- Validate and sanitize URLs before loading in iframe
- Use URL constructor to parse and validate URLs
- Only allow HTTP and HTTPS protocols
- Use setAttribute instead of direct property assignment
- Add proper error handling for invalid URLs
This fixes:
- Client-side URL redirect vulnerability
- DOM text reinterpreted as HTML
- Client-side cross-site scripting (XSS)
* fix: add character limit to prevent terminal output context explosion
- Enhanced truncateOutput function to accept character limits alongside line limits
- Character limits take priority over line limits to prevent context window explosion
- Added terminalOutputCharacterLimit setting (default: 100,000 characters)
- Updated all terminal output processing to use both limits
- Added comprehensive tests for character limit functionality
Fixes#5775
* feat: add terminal output character limit setting to UI
- Add character limit slider to Terminal Settings UI (default: 50,000)
- Update ExtensionStateContext to manage character limit state
- Add validation for positive character limit values
- Add English translation and translations for all 17 supported languages
- Connect UI to backend through proper message handling
- Character limit takes precedence over line limit to prevent memory issues
* fix: update test expectations for character limit edge cases
- Fix multi-byte character test to account for JavaScript's string length behavior
- Fix newline content test to match actual slice behavior
- Tests now correctly validate the truncateOutput function's character limit handling
---------
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Daniel Riccio <ricciodaniel98@gmail.com>
* feat: add Mistral embedding provider with OpenAI Compatible Wrapper
- Implement MistralEmbedder class using OpenAI-compatible API
- Add comprehensive unit tests with 100% coverage
- Update type definitions for Mistral provider support
- Integrate Mistral option in UI components and configuration
- Add internationalization support for Mistral provider
- Fix API key storage and retrieval for embedding providers
- Update service factory to support Mistral embeddings
- Add proper error handling and validation
This implementation allows users to use Mistral's embedding models
through the existing OpenAI-compatible wrapper approach, providing
a seamless integration experience.
* feat: add Mistral embedding provider support
- Implement MistralEmbedder class with API integration
- Add Mistral models to embedding model configurations
- Update UI to include Mistral provider option
- Add comprehensive unit tests for Mistral embedder
- Update type definitions and interfaces
- Add internationalization support for Mistral provider
* fix: add missing translations for Mistral embedding provider
* fix: address PR review feedback - improve translations and add clarifying comment
feat: add batch limiting to code indexer to control memory usage
- Add MAX_PENDING_BATCHES constant (20) to limit concurrent batches
- Implement backpressure mechanism to pause file parsing when limit reached
- Prevent memory overflow during large codebase indexing
* feat: add global rate limiting for OpenAI-compatible embeddings
- Implement shared rate limit state across all embedder instances
- Add exponential backoff (5s base, up to 5 minutes max)
- Track consecutive rate limit errors with auto-reset after 60s
- Add thread-safe mutex for concurrent access
- Remove verbose logging to prevent log flooding during retries
- Add comprehensive test coverage for rate limiting behavior
This prevents multiple parallel batches from overwhelming APIs with
restrictive rate limits by coordinating delays globally.
* fix: restore original logging while keeping rate limit logging silent
- Restored all original console.warn and console.error calls that were inadvertently removed
- Only the rate limit retry warning remains silent (no console output)
- Fixed test expectation to use correct error variable
- All existing logging behavior is preserved
* feat: add configurable delay for Go diagnostics to prevent premature error reporting
- Add diagnosticsDelayMs setting (default: 2000ms) to allow linters time to process
- Add diagnosticsEnabled setting to optionally disable diagnostic checking entirely
- Update DiffViewProvider.saveChanges() to use configurable delay before checking diagnostics
- Update all tool files (writeToFile, searchAndReplace, insertContent, applyDiff, multiApplyDiff) to pass diagnostic settings
- Add comprehensive tests for new diagnostic functionality
- Fixes issue where Go diagnostics errors were submitted to LLM before linter could clean up unused imports
Resolves#5859
* fix: add missing TypeScript type definitions for diagnostic settings
- Add diagnosticsDelayMs and diagnosticsEnabled to globalSettingsSchema
- Include properties in ExtensionState Pick type
- Add default values to EVALS_SETTINGS
- Fix VSCode mock to include DiagnosticSeverity for tests
- Resolves compilation errors in ClineProvider and webviewMessageHandler
* fix: update test mocks to support diagnostic settings in tool tests
- Add providerRef mock to insertContentTool and writeToFileTool tests
- Update mocks to include diagnosticsEnabled and diagnosticsDelayMs settings
- Fix test expectations to match new implementation with diagnostic configuration
- Resolves failing unit tests for insertContentTool.spec.ts and writeToFileTool.spec.ts
* fix: remove package-lock.json file (project uses pnpm)
* refactor: use existing writeDelayMs instead of diagnosticsDelayMs
- Remove diagnosticsDelayMs setting in favor of existing writeDelayMs
- Add min(0) validation for writeDelayMs in global settings schema
- Add error handling around delay function calls in DiffViewProvider
- Create DEFAULT_WRITE_DELAY_MS constant (1000ms) to replace repeated defaults
- Update all tool files to pass writeDelayMs instead of diagnosticsDelayMs
- Remove diagnosticsDelayMs from webview message handlers and types
- Update test files to use writeDelayMs instead of diagnosticsDelayMs
This refactoring consolidates diagnostic delay functionality to use the
existing writeDelayMs setting as requested in PR feedback.
* fix: resolve failing unit tests and TypeScript compilation errors
- Fix DiffViewProvider test to expect correct default delay (1000ms instead of 2000ms)
- Fix TypeScript type errors in ClineProvider test mock state object
- Correct terminalPowershellCounter and terminalZdotdir types to boolean
- Fix pinnedApiConfigs type from array to Record<string, boolean>
* fix: remove unrelated changes from ClineProvider.spec.ts
- Removed extensive unrelated property additions to mock state
- Kept only diagnosticsEnabled property which is related to Go diagnostics delay feature
- Removed unused DEFAULT_WRITE_DELAY_MS import
- Restored original structure and organization of mock state object
This addresses the feedback to remove unrelated changes while preserving
the necessary diagnostic functionality for the Go diagnostics delay feature.
* refactor: move DEFAULT_WRITE_DELAY_MS to packages/types/src/global-settings.ts
- Move DEFAULT_WRITE_DELAY_MS constant from src/shared/constants.ts to packages/types/src/global-settings.ts
- Update all import statements in affected files to use @roo-code/types
- Delete src/shared/constants.ts file as it is no longer needed
- Files updated:
- src/integrations/editor/DiffViewProvider.ts
- src/core/webview/ClineProvider.ts
- src/core/tools/multiApplyDiffTool.ts
- src/core/tools/applyDiffTool.ts
- src/core/tools/searchAndReplaceTool.ts
- src/core/tools/insertContentTool.ts
- src/core/tools/writeToFileTool.ts
---------
Co-authored-by: Roo Code <roomote@roocode.com>
* fix: detect Claude models by name for API protocol selection
- Modified getApiProtocol to accept modelId parameter
- Added check for 'claude' in model name (case-insensitive)
- Updated Task.ts to pass model ID to getApiProtocol
- Added comprehensive tests for the new logic
Fixes#5830
* fix: limit Claude model detection to vertex and bedrock providers only
- Modified getApiProtocol to only detect Claude models by name when provider is vertex or bedrock
- Added comprehensive unit tests for getApiProtocol function as requested in PR review
- This ensures Claude models are only auto-detected for providers that need it
* improved chat row first pass
* big UI improvements
* working functionality
* tests working
* ok finally tests working for real!
* translations
* add back hidden flag
* remove option to skip notif
* fixed image issue
* ui fix
* put back edit flag
* oops test fix
* reduce margins
* code review
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
Co-authored-by: Daniel Riccio <ricciodaniel98@gmail.com>
Co-authored-by: Daniel <57051444+daniel-lxs@users.noreply.github.com>
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
Co-authored-by: Daniel Riccio <ricciodaniel98@gmail.com>
Co-authored-by: Daniel <57051444+daniel-lxs@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Daniel <57051444+daniel-lxs@users.noreply.github.com>
Co-authored-by: Daniel Riccio <ricciodaniel98@gmail.com>
