Gemini CLI

On 20 October 2026, Gemini CLI 0.65.0 reached stable with a refusal of project-scoped MCP additions in untrusted folders, closing the empty-settings overwrite path. The safeguard ships; deciding which repository deserves trust still belongs to you.

Where it stands, 2026-10-24

Channel. Pin 0.65.0 stable, released 20 October 2026: npm install -g @google/gemini-cli@0.65.0, with Node 20 or later. At the 24 October, 10:12:57 UTC npm read, preview selected 0.66.0-preview.0 and nightly selected 0.67.0-nightly.20261024.gcd1b45c2d. Choose a prerelease only for a need named below.

Preview adds user Git configuration, earlier .env loading and a per-server private-network OAuth exception that defaults off. Nightly adds further cancellation controls, container editor integration, file-write changes, model listing and hook-timeout conversion. None of the inspected changes remains main-only.

Upgrade before changing project MCP settings. If the guard refuses, choose user scope or explicitly decide whether to trust the folder. The guard applies only to settings persistence. Before unattended rollout, confirm service access, keep folder trust enabled and verify extension checkouts. For plan-only work, deny exit_plan_mode or enforce a read-only filesystem.

Verify service access before investing in rollout. Google’s 16 October 2026 README update says Gemini CLI was replaced for unpaid-tier and Google One users on 18 June 2026, recommends Antigravity for current Gemini models, and warns that this CLI is not optimized for Gemini 4 Argon. The stable authentication guide still recommends consumer sign-in. Check the account route and support terms before choosing a deployment, whatever the package version.

Repository trust still belongs to you

Verify extension checkouts during installation. Stable’s JSON downloader restricts GITHUB_TOKEN to HTTPS github.com and its subdomains, checks destinations and socket DNS results, and adds a 30-second timeout. The installer still checks out FETCH_HEAD without comparing resulting HEAD to the requested commit.

Upgrade token-authenticated install flows, test redirects and private-host refusals, and compare the installed HEAD with your intended commit.

Enforce the boundary for plan-only jobs. Headless planning encourages implementation without waiting, and policy-allowed exit_plan_mode can select YOLO. Deny that tool in effective policy or enforce a read-only filesystem. Recognized build-file edit gates leave other routes open, including YOLO shell redirection.

Keep folder trust enabled for unattended launches. It defaults on in stable, despite the guide’s off-default statement. Disabling it bypasses the headless untrusted-workspace rejection. Check the effective setting before granting unattended work.

Stable makes interrupted work easier to inspect

Retest interrupted sessions on stable. 0.65.0 deduplicates reconstructed tool responses, preserves resumed sessions during cleanup and repairs rapid-exit cancellation bookkeeping.

Resume a multi-call turn, then interrupt and exit quickly. Tools that read session logs must still apply appended $patch records. Reconcile the interrupted external action before retrying it.

Let the agent explore a referenced directory. Stable leaves its path in the query instead of eagerly reading all its files, handing file selection to the agent. Name files explicitly if the job needs them immediately.

Keep the question beside the answer. Stable’s ask_user result display retains the full question text and multiline formatting beside the answer. Keep that context in review tools so nobody has to reconstruct what a short answer meant.

Integrations require a deliberate channel choice

Try native collector authentication before maintaining a header-only proxy. Stable passes configured OTLP headers to HTTP and gRPC exporters. Inspect effective headers: comma-separated input can keep valid pairs while skipping malformed ones. Choose what to export before connecting a collector; the guide defaults prompt logging to on, while telemetry itself defaults off.

Try preview when Git jobs need user configuration. 0.66.0-preview.0 restores global Git configuration while retaining sensitive overrides and disabling system configuration. Its Git helper disables interactive credential prompts. Check identity and URL rewrites; provision authentication before launching unattended jobs.

Review internal MCP OAuth endpoints before enabling preview’s exception. In 0.66.0-preview.0, per-server oauth.allowPrivateNetwork defaults off. Enabling it permits private/internal OAuth endpoints, with HTTPS required away from loopback, resolved-address checks and link-local addresses still blocked. Check the specific server and DNS before removing a public-endpoint workaround.

Choose the right channel for settings migration. Regular preview loads eligible .env files before final placeholder expansion. Preserving literal placeholders when deprecated settings migrate requires nightly’s separate raw-value persistence. Inspect migration diffs for resolved secrets before committing configuration.

Try editor diff review in a container on nightly. Its host bridge limits tool calls to openDiff and closeDiff and checks normalized workspace paths lexically, while the companion token stays on the host. Test workspace mappings, symlink escape and companion compatibility before relying on it.

Test nightly cancellation with the actual supervisor. It checks cancellation before scheduling more tools and stops continuation after cancellation and suppresses automatic nudges after terminal outcomes. With piped input and your output mode, check that no new tool starts and already-running work stops.

Review the first shell approval’s scope on nightly. It matches unfamiliar low-risk flags against external output and remembers approved flags for the same root commands within the session. The first yes now has a longer reach. Inspect which flags the same set of root commands can reuse before accepting.

Test file semantics before sharing a workspace. Nightly checks existing-file writability and writes hard-linked files in place, trading atomic replacement for link fidelity. Test permission failures under the real execution identity. Stable’s locks only coordinate within one process; coordinate separate agents’ writes yourself.

Use model listing as inventory when building an adapter. Nightly’s gemini models list --output-format json reads local configuration and hard-codes outputTokens=8192. Check service access separately. Stable rewrites outgoing model IDs, with Flash routing enabled for API-key, Vertex and Gateway auth and experiment gates for Google login. Record configured, outgoing and returned IDs separately in evaluations.

Inspect imported Claude hooks before relying on their timing. The 24 October nightly converts valid timeout values from seconds to milliseconds. Audit old imports separately. Test the command’s timeout and refusal behavior in Gemini.

Save complete tool output outside the conversation. Stable truncates individual handled text fields/parts, with best-effort output saving, using a 65,536-byte limit. Paginate large results and check that the saved file is complete before using it as an audit record.

What is unresolved

• Continued support for API-key, Vertex and Gateway routes. Explicit Google commitments naming each route would settle it. Check Google’s consumer notice and subscription terms for the account you intend to use.
• Hosted reach of the unchecked extension pin path. A hosted branch-acceptance reproduction would establish reach; a tagged resulting-HEAD check would settle installer verification.
• Marketplace delivery of the companion shutdown repair now in stable source. The observed package manifest identifies 0.20.0; a package-to-source mapping would establish delivery.
• Runtime success of the nightly IDE bridge and cancellation controls. Recorded tests naming the container, companion, supervisor and output mode would settle those deployments.

Review date and method

This page describes Gemini CLI as of 24 October 2026. See METHOD.md for the evidence contract.