- Add SecurityMiddleware class with YAML-based configuration support
- Implement three-tier configuration hierarchy (Enterprise → Global → Project → Custom)
- Add ASK action support for prompting users instead of just blocking
- Create EnhancedRooIgnoreController that integrates with SecurityMiddleware
- Support both gitignore-style and regex patterns for file matching
- Add comprehensive type definitions for security configuration
- Include example YAML configurations for different use cases
- Add documentation for the new security middleware features
- Implement tests for core functionality
Fixes#7912
* First pass at separate upsell dialog
* Revert PR #7188 - Restore temperature parameter to fix TabbyApi/ExLlamaV2 crashes (#7594)
* fix: reduce CodeBlock button z-index to prevent overlap with popovers (#7783)
Fixes#7703 - CodeBlock language dropdown and copy button were appearing above popovers due to z-index: 100. Reduced to z-index: 40 to maintain proper layering hierarchy while keeping buttons functional.
* Make ollama models info transport work like lmstudio (#7679)
* feat: add click-to-edit, ESC-to-cancel, and fix padding consistency for chat messages (#7790)
* feat: add click-to-edit, ESC-to-cancel, and fix padding consistency
- Enable click-to-edit for past messages by making message text clickable
- Add ESC key handler to cancel edit mode in ChatTextArea
- Fix padding consistency between past and queued message editors
- Adjust right padding for edit mode to accommodate cancel button
Fixes#7788
* fix: adjust padding and layout for ChatTextArea in edit mode
* refactor: replace hardcoded pr-[72px] with standard Tailwind pr-20 class
---------
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Hannes Rudolph <hrudolph@gmail.com>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
* Let people paste in the auth redirect url (#7805)
Co-authored-by: roomote[bot] <219738659+roomote[bot]@users.noreply.github.com>
Co-authored-by: Bruno Bergher <me@brunobergher.com>
* fix: resolve chat message edit/delete duplication issues (#7793)
* fix: add GIT_EDITOR env var to merge-resolver mode for non-interactive rebase (#7819)
* UI: Render reasoning as plain italic (match <thinking>) (#7752)
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Hannes Rudolph <hrudolph@gmail.com>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
* Add taskSyncEnabled to userSettingsConfigSchema (#7827)
feat: add taskSyncEnabled to userSettingsConfigSchema
Co-authored-by: Roo Code <roomote@roocode.com>
* Release: v1.75.0 (#7829)
chore: bump version to v1.75.0
* fix: prevent negative cost values and improve label visibility in evals chart (#7830)
Co-authored-by: Roo Code <roomote@roocode.com>
* Fix Groq context window display (#7839)
* feat: add DismissibleUpsell component for dismissible messages
- Created DismissibleUpsell component with variant support (banner/default)
- Added dismissedUpsells to GlobalState for persistence
- Implemented message handlers for dismissing and retrieving dismissed upsells
- Added comprehensive tests for the component
- Uses VSCode extension globalState for persistent storage
* fix: Apply PR feedback for DismissibleUpsell component
- Changed from className to separate 'id' and 'className' props for better semantics
- Added i18n support for accessibility labels (aria-label and title)
- Fixed memory leak by adding mounted flag to prevent state updates after unmount
- Fixed race condition by sending dismiss message before hiding component
- Fixed inefficient array operations in webviewMessageHandler
- Added comprehensive test coverage for edge cases including:
- Multiple rapid dismissals
- Component unmounting during async operations
- Invalid/malformed message handling
- Proper message sending before unmount
- Added null checks for message data to handle edge cases gracefully
* New Cloud upsell dialog in task share and cloud view, shared component
* Properly working DismissibleUpsell
* Working upsell for long-running tasks
* CTA in AutoApproveMenu
* Home page CTA
* Fixes the autoapprove upsell and some tests
* Visual and copy fixes
* Test fix
* Translations
* Stray className attribute
* Cloud view fixes in a left-aligned layout
* Removes unnecessary test
* Less flaky tests
* Fixes sharebutton behavior and updates associated tests
* Update webview-ui/src/i18n/locales/it/cloud.json
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
* Fix dismissed flicker
* Fix long task upsell
---------
Co-authored-by: Daniel <57051444+daniel-lxs@users.noreply.github.com>
Co-authored-by: ItsOnlyBinary <ItsOnlyBinary@users.noreply.github.com>
Co-authored-by: roomote[bot] <219738659+roomote[bot]@users.noreply.github.com>
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Hannes Rudolph <hrudolph@gmail.com>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
Co-authored-by: John Richmond <5629+jr@users.noreply.github.com>
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
* feat: separate Task Sync and Roomote Control settings
- Add new taskSyncEnabled setting to control task content syncing
- Keep remoteControlEnabled for Roomote Control functionality
- Task Sync controls whether task content is sent to cloud
- Roomote Control controls whether cloud can send instructions back
- Roomote Control now depends on Task Sync being enabled
- Usage metrics (tokens, cost) always reported regardless of settings
- Update UI with two separate toggles and clear descriptions
- Add info text explaining usage metrics are always reported
* feat: add missing translations for Task Sync and Roomote Control settings
- Added taskSync, taskSyncDescription, remoteControlRequiresTaskSync, and usageMetricsAlwaysReported keys to all non-English cloud.json files
- Updated cloudBenefit keys to match English structure
- Ensured all languages have consistent translation keys for the new Task Sync and Roomote Control features
* Cloud: cleanup taskSyncEnabled additions
* fix: correct indentation localization files
---------
Co-authored-by: Roo Code <roomote@roocode.com>
* feat(checkpoints): create checkpoint on user message send
* fix(checkpoints): suppress implicit user-message checkpoint row; keep current checkpoint updated without a chat row
* Fix checkpoint suppression for user messages
- Propagate suppressMessage flag through event chain properly
- Update ChatView to check checkpoint metadata for suppressMessage flag
- Ensure checkpoint messages are created but not rendered when suppressed
- Fix bug where checkpointSave(false) should have been checkpointSave(true)
* fix: only create checkpoint on user message when files have changed
- Changed allowEmpty from true to false in checkpointSave call
- Checkpoints will now only be created when there are actual file changes
- This avoids creating empty commits in the shadow git repository
* test: update checkpoint test to include suppressMessage parameter
- Fixed test expectation to match the new function signature
- saveCheckpoint now expects both allowEmpty and suppressMessage parameters
---------
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Hannes Rudolph <hrudolph@gmail.com>
Co-authored-by: Daniel Riccio <ricciodaniel98@gmail.com>
* fix: handle array paths from VSCode terminal profiles
- Updated terminal profile interfaces to support string | string[] for path property
- Added normalizeShellPath helper to safely extract first element from array paths
- Modified isShellAllowed to handle both string and array inputs
- Updated getWindowsShellFromVSCode, getMacShellFromVSCode, and getLinuxShellFromVSCode to use normalizeShellPath
- Added comprehensive tests for array path handling
Fixes#7695
* feat: add validateShellPath export for robust shell validation
- Created validateShellPath as a public API for shell path validation
- Refactored internal validation logic into isShellAllowedInternal
- Added comprehensive test coverage for all edge cases
- Maintains backward compatibility with deprecated isShellAllowed
- Handles arrays, strings, null, undefined, and nested arrays gracefully
* Simplify roomote's work a little
---------
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: John Richmond <5629+jr@users.noreply.github.com>
Fixes issue where isWriteProtected was incorrectly passed as the partial flag
to task.ask(), causing "Current ask promise was ignored (#1)" error.
Both tools now use the askApproval wrapper function which correctly handles
the parameter ordering, passing undefined for progressStatus and isWriteProtected
as the fourth parameter.
Fixes#7648
Co-authored-by: Roo Code <roomote@roocode.com>
* fix: add cache reporting support for OpenAI-Native provider
- Add normalizeUsage method to properly extract cache tokens from Responses API
- Support both detailed token shapes (input_tokens_details) and legacy fields
- Calculate cache read/write tokens with proper fallbacks
- Include reasoning tokens when available in output_tokens_details
- Ensure accurate cost calculation using uncached input tokens
This fixes the issue where caching information was not being reported
when using the OpenAI-Native provider with the Responses API.
* fix: improve cache token normalization and add comprehensive tests
- Add fallback to derive total input tokens from details when totals are missing
- Remove unused convertToOpenAiMessages import
- Add comment explaining cost calculation alignment with Gemini provider
- Add comprehensive test coverage for normalizeUsage method covering:
- Detailed token shapes with cached/miss tokens
- Legacy field names and SSE-only events
- Edge cases including missing totals with details-only
- Cost calculation with uncached input tokens
* fix: address PR review comments
- Remove incorrect fallback to missFromDetails for cache write tokens
- Fix cost calculation to pass total input tokens (calculateApiCostOpenAI handles subtraction)
- Improve readability by extracting cache detail checks to intermediate variables
- Remove redundant ?? undefined
- Update tests to reflect correct behavior (miss tokens are not cache writes)
- Add clarifying comments about cache miss vs cache write tokens
* feat: add Ollama API key support for Turbo mode
- Add ollamaApiKey field to ProviderSettings schema
- Add ollamaApiKey to SECRET_STATE_KEYS for secure storage
- Update Ollama and NativeOllama providers to use API key for authentication
- Add UI field for Ollama API key (shown when custom base URL is provided)
- Add test coverage for API key functionality
This enables users to use Ollama Turbo with datacenter-grade hardware by providing an API key for authenticated Ollama instances or cloud services.
* fix: use VSCodeTextField for Ollama API key field
Remove non-existent ApiKeyField import and use standard VSCodeTextField with password type, matching other provider implementations
* Add missing translation keys for Ollama API key support
- Add providers.ollama.apiKey and providers.ollama.apiKeyHelp to all 18 language files
- Support for authenticated Ollama instances and cloud services
- Relates to PR #7425
* refactor: improve type safety for Ollama client configuration
- Replace 'any' type with proper OllamaOptions (Config) type
- Import Config type from ollama package for better type checking
---------
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Daniel Riccio <ricciodaniel98@gmail.com>
* feat: optimize memory usage for image handling in webview
- Replace base64 image data with webview URIs to reduce memory footprint
- Add proper resource roots to webview for workspace file access
- Implement convertToWebviewUri method for safe file-to-URI conversion
- Update ImageViewer to handle both webview URIs and file paths separately
- Add image message type for proper image rendering in chat
- Improve error handling and display for failed image loads
- Add comprehensive tests for ImageViewer component
- Format display paths as relative for better readability
This change significantly reduces memory usage by avoiding base64 encoding
of images and instead using VSCode's webview URI system for direct file
access. Images are now loaded on-demand from disk rather than being held
in memory as base64 strings.
* fix: address PR review comments
- Use safeJsonParse instead of JSON.parse in ChatRow.tsx
- Add type definition for parsed image info
- Add more specific error types in ClineProvider.ts
- Add comprehensive JSDoc comments to ImageBlock.tsx
- Improve error handling and type safety
* fix: address MrUbens' review comments
- Remove hardcoded 'rc1' pattern in formatDisplayPath, use generic workspace detection
- Internationalize 'No image data' text using i18n system
* chore: remove useless comment
* chore(i18n): add image.noData to all locales to fix translation check
* test: update ImageViewer.spec to align with i18n key and flexible path formatting
