• Changed the default Agent Mode from Default to Auto: sessions with no saved mode, including headless -p runs, now start in Auto wherever Auto mode is available and in Default elsewhere; to keep the previous behavior, choose Default for Agent Mode in /config, which saves "agentMode": "" to settings.json. A Tool Permission setting of strict now also takes precedence over Auto and accept-edits modes, so file edits still ask for approval under strict.
• Fixed multi-second UI freezes, which also stalled streaming and window resizing, when a command printed a very long line without spaces; line wrapping now takes time proportional to the line's length.
• Fixed agent replies stalling for 20 seconds or more while a group of tool calls with long output was still animating its token counts; streamed steps now keep appearing while the group re-renders.
• Fixed the agent not noticing that a command it moved to the background was waiting for input, such as a password or y/n prompt printed before the command went to the background; the agent is now notified once that output settles instead of waiting silently.
• Fixed browser sign-in on Windows sometimes failing to complete because the CLI's local sign-in callback listened on only IPv4 or IPv6 while the browser redirected over the other; the callback now listens on both.
• Fixed Gemini 4 Carbon requests through an enterprise model gateway failing with an HTTP 400 Thinking budget is not supported for this model error; the CLI now sends Gemini 4 Carbon a thinking level and no longer leaves the Low, Medium, or High suffix in the model ID it sends to the gateway.
• Fixed a PreToolUse hook returning auto_approve, or a wildcard command(*) allow rule, bypassing an organization's admin-enforced review: commands that would leave the terminal sandbox, commands the admin policy holds for review, and file reads or writes outside the workspace under an "always ask" file-access policy now always ask for your approval.
• Fixed saved command allow and deny rules being ignored, so that every command asked for approval, when an organization's admin policy requires commands to run in the terminal sandbox but the machine has no OS sandbox; your saved rules now apply and unlisted commands still ask before running.
• Fixed background task details from manage_task losing their formatting when the task's recent output, or input sent to the task, contained Markdown code blocks or runs of backticks.
• Fixed Remote Control showing a link that could not be opened at the end of some agent replies, such as the swarm coordinator's link to the swarm UI; Remote Control now leaves these links out.