Gemini CLI v0.65 enforces read-only settings in untrusted folders and adds OTLP headers

Gemini CLI v0.65.0 carries 27 changes, but only one is a feature: the telemetry OTLP exporter now accepts custom headers. The rest is 25 fixes and one performance change.

As in the previous release, untrusted folder handling and @ references both got attention. Those are the same two areas v0.64.0 touched, so this is the second release in a row working on them.

Untrusted folder settings are enforced as read-only

PR #29583 makes workspace settings read-only in a folder you have not trusted.

Folder trust exists to stop an unvetted project from loading its own configuration. Per the documentation, an untrusted folder does not load .gemini/settings.json or .env, cannot install or update extensions, disables tool auto-acceptance, and does not connect to MCP servers.

v0.64.0 fixed headless mode treating an untrusted folder as trusted. This release continues that work by closing the write side. If your CI depends on the feature, v0.65.0 is the version that has both. For the previous release, see Gemini CLI v0.64 fixes the CPU hang on @ inside code.

Relatedly, PR #29672 removes false positives from the untrusted command flag and compound loop checks — the case where the check erred so far toward caution that ordinary commands were caught by it.

The only new feature is custom OTLP headers

PR #29641 adds otlpHeaders to the telemetry settings, so you can attach arbitrary headers to OTLP exporter requests. That is what you need when the collector you send to requires an authentication header.

{
  "telemetry": {
    "enabled": true,
    "target": "local",
    "otlpEndpoint": "http://localhost:4317",
    "otlpProtocol": "grpc",
    "otlpHeaders": {
      "x-api-key": "your-key"
    }
  }
}

The documentation's settings table defines it as:

Setting	Environment variable	Values	Default
otlpHeaders	GEMINI_TELEMETRY_OTLP_HEADERS	JSON or key=value	none

Because the environment variable works too, a CI job can pass the key from its own secret store instead of a settings file.

Session resume and authentication fixes

Six fixes address losing work or failing to sign in.

PR	What it fixes
#29584	A resumed session's history being deleted on a quick exit (Issue #29198)
#29618	Duplicate tool response turns when resuming a session
#29728	Session poisoning on a rapid Ctrl-C interruption
#29655	Infinite verification and OAuth retry loops
#29643	Cached credentials now cleared when Google login is re-selected
#29616	OAuth callback iss validation aligned with RFC 9207 metadata

#29584 and #29728 are the kind of bug that costs you work. If you routinely resume long sessions, they are the reason to upgrade.

@ references and ignore-file performance

PR #29617 stops the eager recursive file reading that @ references triggered, so pointing at a directory with @src/ no longer pulls in its contents unconditionally.

v0.64.0 fixed the CPU hang on code containing @, so @ handling has now been worked on in two consecutive releases.

On performance, PR #29582 optimises ignore filtering and enables subtree pruning (Issue #29077), which helps when file discovery is slow in a large repository.

Also fixed: the Enter key hanging in interactive mode (PR #29476, Issue #23297), one extension failing the allowlist check preventing the others from loading (PR #29720), and unnecessary terminal clears when expanding with Ctrl+O (PR #29640). For MCP configuration, see Setting up MCP servers in Gemini CLI.

Summary

• Of 27 entries in v0.65.0, one is a feature, one is performance, and 25 are fixes and release work
• Workspace settings in an untrusted folder are now enforced as read-only
• The feature is telemetry.otlpHeaders, also settable via GEMINI_TELEMETRY_OTLP_HEADERS
• Resumed session history loss and session poisoning on rapid Ctrl-C are fixed
• @ references no longer read recursively ahead of time, continuing v0.64's @ work