1. Persist taskPermissions in HistoryItem so permissions survive task
restarts. Added taskPermissions field to historyItemSchema, included
it in taskMetadata output, and restored it in the Task constructor
when loading from history.
2. Add ReDoS mitigation for model-provided regex patterns:
- isSafeRegex() heuristic rejects nested quantifiers like (a+)+
and overlapping alternations in repeated groups like (a|a)+
- Max pattern length capped at 200 characters
- Both checks enforced at schema validation time via Zod refinements
- 11 new tests covering ReDoS detection and persistence round-trips
1. Anchor regex patterns in matchesAnyPattern with ^(?:...)$ wrapping so
patterns like "src/.*" require full-path matching instead of substring
matching. Prevents "evil/src/foo" from matching a "src/.*" permission.
2. Add regex validation at schema level (regexString refinement) so
invalid patterns are rejected at parse time rather than silently
failing at runtime.
3. Simplify duplicate file/command pattern validation in validateToolUse
by unifying layered and flat code paths into a single branch that
falls back to wrapping flat patterns as a single layer.
4. Remove unused matchesAnyPattern import from validateToolUse.ts.
5. Add tests for anchoring behavior, pre-anchored patterns, and
invalid regex rejection at schema level.
1. NativeToolCallParser: Remove permissions from update_todo_list cases
(was erroneously added to wrong tool case, should only be on new_task)
2. deniedTools: Exempt ALWAYS_AVAILABLE_TOOLS (attempt_completion, etc.)
from deniedTools check, matching the existing allowedTools behavior.
Prevents parent from trapping subtask by denying completion tools.
3. Pattern merging: Replace broken exact-string intersection with layered
enforcement. filePatterns/commandPatterns from parent and child are
kept as separate layers (AND between layers, OR within each layer).
This correctly handles narrowing: parent ["src/.*"] + child
["src/components/.*"] now allows only files matching BOTH patterns,
instead of producing an empty intersection.
Adds an optional `permissions` parameter to the `new_task` tool, allowing
the Orchestrator (or any parent task) to dynamically set permission
boundaries for subtasks:
- New `TaskPermissions` type with filePatterns, commandPatterns,
allowedTools, and deniedTools
- Permission merging with most-restrictive-wins semantics for nested
subtask delegation
- Runtime enforcement in validateToolUse() for all permission types
- Full test coverage for merging logic and enforcement
Addresses Issue #12330 (Phase 3b)
feat(cli): add create-with-session-id support
rename public task id flag to --create-with-session-id
validate session ids as UUIDs for create/resume and stdin start.taskId
add integration coverage for create+resume loading correct session
* Allow selecting a specific shell
Add --terminal-shell CLI flag to specify which shell ExecaTerminalProcess
uses for inline command execution. The shell path is validated at the CLI
layer and passed through the standard settings mechanism (BaseTerminal
static getter/setter), matching how all other CLI terminal settings flow
through the system.
* test(cli): make shell path access test cross-platform
feat(cli): support images in stdin stream start and message commands
Add optional `images` field (array of base64 data URIs) to the `start` and
`message` CLI stdin stream commands, allowing callers to attach images to
prompts. The images are validated, forwarded through the extension host, and
included in queued messages.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Propagate the command exit code through the JSON event emitter so CLI
consumers can distinguish between successful and failed command
executions without parsing output text.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
fix: forward task configuration through stdin-prompt-stream protocol
The stdin-prompt-stream `start` command only accepted `prompt` — any
`configuration` passed via the cloud worker's StartNewTask was silently
dropped. This meant custom modes (e.g. `ask-artifacts`), disabled tools,
and other task-level settings never reached the extension when running
via the CLI harness.
Changes:
- Add optional `configuration` field to the `start` stdin command
- Parse and forward it in `runStdinStreamMode`
- Thread it through `ExtensionHost.runTask` → `newTask` webview message
→ `ClineProvider.createTask` (which already calls `setValues`)
- Add `taskConfiguration` field to `WebviewMessage` type
Backward-compatible: older CLIs ignore the extra field; older workers
that don't send `configuration` trigger no change in behavior.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: cte <cestreich@gmail.com>
* fix(cli): streaming deltas, task ID propagation, cancel recovery, and misc fixes
- Stream tool_use ask messages (command, tool, mcp) as structured deltas
instead of full snapshots in json-event-emitter
- Generate task ID upfront and propagate through runTask/createTask so
currentTaskId is available in extension state immediately
- Wait for resumable state after cancel before processing follow-up
messages to prevent race conditions in stdin-stream
- Add ROO_CODE_DISABLE_TELEMETRY=1 env var to disable cloud telemetry
- Provide valid empty JSON Schema for custom tools without parameters
to fix strict-mode API validation
- Skip paths outside cwd in RooProtectedController to avoid RangeError
- Silently handle abort during exponential backoff retry countdown
- Enable customTools experiment in extension host
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add start() to TaskStub in single-open-invariant test
The ClineProvider.createTask change to call task.start() after
addClineToStack requires the test's TaskStub mock to have this method.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add MiniMax M2.5 model and set as default
* fix: update MiniMax M2.5 contextWindow to 204_800
* Delete .changeset/add-minimax-m25.md
---------
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
* feat: restore Unbound as a provider
* Adds translations
* fix: add unbound to ClineProvider test expectations
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: show aggregated +/− line counts in FileChangesPanel header
* feat(FileChangesPanel): show merged diff relative to final file state
* fix(webview): restrict readFileContent to paths inside the workspace
* fix: add workspace-boundary validation to readFileContent to prevent path traversal
* fix(tests): mock isPathOutsideWorkspace in readFileContent spec
* fix(tests): mock isPathOutsideWorkspace in readFileContent spec
* fix: use path.resolve/path.sep in readFileContent test mock for cross-platform compatibility
The isPathOutsideWorkspace mock used hardcoded Unix-style path comparisons
(/mock/workspace with forward slashes), which fails on Windows where
path.resolve() produces paths with drive letters (C:\mock\workspace\...).
Replace manual string normalization with path.resolve() and path.sep so the
mock behaves correctly on both Windows and Unix.
---------
Co-authored-by: Roo Code <roomote@roocode.com>
* feat: remove Roomote Control from extension
Remove all Roomote Control (remote control) functionality:
- Remove BridgeOrchestrator and entire bridge directory from @roo-code/cloud
- Remove remoteControlEnabled, featureRoomoteControlEnabled from extension state
- Remove extensionBridgeEnabled from CloudUserInfo and user settings
- Remove roomoteControlEnabled from organization/user feature schemas
- Remove enableBridge from Task and ClineProvider
- Remove remote control toggle from CloudView UI
- Remove remoteControlEnabled message handler
- Remove extension bridge disconnect on logout/deactivate
- Update CloudTaskButton to show for all logged-in users
- Remove remote control translation strings from all locales
- Update all related tests
CLO-765
* fix: remove dead getOrganizationMetadata and unused socket.io-client dep
* Readmes
* Readmes
* Types
* fix: remove leftover Roomote Control references from locale READMEs and stale BridgeOrchestrator mock
* Removes cloudtaskbutton
* fix: remove orphaned qrcode packages and dead openInCloud translation keys
* pnpmlock
* Revert these
* Revert these
* Revert these
* Remove socket.io
---------
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Bruno Bergher <bruno@roocode.com>
Co-authored-by: cte <cestreich@gmail.com>
* chore: remove integration test files
* chore: remove integration test job from CI workflow
---------
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Hannes Rudolph <hrudolph@gmail.com>
* feat: add per-workspace indexing opt-in and stop/cancel control
- Add codeIndexWorkspaceEnabled flag in workspaceState (default: false)
- Thread AbortController/AbortSignal through orchestrator → scanner
- Add Stop Indexing button and Stopping state to UI
- Fix handleSettingsChange() to abort active scan when disabling toggle
- Add translations for all 18 locales
* fix: correct abort handling in indexing scanner and orchestrator
- Re-throw AbortError in scanner's file processing catch block to prevent
abort signals from being silently swallowed as file errors
- Reorder stopWatcher() before setSystemState() in orchestrator abort
catch path to ensure watcher cleanup before state transition
- Update scanner test to assert AbortError propagation on mid-scan abort
* fix: optimize workspace check ordering, translate new i18n keys, fix abort handling
- Move workspace-enabled check before _recreateServices() in initialize()
to avoid creating Qdrant/embedder connections for disabled workspaces
- Translate new i18n keys (indexingStopped, indexingStoppedPartial, stopping,
stopIndexingButton, stoppingButton, workspaceToggleLabel,
workspaceDisabledMessage) in all 17 non-English locales
- Re-throw AbortError in scanner catch block to prevent silent swallowing
- Reorder stopWatcher() before setSystemState() in orchestrator abort path
- Update scanner test to assert AbortError propagation on mid-scan abort
- Fix recoverFromError test for workspace-enabled check ordering
* fix: per-folder enablement key, abort-safe dispose and back-pressure, translate i18n
Addresses 0xMink review feedback:
- Store workspace enablement keyed by folder path to support multi-root
workspaces (codeIndexWorkspaceEnabled:<path> instead of single boolean)
- Add test proving folder A enabled does not enable folder B
- dispose() now calls stopIndexing() to abort orphaned scans on folder removal
- Scanner back-pressure loop checks abort signal to avoid spin-waiting
- Move workspace-enabled check before _recreateServices() in initialize()
- Translate new i18n keys in all 17 non-English locales
- Fix abort handling in orchestrator and scanner catch blocks
* fix: flush debounced cache writes on abort to preserve indexing progress
* feat: add global auto-enable default for backward-compatible workspace indexing
* fix: stop/start indexer when auto-enable default changes effective state
* fix: URI-keyed enablement, throw AbortError in back-pressure, stopWatcher on early-return
* fix: iterate all managers when auto-enable default changes in multi-root workspaces
---------
Co-authored-by: James Mtendamema <jmtendamema@geologicai.com>
Replace the incorrect Sonnet 4.6 Bedrock ID with the AWS-supported
model ID in the model registry and Bedrock capability lists.
Remove references to the deprecated dated ID and update Bedrock
tests to validate the corrected Sonnet 4.6 identifier.
* Add Anthropic Claude Sonnet 4.6 support across providers
Add model definitions and capability flags for Anthropic, Bedrock,
Vertex, OpenRouter, and Vercel AI Gateway.
Update Anthropic handler and UI model selection logic to support Claude
Sonnet 4.6 1M context behavior and tier pricing.
Add focused tests for provider handlers, fetchers, and selected-model
hooks.
Keep Bedrock UI tier pricing parity as-is because this is a
pre-existing issue for Opus 4.6 and will be handled separately.
Reference:
- https://www.anthropic.com/news/claude-sonnet-4-6
- https://platform.claude.com/docs/en/about-claude/models/overview#latest-models-comparison
* Delete .changeset/soft-carpets-hunt.md
---------
Co-authored-by: Hannes Rudolph <hrudolph@gmail.com>
* fix: correct Bedrock model ID for Claude Opus 4.6 (#11232)
Remove the :0 suffix from the Claude Opus 4.6 model ID to match
the correct AWS Bedrock model identifier.
The model ID was "anthropic.claude-opus-4-6-v1:0" but should be
"anthropic.claude-opus-4-6-v1" per AWS Bedrock documentation.
Fixes#11231
Co-authored-by: Roo Code <roomote@roocode.com>
* fix: guard against empty-string baseURL in provider constructors (#11233)
When the 'custom base URL' checkbox is unchecked in the UI, the setting
is set to '' (empty string). Providers that passed this directly to their
SDK constructors caused 'Failed to parse URL' errors because the SDK
treated '' as a valid but broken base URL override.
- gemini.ts: use || undefined (was passing raw option)
- openai-native.ts: use || undefined (was passing raw option)
- openai.ts: change ?? to || for fallback default
- deepseek.ts: change ?? to || for fallback default
- moonshot.ts: change ?? to || for fallback default
Adds test coverage for Gemini and OpenAI Native constructors verifying
empty-string baseURL is coerced to undefined.
* fix: make defaultTemperature required in getModelParams to prevent silent temperature overrides (#11218)
* fix: DeepSeek temperature defaulting to 0 instead of 0.3
Pass defaultTemperature: DEEP_SEEK_DEFAULT_TEMPERATURE to getModelParams() in
DeepSeekHandler.getModel() to ensure the correct default temperature (0.3)
is used when no user configuration is provided.
Closes#11194
* refactor: make defaultTemperature required in getModelParams
Make the defaultTemperature parameter required in getModelParams() instead
of defaulting to 0. This prevents providers with their own non-zero default
temperature (like DeepSeek's 0.3) from being silently overridden by the
implicit 0 default.
Every provider now explicitly declares its temperature default, making the
temperature resolution chain clear:
user setting → model default → provider default
---------
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
* feat: batch consecutive tool calls in chat UI with shared utility (#11245)
* feat: group consecutive list_files tool calls into single UI block
Consolidate consecutive listFilesTopLevel/listFilesRecursive ask messages
into a single 'Roo wants to view multiple directories' block, matching the
existing read_file batching pattern.
* chore: add missing translation keys for all locales
* refactor: consolidate duplicate listFiles batch-handling blocks in ChatRow
Merge the separate listFilesTopLevel and listFilesRecursive case blocks
into a single combined case with shared batch-detection logic, selecting
the icon and translation key based on the tool type. This removes the
duplicated isBatchDirRequest check and BatchListFilesPermission render.
* feat: batch consecutive file-edit tool calls into single UI block
Add edit-file batching in ChatView groupedMessages that consolidates
consecutive editedExistingFile, appliedDiff, newFileCreated,
insertContent, and searchAndReplace asks into a single BatchDiffApproval
block. Move batchDiffs detection in ChatRow above the switch statement
so it applies to any file-edit tool type.
* refactor: extract batchConsecutive utility, fix batch UI issues
- Extract generic batchConsecutive() utility from 3 identical while-loops
- Fix React key collisions in BatchListFilesPermission, BatchFilePermission, BatchDiffApproval
- Normalize language prop to "shellsession" (was "shell-session" for top-level)
- Remove unused _batchedMessages property from synthetic messages
- Remove dead didViewMultipleDirectories i18n key from all 18 locale files
- Add batch button text for listFilesTopLevel/listFilesRecursive
- Add batchConsecutive utility tests (6 cases)
* fix: audit improvements for batch tool-call UI
- Make batchConsecutive() generic instead of ClineMessage-specific
- Add batch-aware button text for edit-file batches ("Save All"/"Deny All")
- Add dedicated list-batch/edit-batch i18n keys (stop reusing read-batch)
- Add JSON.parse defense-in-depth in all three synthesizers
- Fix mixed list_files batch icon to default to FolderTree
- Add 6 missing test cases (all-match, immutability, spy, single-dir)
* chore: minor type cleanup (out-of-scope housekeeping)
- Trim unused recursive/isOutsideWorkspace from DirPermissionItem interface
- Remove 4 pre-existing `as any` casts in ChatView.tsx:
- window cast → precise inline type
- checkpoint bracket access → removed unnecessary casts
- condensing message → `as ClineMessage`
- debounce cancel → `.clear()` (correct API)
- Update BatchListFilesPermission test data to match trimmed interface
* i18n: add list-batch and edit-batch translations for all locales
* feat: add IPC query handlers for commands, modes, and models (#11279)
Add GetCommands, GetModes, and GetModels to the IPC protocol so external
clients can fetch slash commands, available modes, and Roo provider models
without going through the internal webview message channel.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add lock toggle to pin API config across all modes in workspace (#11295)
* feat: add lock toggle to pin API config across all modes in workspace
Add a lock/unlock toggle inside the API config selector popover (next to
the settings gear) that, when enabled, applies the selected API
configuration to all modes in the current workspace.
- Add lockApiConfigAcrossModes to ExtensionState and WebviewMessage types
- Store setting in workspaceState (per-workspace, not global)
- When locked, activateProviderProfile sets config for all modes
- Lock icon in ApiConfigSelector popover bottom bar next to gear
- Full i18n: English + 17 locale translations (all mention workspace scope)
- 9 new tests: 2 ClineProvider, 2 handler, 5 UI (77 total pass)
* refactor: replace write-fan-out with read-time override for lock API config
The original lock implementation used setModeConfig() fan-out to write the
locked config to ALL modes globally. Since the lock flag lives in workspace-
scoped workspaceState but modeApiConfigs are in global secrets, this caused
cross-workspace data destruction.
Replaced with read-time guards:
- handleModeSwitch: early return when lock is on (skip per-mode config load)
- createTaskWithHistoryItem: skip mode-based config restoration under lock
- activateProviderProfile: removed fan-out block
- lockApiConfigAcrossModes handler: simplified to flag + state post only
- Fixed pre-existing workspaceState mock gap in ClineProvider.spec.ts and
ClineProvider.sticky-profile.spec.ts
* fix: validate Gemini thinkingLevel against model capabilities and handle empty streams (#11303)
* fix: validate Gemini thinkingLevel against model capabilities and handle empty streams
getGeminiReasoning() now validates the selected effort against the model's
supportsReasoningEffort array before sending it as thinkingLevel. When a
stale settings value (e.g. 'medium' from a different model) is not in the
supported set, it falls back to the model's default reasoningEffort.
GeminiHandler.createMessage() now tracks whether any text content was
yielded during streaming and handles NoOutputGeneratedError gracefully
instead of surfacing the cryptic 'No output generated' error.
* fix: guard thinkingLevel fallback against 'none' effort and add i18n TODO
The array validation fallback in getGeminiReasoning() now only triggers
when the selected effort IS a valid Gemini thinking level but not in
the model's supported set. Values like 'none' (explicit no-reasoning
signal) are no longer overridden by the model default.
Also adds a TODO for moving the empty-stream message to i18n.
* fix: track tool_call_start in hasContent to avoid false empty-stream warning
Tool-only responses (no text) are valid content. Without this,
agentic tool-call responses would incorrectly trigger the empty
response warning message.
* chore(cli): prepare release v0.0.53 (#11425)
* feat: add GLM-5 model support to Z.ai provider (#11440)
* chore: regenerate pnpm-lock.yaml
* fix: resolve type errors and remove AI SDK test contamination
* docs: update progress.txt with rebuilt Batch 2 status
---------
Co-authored-by: roomote[bot] <219738659+roomote[bot]@users.noreply.github.com>
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
Co-authored-by: Chris Estreich <cestreich@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
