Commit graph

5810 commits

Author SHA1 Message Date
daniel-lxs
3ff9b21dae
refactor: remove unused normalizeDataUrlsToFilePaths function
- Function was only used in tests, not in production code
- Dual-storage approach (images + imagesBase64) eliminated need for base64→file conversion
- Removed ~60 lines of function code + ~90 lines of tests
- Simplified imageDataUrl module to focus on production use case
- Kept normalizeImageRefsToDataUrls which is used in production (Task.ts)
2025-11-03 16:58:01 -05:00
daniel-lxs
7ddfa4e529
refactor: remove unnecessary caching from normalizeDataUrlsToFilePaths
- Function is now primarily used for testing
- Production code uses dual-storage (images + imagesBase64)
- Removed redundant cache since same hash always produces same file path
- Simplified implementation and removed obsolete test
2025-11-03 15:13:07 -05:00
daniel-lxs
17ee88c802
fix: optimize image handling with dual-storage approach
- Add imagesBase64 field to ClineMessage schema for efficient dual storage
- Store both webview URIs (for display) and base64 (for API) when creating messages
- Remove repeated base64→file→URI conversions on every render
- Update all tools to use base64 from stored messages for API calls
- Eliminates file I/O overhead during rendering and message updates
- Improves performance by storing each format once instead of converting repeatedly
2025-11-03 14:48:09 -05:00
daniel-lxs
d56b74ffb3
fix(tests): normalize expected path for CDN URI test in imageDataUrl.spec.ts 2025-10-28 16:01:14 -05:00
daniel-lxs
f3b31d7a53
test(images): add CDN URI conversion tests for normalizeImageRefsToDataUrls
Add test coverage for HTTPS CDN URL conversion (e.g., https://file+.vscode-resource.vscode-cdn.net/...) to base64 data URLs. This covers the critical URI-to-base64 conversion flow that was previously only tested with legacy file:// URIs.
2025-10-28 13:46:11 -05:00
daniel-lxs
c445cfe4c7
fix(images): remove legacy file:// URI support and use centralized image utils
- Remove file:// URI handling from webviewUriToFilePath (legacy support no longer needed)

- Update tests to reflect modern CDN-style URIs only

- Use MAX_IMAGE_BYTES and estimateBytesFromBase64DataUrl from webview-ui/src/utils/image.ts in ChatTextArea for consistent 10MB enforcement

Fixes knip unused export error and test failure
2025-10-28 13:33:38 -05:00
daniel-lxs
09d512b1e5
chore(webview): add image utils for size estimation and 10MB limit enforcement [TS.image.ts](webview-ui/src/utils/image.ts:1) 2025-10-28 13:09:17 -05:00
daniel-lxs
1c7700eb69
feat(images): enforce 10MB limit UI+backend; reuse original base64 via cache to avoid re-encoding
UI: early-reject >10MB in ChatTextArea paste/drop handlers. Backend: validate >10MB in savePastedImageToTemp(). Cache base64 mapped to file path and consume in normalizeImageRefsToDataUrls() to avoid re-encoding UI-pasted images.
2025-10-28 11:33:08 -05:00
daniel-lxs
5d3f45bec0
fix(image-uris): broaden Unix path regex to include common Linux roots
Use /^[^?#]*\/(?:Users|home|root|var|tmp|opt)\/[^?#]{1,300}\.(png|jpg|jpeg|gif|webp)$/i to support Linux/macOS while keeping bounds and avoiding backtracking.
2025-10-27 20:46:27 -05:00
daniel-lxs
634ee677d9
fix(image-uris): resolve review-bot issues
ClineProvider.convertToWebviewUri: align JSDoc with non-throwing behavior and fallback to file URI.

imageDataUrl.webviewUriToFilePath: remove impossible CDN host check from vscode-resource branch; expand Windows path regex to allow spaces while keeping bounds.

ChatTextArea: clear pendingImageUploadsRef via captured ref in cleanup to avoid stale closure.
2025-10-27 20:30:25 -05:00
daniel-lxs
9dc853cf7f
feat(images): persist base64 in backend messages; normalize URIs once at ingestion; support VS Code CDN webview URLs in normalization 2025-10-27 19:30:16 -05:00
daniel-lxs
3d796de327
security: fix host injection vulnerability in URL validation
- Replace dangerous substring check webviewUri.includes('vscode-cdn.net')
- Add proper URL host validation using URL constructor
- Check url.host === 'vscode-cdn.net' to prevent injection via paths/queries
- Graceful fallback when URL parsing fails
- Addresses final CodeQL warning for incomplete URL substring sanitization
2025-10-27 14:33:42 -05:00
daniel-lxs
a1c402e77b
security: harden URL parsing against ReDoS and injection attacks
- Add strict prefix validation: require vscode-resource://vscode-webview/ prefix
- Add URI length limits (max 2048 chars) to prevent DoS
- Replace potentially vulnerable regex with bounded, anchored patterns
- Use ^ and $ anchors to prevent partial matches
- Limit character classes to prevent backtracking (e.g., [a-zA-Z0-9._-]{1,50})
- Add proper error handling for decode failures
- Addresses CodeQL warnings for polynomial regex and incomplete URL sanitization
2025-10-27 14:26:28 -05:00
daniel-lxs
7029f1d6f8
security: fix polynomial regex and improve URL sanitization in imageDataUrl.ts
- Replace potentially polynomial regex /(?:Users|C:)([^?#]+\.(?:png|jpg|jpeg|gif|webp))/i
- Split into separate bounded patterns for Unix and Windows paths
- Add length limit {0,500} to prevent ReDoS attacks
- Improve URL substring sanitization for vscode-userdata and vscode-cdn.net URIs
- Addresses GitHub CodeQL security warnings for polynomial regex vulnerability
2025-10-27 14:24:06 -05:00
daniel-lxs
32b708592d
optimize: implement efficient approach for PR #8225 - store base64 directly in backend messages
- Remove unnecessary memory caching logic
- Store base64 data URLs directly in ClineMessage.images[] and ApiMessage content when first received
- Eliminate conversion overhead at API call time (base64 already available)
- Keep frontend memory efficient with webview URIs for display
- Much simpler and more efficient than caching approach
- One-time conversion: webview URI → base64 when storing in backend
- API calls use pre-stored base64 directly (no file I/O or conversion needed)

This achieves PR goals with optimal performance: frontend memory efficiency + instant API calls
2025-10-27 13:42:41 -05:00
daniel-lxs
e7531e5b6e
fix: complete PR #8225 - add missing webview URI to base64 conversion
- Add normalizeImageRefsToDataUrls() function to convert webview URIs to base64 data URLs
- Add formatImagesIntoBlocksAsync() for async image processing in backend
- Update Task.ts to use async conversion when storing images in backend messages
- Backend now stores base64 (for API calls), frontend displays webview URIs (memory efficient)
- Fixes OpenRouter and other providers not being able to see attached images
- Maintains PR goals: webview memory efficiency + working image functionality
2025-10-27 12:42:27 -05:00
Daniel
f34243e1c9
Merge branch 'main' into feat/webview-image-uri 2025-09-25 18:36:43 -05:00
Daniel
87d50a78cb
refactor: remove pr-reviewer mode (#8222) 2025-09-25 17:44:49 -05:00
Bruno Bergher
7fd01ab2a0
wip: Website Improvements (#8303)
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
2025-09-25 16:31:04 -04:00
Matt Rubens
8485548f53
Show the Roo provider on the welcome screen (#8317) 2025-09-25 16:13:04 -04:00
John Costa
a0d6a4b4f9
removing user hint when refreshing models (#7710) 2025-09-25 15:22:16 -04:00
Hannes Rudolph
ab0644d367
Correct tool use suggestion to improve model adherence to suggestion (#8315)
* Correct tool use suggestion to improve model adherence to suggestion

* tweak
2025-09-25 11:53:31 -06:00
roomote[bot]
d959e88a97
feat: Add telemetry tracking to DismissibleUpsell component (#8309)
* feat: add telemetry tracking to DismissibleUpsell component

- Added UPSELL_DISMISSED and UPSELL_CLICKED events to TelemetryEventName enum
- Updated DismissibleUpsell component to track clicks and dismissals with telemetry
- Added telemetry tests to DismissibleUpsell test suite
- Events include upsellId in the payload for tracking specific upsells

* refactor(webview): make handleDismiss synchronous in DismissibleUpsell

test(webview): add scenario where dismissOnClick=true without onClick tracks only UPSELL_DISMISSED; update tests; all tests passing locally

---------

Co-authored-by: Roo Code <roomote@roocode.com>
2025-09-25 13:29:43 -04:00
roomote[bot]
43c1de0d7e
feat: log out from cloud when resetting extension state (#8312)
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
2025-09-25 12:24:46 -04:00
github-actions[bot]
bf1aafad9b
Changeset version bump (#8306)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
2025-09-25 10:25:30 -04:00
Matt Rubens
37a175c4ed
Release v3.28.8 (#8305) 2025-09-25 10:15:34 -04:00
Matt Rubens
b75f8dd274
Add a couple more free models to the Roo provider (#8304) 2025-09-25 10:00:40 -04:00
Hannes Rudolph
798801d582
Fix frequent "No tool used" errors by clarifying tool-use rules (#8292) 2025-09-25 09:24:46 -04:00
Hannes Rudolph
2f1b94f430
fix: include initial ask in condense summarization (#8293) (#8298)
* fix: include initial ask in condense summarization (#8293)

---------

Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
2025-09-24 23:14:44 -06:00
Matt Rubens
d3d0967fc3
Show cloud switcher and option to add a team when logged in (#8291) 2025-09-24 16:42:06 -04:00
Chris Estreich
25f61943ca
Set port 3446 for web-evals in production mode (#8288) 2025-09-24 08:43:05 -07:00
Bruno Bergher
205f3e4242
web: Opengraph image (#8285)
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
2025-09-24 09:18:55 -04:00
github-actions[bot]
8dbd8c4b1b
Changeset version bump (#8271)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
2025-09-23 19:14:03 -04:00
Matt Rubens
c5269f3262
chore: add changeset for v3.28.7 (#8268) 2025-09-23 18:59:42 -04:00
Matt Rubens
fc4ee93585
Remove org switcher tooltip (#8269) 2025-09-23 18:59:06 -04:00
Bruno Bergher
d8dd19a6ed
ux: Collapse thinking blocks by default (but control all of them with a keyboard shortcut) (#8254)
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
2025-09-23 18:48:04 -04:00
roomote[bot]
35791d03d3
fix: checkpoint restore popover positioning issue (#8219) (#8220)
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
2025-09-23 18:35:46 -04:00
Matt Rubens
0682629ac8
Cloud account switcher (#8223)
* Cloud account switcher

* Bare metal evals fixes (#8224)

Co-authored-by: Roo Code <roomote@roocode.com>

* Rounded icons in chat account switcher

* Visual tweaks to CloudView

* Remove hardcoded timeout

* Safer check

* PR feedback

* Fix test

* Check for org mismatches in handleCredentialsChange

* Cloud: use the existing auth event flow to handle org switching

* Cleanup: broadcast() might be confusingly named.

---------

Co-authored-by: Chris Estreich <cestreich@gmail.com>
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Bruno Bergher <bruno@roocode.com>
Co-authored-by: John Richmond <5629+jr@users.noreply.github.com>
2025-09-23 18:18:28 -04:00
roomote[bot]
382ab63ea1
feat: add zai-org/GLM-4.5-turbo model to Chutes provider (#8157)
Co-authored-by: Roo Code <roomote@roocode.com>
2025-09-23 17:33:44 -04:00
daniel-lxs
ab402bf1d9
fix: improve vscode-cdn.net URL validation and add copy action check
- Fixed CodeQL security issue by properly validating vscode-cdn.net domain instead of substring check
- Added missing copy action check for HTTPS/vscode-cdn URLs before opening image
- Updated tests to match the more secure URL validation logic
2025-09-23 15:06:27 -05:00
daniel-lxs
b10c87422a
feat: add clipboard copy functionality to openImage for file paths 2025-09-23 14:57:26 -05:00
daniel-lxs
addd1bc6e7
feat: enhance openImage function to handle vscode webview CDN URLs 2025-09-23 14:53:09 -05:00
Matt Rubens
f47a2b8b1d
Add image for 3.28.5 (#8266) 2025-09-23 14:19:35 -04:00
github-actions[bot]
44cbee5e75
Changeset version bump (#8262)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
2025-09-23 14:02:01 -04:00
Matt Rubens
606167209d
chore: add changeset for v3.28.6 (#8263) 2025-09-23 13:54:18 -04:00
Chris Estreich
19c36068cb
Follow-up questions should trigger the "interactive" state (#8259) 2025-09-23 13:47:00 -04:00
Matt Rubens
8e9a266256
chore: add changeset for v3.28.6 (#8261) 2025-09-23 13:43:44 -04:00
Daniel
1a4fb7f91c
feat(types): add GPT-5-Codex model (#8260) 2025-09-23 13:35:44 -04:00
roomote[bot]
807cc999a5
feat: add package.nls.json checking to find-missing-translations script (#8255)
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
2025-09-23 11:10:23 -04:00
roomote[bot]
12f94fc727
fix: respect Ollama Modelfile num_ctx configuration (#7798)
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Hannes Rudolph <hrudolph@gmail.com>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
2025-09-22 23:08:09 -04:00