Gemini CLI v0.61.0 adds Gemini 3.8 Flash and guards build files

Gemini CLI now supports Gemini 3.8 Flash as its newest Flash model. Gemini 3.5 Flash Lite joins it, and Gemini 3.5 Flash and 3.1 Flash Lite become the base tier.

Slide text

Gemini CLI v0.61.0 adds Gemini 3.8 Flash

Plus Gemini 3.5 Flash Lite, guarded build files, and a tighter sandbox.

github.com/google-gemini/gemini-cli, release v0.61.0

The new Flash models.

With a Gemini API key, Vertex AI, or a gateway, both new models are available as soon as you upgrade. With Login with Google, they arrive when the rollout flag switches on for you.

The short model names follow them. Once you have access, asking for flash gets you Gemini 3.8 Flash, and asking for flash lite gets you Gemini 3.5 Flash Lite.

When Gemini CLI falls back to an older model, it now lands on Gemini 3.5 Flash instead of 2.5 Flash. That covers the flash alias without preview access, and the last resort after retries.

If you write your own model configs, useGemini3_5Flash is now useLatestFlash, and the Flash Lite condition is renamed to match. The old names still work as deprecated aliases.

Pinning a model.

Pin a versioned Flash model with the model flag, and that exact ID now goes out with the request. Before, Gemini CLI quietly swapped it for the Gemini 3.5 Flash rollout default.

Build files and outside content.

When the agent edits a build file, such as package.json, a Makefile, or build dot gradle, Gemini CLI now always stops to ask, with a security warning. In a non-interactive run, the edit is denied.

Once a build file has changed in a session, the next build or test command, like npm, make, or cargo, asks before it runs. Allow for this session is no longer offered for it.

If a command's flags came from outside content, like a fetched web page, an MCP server response, or a Google Doc, Gemini CLI lists those flags in a critical warning and waits for your approval.

The sandbox.

Start a sandboxed session from the root of your home folder, from the filesystem root, or from the dot gemini folder, and it now refuses. Those folders can't be mounted into a container either.

Docker and Podman sandboxes now get a sanitized copy of your settings file, with hooks, custom tool commands, and API keys stripped out. Your real settings folder stays on the host.

On macOS, the Seatbelt profiles now deny reading and writing your OAuth credentials, your Google accounts file, your trusted hooks, and any dot env file.

Seatbelt now blocks writes to the dot gemini folder, so a sandboxed session keeps its history in a dot gemini folder under dot cache, and it still carries over between runs.

Your personal commands in the dot gemini commands folder now load even in an untrusted workspace. Commands from the workspace and from extensions still depend on folder trust.

To upgrade, install the Gemini CLI package globally from npm, pinned to this release.