Gemini CLI

Gemini CLI ships no export/import for the agent and no documented procedure for moving it; the only export command, /chat share, exports a single conversation as Markdown/JSON. Agent state sits in local directories (~/.gemini, project .gemini) documented piecemeal, so moving it is an undocumented manual copy that also needs auth re-setup.

• Command reference (/chat share)
• Session management (storage location)

All agent-defining state is local: settings, GEMINI.md memory, skills, policies, extensions and JSONL session records. Nothing agent-defining is held server-side. Re-linking the default model integration ('Sign in with Google') needs Google's own registered OAuth client, and credentials default to the OS keychain rather than the ~/.gemini directory.

• Session management
• Memory files
• Keychain service (hybrid storage)
• Auth dialog

The runtime is Apache-2.0 and the source contains no licence check or expiry. Experiment flags are fetched only when a Code Assist server is in use, and usage-statistics failures are non-fatal. Whether every capability survives with all Google domains blocked has no public documentation (hands-on test), so the pass is withheld under G12.

• LICENSE (Apache 2.0)
• Experiments fetch
• Configuration: sandbox image, base URLs

The documented model choices are Gemini models only (Auto, Pro, Flash). Other or local models can be reached only by pointing the documented GOOGLE_GEMINI_BASE_URL override (localhost allowed) at a third-party Gemini-API-compatible proxy, which is a workaround. The local Gemma support is an experimental routing classifier, not the agent model. The built-in Google Search grounding tool depends on a Gemini hosted-model feature.

• Model selection
• Base URL override
• Gemma local routing (experimental)
• Web search tool

Agent state (config, memory, skills, session records) is stored on the owner's machine by default, so a current copy stays in the owner's hands if the Google account or licence is terminated or the service shuts down.

• Session management (local storage)
• Checkpointing (local storage)

State is stored in open formats: JSON settings with a published schema, Markdown memory and skills, TOML policies and JSONL session records defined in the Apache-2.0 source. Stored credentials are encrypted with a locally derived key or held in the OS keychain, so no provider-held key is involved.

• Settings JSON schema
• Chat record types
• File keychain

The default system prompt can be written to a file (GEMINI_WRITE_SYSTEM_MD), and prompts can be logged locally through OpenTelemetry file output. However, provider-controlled behaviour switches fetched from the Code Assist server (compression threshold, routing classifier threshold, which model 'auto'/Flash resolves to) are not surfaced to the owner through any documented view (one shortfall). /chat debug request export is documented for nightly builds only.

• System prompt export
• Telemetry file output
• Experiment flags
• Flag use in config
• /chat debug (nightly)

By default Google receives usage statistics and Code Assist request and interaction data. The Code Assist data-governance page and the Google Cloud terms opened for this review give no bounded retention table for these logs. Usage statistics fall under Google's general Privacy Policy, and the owner cannot view what is held item by item.

• Gemini for Google Cloud data governance
• ToS and privacy doc
• Google Cloud Terms

The open-source client contains no paid placement. Its first-party defaults (Gemini models, Google Search grounding) are disclosed and can be replaced or excluded. The server can push banner text and routing/model flags, the hosted Code Assist layer cannot be inspected, and Google has made no binding no-steering commitment.

• Experiment flags (banner text, routing)
• tools.exclude / tools.core

Tool calls from the main agent and subagents are recorded in session JSONL files. Those records are pruned after 30 days by default. If the disk fills (ENOSPC), recording stops and the only warning goes to the debug logger, so the session continues unrecorded without the owner being told (two shortfalls).

• Session retention default 30d
• Chat recording ENOSPC handling

Session records are plain JSONL files with no hashing, signing or other integrity data, so they can be edited or deleted without trace.

• Chat recording service

The session record lives in the project temp directory (~/.gemini/tmp/<hash>/chats). isPathAllowed explicitly lets the agent's file tools write to that directory, and the shell tool is unsandboxed by default. The only barrier is per-call approval in the default approval mode.

• isPathAllowed (project temp dir allowed)
• Session storage location

All client source is Apache-2.0. The default npm release is an esbuild bundle published without npm provenance attestations (the registry metadata for 0.62.0 has none), so the distributed build cannot be tied to source independently. Building from source is supported only as an alternative install path.

• Release publish action
• npm registry metadata 0.62.0
• LICENSE

The agent has no identity of its own. It acts under the owner's Google account or API key, which are provider-issued credentials Google can revoke.

• Authentication setup

/rewind shows and reverts file changes made by the agent's edit tools, including memory-file edits, attributed to the agent within retained sessions. Auto Memory (off by default) proposes diffs for review. Nothing records or restores changes to settings, tools, permissions, model or runtime version, or changes made by the owner or updates.

• Rewind
• Auto Memory
• Checkpointing

GEMINI_SYSTEM_MD fully replaces the base system prompt, and built-in subagents can be disabled or overridden. Other behaviour-defining prompts (chat compression, routing classifier, loop detection and similar internal injections) are hard-coded and can be changed only by editing source.

• System prompt override
• Subagents overrides

Persistent memory is kept in Markdown files (repository GEMINI.md, a private per-project memory folder, global ~/.gemini/GEMINI.md) that the owner can view, edit and delete item by item. Auto Memory candidates are held in a review inbox until approved.

• Memory files
• Auto Memory

Owners can add any tool without Google review through MCP servers, extensions and a tool discovery command. Any built-in can be removed with tools.core/tools.exclude or policy-engine deny rules.

• MCP servers
• tools.core / tools.exclude
• Policy engine

Most protections are owner-configurable: sandboxing, folder trust, loop detection, env-var redaction, default policies (user tier outranks default tier) and YOLO mode. Some are locked in code, such as the rule that a non-localhost base URL must use HTTPS and the hard-coded denial of agent access to the memory inbox.

• Policy priority tiers
• Env redaction
• Base URL HTTPS requirement
• Inbox deny

On the default Sign in with Google path, the CLI fetches server-side experiment flags that change the compression threshold, routing and which model the Flash/Auto selections resolve to, without notice or consent. Automatic updates are on by default. Owners can pin by disabling auto-update or supplying GEMINI_EXP, but server flags apply silently.

• Experiment flags
• Flag-driven model switching
• Auto-update default true

The policy engine gives per-tool and per-argument allow/deny rules, file tools are limited to the workspace plus added directories, and the documented sandbox proxy can filter egress per domain. The CLI has no payment capability, so spend counts as met (G11). The agent's file tools can edit the workspace .gemini/settings.json and policies, which take precedence over user settings. Only per-call approval, which the owner can relax, stands in the way (one shortfall).

• Policy engine
• isPathAllowed
• Sandbox proxy example

Owners choose which tools, commands or subagents need approval using policy-engine ask_user rules and tools.confirmationRequired. Subagents are matched by the same engine.

• Policy engine decisions
• Subagent policy
• tools.confirmationRequired

Ctrl+C cancels the current request or quits the CLI. Commands started in the background keep running after the tool returns (documented), so stopping them takes separate steps. No provider-side schedulers exist on this path.

• Keyboard shortcuts
• Shell tool background processes

Usage statistics are on by default (opt-out). The Clearcut logger attaches the cached Google account email, or else an installation ID, even though the docs say no email is collected. Code Assist interaction telemetry (conversation-offered and tool-call interaction records) is sent with every response and is not gated by the usage-statistics setting. Google Cloud terms changes take effect on 30 days' notice without specific consent.

• usageStatisticsEnabled default true
• Usage statistics disclosure
• Clearcut email/install ID
• Code Assist telemetry
• Google Cloud Terms

Credentials (Google OAuth, MCP OAuth tokens, API keys) are held locally in the OS keychain or files and can be cleared (/auth signout). No single documented view lists every credential and grant, and per-MCP-server token revocation is not documented beyond the token file.

• MCP token management
• Auth command

No single action deletes the agent. The uninstall docs remove only the package, leaving ~/.gemini, and there is no documented owner-initiated deletion with a stated completion limit for Google-side usage statistics and Code Assist logs.

• Uninstall
• Gemini data governance