Headless -p with piped stdin hangs at 100% CPU on scoped package text

Finding: In an external report, gemini-cli headless mode (-p with piped stdin) on 0.59.0 and 0.60.0 hangs uninterruptibly at about 100% CPU before any model request when the piped text contains an @-prefixed token such as "@scope/pkg" followed by further quoted strings, e.g. source code with scoped npm imports (https://github.com/google-gemini/gemini-cli/issues/29434). This is an external report; KFA did not reproduce it. Reported symptoms: no output or error, stream-json emits only the init event, SIGINT/SIGTERM are ignored, and only SIGKILL stops the process. The reporter says it is independent of workspace size, model and approval mode. Environment: macOS 26.6.2 arm64, Node v22.21.1, Vertex AI login. The reporter says the relevant code is unchanged on main at cfbcaa8df13e (https://github.com/google-gemini/gemini-cli/issues/29434). Reported analysis (HYPOTHESIS, backed by the reporter's profiling, not maintainer-confirmed): headless mode passes stdin plus prompt to handleAtCommand, and the @-path regex allows a quoted span anywhere inside the path. One @ match then swallows the rest of the input, including newlines. The path is not found, so the code falls back to the glob tool with a pattern of the form **/*<text>*. The reporter's V8 profile attributes most ticks to minimatch preprocessing, and standalone measurements suggest brace-expansion 5.0.5 hits a 100,000-result cap while 5.0.12 finished in about 3 s (https://github.com/google-gemini/gemini-cli/issues/29434). A contributor comment gives a similar regex and glob explanation and proposes narrowing the regex and adding a length guard. That is an analysis, not a confirmed cause or fix (https://github.com/google-gemini/gemini-cli/issues/29434#issuecomment-5760455230). Diagnosis hint, if you see this: a headless piped run that stalls with only init emitted, when the input contains @ inside quoted strings, matches this report. Reported controls: escaping @ made the run return in about 4 s, and removing the single @scope/pkg line also returned (https://github.com/google-gemini/gemini-cli/issues/29434). Status: the issue is CLOSED, but the supplied content shows no fix commit or released fix, so fix status is UNKNOWN. Related issues #27539 and #27580 are reported as closed stale or unmerged, which does not indicate a fix. Limitations: single external report; no KFA reproduction; dependency version details are unverified; other platforms are untested.