Minor release (0.59.0) focused on sandbox hardening on macOS, path and history reliability fixes, and tighter write-policy safety checks.
Changelog
[fix] macOS Seatbelt sandbox isolation now keeps Docker and other container-runtime sockets and binaries out of the sandboxed environment, reducing accidental exposure of the host runtime.
[fix] Write policy configuration declares top-level safety checkers so execution guardrails are applied more consistently before writes run.
[fix] Ignore-path handling evaluates symlinks consistently in core services, so ignored paths resolve the same way whether they are reached via a link or a real path.
[fix] History rollback and retry-nudge behaviour is tightened for cleaner session recovery after cancels, aborts, or retries.
[fix] The A2A server clears stale cancellation errors when a new message turn starts, so earlier cancels no longer leave the session stuck in the wrong error state.
Under the hood
Introduced GEMINI_RESTRICTED_MODE (restricted-mode env flag) for upcoming or internal restricted operation; not required for normal upgrades.
Sandbox image tag bumped to 0.59.0 alongside the CLI.
Internal cleanup in shell execution (stricter typing, fewer suppressions) with no intentional user-facing behaviour change.
Upgrade notes
If you pin or mirror the sandbox image, pull us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.59.0 so it matches this CLI version.
macOS users who rely on Docker or other container runtimes inside the sandbox should confirm workflows still behave as expected with the tighter Seatbelt isolation.
