-policy-engine-in-acp, 2026-06-23-gemini-antigravity-migration-to-stable, 2026-06-23-gemini-antigravity-banner-uncapped-in-stable, 2026-06-23-gemini-skill-path-traversal-stranded-in-preview.

Open Questions

• When does the skill-path-traversal fix reach a stable tag, and how wide is the managed succession? The fix has been preview-only for two windows; whether the carrying stable lands next cycle, and whether the Antigravity funnel stays scoped to free/unpaid tiers or expands, both decide the operator posture.
• Where do remote session invocations actually run? RemoteSessionInvocation is stable in v0.44.0 as a protocol but the runtime target -- Google-hosted, operator-hosted, or both -- is undocumented. Until Google names a destination, production callers cannot adopt the remote path with confidence.
• What is the PolicyEngine-in-ACP default posture? Per-session enforcement by default, or only when an operator has configured a policy? The "deadlock fix" framing in the release notes understates the structural shift.
• AUTO_EDIT shell-redirect auto-approval: is the new approval gated by workspace trust, by the existing shell-tools allowlist, or a separate decision?
• Does Gemini CLI offer a first-class long-horizon primitive (goal, mission, outcome) beyond in-session todos and memory? Memory captures facts, not intent. No accepted finding establishes such a primitive as of 2026-05-27. The 2026-05-13 → 2026-05-27 cycle did not produce a finding that resolves this either way; status remains open_question. Tracked in the claims: block as long-horizon-goal-primitive.
• What state crosses the wire on session export? The export commit introduces the file but does not document whether accepted memory patches, approval-mode state, or active MCP connections are included.

For research-lens-level open questions (preview/nightly harvest treatment, security advisory handling), see sources/gemini-cli.yml#discovery.

What To Watch Next

• The actual remote runtime target of RemoteSessionInvocation once one ships or is named.
• How PolicyEngine-in-ACP interacts with operators using Gemini CLI as an ACP server (e.g., behind OpenHands' ACP UI). Whether the PolicyEngine still applies when Gemini is being fronted is the composition question.
• Whether the AUTO_EDIT shell-redirect auto-approval expands to other shell verbs or remains bounded to redirects.
• Further structured non-interactive output beyond AgentExecutionStopped, especially for sub-agent lifecycle and approval prompts.
• Whether the memory-inbox pattern extends to other state classes (skills, goals, session recaps).
• Documentation or schema for the session-export file format.
• Stable-channel arrival of changes currently visible only in preview or nightly -- specifically the skill install/link/uninstall path-traversal fix (bca5667fc / PR #27767), stranded in preview for two windows.
• Whether the Antigravity migration funnel hardens further (defaulted, made non-dismissable beyond the banner, or extended past the free/unpaid tier) or stalls -- the managed-succession trajectory for Gemini CLI's free tier.
• Policy-engine work that changes how operators express trust beyond workspace-level grants.