Refactor: Eliminate no-unsafe-return suppressions via strict type validation

[M-DEV-1]

Summary

This PR removes all remaining @typescript-eslint/no-unsafe-return suppressions across the core and cli packages. It replaces risky type-casting with native TS runtime structural validations using zod, typeof, and instanceof.

Details

• replaced JSON.parse assertions with Zod schema parsing wrappers
• used Type predicates, and native Type Guards in place

Related Issues

Fixes #20606, Related to #19720

How to Validate

• Run npm run lint and npm run typecheck against the workspace.
• Run npm start to use and test the CLI

Pre-Merge Checklist

• Updated relevant documentation and README (if needed) - NA
• Added/updated tests (if needed) - NA
• Noted breaking changes (if any) - NA
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on a comprehensive refactoring effort to bolster the type safety and reliability of the application. By systematically removing all instances of @typescript-eslint/no-unsafe-return suppressions, the codebase now enforces stricter type checks at runtime. This was achieved through the strategic adoption of Zod for schema-based validation of parsed JSON data and the consistent application of native TypeScript type guards, ensuring that data structures conform to their defined types and reducing the likelihood of unexpected runtime errors.

Highlights

• Type Safety Enhancement: Eliminated all @typescript-eslint/no-unsafe-return suppressions across the core and cli packages, significantly improving the codebase's type safety.
• Zod Integration: Introduced the Zod library for robust runtime schema validation, particularly for JSON.parse operations, ensuring data integrity and expected type conformity.
• Native Type Guards: Replaced risky type-casting with native TypeScript type guards (typeof, instanceof) and explicit type assertions to provide more precise and reliable type narrowing.

Changelog

• packages/cli/src/commands/extensions/utils.ts
  • Replaced no-unsafe-return suppression with a typeof boolean check for response.confirm.
• packages/cli/src/config/extensionRegistryClient.ts
  • Explicitly typed the results array from fzf.find and removed no-unsafe-return suppression.
• packages/cli/src/config/extensions/extensionEnablement.ts
  • Imported Zod and implemented schema validation for JSON.parse output in readConfig.
• packages/cli/src/config/extensions/extensionSettings.ts
  • Added a typeof string check for response.value before returning.
• packages/cli/src/config/extensions/variables.ts
  • Added explicit unknown[] type assertion for array mapping in recursivelyHydrateStrings.
• packages/cli/src/test-utils/mockCommandContext.ts
  • Introduced a type guard isCommandContext and runtime check for the merged command context.
• packages/cli/src/test-utils/render.tsx
  • Explicitly cast the return of Reflect.get to unknown to satisfy type safety.
• packages/cli/src/ui/hooks/useAtCompletion.ts
  • Explicitly typed results arrays from fzf.find and removed no-unsafe-return suppressions in searchResourceCandidates and searchAgentCandidates.
• packages/cli/src/ui/utils/TableRenderer.tsx
  • Explicitly typed actualColumnWidths as number[] and removed no-unsafe-return suppressions.
• packages/cli/src/utils/envVarResolver.ts
  • Added isTArray type guard and runtime checks for array returns in resolveEnvVarsInObjectInternal.
• packages/cli/src/utils/gitUtils.ts
  • Added a typeof string check for releaseTag before returning.
• packages/cli/src/utils/jsonoutput.ts
  • Removed no-unsafe-assignment and no-unsafe-return suppressions, explicitly typed parsed as unknown.
• packages/cli/src/utils/settingsUtils.ts
  • Replaced JSON.parse(JSON.stringify(pendingSettings)) with structuredClone and added explicit type assertion for setNestedValue.
• packages/cli/src/zed-integration/fileSystemService.ts
  • Added a typeof string check for response.content before returning.
• packages/core/src/code_assist/oauth2.ts
  • Introduced isOAuthCreds type guard and runtime check for JSON.parse output in fetchCachedCredentials.
• packages/core/src/config/projectRegistry.ts
  • Imported Zod and implemented schema validation for JSON.parse output in readRegistry.
• packages/core/src/core/baseLlmClient.ts
  • Introduced isRecord type guard and runtime check for JSON.parse output in generateContent.
• packages/core/src/core/fakeContentGenerator.ts
  • Added instanceof checks for GenerateContentResponse and EmbedContentResponse after Object.setPrototypeOf.
• packages/core/src/core/localLiteRtLmClient.ts
  • Introduced isRecord type guard and runtime check for JSON.parse output in generateContent.
• packages/core/src/ide/ide-client.ts
  • Added a typeof string check for parsedJson.content before returning.
• packages/core/src/ide/ide-connection-utils.ts
  • Introduced isConfig type guard and runtime checks for JSON.parse outputs in getConnectionConfigFromFile.
• packages/core/src/services/chatRecordingService.ts
  • Introduced isConversationRecord type guard and runtime check for JSON.parse output in readConversation.
• packages/core/src/utils/filesearch/fileSearch.ts
  • Removed FzfResultItem import, explicitly typed filteredCandidates, and added runtime checks for fzf.find results.
• packages/core/src/utils/safeJsonStringify.ts
  • Explicitly cast return values to unknown in safeJsonStringify and safeJsonStringifyBooleanValuesOnly.
• packages/core/src/utils/stdio.ts
  • Explicitly cast return values to unknown in createWorkingStdio proxy handlers.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request is a significant and well-executed refactoring to improve type safety across the codebase. By systematically eliminating @typescript-eslint/no-unsafe-return and other unsafe suppressions, you've made the code more robust and maintainable. The use of Zod for runtime validation of JSON structures, along with proper type guards (typeof, instanceof), is an excellent approach. The changes are consistent and correctly applied, addressing potential runtime errors from unsafe type assumptions. I have reviewed the changes and found no issues. Great work!

[M-DEV-1]

Hi @gundermanc, just checking in. I'd appreciate if you could give a review, whenever time permits. Thanks!

[M-DEV-1]

resolving merge conflicts..

[M-DEV-1]

resolved. also, @gundermanc, I was wondering if I should squash all the merge commits or leave them as is.

[M-DEV-1]

Hi @gundermanc, was wondering if you'd be free this week for a review. Thanks!

[M-DEV-1]

Hi @gundermanc, would it be possible to get a review this week? Thanks :)

[cocosheng-g]

Please resolve conflicts

[M-DEV-1]

@cocosheng-g resolved!

[M-DEV-1]

@gundermanc @cocosheng-g resolved again 👍🏼

would appreciate reviews and CI run approval so that we can get read to merge. it's been open for quite some time now.

[M-DEV-1]

Hi @cocosheng-g, @gundermanc 👍🏼

Hope you have a good weekend. Was wondering if I could get any reviews this week 😄

[scidomino]

The change looks good. Please fix the merge conflict and I will approve.

[M-DEV-1]

Resolved the conflict, testing locally to resolve any other bugs.

[M-DEV-1]

Made some fixes, I believe we can run full CI now 👍🏼 @scidomino

[scidomino]

You have a bunch of broken tests. Please make sure npm run preflight passes before sending it back for review.

[M-DEV-1]

Hi @scidomino,

I looked through the failed runs, and well,

this commit was the breaking change, specifically the CONTRIBUTING.md change that I got from npm run lint

the linter added a new line at the end of the symlink file in docs/CONTRIBUTING.md

the failed CI output was (one example)

  > @google/gemini-cli-devtools@0.42.0-nightly.20260428.g59b2dea0e build:client
  > node esbuild.client.js
  
  
  > @google/gemini-cli-core@0.42.0-nightly.20260428.g59b2dea0e bundle:browser-mcp
  > node scripts/bundle-browser-mcp.mjs
  
  Copied 10 policy files to bundle/policies/
  node:fs:1681
    const stats = binding.stat(
                          ^
  
  Error: ENOENT: no such file or directory, stat '/home/runner/work/gemini-cli/gemini-cli/docs/CONTRIBUTING.md'
      at statSync (node:fs:1681:25)
      at getStatsSync (node:internal/fs/cp/cp-sync:120:19)
      at checkPathsSync (node:internal/fs/cp/cp-sync:72:33)
      at copyDir (node:internal/fs/cp/cp-sync:274:37)
      at mkDirAndCopy (node:internal/fs/cp/cp-sync:260:3)
      at onDir (node:internal/fs/cp/cp-sync:254:25)
      at getStats (node:internal/fs/cp/cp-sync:158:12)
      at checkParentDir (node:internal/fs/cp/cp-sync:150:10)
      at cpSyncFn (node:internal/fs/cp/cp-sync:61:10)
      at cpSync (node:fs:3089:3) {
    errno: -2,
    code: 'ENOENT',
    syscall: 'stat',
    path: '/home/runner/work/gemini-cli/gemini-cli/docs/CONTRIBUTING.md'
  }

I have run `npm run preflight` locally, and got this output

  PS C:\code\oss\gemini-cli> npm run preflight

@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e preflight

npm run clean && npm ci && npm run format && npm run build && npm run lint:ci && npm run typecheck && npm run test:ci


@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e clean

node scripts/clean.js

npm warn deprecated domexception@4.0.0: Use your platform's native DOMException instead

npm warn deprecated node-domexception@1.0.0: Use your platform's native DOMException instead

@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e prepare

husky && npm run bundle


@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e bundle

npm run generate && npm run build --workspace=@google/gemini-cli-devtools && npm run bundle:browser-mcp -w @google/gemini-cli-core && node esbuild.config.js && node scripts/copy_bundle_assets.js


@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e generate

node scripts/generate-git-commit-info.js


@google/gemini-cli-devtools@0.42.0-nightly.20260428.g59b2dea0e build

npm run build:client && tsc -p tsconfig.build.json


@google/gemini-cli-devtools@0.42.0-nightly.20260428.g59b2dea0e build:client

node esbuild.client.js


@google/gemini-cli-core@0.42.0-nightly.20260428.g59b2dea0e bundle:browser-mcp

node scripts/bundle-browser-mcp.mjs

Copied 10 policy files to bundle/policies/

Copied docs to bundle/docs/

Copied built-in skills to bundle/builtin/

Copied devtools package to bundle/node_modules/

Copied bundled chrome-devtools-mcp to bundle/bundled/

Copied extension examples to bundle/examples/

Assets copied to bundle/
added 1321 packages, and audited 1329 packages in 2m
362 packages are looking for funding

run npm fund for details
34 vulnerabilities (8 low, 19 moderate, 6 high, 1 critical)
To address issues that do not require attention, run:

npm audit fix
To address all issues (including breaking changes), run:

npm audit fix --force
Run npm audit for details.

@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e format

prettier --experimental-cli --write .


@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e build

node scripts/build.js


@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e generate

node scripts/generate-git-commit-info.js

Building @google/gemini-cli-core...

@google/gemini-cli-core@0.42.0-nightly.20260428.g59b2dea0e build

node ../../scripts/build_package.js

Running chrome devtools MCP bundling...

@google/gemini-cli-core@0.42.0-nightly.20260428.g59b2dea0e bundle:browser-mcp

node scripts/bundle-browser-mcp.mjs

Successfully copied files.

Copied documentation to dist/docs

Building other workspaces in parallel...

npm warn Unknown cli config "sandboxImageUri" (@google/gemini-cli:sandboxImageUri). This will stop working in the next major version of npm.

npm warn Unknown cli config "sandboxImageUri" (@google/gemini-cli:sandboxImageUri). This will stop working in the next major version of npm.

npm warn Unknown cli config "sandboxImageUri" (@google/gemini-cli:sandboxImageUri). This will stop working in the next major version of npm.

npm warn Unknown cli config "sandboxImageUri" (@google/gemini-cli:sandboxImageUri). This will stop working in the next major version of npm.

npm warn Unknown cli config "sandboxImageUri" (@google/gemini-cli:sandboxImageUri). This will stop working in the next major version of npm.

npm warn Unknown cli config "sandboxImageUri" (@google/gemini-cli:sandboxImageUri). This will stop working in the next major version of npm.

@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e build

node ../../scripts/build_package.js


@google/gemini-cli-a2a-server@0.42.0-nightly.20260428.g59b2dea0e build

node ../../scripts/build_package.js


@google/gemini-cli-devtools@0.42.0-nightly.20260428.g59b2dea0e build

npm run build:client && tsc -p tsconfig.build.json


@google/gemini-cli-sdk@0.42.0-nightly.20260428.g59b2dea0e build

node ../../scripts/build_package.js


gemini-cli-vscode-ide-companion@0.42.0-nightly.20260428.g59b2dea0e build

npm run build:dev


@google/gemini-cli-test-utils@0.42.0-nightly.20260428.g59b2dea0e build

node ../../scripts/build_package.js


@google/gemini-cli-devtools@0.42.0-nightly.20260428.g59b2dea0e build:client

node esbuild.client.js


gemini-cli-vscode-ide-companion@0.42.0-nightly.20260428.g59b2dea0e build:dev

node esbuild.js

[watch] build started

[watch] build finished

Successfully copied files.

Successfully copied files.

Successfully copied files.

Successfully copied files.

@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e lint:ci

npm run lint:all


@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e lint:all

node scripts/lint.js

Setting up linters...

Installing actionlint...

Installing shellcheck...

Installing yamllint...

Requirement already satisfied: pip in c:\users\mahad\appdata\local\temp\gemini-cli-linters\python_venv\lib\site-packages (25.2)

Collecting pip

Using cached pip-26.1.1-py3-none-any.whl.metadata (4.6 kB)

Using cached pip-26.1.1-py3-none-any.whl (1.8 MB)

Installing collected packages: pip

Attempting uninstall: pip

Found existing installation: pip 25.2

Uninstalling pip-25.2:

Successfully uninstalled pip-25.2

Successfully installed pip-26.1.1

WARNING: Cache entry deserialization failed, entry ignored

Collecting yamllint==1.35.1

Using cached yamllint-1.35.1-py3-none-any.whl.metadata (4.2 kB)

WARNING: Cache entry deserialization failed, entry ignored

Collecting pathspec>=0.5.3 (from yamllint==1.35.1)

Using cached pathspec-1.1.1-py3-none-any.whl.metadata (14 kB)

WARNING: Cache entry deserialization failed, entry ignored

Collecting pyyaml (from yamllint==1.35.1)

Using cached pyyaml-6.0.3-cp314-cp314-win_amd64.whl.metadata (2.4 kB)

Using cached yamllint-1.35.1-py3-none-any.whl (66 kB)

Using cached pathspec-1.1.1-py3-none-any.whl (57 kB)

Using cached pyyaml-6.0.3-cp314-cp314-win_amd64.whl (156 kB)

Installing collected packages: pyyaml, pathspec, yamllint

Successfully installed pathspec-1.1.1 pyyaml-6.0.3 yamllint-1.35.1

All required linters are available.
Running ESLint...

@google/gemini-cli@0.42.0-nightly.20260428.g59b2dea0e lint

cross-env NODE_OPTIONS="--max-old-space-size=8192" eslint . --cache --max-warnings 0

Running actionlint...
Running shellcheck...
Running yamllint...

'yml)'' is not recognized as an internal or external command,

operable program or batch file.

PS C:\code\oss\gemini-cli>

[M-DEV-1]

not sure why this is happening when I perform npm run preflight

Running actionlint...


Running shellcheck...


Running yamllint...
'yml)'' is not recognized as an internal or external command,
operable program or batch file.

this PR's original branch was in Windows, and this is the Powershell output. will run in WSL and report if there is anything different.