From 6f0948137f4c0940d6b4dc69ca4e9c9c0abb5fd2 Mon Sep 17 00:00:00 2001
From: Daniel <57051444+daniel-lxs@users.noreply.github.com>
Date: Tue, 6 Jan 2026 00:22:33 -0500
Subject: [PATCH 1/3] fix: preserve tool_use blocks for all tool_results in
 kept messages during condensation (#10471)

---
 src/core/condense/__tests__/index.spec.ts | 248 ++++++++++++++++++++++
 src/core/condense/index.ts                |  90 ++++++--
 2 files changed, 317 insertions(+), 21 deletions(-)

diff --git a/src/core/condense/__tests__/index.spec.ts b/src/core/condense/__tests__/index.spec.ts
index 1309afb221..ef5af01243 100644
--- a/src/core/condense/__tests__/index.spec.ts
+++ b/src/core/condense/__tests__/index.spec.ts
@@ -334,6 +334,254 @@ describe("getKeepMessagesWithToolBlocks", () => {
 		expect(result.toolUseBlocksToPreserve).toHaveLength(1)
 		expect(result.reasoningBlocksToPreserve).toHaveLength(0)
 	})
+
+	it("should preserve tool_use when tool_result is in 2nd kept message and tool_use is 2 messages before boundary", () => {
+		const toolUseBlock = {
+			type: "tool_use" as const,
+			id: "toolu_second_kept",
+			name: "read_file",
+			input: { path: "test.txt" },
+		}
+		const toolResultBlock = {
+			type: "tool_result" as const,
+			tool_use_id: "toolu_second_kept",
+			content: "file contents",
+		}
+
+		const messages: ApiMessage[] = [
+			{ role: "user", content: "Hello", ts: 1 },
+			{ role: "assistant", content: "Let me help", ts: 2 },
+			{
+				role: "assistant",
+				content: [{ type: "text" as const, text: "Reading file..." }, toolUseBlock],
+				ts: 3,
+			},
+			{ role: "user", content: "Some other message", ts: 4 },
+			{ role: "assistant", content: "First kept message", ts: 5 },
+			{
+				role: "user",
+				content: [toolResultBlock, { type: "text" as const, text: "Continue" }],
+				ts: 6,
+			},
+			{ role: "assistant", content: "Third kept message", ts: 7 },
+		]
+
+		const result = getKeepMessagesWithToolBlocks(messages, 3)
+
+		// keepMessages should be the last 3 messages (ts: 5, 6, 7)
+		expect(result.keepMessages).toHaveLength(3)
+		expect(result.keepMessages[0].ts).toBe(5)
+		expect(result.keepMessages[1].ts).toBe(6)
+		expect(result.keepMessages[2].ts).toBe(7)
+
+		// Should preserve the tool_use block from message at ts:3 (2 messages before boundary)
+		expect(result.toolUseBlocksToPreserve).toHaveLength(1)
+		expect(result.toolUseBlocksToPreserve[0]).toEqual(toolUseBlock)
+	})
+
+	it("should preserve tool_use when tool_result is in 3rd kept message and tool_use is at boundary edge", () => {
+		const toolUseBlock = {
+			type: "tool_use" as const,
+			id: "toolu_third_kept",
+			name: "search",
+			input: { query: "test" },
+		}
+		const toolResultBlock = {
+			type: "tool_result" as const,
+			tool_use_id: "toolu_third_kept",
+			content: "search results",
+		}
+
+		const messages: ApiMessage[] = [
+			{ role: "user", content: "Start", ts: 1 },
+			{
+				role: "assistant",
+				content: [{ type: "text" as const, text: "Searching..." }, toolUseBlock],
+				ts: 2,
+			},
+			{ role: "user", content: "First kept message", ts: 3 },
+			{ role: "assistant", content: "Second kept message", ts: 4 },
+			{
+				role: "user",
+				content: [toolResultBlock, { type: "text" as const, text: "Done" }],
+				ts: 5,
+			},
+		]
+
+		const result = getKeepMessagesWithToolBlocks(messages, 3)
+
+		// keepMessages should be the last 3 messages (ts: 3, 4, 5)
+		expect(result.keepMessages).toHaveLength(3)
+		expect(result.keepMessages[0].ts).toBe(3)
+		expect(result.keepMessages[1].ts).toBe(4)
+		expect(result.keepMessages[2].ts).toBe(5)
+
+		// Should preserve the tool_use block from message at ts:2 (at the search boundary edge)
+		expect(result.toolUseBlocksToPreserve).toHaveLength(1)
+		expect(result.toolUseBlocksToPreserve[0]).toEqual(toolUseBlock)
+	})
+
+	it("should preserve multiple tool_uses when tool_results are in different kept messages", () => {
+		const toolUseBlock1 = {
+			type: "tool_use" as const,
+			id: "toolu_multi_1",
+			name: "read_file",
+			input: { path: "file1.txt" },
+		}
+		const toolUseBlock2 = {
+			type: "tool_use" as const,
+			id: "toolu_multi_2",
+			name: "read_file",
+			input: { path: "file2.txt" },
+		}
+		const toolResultBlock1 = {
+			type: "tool_result" as const,
+			tool_use_id: "toolu_multi_1",
+			content: "contents 1",
+		}
+		const toolResultBlock2 = {
+			type: "tool_result" as const,
+			tool_use_id: "toolu_multi_2",
+			content: "contents 2",
+		}
+
+		const messages: ApiMessage[] = [
+			{ role: "user", content: "Start", ts: 1 },
+			{
+				role: "assistant",
+				content: [{ type: "text" as const, text: "Reading file 1..." }, toolUseBlock1],
+				ts: 2,
+			},
+			{ role: "user", content: "Some message", ts: 3 },
+			{
+				role: "assistant",
+				content: [{ type: "text" as const, text: "Reading file 2..." }, toolUseBlock2],
+				ts: 4,
+			},
+			{
+				role: "user",
+				content: [toolResultBlock1, { type: "text" as const, text: "First result" }],
+				ts: 5,
+			},
+			{
+				role: "user",
+				content: [toolResultBlock2, { type: "text" as const, text: "Second result" }],
+				ts: 6,
+			},
+			{ role: "assistant", content: "Got both files", ts: 7 },
+		]
+
+		const result = getKeepMessagesWithToolBlocks(messages, 3)
+
+		// keepMessages should be the last 3 messages (ts: 5, 6, 7)
+		expect(result.keepMessages).toHaveLength(3)
+
+		// Should preserve both tool_use blocks
+		expect(result.toolUseBlocksToPreserve).toHaveLength(2)
+		expect(result.toolUseBlocksToPreserve).toContainEqual(toolUseBlock1)
+		expect(result.toolUseBlocksToPreserve).toContainEqual(toolUseBlock2)
+	})
+
+	it("should not crash when tool_result references tool_use beyond search boundary", () => {
+		const toolResultBlock = {
+			type: "tool_result" as const,
+			tool_use_id: "toolu_beyond_boundary",
+			content: "result",
+		}
+
+		// Tool_use is at ts:1, but with N_MESSAGES_TO_KEEP=3, we only search back 3 messages
+		// from startIndex-1. StartIndex is 7 (messages.length=10, keepCount=3, startIndex=7).
+		// So we search from index 6 down to index 4 (7-1 down to 7-3).
+		// The tool_use at index 0 (ts:1) is beyond the search boundary.
+		const messages: ApiMessage[] = [
+			{
+				role: "assistant",
+				content: [
+					{ type: "text" as const, text: "Way back..." },
+					{
+						type: "tool_use" as const,
+						id: "toolu_beyond_boundary",
+						name: "old_tool",
+						input: {},
+					},
+				],
+				ts: 1,
+			},
+			{ role: "user", content: "Message 2", ts: 2 },
+			{ role: "assistant", content: "Message 3", ts: 3 },
+			{ role: "user", content: "Message 4", ts: 4 },
+			{ role: "assistant", content: "Message 5", ts: 5 },
+			{ role: "user", content: "Message 6", ts: 6 },
+			{ role: "assistant", content: "Message 7", ts: 7 },
+			{
+				role: "user",
+				content: [toolResultBlock],
+				ts: 8,
+			},
+			{ role: "assistant", content: "Message 9", ts: 9 },
+			{ role: "user", content: "Message 10", ts: 10 },
+		]
+
+		// Should not crash
+		const result = getKeepMessagesWithToolBlocks(messages, 3)
+
+		// keepMessages should be the last 3 messages
+		expect(result.keepMessages).toHaveLength(3)
+		expect(result.keepMessages[0].ts).toBe(8)
+		expect(result.keepMessages[1].ts).toBe(9)
+		expect(result.keepMessages[2].ts).toBe(10)
+
+		// Should not preserve the tool_use since it's beyond the search boundary
+		expect(result.toolUseBlocksToPreserve).toHaveLength(0)
+	})
+
+	it("should not duplicate tool_use blocks when same tool_result ID appears multiple times", () => {
+		const toolUseBlock = {
+			type: "tool_use" as const,
+			id: "toolu_duplicate",
+			name: "read_file",
+			input: { path: "test.txt" },
+		}
+		const toolResultBlock1 = {
+			type: "tool_result" as const,
+			tool_use_id: "toolu_duplicate",
+			content: "result 1",
+		}
+		const toolResultBlock2 = {
+			type: "tool_result" as const,
+			tool_use_id: "toolu_duplicate",
+			content: "result 2",
+		}
+
+		const messages: ApiMessage[] = [
+			{ role: "user", content: "Start", ts: 1 },
+			{
+				role: "assistant",
+				content: [{ type: "text" as const, text: "Using tool..." }, toolUseBlock],
+				ts: 2,
+			},
+			{
+				role: "user",
+				content: [toolResultBlock1],
+				ts: 3,
+			},
+			{ role: "assistant", content: "Processing", ts: 4 },
+			{
+				role: "user",
+				content: [toolResultBlock2], // Same tool_use_id as first result
+				ts: 5,
+			},
+		]
+
+		const result = getKeepMessagesWithToolBlocks(messages, 3)
+
+		// keepMessages should be the last 3 messages (ts: 3, 4, 5)
+		expect(result.keepMessages).toHaveLength(3)
+
+		// Should only preserve the tool_use block once, not twice
+		expect(result.toolUseBlocksToPreserve).toHaveLength(1)
+		expect(result.toolUseBlocksToPreserve[0]).toEqual(toolUseBlock)
+	})
 })
 
 describe("getMessagesSinceLastSummary", () => {
diff --git a/src/core/condense/index.ts b/src/core/condense/index.ts
index 3238eca707..79bc31ef9f 100644
--- a/src/core/condense/index.ts
+++ b/src/core/condense/index.ts
@@ -7,6 +7,7 @@ import { t } from "../../i18n"
 import { ApiHandler } from "../../api"
 import { ApiMessage } from "../task-persistence/apiMessages"
 import { maybeRemoveImageBlocks } from "../../api/transform/image-cleaning"
+import { findLast } from "../../shared/array"
 
 /**
  * Checks if a message contains tool_result blocks.
@@ -30,6 +31,28 @@ function getToolUseBlocks(message: ApiMessage): Anthropic.Messages.ToolUseBlock[
 	return message.content.filter((block) => block.type === "tool_use") as Anthropic.Messages.ToolUseBlock[]
 }
 
+/**
+ * Gets the tool_result blocks from a message.
+ */
+function getToolResultBlocks(message: ApiMessage): Anthropic.ToolResultBlockParam[] {
+	if (message.role !== "user" || typeof message.content === "string") {
+		return []
+	}
+	return message.content.filter((block): block is Anthropic.ToolResultBlockParam => block.type === "tool_result")
+}
+
+/**
+ * Finds a tool_use block by ID in a message.
+ */
+function findToolUseBlockById(message: ApiMessage, toolUseId: string): Anthropic.Messages.ToolUseBlock | undefined {
+	if (message.role !== "assistant" || typeof message.content === "string") {
+		return undefined
+	}
+	return message.content.find(
+		(block): block is Anthropic.Messages.ToolUseBlock => block.type === "tool_use" && block.id === toolUseId,
+	)
+}
+
 /**
  * Gets reasoning blocks from a message's content array.
  * Task stores reasoning as {type: "reasoning", text: "..."} blocks,
@@ -57,11 +80,11 @@ export type KeepMessagesResult = {
 
 /**
  * Extracts tool_use blocks that need to be preserved to match tool_result blocks in keepMessages.
- * When the first kept message is a user message with tool_result blocks,
- * we need to find the corresponding tool_use blocks from the preceding assistant message.
+ * Checks ALL kept messages for tool_result blocks and searches backwards through the condensed
+ * region (bounded by N_MESSAGES_TO_KEEP) to find the matching tool_use blocks by ID.
  * These tool_use blocks will be appended to the summary message to maintain proper pairing.
  *
- * Also extracts reasoning blocks from the preceding assistant message, which are required
+ * Also extracts reasoning blocks from messages containing preserved tool_uses, which are required
  * by DeepSeek and Z.ai for interleaved thinking mode. Without these, the API returns a 400 error
  * "Missing reasoning_content field in the assistant message".
  * See: https://api-docs.deepseek.com/guides/thinking_mode#tool-calls
@@ -78,28 +101,53 @@ export function getKeepMessagesWithToolBlocks(messages: ApiMessage[], keepCount:
 	const startIndex = messages.length - keepCount
 	const keepMessages = messages.slice(startIndex)
 
-	// Check if the first kept message is a user message with tool_result blocks
-	if (keepMessages.length > 0 && hasToolResultBlocks(keepMessages[0])) {
-		// Look for the preceding assistant message with tool_use blocks
-		const precedingIndex = startIndex - 1
-		if (precedingIndex >= 0) {
-			const precedingMessage = messages[precedingIndex]
-			const toolUseBlocks = getToolUseBlocks(precedingMessage)
-			if (toolUseBlocks.length > 0) {
-				// Also extract reasoning blocks for DeepSeek/Z.ai interleaved thinking
-				// Task stores reasoning as {type: "reasoning", text: "..."} content blocks
-				const reasoningBlocks = getReasoningBlocks(precedingMessage)
-				// Return the tool_use blocks and reasoning blocks to be merged into the summary message
-				return {
-					keepMessages,
-					toolUseBlocksToPreserve: toolUseBlocks,
-					reasoningBlocksToPreserve: reasoningBlocks,
-				}
+	const toolUseBlocksToPreserve: Anthropic.Messages.ToolUseBlock[] = []
+	const reasoningBlocksToPreserve: Anthropic.Messages.ContentBlockParam[] = []
+	const preservedToolUseIds = new Set<string>()
+
+	// Check ALL kept messages for tool_result blocks
+	for (const keepMsg of keepMessages) {
+		if (!hasToolResultBlocks(keepMsg)) {
+			continue
+		}
+
+		const toolResults = getToolResultBlocks(keepMsg)
+
+		for (const toolResult of toolResults) {
+			const toolUseId = toolResult.tool_use_id
+
+			// Skip if we've already found this tool_use
+			if (preservedToolUseIds.has(toolUseId)) {
+				continue
+			}
+
+			// Search backwards through the condensed region (bounded)
+			const searchStart = startIndex - 1
+			const searchEnd = Math.max(0, startIndex - N_MESSAGES_TO_KEEP)
+			const messagesToSearch = messages.slice(searchEnd, searchStart + 1)
+
+			// Find the message containing this tool_use
+			const messageWithToolUse = findLast(messagesToSearch, (msg) => {
+				return findToolUseBlockById(msg, toolUseId) !== undefined
+			})
+
+			if (messageWithToolUse) {
+				const toolUse = findToolUseBlockById(messageWithToolUse, toolUseId)!
+				toolUseBlocksToPreserve.push(toolUse)
+				preservedToolUseIds.add(toolUseId)
+
+				// Also preserve reasoning blocks from that message
+				const reasoning = getReasoningBlocks(messageWithToolUse)
+				reasoningBlocksToPreserve.push(...reasoning)
 			}
 		}
 	}
 
-	return { keepMessages, toolUseBlocksToPreserve: [], reasoningBlocksToPreserve: [] }
+	return {
+		keepMessages,
+		toolUseBlocksToPreserve,
+		reasoningBlocksToPreserve,
+	}
 }
 
 export const N_MESSAGES_TO_KEEP = 3

From 6b13d1d84ec71f90d4fd2816806b33f79572994d Mon Sep 17 00:00:00 2001
From: Daniel <57051444+daniel-lxs@users.noreply.github.com>
Date: Tue, 6 Jan 2026 00:26:17 -0500
Subject: [PATCH 2/3] fix: add additionalProperties: false to MCP tool schemas
 for OpenAI Responses API (#10472)

---
 .../providers/__tests__/base-provider.spec.ts | 283 ++++++++++++++++++
 .../__tests__/openai-native-tools.spec.ts     | 219 ++++++++++++++
 src/api/providers/base-provider.ts            |   7 +
 src/api/providers/openai-native.ts            |  47 ++-
 4 files changed, 555 insertions(+), 1 deletion(-)
 create mode 100644 src/api/providers/__tests__/base-provider.spec.ts

diff --git a/src/api/providers/__tests__/base-provider.spec.ts b/src/api/providers/__tests__/base-provider.spec.ts
new file mode 100644
index 0000000000..ced452f5a5
--- /dev/null
+++ b/src/api/providers/__tests__/base-provider.spec.ts
@@ -0,0 +1,283 @@
+import { Anthropic } from "@anthropic-ai/sdk"
+
+import type { ModelInfo } from "@roo-code/types"
+
+import { BaseProvider } from "../base-provider"
+import type { ApiStream } from "../../transform/stream"
+
+// Create a concrete implementation for testing
+class TestProvider extends BaseProvider {
+	createMessage(_systemPrompt: string, _messages: Anthropic.Messages.MessageParam[]): ApiStream {
+		throw new Error("Not implemented")
+	}
+
+	getModel(): { id: string; info: ModelInfo } {
+		return {
+			id: "test-model",
+			info: {
+				maxTokens: 4096,
+				contextWindow: 128000,
+				supportsPromptCache: false,
+			},
+		}
+	}
+
+	// Expose protected method for testing
+	public testConvertToolSchemaForOpenAI(schema: any): any {
+		return this.convertToolSchemaForOpenAI(schema)
+	}
+
+	// Expose protected method for testing
+	public testConvertToolsForOpenAI(tools: any[] | undefined): any[] | undefined {
+		return this.convertToolsForOpenAI(tools)
+	}
+}
+
+describe("BaseProvider", () => {
+	let provider: TestProvider
+
+	beforeEach(() => {
+		provider = new TestProvider()
+	})
+
+	describe("convertToolSchemaForOpenAI", () => {
+		it("should add additionalProperties: false to object schemas", () => {
+			const schema = {
+				type: "object",
+				properties: {
+					name: { type: "string" },
+				},
+			}
+
+			const result = provider.testConvertToolSchemaForOpenAI(schema)
+
+			expect(result.additionalProperties).toBe(false)
+		})
+
+		it("should add required array with all properties for strict mode", () => {
+			const schema = {
+				type: "object",
+				properties: {
+					name: { type: "string" },
+					age: { type: "number" },
+				},
+			}
+
+			const result = provider.testConvertToolSchemaForOpenAI(schema)
+
+			expect(result.required).toEqual(["name", "age"])
+		})
+
+		it("should recursively add additionalProperties: false to nested objects", () => {
+			const schema = {
+				type: "object",
+				properties: {
+					user: {
+						type: "object",
+						properties: {
+							name: { type: "string" },
+						},
+					},
+				},
+			}
+
+			const result = provider.testConvertToolSchemaForOpenAI(schema)
+
+			expect(result.additionalProperties).toBe(false)
+			expect(result.properties.user.additionalProperties).toBe(false)
+		})
+
+		it("should recursively add additionalProperties: false to array item objects", () => {
+			const schema = {
+				type: "object",
+				properties: {
+					users: {
+						type: "array",
+						items: {
+							type: "object",
+							properties: {
+								name: { type: "string" },
+							},
+						},
+					},
+				},
+			}
+
+			const result = provider.testConvertToolSchemaForOpenAI(schema)
+
+			expect(result.additionalProperties).toBe(false)
+			expect(result.properties.users.items.additionalProperties).toBe(false)
+		})
+
+		it("should handle deeply nested objects", () => {
+			const schema = {
+				type: "object",
+				properties: {
+					level1: {
+						type: "object",
+						properties: {
+							level2: {
+								type: "object",
+								properties: {
+									level3: {
+										type: "object",
+										properties: {
+											value: { type: "string" },
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			}
+
+			const result = provider.testConvertToolSchemaForOpenAI(schema)
+
+			expect(result.additionalProperties).toBe(false)
+			expect(result.properties.level1.additionalProperties).toBe(false)
+			expect(result.properties.level1.properties.level2.additionalProperties).toBe(false)
+			expect(result.properties.level1.properties.level2.properties.level3.additionalProperties).toBe(false)
+		})
+
+		it("should convert nullable types to non-nullable", () => {
+			const schema = {
+				type: "object",
+				properties: {
+					name: { type: ["string", "null"] },
+				},
+			}
+
+			const result = provider.testConvertToolSchemaForOpenAI(schema)
+
+			expect(result.properties.name.type).toBe("string")
+		})
+
+		it("should return non-object schemas unchanged", () => {
+			const schema = { type: "string" }
+			const result = provider.testConvertToolSchemaForOpenAI(schema)
+
+			expect(result).toEqual(schema)
+		})
+
+		it("should return null/undefined unchanged", () => {
+			expect(provider.testConvertToolSchemaForOpenAI(null)).toBeNull()
+			expect(provider.testConvertToolSchemaForOpenAI(undefined)).toBeUndefined()
+		})
+
+		it("should handle empty properties object", () => {
+			const schema = {
+				type: "object",
+				properties: {},
+			}
+
+			const result = provider.testConvertToolSchemaForOpenAI(schema)
+
+			expect(result.additionalProperties).toBe(false)
+			expect(result.required).toEqual([])
+		})
+	})
+
+	describe("convertToolsForOpenAI", () => {
+		it("should return undefined for undefined input", () => {
+			const result = provider.testConvertToolsForOpenAI(undefined)
+			expect(result).toBeUndefined()
+		})
+
+		it("should set strict: true for non-MCP tools", () => {
+			const tools = [
+				{
+					type: "function",
+					function: {
+						name: "read_file",
+						description: "Read a file",
+						parameters: { type: "object", properties: {} },
+					},
+				},
+			]
+
+			const result = provider.testConvertToolsForOpenAI(tools)
+
+			expect(result?.[0].function.strict).toBe(true)
+		})
+
+		it("should set strict: false for MCP tools (mcp-- prefix)", () => {
+			const tools = [
+				{
+					type: "function",
+					function: {
+						name: "mcp--github--get_me",
+						description: "Get current user",
+						parameters: { type: "object", properties: {} },
+					},
+				},
+			]
+
+			const result = provider.testConvertToolsForOpenAI(tools)
+
+			expect(result?.[0].function.strict).toBe(false)
+		})
+
+		it("should apply schema conversion to non-MCP tools", () => {
+			const tools = [
+				{
+					type: "function",
+					function: {
+						name: "read_file",
+						description: "Read a file",
+						parameters: {
+							type: "object",
+							properties: {
+								path: { type: "string" },
+							},
+						},
+					},
+				},
+			]
+
+			const result = provider.testConvertToolsForOpenAI(tools)
+
+			expect(result?.[0].function.parameters.additionalProperties).toBe(false)
+			expect(result?.[0].function.parameters.required).toEqual(["path"])
+		})
+
+		it("should not apply schema conversion to MCP tools in base-provider", () => {
+			// Note: In base-provider, MCP tools are passed through unchanged
+			// The openai-native provider has its own handling for MCP tools
+			const tools = [
+				{
+					type: "function",
+					function: {
+						name: "mcp--github--get_me",
+						description: "Get current user",
+						parameters: {
+							type: "object",
+							properties: {
+								token: { type: "string" },
+							},
+							required: ["token"],
+						},
+					},
+				},
+			]
+
+			const result = provider.testConvertToolsForOpenAI(tools)
+
+			// MCP tools pass through original parameters in base-provider
+			expect(result?.[0].function.parameters.additionalProperties).toBeUndefined()
+		})
+
+		it("should preserve non-function tools unchanged", () => {
+			const tools = [
+				{
+					type: "other_type",
+					data: "some data",
+				},
+			]
+
+			const result = provider.testConvertToolsForOpenAI(tools)
+
+			expect(result?.[0]).toEqual(tools[0])
+		})
+	})
+})
diff --git a/src/api/providers/__tests__/openai-native-tools.spec.ts b/src/api/providers/__tests__/openai-native-tools.spec.ts
index 1a3b93b9c2..7be4814b63 100644
--- a/src/api/providers/__tests__/openai-native-tools.spec.ts
+++ b/src/api/providers/__tests__/openai-native-tools.spec.ts
@@ -1,6 +1,8 @@
 import OpenAI from "openai"
 
 import { OpenAiHandler } from "../openai"
+import { OpenAiNativeHandler } from "../openai-native"
+import type { ApiHandlerOptions } from "../../../shared/api"
 
 describe("OpenAiHandler native tools", () => {
 	it("includes tools in request when custom model info lacks supportsNativeTools (regression test)", async () => {
@@ -75,3 +77,220 @@ describe("OpenAiHandler native tools", () => {
 		)
 	})
 })
+
+describe("OpenAiNativeHandler MCP tool schema handling", () => {
+	it("should add additionalProperties: false to MCP tools while keeping strict: false", async () => {
+		let capturedRequestBody: any
+
+		const handler = new OpenAiNativeHandler({
+			openAiNativeApiKey: "test-key",
+			apiModelId: "gpt-4o",
+		} as ApiHandlerOptions)
+
+		// Mock the responses API call
+		const mockClient = {
+			responses: {
+				create: vi.fn().mockImplementation((body: any) => {
+					capturedRequestBody = body
+					return {
+						[Symbol.asyncIterator]: async function* () {
+							yield {
+								type: "response.done",
+								response: {
+									output: [{ type: "message", content: [{ type: "output_text", text: "test" }] }],
+									usage: { input_tokens: 10, output_tokens: 5 },
+								},
+							}
+						},
+					}
+				}),
+			},
+		}
+		;(handler as any).client = mockClient
+
+		const mcpTools: OpenAI.Chat.ChatCompletionTool[] = [
+			{
+				type: "function",
+				function: {
+					name: "mcp--github--get_me",
+					description: "Get current GitHub user",
+					parameters: {
+						type: "object",
+						properties: {
+							token: { type: "string", description: "API token" },
+						},
+						required: ["token"],
+					},
+				},
+			},
+		]
+
+		const stream = handler.createMessage("system prompt", [], {
+			taskId: "test-task-id",
+			tools: mcpTools,
+			toolProtocol: "native" as const,
+		})
+
+		// Consume the stream
+		for await (const _ of stream) {
+			// Just consume
+		}
+
+		// Verify the request body
+		expect(capturedRequestBody.tools).toBeDefined()
+		expect(capturedRequestBody.tools.length).toBe(1)
+
+		const tool = capturedRequestBody.tools[0]
+		expect(tool.name).toBe("mcp--github--get_me")
+		expect(tool.strict).toBe(false) // MCP tools should have strict: false
+		expect(tool.parameters.additionalProperties).toBe(false) // Should have additionalProperties: false
+		expect(tool.parameters.required).toEqual(["token"]) // Should preserve original required array
+	})
+
+	it("should add additionalProperties: false and required array to non-MCP tools with strict: true", async () => {
+		let capturedRequestBody: any
+
+		const handler = new OpenAiNativeHandler({
+			openAiNativeApiKey: "test-key",
+			apiModelId: "gpt-4o",
+		} as ApiHandlerOptions)
+
+		// Mock the responses API call
+		const mockClient = {
+			responses: {
+				create: vi.fn().mockImplementation((body: any) => {
+					capturedRequestBody = body
+					return {
+						[Symbol.asyncIterator]: async function* () {
+							yield {
+								type: "response.done",
+								response: {
+									output: [{ type: "message", content: [{ type: "output_text", text: "test" }] }],
+									usage: { input_tokens: 10, output_tokens: 5 },
+								},
+							}
+						},
+					}
+				}),
+			},
+		}
+		;(handler as any).client = mockClient
+
+		const regularTools: OpenAI.Chat.ChatCompletionTool[] = [
+			{
+				type: "function",
+				function: {
+					name: "read_file",
+					description: "Read a file from the filesystem",
+					parameters: {
+						type: "object",
+						properties: {
+							path: { type: "string", description: "File path" },
+							encoding: { type: "string", description: "File encoding" },
+						},
+					},
+				},
+			},
+		]
+
+		const stream = handler.createMessage("system prompt", [], {
+			taskId: "test-task-id",
+			tools: regularTools,
+			toolProtocol: "native" as const,
+		})
+
+		// Consume the stream
+		for await (const _ of stream) {
+			// Just consume
+		}
+
+		// Verify the request body
+		expect(capturedRequestBody.tools).toBeDefined()
+		expect(capturedRequestBody.tools.length).toBe(1)
+
+		const tool = capturedRequestBody.tools[0]
+		expect(tool.name).toBe("read_file")
+		expect(tool.strict).toBe(true) // Non-MCP tools should have strict: true
+		expect(tool.parameters.additionalProperties).toBe(false) // Should have additionalProperties: false
+		expect(tool.parameters.required).toEqual(["path", "encoding"]) // Should have all properties as required
+	})
+
+	it("should recursively add additionalProperties: false to nested objects in MCP tools", async () => {
+		let capturedRequestBody: any
+
+		const handler = new OpenAiNativeHandler({
+			openAiNativeApiKey: "test-key",
+			apiModelId: "gpt-4o",
+		} as ApiHandlerOptions)
+
+		// Mock the responses API call
+		const mockClient = {
+			responses: {
+				create: vi.fn().mockImplementation((body: any) => {
+					capturedRequestBody = body
+					return {
+						[Symbol.asyncIterator]: async function* () {
+							yield {
+								type: "response.done",
+								response: {
+									output: [{ type: "message", content: [{ type: "output_text", text: "test" }] }],
+									usage: { input_tokens: 10, output_tokens: 5 },
+								},
+							}
+						},
+					}
+				}),
+			},
+		}
+		;(handler as any).client = mockClient
+
+		const mcpToolsWithNestedObjects: OpenAI.Chat.ChatCompletionTool[] = [
+			{
+				type: "function",
+				function: {
+					name: "mcp--linear--create_issue",
+					description: "Create a Linear issue",
+					parameters: {
+						type: "object",
+						properties: {
+							title: { type: "string" },
+							metadata: {
+								type: "object",
+								properties: {
+									priority: { type: "number" },
+									labels: {
+										type: "array",
+										items: {
+											type: "object",
+											properties: {
+												name: { type: "string" },
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		]
+
+		const stream = handler.createMessage("system prompt", [], {
+			taskId: "test-task-id",
+			tools: mcpToolsWithNestedObjects,
+			toolProtocol: "native" as const,
+		})
+
+		// Consume the stream
+		for await (const _ of stream) {
+			// Just consume
+		}
+
+		// Verify the request body
+		const tool = capturedRequestBody.tools[0]
+		expect(tool.strict).toBe(false) // MCP tool should have strict: false
+		expect(tool.parameters.additionalProperties).toBe(false) // Root level
+		expect(tool.parameters.properties.metadata.additionalProperties).toBe(false) // Nested object
+		expect(tool.parameters.properties.metadata.properties.labels.items.additionalProperties).toBe(false) // Array items
+	})
+})
diff --git a/src/api/providers/base-provider.ts b/src/api/providers/base-provider.ts
index 64d99b3f0c..a6adeeadbd 100644
--- a/src/api/providers/base-provider.ts
+++ b/src/api/providers/base-provider.ts
@@ -55,6 +55,7 @@ export abstract class BaseProvider implements ApiHandler {
 	 * Converts tool schemas to be compatible with OpenAI's strict mode by:
 	 * - Ensuring all properties are in the required array (strict mode requirement)
 	 * - Converting nullable types (["type", "null"]) to non-nullable ("type")
+	 * - Adding additionalProperties: false to all object schemas (required by OpenAI Responses API)
 	 * - Recursively processing nested objects and arrays
 	 *
 	 * This matches the behavior of ensureAllRequired in openai-native.ts
@@ -66,6 +67,12 @@ export abstract class BaseProvider implements ApiHandler {
 
 		const result = { ...schema }
 
+		// OpenAI Responses API requires additionalProperties: false on all object schemas
+		// Only add if not already set to false (to avoid unnecessary mutations)
+		if (result.additionalProperties !== false) {
+			result.additionalProperties = false
+		}
+
 		if (result.properties) {
 			const allKeys = Object.keys(result.properties)
 			// OpenAI strict mode requires ALL properties to be in required array
diff --git a/src/api/providers/openai-native.ts b/src/api/providers/openai-native.ts
index 8f9cc2297f..58a62497f7 100644
--- a/src/api/providers/openai-native.ts
+++ b/src/api/providers/openai-native.ts
@@ -196,6 +196,12 @@ export class OpenAiNativeHandler extends BaseProvider implements SingleCompletio
 
 			const result = { ...schema }
 
+			// OpenAI Responses API requires additionalProperties: false on all object schemas
+			// Only add if not already set to false (to avoid unnecessary mutations)
+			if (result.additionalProperties !== false) {
+				result.additionalProperties = false
+			}
+
 			if (result.properties) {
 				const allKeys = Object.keys(result.properties)
 				result.required = allKeys
@@ -219,6 +225,42 @@ export class OpenAiNativeHandler extends BaseProvider implements SingleCompletio
 			return result
 		}
 
+		// Adds additionalProperties: false to all object schemas recursively
+		// without modifying required array. Used for MCP tools with strict: false
+		// to comply with OpenAI Responses API requirements.
+		const ensureAdditionalPropertiesFalse = (schema: any): any => {
+			if (!schema || typeof schema !== "object" || schema.type !== "object") {
+				return schema
+			}
+
+			const result = { ...schema }
+
+			// OpenAI Responses API requires additionalProperties: false on all object schemas
+			// Only add if not already set to false (to avoid unnecessary mutations)
+			if (result.additionalProperties !== false) {
+				result.additionalProperties = false
+			}
+
+			if (result.properties) {
+				// Recursively process nested objects
+				const newProps = { ...result.properties }
+				for (const key of Object.keys(result.properties)) {
+					const prop = newProps[key]
+					if (prop && prop.type === "object") {
+						newProps[key] = ensureAdditionalPropertiesFalse(prop)
+					} else if (prop && prop.type === "array" && prop.items?.type === "object") {
+						newProps[key] = {
+							...prop,
+							items: ensureAdditionalPropertiesFalse(prop.items),
+						}
+					}
+				}
+				result.properties = newProps
+			}
+
+			return result
+		}
+
 		// Build a request body for the OpenAI Responses API.
 		// Ensure we explicitly pass max_output_tokens based on Roo's reserved model response calculation
 		// so requests do not default to very large limits (e.g., 120k).
@@ -295,12 +337,15 @@ export class OpenAiNativeHandler extends BaseProvider implements SingleCompletio
 					.map((tool) => {
 						// MCP tools use the 'mcp--' prefix - disable strict mode for them
 						// to preserve optional parameters from the MCP server schema
+						// But we still need to add additionalProperties: false for OpenAI Responses API
 						const isMcp = isMcpTool(tool.function.name)
 						return {
 							type: "function",
 							name: tool.function.name,
 							description: tool.function.description,
-							parameters: isMcp ? tool.function.parameters : ensureAllRequired(tool.function.parameters),
+							parameters: isMcp
+								? ensureAdditionalPropertiesFalse(tool.function.parameters)
+								: ensureAllRequired(tool.function.parameters),
 							strict: !isMcp,
 						}
 					}),

From 861139ca24d4c4c5115a1a78195537a87ed6970f Mon Sep 17 00:00:00 2001
From: Chris Estreich <cestreich@gmail.com>
Date: Tue, 6 Jan 2026 03:27:44 -0800
Subject: [PATCH 3/3] Add a cli installer (#10474)

Co-authored-by: roomote[bot] <219738659+roomote[bot]@users.noreply.github.com>
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
---
 apps/cli/README.md          |  83 +++++++--
 apps/cli/install.sh         | 287 ++++++++++++++++++++++++++++
 apps/cli/scripts/release.sh | 363 ++++++++++++++++++++++++++++++++++++
 apps/cli/src/utils.ts       |  10 +-
 apps/cli/tsup.config.ts     |   6 +-
 5 files changed, 731 insertions(+), 18 deletions(-)
 create mode 100755 apps/cli/install.sh
 create mode 100755 apps/cli/scripts/release.sh

diff --git a/apps/cli/README.md b/apps/cli/README.md
index e365e40b55..3e78192d4e 100644
--- a/apps/cli/README.md
+++ b/apps/cli/README.md
@@ -8,6 +8,49 @@ This CLI uses the `@roo-code/vscode-shim` package to provide a VSCode API compat
 
 ## Installation
 
+### Quick Install (Recommended)
+
+Install the Roo Code CLI with a single command:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/RooCodeInc/Roo-Code/main/apps/cli/install.sh | sh
+```
+
+**Requirements:**
+
+- Node.js 20 or higher
+- macOS (Intel or Apple Silicon) or Linux (x64 or ARM64)
+
+**Custom installation directory:**
+
+```bash
+ROO_INSTALL_DIR=/opt/roo-code ROO_BIN_DIR=/usr/local/bin curl -fsSL ... | sh
+```
+
+**Install a specific version:**
+
+```bash
+ROO_VERSION=0.1.0 curl -fsSL https://raw.githubusercontent.com/RooCodeInc/Roo-Code/main/apps/cli/install.sh | sh
+```
+
+### Updating
+
+Re-run the install script to update to the latest version:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/RooCodeInc/Roo-Code/main/apps/cli/install.sh | sh
+```
+
+### Uninstalling
+
+```bash
+rm -rf ~/.roo/cli ~/.local/bin/roo
+```
+
+### Development Installation
+
+For contributing or development:
+
 ```bash
 # From the monorepo root.
 pnpm install
@@ -28,13 +71,7 @@ By default, the CLI prompts for approval before executing actions:
 ```bash
 export OPENROUTER_API_KEY=sk-or-v1-...
 
-pnpm --filter @roo-code/cli start \
-  -x \
-  -p openrouter \
-  -k $OPENROUTER_API_KEY \
-  -m anthropic/claude-sonnet-4.5 \
-  --workspace ~/Documents/my-project \
-  "What is this project?"
+roo "What is this project?" --workspace ~/Documents/my-project
 ```
 
 In interactive mode:
@@ -49,14 +86,7 @@ In interactive mode:
 For automation and scripts, use `-y` to auto-approve all actions:
 
 ```bash
-pnpm --filter @roo-code/cli start \
-  -y \
-  -x \
-  -p openrouter \
-  -k $OPENROUTER_API_KEY \
-  -m anthropic/claude-sonnet-4.5 \
-  --workspace ~/Documents/my-project \
-  "Refactor the utils.ts file"
+roo -y "Refactor the utils.ts file" --workspace ~/Documents/my-project
 ```
 
 In non-interactive mode:
@@ -158,6 +188,29 @@ pnpm check-types
 pnpm lint
 ```
 
+## Releasing
+
+To create a new release, run the release script from the monorepo root:
+
+```bash
+# Release using version from package.json
+./apps/cli/scripts/release.sh
+
+# Release with a specific version
+./apps/cli/scripts/release.sh 0.1.0
+```
+
+The script will:
+
+1. Build the extension and CLI
+2. Create a platform-specific tarball (for your current OS/architecture)
+3. Create a GitHub release with the tarball attached
+
+**Prerequisites:**
+
+- GitHub CLI (`gh`) installed and authenticated (`gh auth login`)
+- pnpm installed
+
 ## Troubleshooting
 
 ### Extension bundle not found
diff --git a/apps/cli/install.sh b/apps/cli/install.sh
new file mode 100755
index 0000000000..ca82ecfdd8
--- /dev/null
+++ b/apps/cli/install.sh
@@ -0,0 +1,287 @@
+#!/bin/sh
+# Roo Code CLI Installer
+# Usage: curl -fsSL https://raw.githubusercontent.com/RooCodeInc/Roo-Code/main/apps/cli/install.sh | sh
+#
+# Environment variables:
+#   ROO_INSTALL_DIR - Installation directory (default: ~/.roo/cli)
+#   ROO_BIN_DIR     - Binary symlink directory (default: ~/.local/bin)
+#   ROO_VERSION     - Specific version to install (default: latest)
+
+set -e
+
+# Configuration
+INSTALL_DIR="${ROO_INSTALL_DIR:-$HOME/.roo/cli}"
+BIN_DIR="${ROO_BIN_DIR:-$HOME/.local/bin}"
+REPO="RooCodeInc/Roo-Code"
+MIN_NODE_VERSION=20
+
+# Color output (only if terminal supports it)
+if [ -t 1 ]; then
+    RED='\033[0;31m'
+    GREEN='\033[0;32m'
+    YELLOW='\033[1;33m'
+    BLUE='\033[0;34m'
+    BOLD='\033[1m'
+    NC='\033[0m'
+else
+    RED=''
+    GREEN=''
+    YELLOW=''
+    BLUE=''
+    BOLD=''
+    NC=''
+fi
+
+info() { printf "${GREEN}==>${NC} %s\n" "$1"; }
+warn() { printf "${YELLOW}Warning:${NC} %s\n" "$1"; }
+error() { printf "${RED}Error:${NC} %s\n" "$1" >&2; exit 1; }
+
+# Check Node.js version
+check_node() {
+    if ! command -v node >/dev/null 2>&1; then
+        error "Node.js is not installed. Please install Node.js $MIN_NODE_VERSION or higher.
+
+Install Node.js:
+  - macOS: brew install node
+  - Linux: https://nodejs.org/en/download/package-manager
+  - Or use a version manager like fnm, nvm, or mise"
+    fi
+    
+    NODE_VERSION=$(node -v | sed 's/v//' | cut -d. -f1)
+    if [ "$NODE_VERSION" -lt "$MIN_NODE_VERSION" ]; then
+        error "Node.js $MIN_NODE_VERSION+ required. Found: $(node -v)
+
+Please upgrade Node.js to version $MIN_NODE_VERSION or higher."
+    fi
+    
+    info "Found Node.js $(node -v)"
+}
+
+# Detect OS and architecture
+detect_platform() {
+    OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+    ARCH=$(uname -m)
+    
+    case "$OS" in
+        darwin) OS="darwin" ;;
+        linux) OS="linux" ;;
+        mingw*|msys*|cygwin*) 
+            error "Windows is not supported by this installer. Please use WSL or install manually."
+            ;;
+        *) error "Unsupported OS: $OS" ;;
+    esac
+    
+    case "$ARCH" in
+        x86_64|amd64) ARCH="x64" ;;
+        arm64|aarch64) ARCH="arm64" ;;
+        *) error "Unsupported architecture: $ARCH" ;;
+    esac
+    
+    PLATFORM="${OS}-${ARCH}"
+    info "Detected platform: $PLATFORM"
+}
+
+# Get latest release version or use specified version
+get_version() {
+    if [ -n "$ROO_VERSION" ]; then
+        VERSION="$ROO_VERSION"
+        info "Using specified version: $VERSION"
+        return
+    fi
+    
+    info "Fetching latest version..."
+    
+    # Try to get the latest cli release
+    RELEASES_JSON=$(curl -fsSL "https://api.github.com/repos/$REPO/releases" 2>/dev/null) || {
+        error "Failed to fetch releases from GitHub. Check your internet connection."
+    }
+    
+    # Extract the latest cli-v* tag
+    VERSION=$(echo "$RELEASES_JSON" | 
+              grep -o '"tag_name": "cli-v[^"]*"' | 
+              head -1 | 
+              sed 's/"tag_name": "cli-v//' | 
+              sed 's/"//')
+    
+    if [ -z "$VERSION" ]; then
+        error "Could not find any CLI releases. The CLI may not have been released yet."
+    fi
+    
+    info "Latest version: $VERSION"
+}
+
+# Download and extract
+download_and_install() {
+    TARBALL="roo-cli-${PLATFORM}.tar.gz"
+    URL="https://github.com/$REPO/releases/download/cli-v${VERSION}/${TARBALL}"
+    
+    info "Downloading from $URL..."
+    
+    # Create temp directory
+    TMP_DIR=$(mktemp -d)
+    trap "rm -rf $TMP_DIR" EXIT
+    
+    # Download with progress indicator
+    HTTP_CODE=$(curl -fsSL -w "%{http_code}" "$URL" -o "$TMP_DIR/$TARBALL" 2>/dev/null) || {
+        if [ "$HTTP_CODE" = "404" ]; then
+            error "Release not found for platform $PLATFORM version $VERSION.
+
+Available at: https://github.com/$REPO/releases"
+        fi
+        error "Download failed. HTTP code: $HTTP_CODE"
+    }
+
+    # Verify we got something
+    if [ ! -s "$TMP_DIR/$TARBALL" ]; then
+        error "Downloaded file is empty. Please try again."
+    fi
+
+    # Remove old installation if exists
+    if [ -d "$INSTALL_DIR" ]; then
+        info "Removing previous installation..."
+        rm -rf "$INSTALL_DIR"
+    fi
+    
+    mkdir -p "$INSTALL_DIR"
+    
+    # Extract
+    info "Extracting to $INSTALL_DIR..."
+    tar -xzf "$TMP_DIR/$TARBALL" -C "$INSTALL_DIR" --strip-components=1 || {
+        error "Failed to extract tarball. The download may be corrupted."
+    }
+    
+    # Save ripgrep binary before npm install (npm install will overwrite node_modules)
+    RIPGREP_BIN=""
+    if [ -f "$INSTALL_DIR/node_modules/@vscode/ripgrep/bin/rg" ]; then
+        RIPGREP_BIN="$TMP_DIR/rg"
+        cp "$INSTALL_DIR/node_modules/@vscode/ripgrep/bin/rg" "$RIPGREP_BIN"
+    fi
+    
+    # Install npm dependencies
+    info "Installing dependencies..."
+    cd "$INSTALL_DIR"
+    npm install --production --silent 2>/dev/null || {
+        warn "npm install failed, trying with --legacy-peer-deps..."
+        npm install --production --legacy-peer-deps --silent 2>/dev/null || {
+            error "Failed to install dependencies. Make sure npm is available."
+        }
+    }
+    cd - > /dev/null
+    
+    # Restore ripgrep binary after npm install
+    if [ -n "$RIPGREP_BIN" ] && [ -f "$RIPGREP_BIN" ]; then
+        mkdir -p "$INSTALL_DIR/node_modules/@vscode/ripgrep/bin"
+        cp "$RIPGREP_BIN" "$INSTALL_DIR/node_modules/@vscode/ripgrep/bin/rg"
+        chmod +x "$INSTALL_DIR/node_modules/@vscode/ripgrep/bin/rg"
+    fi
+    
+    # Make executable
+    chmod +x "$INSTALL_DIR/bin/roo"
+    
+    # Also make ripgrep executable if it exists
+    if [ -f "$INSTALL_DIR/bin/rg" ]; then
+        chmod +x "$INSTALL_DIR/bin/rg"
+    fi
+}
+
+# Create symlink in bin directory
+setup_bin() {
+    mkdir -p "$BIN_DIR"
+    
+    # Remove old symlink if exists
+    if [ -L "$BIN_DIR/roo" ] || [ -f "$BIN_DIR/roo" ]; then
+        rm -f "$BIN_DIR/roo"
+    fi
+    
+    ln -sf "$INSTALL_DIR/bin/roo" "$BIN_DIR/roo"
+    info "Created symlink: $BIN_DIR/roo"
+}
+
+# Check if bin dir is in PATH and provide instructions
+check_path() {
+    case ":$PATH:" in
+        *":$BIN_DIR:"*) 
+            # Already in PATH
+            return 0
+            ;;
+    esac
+    
+    warn "$BIN_DIR is not in your PATH"
+    echo ""
+    echo "Add this line to your shell profile:"
+    echo ""
+    
+    # Detect shell and provide specific instructions
+    SHELL_NAME=$(basename "$SHELL")
+    case "$SHELL_NAME" in
+        zsh)
+            echo "  echo 'export PATH=\"$BIN_DIR:\$PATH\"' >> ~/.zshrc"
+            echo "  source ~/.zshrc"
+            ;;
+        bash)
+            if [ -f "$HOME/.bashrc" ]; then
+                echo "  echo 'export PATH=\"$BIN_DIR:\$PATH\"' >> ~/.bashrc"
+                echo "  source ~/.bashrc"
+            else
+                echo "  echo 'export PATH=\"$BIN_DIR:\$PATH\"' >> ~/.bash_profile"
+                echo "  source ~/.bash_profile"
+            fi
+            ;;
+        fish)
+            echo "  set -Ux fish_user_paths $BIN_DIR \$fish_user_paths"
+            ;;
+        *)
+            echo "  export PATH=\"$BIN_DIR:\$PATH\""
+            ;;
+    esac
+    echo ""
+}
+
+# Verify installation
+verify_install() {
+    if [ -x "$BIN_DIR/roo" ]; then
+        info "Verifying installation..."
+        # Just check if it runs without error
+        "$BIN_DIR/roo" --version >/dev/null 2>&1 || true
+    fi
+}
+
+# Print success message
+print_success() {
+    echo ""
+    printf "${GREEN}${BOLD}✓ Roo Code CLI installed successfully!${NC}\n"
+    echo ""
+    echo "  Installation: $INSTALL_DIR"
+    echo "  Binary: $BIN_DIR/roo"
+    echo "  Version: $VERSION"
+    echo ""
+    echo "  ${BOLD}Get started:${NC}"
+    echo "    roo --help"
+    echo ""
+    echo "  ${BOLD}Example:${NC}"
+    echo "    export OPENROUTER_API_KEY=sk-or-v1-..."
+    echo "    roo \"What is this project?\" --workspace ~/my-project"
+    echo ""
+}
+
+# Main
+main() {
+    echo ""
+    printf "${BLUE}${BOLD}"
+    echo "  ╭─────────────────────────────────╮"
+    echo "  │     Roo Code CLI Installer      │"
+    echo "  ╰─────────────────────────────────╯"
+    printf "${NC}"
+    echo ""
+    
+    check_node
+    detect_platform
+    get_version
+    download_and_install
+    setup_bin
+    check_path
+    verify_install
+    print_success
+}
+
+main "$@"
diff --git a/apps/cli/scripts/release.sh b/apps/cli/scripts/release.sh
new file mode 100755
index 0000000000..43d5298956
--- /dev/null
+++ b/apps/cli/scripts/release.sh
@@ -0,0 +1,363 @@
+#!/bin/bash
+# Roo Code CLI Release Script
+# 
+# Usage:
+#   ./apps/cli/scripts/release.sh [version]
+#
+# Examples:
+#   ./apps/cli/scripts/release.sh           # Use version from package.json
+#   ./apps/cli/scripts/release.sh 0.1.0     # Specify version
+#
+# This script:
+# 1. Builds the extension and CLI
+# 2. Creates a tarball for the current platform
+# 3. Creates a GitHub release and uploads the tarball
+#
+# Prerequisites:
+#   - GitHub CLI (gh) installed and authenticated
+#   - pnpm installed
+#   - Run from the monorepo root directory
+
+set -e
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+BOLD='\033[1m'
+NC='\033[0m'
+
+info() { printf "${GREEN}==>${NC} %s\n" "$1"; }
+warn() { printf "${YELLOW}Warning:${NC} %s\n" "$1"; }
+error() { printf "${RED}Error:${NC} %s\n" "$1" >&2; exit 1; }
+step() { printf "${BLUE}${BOLD}[%s]${NC} %s\n" "$1" "$2"; }
+
+# Get script directory and repo root
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+CLI_DIR="$REPO_ROOT/apps/cli"
+
+# Detect current platform
+detect_platform() {
+    OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+    ARCH=$(uname -m)
+    
+    case "$OS" in
+        darwin) OS="darwin" ;;
+        linux) OS="linux" ;;
+        *) error "Unsupported OS: $OS" ;;
+    esac
+    
+    case "$ARCH" in
+        x86_64|amd64) ARCH="x64" ;;
+        arm64|aarch64) ARCH="arm64" ;;
+        *) error "Unsupported architecture: $ARCH" ;;
+    esac
+    
+    PLATFORM="${OS}-${ARCH}"
+}
+
+# Check prerequisites
+check_prerequisites() {
+    step "1/7" "Checking prerequisites..."
+    
+    if ! command -v gh &> /dev/null; then
+        error "GitHub CLI (gh) is not installed. Install it with: brew install gh"
+    fi
+    
+    if ! gh auth status &> /dev/null; then
+        error "GitHub CLI is not authenticated. Run: gh auth login"
+    fi
+    
+    if ! command -v pnpm &> /dev/null; then
+        error "pnpm is not installed."
+    fi
+    
+    if ! command -v node &> /dev/null; then
+        error "Node.js is not installed."
+    fi
+    
+    info "Prerequisites OK"
+}
+
+# Get version
+get_version() {
+    if [ -n "$1" ]; then
+        VERSION="$1"
+    else
+        VERSION=$(node -p "require('$CLI_DIR/package.json').version")
+    fi
+    
+    # Validate semver format
+    if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
+        error "Invalid version format: $VERSION (expected semver like 0.1.0)"
+    fi
+    
+    TAG="cli-v$VERSION"
+    info "Version: $VERSION (tag: $TAG)"
+}
+
+# Build everything
+build() {
+    step "2/7" "Building extension bundle..."
+    cd "$REPO_ROOT"
+    pnpm bundle
+    
+    step "3/7" "Building CLI..."
+    pnpm --filter @roo-code/cli build
+    
+    info "Build complete"
+}
+
+# Create release tarball
+create_tarball() {
+    step "4/7" "Creating release tarball for $PLATFORM..."
+    
+    RELEASE_DIR="$REPO_ROOT/roo-cli-${PLATFORM}"
+    TARBALL="roo-cli-${PLATFORM}.tar.gz"
+    
+    # Clean up any previous build
+    rm -rf "$RELEASE_DIR"
+    rm -f "$REPO_ROOT/$TARBALL"
+    
+    # Create directory structure
+    mkdir -p "$RELEASE_DIR/bin"
+    mkdir -p "$RELEASE_DIR/lib"
+    mkdir -p "$RELEASE_DIR/extension"
+    
+    # Copy CLI dist files
+    info "Copying CLI files..."
+    cp -r "$CLI_DIR/dist/"* "$RELEASE_DIR/lib/"
+    
+    # Create package.json for npm install (only runtime dependencies)
+    info "Creating package.json..."
+    node -e "
+      const pkg = require('$CLI_DIR/package.json');
+      const newPkg = {
+        name: '@roo-code/cli',
+        version: pkg.version,
+        type: 'module',
+        dependencies: {
+          commander: pkg.dependencies.commander
+        }
+      };
+      console.log(JSON.stringify(newPkg, null, 2));
+    " > "$RELEASE_DIR/package.json"
+    
+    # Copy extension bundle
+    info "Copying extension bundle..."
+    cp -r "$REPO_ROOT/src/dist/"* "$RELEASE_DIR/extension/"
+    
+    # Add package.json to extension directory to mark it as CommonJS
+    # This is necessary because the main package.json has "type": "module"
+    # but the extension bundle is CommonJS
+    echo '{"type": "commonjs"}' > "$RELEASE_DIR/extension/package.json"
+    
+    # Find and copy ripgrep binary
+    # The extension looks for ripgrep at: appRoot/node_modules/@vscode/ripgrep/bin/rg
+    # The CLI sets appRoot to the CLI package root, so we need to put ripgrep there
+    info "Looking for ripgrep binary..."
+    RIPGREP_PATH=$(find "$REPO_ROOT/node_modules" -path "*/@vscode/ripgrep/bin/rg" -type f 2>/dev/null | head -1)
+    if [ -n "$RIPGREP_PATH" ] && [ -f "$RIPGREP_PATH" ]; then
+        info "Found ripgrep at: $RIPGREP_PATH"
+        # Create the expected directory structure for the extension to find ripgrep
+        mkdir -p "$RELEASE_DIR/node_modules/@vscode/ripgrep/bin"
+        cp "$RIPGREP_PATH" "$RELEASE_DIR/node_modules/@vscode/ripgrep/bin/"
+        chmod +x "$RELEASE_DIR/node_modules/@vscode/ripgrep/bin/rg"
+        # Also keep a copy in bin/ for direct access
+        mkdir -p "$RELEASE_DIR/bin"
+        cp "$RIPGREP_PATH" "$RELEASE_DIR/bin/"
+        chmod +x "$RELEASE_DIR/bin/rg"
+    else
+        warn "ripgrep binary not found - users will need ripgrep installed"
+    fi
+    
+    # Create the wrapper script
+    info "Creating wrapper script..."
+    cat > "$RELEASE_DIR/bin/roo" << 'WRAPPER_EOF'
+#!/usr/bin/env node
+
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+// Set environment variables for the CLI
+process.env.ROO_EXTENSION_PATH = join(__dirname, '..', 'extension');
+process.env.ROO_RIPGREP_PATH = join(__dirname, 'rg');
+
+// Import and run the actual CLI
+await import(join(__dirname, '..', 'lib', 'index.js'));
+WRAPPER_EOF
+
+    chmod +x "$RELEASE_DIR/bin/roo"
+    
+    # Create version file
+    echo "$VERSION" > "$RELEASE_DIR/VERSION"
+    
+    # Create tarball
+    info "Creating tarball..."
+    cd "$REPO_ROOT"
+    tar -czvf "$TARBALL" "$(basename "$RELEASE_DIR")"
+    
+    # Clean up release directory
+    rm -rf "$RELEASE_DIR"
+    
+    # Show size
+    TARBALL_PATH="$REPO_ROOT/$TARBALL"
+    TARBALL_SIZE=$(ls -lh "$TARBALL_PATH" | awk '{print $5}')
+    info "Created: $TARBALL ($TARBALL_SIZE)"
+}
+
+# Create checksum
+create_checksum() {
+    step "5/7" "Creating checksum..."
+    cd "$REPO_ROOT"
+    
+    if command -v sha256sum &> /dev/null; then
+        sha256sum "$TARBALL" > "${TARBALL}.sha256"
+    elif command -v shasum &> /dev/null; then
+        shasum -a 256 "$TARBALL" > "${TARBALL}.sha256"
+    else
+        warn "No sha256sum or shasum found, skipping checksum"
+        return
+    fi
+    
+    info "Checksum: $(cat "${TARBALL}.sha256")"
+}
+
+# Check if release already exists
+check_existing_release() {
+    step "6/7" "Checking for existing release..."
+    
+    if gh release view "$TAG" &> /dev/null; then
+        warn "Release $TAG already exists"
+        read -p "Do you want to delete it and create a new one? [y/N] " -n 1 -r
+        echo
+        if [[ $REPLY =~ ^[Yy]$ ]]; then
+            info "Deleting existing release..."
+            gh release delete "$TAG" --yes
+            # Also delete the tag if it exists
+            git tag -d "$TAG" 2>/dev/null || true
+            git push origin ":refs/tags/$TAG" 2>/dev/null || true
+        else
+            error "Aborted. Use a different version or delete the existing release manually."
+        fi
+    fi
+}
+
+# Create GitHub release
+create_release() {
+    step "7/7" "Creating GitHub release..."
+    cd "$REPO_ROOT"
+    
+    RELEASE_NOTES=$(cat << EOF
+## Installation
+
+\`\`\`bash
+curl -fsSL https://raw.githubusercontent.com/RooCodeInc/Roo-Code/main/apps/cli/install.sh | sh
+\`\`\`
+
+Or install a specific version:
+\`\`\`bash
+ROO_VERSION=$VERSION curl -fsSL https://raw.githubusercontent.com/RooCodeInc/Roo-Code/main/apps/cli/install.sh | sh
+\`\`\`
+
+## Requirements
+
+- Node.js 20 or higher
+- macOS (Intel or Apple Silicon) or Linux (x64 or ARM64)
+
+## Usage
+
+\`\`\`bash
+# Set your API key
+export OPENROUTER_API_KEY=sk-or-v1-...
+
+# Run a task
+roo "What is this project?" --workspace ~/my-project
+
+# See all options
+roo --help
+\`\`\`
+
+## Platform Support
+
+This release includes:
+- \`roo-cli-${PLATFORM}.tar.gz\` - Built on $(uname -s) $(uname -m)
+
+> **Note:** Additional platforms will be added as needed. If you need a different platform, please open an issue.
+
+## Checksum
+
+\`\`\`
+$(cat "${TARBALL}.sha256" 2>/dev/null || echo "N/A")
+\`\`\`
+EOF
+)
+
+    # Get the current commit SHA for the release target
+    COMMIT_SHA=$(git rev-parse HEAD)
+    info "Creating release at commit: ${COMMIT_SHA:0:8}"
+    
+    # Create release (gh will create the tag automatically)
+    info "Creating release..."
+    RELEASE_FILES="$TARBALL"
+    if [ -f "${TARBALL}.sha256" ]; then
+        RELEASE_FILES="$RELEASE_FILES ${TARBALL}.sha256"
+    fi
+    
+    gh release create "$TAG" \
+        --title "Roo Code CLI v$VERSION" \
+        --notes "$RELEASE_NOTES" \
+        --prerelease \
+        --target "$COMMIT_SHA" \
+        $RELEASE_FILES
+    
+    info "Release created!"
+}
+
+# Cleanup
+cleanup() {
+    info "Cleaning up..."
+    cd "$REPO_ROOT"
+    rm -f "$TARBALL" "${TARBALL}.sha256"
+}
+
+# Print summary
+print_summary() {
+    echo ""
+    printf "${GREEN}${BOLD}✓ Release v$VERSION created successfully!${NC}\n"
+    echo ""
+    echo "  Release URL: https://github.com/RooCodeInc/Roo-Code/releases/tag/$TAG"
+    echo ""
+    echo "  Install with:"
+    echo "    curl -fsSL https://raw.githubusercontent.com/RooCodeInc/Roo-Code/main/apps/cli/install.sh | sh"
+    echo ""
+}
+
+# Main
+main() {
+    echo ""
+    printf "${BLUE}${BOLD}"
+    echo "  ╭─────────────────────────────────╮"
+    echo "  │   Roo Code CLI Release Script   │"
+    echo "  ╰─────────────────────────────────╯"
+    printf "${NC}"
+    echo ""
+    
+    detect_platform
+    check_prerequisites
+    get_version "$1"
+    build
+    create_tarball
+    create_checksum
+    check_existing_release
+    create_release
+    cleanup
+    print_summary
+}
+
+main "$@"
diff --git a/apps/cli/src/utils.ts b/apps/cli/src/utils.ts
index b7508ec297..5ea12e33b6 100644
--- a/apps/cli/src/utils.ts
+++ b/apps/cli/src/utils.ts
@@ -38,6 +38,14 @@ export function getApiKeyFromEnv(provider: string): string | undefined {
  * @param dirname - The __dirname equivalent for the calling module
  */
 export function getDefaultExtensionPath(dirname: string): string {
+	// Check for environment variable first (set by install script)
+	if (process.env.ROO_EXTENSION_PATH) {
+		const envPath = process.env.ROO_EXTENSION_PATH
+		if (fs.existsSync(path.join(envPath, "extension.js"))) {
+			return envPath
+		}
+	}
+
 	// __dirname is apps/cli/dist when bundled
 	// The extension is at src/dist (relative to monorepo root)
 	// So from apps/cli/dist, we need to go ../../../src/dist
@@ -48,7 +56,7 @@ export function getDefaultExtensionPath(dirname: string): string {
 		return monorepoPath
 	}
 
-	// Fallback: when installed as npm package, extension might be at ../extension
+	// Fallback: when installed via curl script, extension is at ../extension
 	const packagePath = path.resolve(dirname, "../extension")
 	return packagePath
 }
diff --git a/apps/cli/tsup.config.ts b/apps/cli/tsup.config.ts
index 02ebb9421d..f692148c3d 100644
--- a/apps/cli/tsup.config.ts
+++ b/apps/cli/tsup.config.ts
@@ -11,12 +11,14 @@ export default defineConfig({
 	banner: {
 		js: "#!/usr/bin/env node",
 	},
-	// Bundle these workspace packages that export TypeScript.
+	// Bundle workspace packages that export TypeScript
 	noExternal: ["@roo-code/types", "@roo-code/vscode-shim"],
 	external: [
-		// Keep native modules external.
+		// Keep native modules external
 		"@anthropic-ai/sdk",
 		"@anthropic-ai/bedrock-sdk",
 		"@anthropic-ai/vertex-sdk",
+		// Keep @vscode/ripgrep external - we bundle the binary separately
+		"@vscode/ripgrep",
 	],
 })