Changelog

3.4.12

Fixed

• BYOT/TUI: Log resolved environment after hub registration and in session traces – Used resolved_env instead of the optional env override parameter (which defaults to None) in run_client()’s post-registration connected, ready for jobs log message, forwarded ByotService._env to run_client() when explicitly set, and fell back to app.resolved_environment when app.config.environment is None in SessionScreen._collect_trajectory().

3.4.11

Fixed

• BYOT/CLI: Fail-fast wait_connected() handshake, 30s CLI timeout, and bootstrap cleanup – Raced ByotService.wait_connected() against the background _run() task so auth or startup failures raise immediately with a descriptive error instead of waiting for the full timeout, increased the sec-gemini CLI BYOT handshake timeout from 10s to 30s (BYOT_HANDSHAKE_TIMEOUT_SECONDS = 30.0) to tolerate cold OIDC token fetches, cancelled pending background venv bootstrap tasks before removing the venv on shutdown, and suppressed false python_venv_removed log messages when no owned venv existed on disk.
• SDK/RPC: Refresh OIDC token and gRPC channel on stream reconnect – Checked JWT exp claim (with 30s leeway) on SEC_GEMINI_OIDC_TOKEN and supported both string and list aud claims so expired environment tokens automatically fall back to fresh gcloud / ADC identity tokens, and added GrpcTransport.reconnect() invoked from RpcClient._listener_loop when reconnecting after an initial stream disconnect so long-running sessions (>1 hour) do not reuse expired static credentials.
• SDK/Config: Refine internal-no-internet resolution priority and upload metadata – Prioritized explicit SEC_GEMINI_PROJECT_NUMBER overrides ahead of corp hostname heuristics and shared GSLB hub fallbacks in resolve_environment(), forwarded the resolved environment to run_client(), and included x-sec-gemini-env metadata in SessionFiles.upload_file().

3.4.10

Added

• SDK/TUI/BYOT: internal-no-internet environment support – Added internal-no-internet environment and endpoint resolution for isolated Corp Run deployments (api-hub-394056583131.cr.gclb.goog and bringyourowntool-hub-394056583131.cr.gclb.goog), including CLI --env support, SEC_GEMINI_PROJECT_NUMBER detection, and TUI status footer styling.
• SDK: Multi-day cold-sleep (PAUSED) and SelfReflectionAgent streaming support – Extended SessionMessages streaming to keep watches active across JobStatus.PAUSED cold-sleep suspensions (PAUSED_SILENCE_HEARTBEAT_TIMEOUT = 300.0) and handle post-response self_reflect / session_review follow-up turns without prematurely terminating FOLLOW_TURN streams.

Fixed

• BYOT/Tools: Harden workstation tools and system info on NFS filesystems – Replaced unhashable None tracking for oversized files (>50 MB) with an $O(1)$ stat_fingerprint_file() check (file size, st_mtime_ns, st_ctime_ns, st_ino, and 4 KB head/middle/tail samples) so write_file, append_file, and search_and_replace work on >50 MB files without reading the entire file over NFS while preserving read-before-write and external modification detection. Offloaded collect_system_info() in Backend.send_prompt() to a worker thread via asyncio.to_thread(), added --no-optional-locks to git status --porcelain to avoid .git/index.lock contention on NFS, bounded search_file_content and search_file directory walks to MAX_WALK_ENTRIES = 10,000, and hardened directory walks against stale NFS file handles (ESTALE/ETIMEDOUT).
• BYOT: Enforce client priority in _lookup_tool across prefix-stripped candidates – Fixed tool lookup ordering in sec_gemini.byot.client._lookup_tool so an earlier MCP client’s prefixed tool (e.g. workstation_run on client 0) takes precedence over a later MCP client’s unprefixed tool (run on client 1), matching _handle_list_tools deduplication order.

3.4.9

Changed

• SDK/Config: Detect .roam.internal and .roam.corp.google.com as internal environment – Roaming Googler devices whose hostname or FQDN ends with .roam.internal or .roam.corp.google.com now automatically resolve to the internal environment by default.

Fixed

• BYOT: OIDC fallback timeout & automatic JWT token refresh – Bounded gcloud auth print-identity-token fallback calls with a 10s timeout (GCLOUD_TOKEN_TIMEOUT_SECONDS = 10.0) so unauthenticated gcloud prompts cannot hang startup indefinitely, and added automatic JWT expiry inspection and refresh in _StaticTokenAuthPlugin for long-lived sessions.
• BYOT: Startup MCP introspection timeout & offline external server resilience – Bounded startup tool introspection (MCP_INTROSPECTION_TIMEOUT_SECONDS = 20.0) and initial client entry in ByotService so a temporarily unreachable or hung external --mcp server does not abort BYOT startup, allowing session_guard to connect it lazily when available.
• BYOT: Reconnect backoff jitter & infinite default CLI retries – Added ±20% randomized jitter (_jittered_backoff) to ByotService reconnect sleeps to prevent thundering herds after hub restarts, and changed the standalone sec-gemini-byot CLI default MAX_RETRIES from 5 to -1 (infinite retries across transient Wi-Fi/VPN drops or laptop sleep/wake cycles).
• BYOT: Tool name deduplication & resource client route caching – Deduplicated clashing stripped tool names in _handle_list_tools (matching _index_tools routing priority) and cached resource URI -> MCP client routes across _handle_list_resources and _handle_read_resource to avoid $O(N)$ list_resources fan-out on cache hits.
• BYOT: Pong liveness watchdog for half-open gRPC streams – Added a stream activity watchdog (PONG_TIMEOUT_SECONDS = 35.0) across _process_jobs and _ping_loop so half-open TCP blackholes where stream.write succeeds locally without any incoming Pong or JobRequest from the hub trigger automatic stream teardown and reconnection.
• BYOT: Bounded registration handshake timeout for fast IPv4 fallback – Wrapped the registration handshake (stream.write + stream.read) in run_client with REGISTRATION_TIMEOUT_SECONDS = 10.0 so an IPv6 blackhole or hung primary target cancels the registration stream after 10s and fails over immediately to the ipv4: fallback target.

3.4.8

Fixed

• BYOT: mcp 2.x and fastmcp 4.x compatibility & major-version bounds – Fixed ImportError: cannot import name 'McpError' from 'mcp.shared.exceptions' when running sec-gemini-byot via uvx against mcp >= 2.0. Added compatibility across mcp 1.x and 2.x (McpError/MCPError, JSONRPCDispatcher and wrapped context streams, "Session not found" 404 responses, and by_alias=True wire serialization for snake_case mcp 2.x Pydantic models), bounded mcp<2.0 and fastmcp<4.0 in package metadata, and imported sec_gemini.byot.client eagerly in ByotService.

3.4.7

Changed

• CLI: --force-load-skills – New flag that preloads every skill passed via --skill/--skills into the agent’s context from the start, instead of letting the agent decide when to load them. It is off by default. SDK users can opt in with Backend.load_local_skills(paths, force_load=True), which makes send_prompt() set the forced_skills prompt metadata (unless the caller already set it). If a local skill has the same name as a platform skill (case- and -/_-insensitive), both stay available and the local one is exposed as user:<name>.

Fixed

• BYOT: Fault-tolerant session recovery and isolation – Resilient MCP session recovery across server restarts (SSE, Streamable HTTP, stdio) in sec_gemini.byot.session_guard. Re-establishes sessions automatically, enforces at-most-once semantics on tool replay (replaying only readOnlyHint/idempotentHint tools), fails fast on hung HTTP connections via watchdog pings, isolates failing/hung servers during concurrent LIST_TOOLS, LIST_RESOURCES, and READ_RESOURCE with a 20s time box, and sets SSETransport.sse_read_timeout to 1800s to support long-running tools.

3.4.6

Changed

• Protobuf bindings moved to sec_gemini_protos – The schema is now compiled exactly once, into a top-level sec_gemini_protos package that is vendored into the wheel. sec_gemini.proto is a re-export facade, so from sec_gemini.proto import api_pb2 keeps working unchanged. Dotted submodule imports such as import sec_gemini.proto.api_pb2 or from sec_gemini.proto.api_pb2 import ClientMessage no longer resolve; use from sec_gemini.proto import api_pb2 (or import sec_gemini_protos.api_pb2 directly) instead.

Fixed

• BYOT/Tools: Fix BYOT interactions with network-attached storage (NAS/NFS) – Prevented sec-gemini-byot event-loop starvation, memory bloat, and tunnel disconnections when operating on slow network-attached storage (NAS/NFS) and large workspaces. Offloaded blocking workstation filesystem tools (read_file_by_lines, read_file_by_bytes, search_file_content, search_file, write_file, append_file, search_and_replace) to worker threads via asyncio.to_thread(), skipped full-file SHA-256 hashing on files >50 MB, bounded subprocess stdout/stderr buffering at 1 MB (MAX_OUTPUT_BYTES) while draining pipes to prevent deadlocks, surfaced explicit warnings when search_file_content/search_file hit size or entry limits, and added exponential-backoff auto-reconnect on registration timeout and transient registration EOF in ByotService.

3.4.5

Added

• Accounting Subsystem – Added accounting model for token usage, tool calls, and model cost estimation in Session model.
• Session Annotation – Annotated sessions with creation source (web, tui, sdk).
• DFIR Enhancements – Added has_enrichment parameter and total matches to search_logs, and enriched records count to describe_tool.
• Pyrefly Type Checker – Added Pyrefly type checking support to Python SDK and resolved all type suppressions.

3.4.4

Added

• SDK/CLI: Wait for BYOT connection – CLI now waits for BYOT to connect when starting a session that requires it.
• SDK/Tests: CyberGym E2E test – Added CyberGym E2E integration test.

Changed

• SDK: SecOps Backend Optimizations – Optimized SecOps backend queries to only include the minimum number of time buckets.

Fixed

• BYOT: Proxied and corporate network support – BYOT now works in proxied environments and corporate networks with IPv6 filtering via native OS resolver defaults, automatic direct IPv4 fallback, and custom CA root bundle auto-discovery.
• SDK/Tools: Kill process groups on timeout – Subprocesses executed via execute_command now run in a new process group and are fully killed on timeout, preventing resource leaks and GCS Fuse hangs. Suggests increasing timeout on exit status 137.
• SDK: Fail-fast BYOT handshake – Made BYOT connection handshake timeout fail-fast to avoid long hangs.
• SDK/Proto: Reverted temporary concurrency fields – Reverted registration response concurrency fields to align with backend changes and fixed type checker errors.

3.4.2

Added

• SDK: File pagination – Added support for limit and page_token parameters in SessionFiles.list(), returning a FileList container with a next_page_token.
• SDK/TUI/BYOT: Active environment logging – Enabled display and logging of the active environment (dev, internal, public) in the SDK client, TUI status footer, and BYOT client.

Fixed

• DFIR: Improved DFIR functionality. – Misc improvements.
• MCP: Safe process group termination – Sanitized process group killing (killpg) to ensure targets are valid PIDs/PGIDs > 1, preventing the user session self-kill bug during unit test mocking.

3.4.1

Added

• DFIR: User-defined LogStore – The enduser may now implement the search and describe log functions over their own infrastructure, without having to either convert to SQLite format or use a SecOps Chronicle instance.

3.4.0

Added

• CLI: dfir subcommand – Added dfir subcommand with --sqlite and --chronicle options to automatically spin up logs MCP servers on dynamically allocated private ports in a background subprocess.
• CLI: Non-interactive options – Added support for --skill and --mcp flags in non-interactive CLI mode.
• CLI/TUI: --meta flag – Support passing arbitrary metadata options to sessions via the --meta flag.
• TUI: Error metrics buttons – Added “Save Output” and “Save Trace” buttons on error messages in TUI.
• SDK: Connect RPC 2.1 upgrade – Upgraded RPC connections to support cursor streaming and caching.
• SDK: Skill resource unification – Unified local and remote skill access, parsing frontmatter YAML and exposing skills as standard resources.
• MCP: Modular environment and network workstation tools – Split the monolithic workstation tools into separate environment and network MCP servers.
• MCP: Log pagination – Added pagination and ordering parameters to the describe_available_logs tool.
• BYOT: Concurrency and response chunking – Refactored the BYOT client to execute jobs concurrently and chunk large responses.
• BYOT: Observability and control enhancements – Added informative runner outputs, data masking, graceful Ctrl+C shutdown, and listing of connected BYOT clients and their tools in the Web UI.
• BYOT: Tunnel proxy support – Added tunnel proxy configurations and strict TCP reachability validation.

Changed

• SDK: Standardized host override environment variables – Standardized environment variables for host overrides to SEC_GEMINI_API_HOST and SEC_GEMINI_BYOT_HUB_HOST.
• SDK: Smarter session listing – Optimized session queries with a default 6-hour time window and a limit of 100 sessions.
• CLI: Switched message streaming mode – Changed CLI message streaming to improve output reliability and real-time visibility.
• BYOT: Standalone package deprecation – Deprecated the legacy standalone sec-gemini-byot package, centralizing the BYOT client in the main SDK package.

Fixed

• SDK: Enforced API key headers for file upload – Modified Python SDK to pass sec-gemini-api-key header metadata on UploadFile gRPC calls.
• SDK: Expired auth keys reporting – Improved error messages for expired keys across SDK and CLI components.
• SDK: Session expiration handling – Raise SessionNotFoundError and terminate message streaming when session expires.
• CLI/TUI: Config precedence – Resolved precedence issues between config files, CLI args, and environment variables when loading API keys.
• CLI: TUI startup error handling – Print TUI startup errors directly to console instead of exiting silently.
• CLI: --mcp flag behavior – Only override session MCPs when the --mcp option is explicitly provided.
• TUI: Layout and text clipping – Fixed clipping, rendering order, and text wrapping issues on message feeds.
• TUI: Stream loop resiliency – Fixed streaming recovery after stream_read_error and session creation race conditions.
• TUI: Deferred/lazy session creation – Fixed rendering and state bugs during deferred session creation.
• BYOT: Resource leaks and event loop blocking – Fixed BYOT background task leaks, keepalive ping intervals, and event loop blocks on reconnection.
• BYOT: Connection hangs – Resolved connection hangs in tool fetcher.
• MCP: SecOps backend bugfix – Fixed an issue in the SecOps MCP server where calling log search functions raised a "cannot pickle '_thread.RLock' object" error.
• Moved DFIR tools to BYOT binary – Fixed an issue where Sec-Gemini-MCP tools were being loaded for DFIR workflows.

3.3.0

Added

• CLI: --version flag – Added --version flag to the main sec-gemini command to print the version from pyproject.toml.

– CLI: -p / --prompt option – Run Sec-Gemini in non-interactive mode.

– CLI: --output option – Useful to write the results to a file when in non-interactive mode.

• TUI: skills panel in right sidebar – Loaded skills now appear in a dedicated “skills” section in the right panel (between tasks and top tools), showing skill name, origin (sec-gemini/byot), and description. Skills no longer clutter the chat feed.

• BYOT: --skill CLI flag – Added support for loading local skill files (.md) in the standalone BYOT CLI. Skills are exposed as MCP resources, allowing the cloud agent to discover and use them. Mirroring existing Backend.start_byot functionality.

• TUI: renamed sec-gemini2 to sec-gemini – The main CLI and terminal UI are now accessible via the shorter sec-gemini command.

• TUI: add fast mode – Add the ability to select “fast mode” at session creation time in the TUI, which makes SecGemini use a faster harness.

• BYOT: integrated into sec-gemini package – The Bring Your Own Tool client is now part of the core SDK and available via sec-gemini-byot.

• Server: proper SKILL_LOADED messages – Improved display of loaded skills in the message stream, reducing clutter.

• MCP: list_session_mcp_servers now includes skills – The response was previously missing the skills array from MCP server info.

Changed

• CLI: extracted from TUI – Moved cli.py and commands/ directory from sec_gemini/tui2 to a new sec_gemini/cli package. The main entry point sec-gemini now points to sec_gemini.cli.cli:cli.
• CLI: cleaner --mode handling – Updated --mode to use click.Choice(["dfir"]) with None default, mapping to "" internally for cleaner help output.
• CLI: updated help text – Removed “TUI v2” from the main help description to reflect that it is now the main CLI.

Removed

• CLI: stub subcommands – Removed model and sessions subcommands as they were stubs.
• CLI: --skills alias – Removed --skills alias, leaving only --skill.

3.2.0

Added

• Centralized logging module – Moved sec_gemini/tui2/logging.py to sec_gemini/logging.py so all components (TUI, MCP server, BYOT CLI) share the same structured JSON logging infrastructure. Fixed _KwargsAdapter to store structured fields safely, avoiding LogRecord attribute collisions (e.g. name=).

• BYOT: setup_byot_logging() – New convenience function for the standalone BYOT CLI. Writes rotating JSON to ~/.config/sec-gemini/logs/byot.log plus colored console output via Rich. Added --verbose CLI flag.

• BYOT: dedicated log file – MCP server now writes BYOT logs to a separate byot.log via a namespace handler on secgemini.byot, in addition to mcp.log via the root logger.

• MCP: BYOT observability tools – Added 3 new Layer 1 tools: get_byot_status (state, tools, hub URL, uptime, errors), list_byot_tools (focused tool listing), reload_byot (stop + restart with refreshed config). Added 2 debug tools: byot_log and byot_log_grep for inspecting BYOT logs.

• MCP: mcp_reload sends ToolListChangedNotification – After re-registering tools, the client is notified so it re-fetches the tool list. New tools appear immediately without a server reconnect.

• MCP: mcp_reload covers BYOT and tools modules – Added sec_gemini.byot.* and sec_gemini.tools.* to the reload list so BYOT code changes take effect without restarting the MCP server.

• BYOT: structured logging – Converted byot/service.py and byot/client.py to use get_logger() with structured kwargs (tool_count=, hub_url=, job_id=) instead of %s formatting.

• BYOT: better auth error reporting – Hub registration rejection now logs registration_rejected with hub URL and key prefix, and raises a more descriptive error message.

• MCP: TUI lifecycle tools – Added tui_start, tui_stop, tui_status debug tools that launch/manage the TUI as a headless subprocess. Enables autonomous TUI debugging from Claude Code without manual terminal setup.

• TUI: debug socket server – New DebugServer in tui2/debug_server.py exposes a Unix domain socket (~/.config/sec-gemini/debug.sock) when --debug is passed. Accepts JSON commands for screen inspection, widget queries, clicks, keypresses, and state dumps.

• TUI: --debug and --headless CLI flags – sec-gemini run --debug starts the debug socket server; --headless runs without a terminal for MCP-managed sessions.

• sec_gemini/backoff.py – ExponentialBackoff utility with full jitter for use in reconnection and retry logic.

• 30 new unit tests covering dispatch routing, error handling, reconnection backoff, retry behavior, and session state management.

Fixed

• TUI: stream loop stops after terminal state – The message stream loop no longer re-subscribes every 30s after a session reaches COMPLETED, FAILED, CANCELED, or MAX_ATTEMPTS_EXCEEDED. Previously this caused the server to replay the entire message history indefinitely. The session VM now tracks status changes via a callback and sets COMPLETED on AGENT_IS_DONE receipt.

• BYOT: idempotent start – start_byot() returns current tools when BYOT is already running instead of raising an error. Fixes the “BYOT already created” toast when creating a second session.

• BYOT: hot-reload resilience – MCP status tools (get_byot_status, list_byot_tools) access raw service attributes to survive Pydantic class identity mismatches after mcp_reload(). ByotService.status() also converts tools to dicts before constructing ByotStatus.

• Sessions: sorted newest-first – list_sessions() now returns sessions sorted by created_at descending in both the Backend and MCP tool layer.

• MCP: mcp_reload now re-registers tools – Previously only reloaded modules without updating the registered tool closures. Now calls register_all_tools() and register_debug_tools() after reload so code changes take effect without restarting the MCP server.

• MCP: TUI inspection tools use IPC – tui_screenshot, tui_get_screen, tui_query, tui_click, tui_type, tui_press, tui_get_state now communicate via the debug Unix socket instead of requiring an in-process app reference that was never set in standalone mode.

• MCP: stale debug socket cleanup – tui_stop and MCP lifespan shutdown now remove the debug socket file to prevent stale socket issues.

• Session: get() reuses cached sessions – ClientSessions.get() now returns the existing tracked session instead of always creating a fresh one, which was clobbering accumulated state (status, name, created_at).

• Session: server-assigned names applied from stream – Added Session.handle_streamed_message() to pick up MESSAGE_TYPE_SESSION_NAME from server. SessionMessages now holds a reference to its parent Session and calls the handler before yielding messages.

• Session: state reconciliation after reconnection – Added reconnect callback mechanism to RpcClient. ClientSessions registers _reconcile_state at bind time, calling list() after reconnection to resync all session state from the server.

• Connection: improved message routing reliability – Message routing now uses strict request ID matching, ensuring reliable delivery and preventing misrouting or silent drops.

• Connection: exponential backoff on reconnection – Replaced fixed 0.2s/1.0s reconnection delays with exponential backoff using full jitter (base=0.5s, max=30s, multiplier=2x). Prevents connection storms and server-side rate limiting during network instability.

• Session: log warning on invalid status – update_from_event now logs a warning when it receives an unrecognized status string, instead of silently swallowing the ValueError.

• Session: handle name and created_at from events – update_from_event now updates _name and _created_at when those fields are present in the event dict.

• ClientSessions: handle session_not_found – _handle_server_message now handles session_not_found events by removing stale sessions from the local cache and logging a warning.

• ClientSessions: log unknown session state changes – State change events for sessions not in the local registry now emit a debug log instead of being silently ignored.