Framework Watch: Gemini CLI Stops Dollar Signs Rewriting Its Prompts, ADK Java Pauses for Approval, and Codex Trusts Read-Only Hints

Gemini CLI 0.68

Released on November 10, 2026, this version includes two fixes worth knowing about even if you never use Gemini CLI, because the same mistakes are easy to make elsewhere.

• Dollar signs in prompts. Pull request #30035 replaces String.prototype.replace(placeholder, value) in the prompt templates for the summarizer, the edit fixer and session summaries. In JavaScript, a replacement string containing $&, $', $` or $$ is interpreted, so tool output or conversation text containing them "silently corrupted the prompts". For example, $' "duplicated the remainder of the prompt template mid-payload". The edit fixer also ran five .replace() calls in a row, so an early input containing a later placeholder was filled in twice. A single-pass replacement now fixes both problems.
• Windows path case. Pull request #29999 makes isWithinRoot() case-insensitive on Windows. Before, a path such as c:\Users from an editor did not match C:\Users from the process, so the ignore-file parsers received null, "bypassing .gitignore and .geminiignore rules for paths with mismatched casing". It could also fail "to protect global ~/.gemini files".

ADK Java and Codex

• Approval in workflows. A November 10 ADK Java commit changes tool nodes in graph workflows. Before, the class documentation said "a tool that asks for confirmation does not pause the workflow: the node outputs the tool's placeholder error." Now the node pauses with a request for input and reruns the tool with the user's answer. Under the old behaviour, the workflow received that placeholder error as the node's output instead of waiting for a person to decide.
• Dev server address. Another commit makes AdkWebServer.main() and start() listen on 127.0.0.1 by default "because the server's endpoints do not authenticate callers". Containers now need SERVER_ADDRESS=0.0.0.0, and the README says to "put authentication in front of the server first". Both ADK changes are unreleased.
• Read-only hints in Codex. Codex pull request #60638, merged November 10, gives an MCP tool's readOnlyHint precedence over destructiveHint and openWorldHint in automatic approval, so a tool with both hints set no longer prompts. Explicit prompt mode and strict automatic review are unchanged. The MCP specification says clients "MUST consider tool annotations to be untrusted unless they come from trusted servers", so the change is only as safe as the servers configured. We did not confirm which release carries it.

What remains uncertain. We did not reproduce any of these bugs, and none of the notes describe real-world exposure. Unreleased commits may change before they ship.

Analysis: Search your own code for template filling with replace and string replacements, especially where model or tool output is inserted, and replace chained calls with a single pass. On Windows, compare paths after normalizing case. If Dinky's catalogue agent at Belgavi's Book Store connects to a third-party MCP server, keep it out of automatic approval unless you trust that server's annotations, because a server can label any tool read-only.

Sources and evidence

• Gemini CLI v0.68.0 release notes (GitHub, November 10)
• fix(core): prevent $-pattern corruption in LLM prompt templates (gemini-cli #30035)
• fix(core): make isWithinRoot case-insensitive on Windows (gemini-cli #29999)
• fix(workflow): pause a tool node when its tool asks for confirmation (ADK Java)
• fix(dev): listen on 127.0.0.1 by default in AdkWebServer.main() and start() (ADK Java)
• Honor read-only MCP tool hints in automatic approval (Codex #60638)
• Tools: annotations (Model Context Protocol specification, 2025-06-18)