fix(gemini): drop removed --skip-trust flag and recover banner-prefixed stream

[nedjamez]

Running the runner against Gemini CLI ≥ 0.35 surfaced two breakages that together make every gemini sub-agent fail or return empty. Both are fixed here, with tests.

1. --skip-trust was removed from Gemini CLI (hard failure)

build_command() passed --skip-trust, which Gemini CLI removed in 0.35. The CLI now exits non-zero with:

Unknown arguments: skip-trust, skipTrust

so the sub-agent dies before doing any work. The permission mapping already passes --approval-mode (plan/auto_edit/yolo), which is the current trust/approval signal in headless -p mode, so --skip-trust is simply dropped.

2. A stdout banner glued onto init silently emptied the result

Gemini prepends a non-JSON banner onto the first event line when an MCP server is unreachable, e.g.:

MCP issues detected. Run /mcp list for status.{"type":"init",...}

json.loads on that glued line throws, so is_gemini is never set, every assistant message is ignored, and the run returns {"result": "", "status": "success"} — a silent empty result. StreamProcessor.process_line now recovers JSON from the first { on a line, so a leading banner no longer eats the stream.

Changes

• skills/sub-agents/scripts/_builder.py — drop --skip-trust (comment explains why).
• skills/sub-agents/scripts/_stream.py — recover JSON after a non-JSON line prefix.
• Synced runner plugin copy via scripts/sync_plugin.py (drift check passes).
• tests/test_builder.py — updated expected gemini args; asserts --skip-trust absent.
• tests/test_stream.py — added a regression test for the banner-prefixed init line.

Verification

• python3 scripts/sync_plugin.py --check → in sync
• full suite: 90 passed
• Reproduced end-to-end before/after against a real gemini 0.35.1 + gemini-3-flash-preview: pre-fix the run errored on --skip-trust, then returned empty; post-fix it returns the model's text.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[shinpr]

Requesting changes on the Gemini trust handling.

The stream recovery change looks good.

I confirmed that --skip-trust is rejected by Gemini CLI 0.35.1 during normal -p execution, so that compatibility issue is real. But in Gemini CLI 0.41.2, --skip-trust exists again, and removing it causes untrusted workspaces to override --approval-mode back to default.

So --approval-mode does not appear to replace the workspace trust behavior.

Instead of just removing --skip-trust, I think we should set GEMINI_CLI_TRUST_WORKSPACE=true for Gemini invocations. That works with the 0.35.x behavior and the current 0.41.x behavior, and it fits the existing env override path used for GEMINI_SYSTEM_MD.

I’d keep the stream parser fix, but change the Gemini command/env handling before merging.