1. Persist taskPermissions in HistoryItem so permissions survive task
restarts. Added taskPermissions field to historyItemSchema, included
it in taskMetadata output, and restored it in the Task constructor
when loading from history.
2. Add ReDoS mitigation for model-provided regex patterns:
- isSafeRegex() heuristic rejects nested quantifiers like (a+)+
and overlapping alternations in repeated groups like (a|a)+
- Max pattern length capped at 200 characters
- Both checks enforced at schema validation time via Zod refinements
- 11 new tests covering ReDoS detection and persistence round-trips
1. Anchor regex patterns in matchesAnyPattern with ^(?:...)$ wrapping so
patterns like "src/.*" require full-path matching instead of substring
matching. Prevents "evil/src/foo" from matching a "src/.*" permission.
2. Add regex validation at schema level (regexString refinement) so
invalid patterns are rejected at parse time rather than silently
failing at runtime.
3. Simplify duplicate file/command pattern validation in validateToolUse
by unifying layered and flat code paths into a single branch that
falls back to wrapping flat patterns as a single layer.
4. Remove unused matchesAnyPattern import from validateToolUse.ts.
5. Add tests for anchoring behavior, pre-anchored patterns, and
invalid regex rejection at schema level.
1. NativeToolCallParser: Remove permissions from update_todo_list cases
(was erroneously added to wrong tool case, should only be on new_task)
2. deniedTools: Exempt ALWAYS_AVAILABLE_TOOLS (attempt_completion, etc.)
from deniedTools check, matching the existing allowedTools behavior.
Prevents parent from trapping subtask by denying completion tools.
3. Pattern merging: Replace broken exact-string intersection with layered
enforcement. filePatterns/commandPatterns from parent and child are
kept as separate layers (AND between layers, OR within each layer).
This correctly handles narrowing: parent ["src/.*"] + child
["src/components/.*"] now allows only files matching BOTH patterns,
instead of producing an empty intersection.
Adds an optional `permissions` parameter to the `new_task` tool, allowing
the Orchestrator (or any parent task) to dynamically set permission
boundaries for subtasks:
- New `TaskPermissions` type with filePatterns, commandPatterns,
allowedTools, and deniedTools
- Permission merging with most-restrictive-wins semantics for nested
subtask delegation
- Runtime enforcement in validateToolUse() for all permission types
- Full test coverage for merging logic and enforcement
Addresses Issue #12330 (Phase 3b)
* Remove pricing/enterprise and Roo Code for pages
* Remove cloud team and router pages
* Refine homepage hero and CTA sections
* nav
* more footer
* Fix knip by removing orphaned web files
feat(bedrock): add Cohere Embed v4 model and improve credential handling
- Add cohere.embed-v4:0 (1536-dim) to Bedrock embedding model profiles
- Add v4-specific request format (embedding_types: ["float"]) and response
parsing (embeddings.float[0]) in BedrockEmbedder
- Replace fromEnv() with fromNodeProviderChain() for default credential
chain when no AWS profile is specified, supporting SSO, IMDS, ECS, and
other credential sources with built-in memoization
- Add unit tests for Cohere v4 request/response handling, credential
provider selection, and v3 regression coverage
Fixes#11823
feat(cli): add create-with-session-id support
rename public task id flag to --create-with-session-id
validate session ids as UUIDs for create/resume and stdin start.taskId
add integration coverage for create+resume loading correct session
* Allow selecting a specific shell
Add --terminal-shell CLI flag to specify which shell ExecaTerminalProcess
uses for inline command execution. The shell path is validated at the CLI
layer and passed through the standard settings mechanism (BaseTerminal
static getter/setter), matching how all other CLI terminal settings flow
through the system.
* test(cli): make shell path access test cross-platform
