scriptoriumadmin/Roo-Code
1
0
Fork 0
mirror of https://github.com/RooVetGit/Roo-Code.git synced 2026-08-28 05:27:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
5799 commits 2166 branches 585 tags 928 MiB
Commit graph

5799 commits

This branch
This branch
All branches
Author SHA1 Message Date
daniel-lxs
3d796de327
security: fix host injection vulnerability in URL validation 
- Replace dangerous substring check webviewUri.includes('vscode-cdn.net')
- Add proper URL host validation using URL constructor
- Check url.host === 'vscode-cdn.net' to prevent injection via paths/queries
- Graceful fallback when URL parsing fails
- Addresses final CodeQL warning for incomplete URL substring sanitization
 2025-10-27 14:33:42 -05:00
daniel-lxs
a1c402e77b
security: harden URL parsing against ReDoS and injection attacks 
- Add strict prefix validation: require vscode-resource://vscode-webview/ prefix
- Add URI length limits (max 2048 chars) to prevent DoS
- Replace potentially vulnerable regex with bounded, anchored patterns
- Use ^ and $ anchors to prevent partial matches
- Limit character classes to prevent backtracking (e.g., [a-zA-Z0-9._-]{1,50})
- Add proper error handling for decode failures
- Addresses CodeQL warnings for polynomial regex and incomplete URL sanitization
 2025-10-27 14:26:28 -05:00
daniel-lxs
7029f1d6f8
security: fix polynomial regex and improve URL sanitization in imageDataUrl.ts 
- Replace potentially polynomial regex /(?:Users|C:)([^?#]+\.(?:png|jpg|jpeg|gif|webp))/i
- Split into separate bounded patterns for Unix and Windows paths
- Add length limit {0,500} to prevent ReDoS attacks
- Improve URL substring sanitization for vscode-userdata and vscode-cdn.net URIs
- Addresses GitHub CodeQL security warnings for polynomial regex vulnerability
 2025-10-27 14:24:06 -05:00
daniel-lxs
32b708592d
optimize: implement efficient approach for PR #8225 - store base64 directly in backend messages 
- Remove unnecessary memory caching logic
- Store base64 data URLs directly in ClineMessage.images[] and ApiMessage content when first received
- Eliminate conversion overhead at API call time (base64 already available)
- Keep frontend memory efficient with webview URIs for display
- Much simpler and more efficient than caching approach
- One-time conversion: webview URI → base64 when storing in backend
- API calls use pre-stored base64 directly (no file I/O or conversion needed)

This achieves PR goals with optimal performance: frontend memory efficiency + instant API calls
 2025-10-27 13:42:41 -05:00
daniel-lxs
e7531e5b6e
fix: complete PR #8225 - add missing webview URI to base64 conversion 
- Add normalizeImageRefsToDataUrls() function to convert webview URIs to base64 data URLs
- Add formatImagesIntoBlocksAsync() for async image processing in backend
- Update Task.ts to use async conversion when storing images in backend messages
- Backend now stores base64 (for API calls), frontend displays webview URIs (memory efficient)
- Fixes OpenRouter and other providers not being able to see attached images
- Maintains PR goals: webview memory efficiency + working image functionality
 2025-10-27 12:42:27 -05:00
Daniel
f34243e1c9
Merge branch 'main' into feat/webview-image-uri 2025-09-25 18:36:43 -05:00
Daniel
87d50a78cb
refactor: remove pr-reviewer mode (#8222) 2025-09-25 17:44:49 -05:00
Bruno Bergher
7fd01ab2a0
wip: Website Improvements (#8303) 
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
 2025-09-25 16:31:04 -04:00
Matt Rubens
8485548f53
Show the Roo provider on the welcome screen (#8317) 2025-09-25 16:13:04 -04:00
John Costa
a0d6a4b4f9
removing user hint when refreshing models (#7710) 2025-09-25 15:22:16 -04:00
Hannes Rudolph
ab0644d367
Correct tool use suggestion to improve model adherence to suggestion (#8315) 
* Correct tool use suggestion to improve model adherence to suggestion

* tweak
 2025-09-25 11:53:31 -06:00
roomote[bot]
d959e88a97
feat: Add telemetry tracking to DismissibleUpsell component (#8309) 
* feat: add telemetry tracking to DismissibleUpsell component

- Added UPSELL_DISMISSED and UPSELL_CLICKED events to TelemetryEventName enum
- Updated DismissibleUpsell component to track clicks and dismissals with telemetry
- Added telemetry tests to DismissibleUpsell test suite
- Events include upsellId in the payload for tracking specific upsells

* refactor(webview): make handleDismiss synchronous in DismissibleUpsell

test(webview): add scenario where dismissOnClick=true without onClick tracks only UPSELL_DISMISSED; update tests; all tests passing locally

---------

Co-authored-by: Roo Code <roomote@roocode.com>
 2025-09-25 13:29:43 -04:00
roomote[bot]
43c1de0d7e
feat: log out from cloud when resetting extension state (#8312) 
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
 2025-09-25 12:24:46 -04:00
github-actions[bot]
bf1aafad9b
Changeset version bump (#8306) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
 2025-09-25 10:25:30 -04:00
Matt Rubens
37a175c4ed
Release v3.28.8 (#8305) 2025-09-25 10:15:34 -04:00
Matt Rubens
b75f8dd274
Add a couple more free models to the Roo provider (#8304) 2025-09-25 10:00:40 -04:00
Hannes Rudolph
798801d582
Fix frequent "No tool used" errors by clarifying tool-use rules (#8292) 2025-09-25 09:24:46 -04:00
Hannes Rudolph
2f1b94f430
fix: include initial ask in condense summarization (#8293) (#8298) 
* fix: include initial ask in condense summarization (#8293)

---------

Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
 2025-09-24 23:14:44 -06:00
Matt Rubens
d3d0967fc3
Show cloud switcher and option to add a team when logged in (#8291) 2025-09-24 16:42:06 -04:00
Chris Estreich
25f61943ca
Set port 3446 for web-evals in production mode (#8288) 2025-09-24 08:43:05 -07:00
Bruno Bergher
205f3e4242
web: Opengraph image (#8285) 
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
 2025-09-24 09:18:55 -04:00
github-actions[bot]
8dbd8c4b1b
Changeset version bump (#8271) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
 2025-09-23 19:14:03 -04:00
Matt Rubens
c5269f3262
chore: add changeset for v3.28.7 (#8268) 2025-09-23 18:59:42 -04:00
Matt Rubens
fc4ee93585
Remove org switcher tooltip (#8269) 2025-09-23 18:59:06 -04:00
Bruno Bergher
d8dd19a6ed
ux: Collapse thinking blocks by default (but control all of them with a keyboard shortcut) (#8254) 
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
 2025-09-23 18:48:04 -04:00
roomote[bot]
35791d03d3
fix: checkpoint restore popover positioning issue (#8219) (#8220) 
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
 2025-09-23 18:35:46 -04:00
Matt Rubens
0682629ac8
Cloud account switcher (#8223) 
* Cloud account switcher

* Bare metal evals fixes (#8224)

Co-authored-by: Roo Code <roomote@roocode.com>

* Rounded icons in chat account switcher

* Visual tweaks to CloudView

* Remove hardcoded timeout

* Safer check

* PR feedback

* Fix test

* Check for org mismatches in handleCredentialsChange

* Cloud: use the existing auth event flow to handle org switching

* Cleanup: broadcast() might be confusingly named.

---------

Co-authored-by: Chris Estreich <cestreich@gmail.com>
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Bruno Bergher <bruno@roocode.com>
Co-authored-by: John Richmond <5629+jr@users.noreply.github.com>
 2025-09-23 18:18:28 -04:00
roomote[bot]
382ab63ea1
feat: add zai-org/GLM-4.5-turbo model to Chutes provider (#8157) 
Co-authored-by: Roo Code <roomote@roocode.com>
 2025-09-23 17:33:44 -04:00
daniel-lxs
ab402bf1d9
fix: improve vscode-cdn.net URL validation and add copy action check 
- Fixed CodeQL security issue by properly validating vscode-cdn.net domain instead of substring check
- Added missing copy action check for HTTPS/vscode-cdn URLs before opening image
- Updated tests to match the more secure URL validation logic
 2025-09-23 15:06:27 -05:00
daniel-lxs
b10c87422a
feat: add clipboard copy functionality to openImage for file paths 2025-09-23 14:57:26 -05:00
daniel-lxs
addd1bc6e7
feat: enhance openImage function to handle vscode webview CDN URLs 2025-09-23 14:53:09 -05:00
Matt Rubens
f47a2b8b1d
Add image for 3.28.5 (#8266) 2025-09-23 14:19:35 -04:00
github-actions[bot]
44cbee5e75
Changeset version bump (#8262) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
 2025-09-23 14:02:01 -04:00
Matt Rubens
606167209d
chore: add changeset for v3.28.6 (#8263) 2025-09-23 13:54:18 -04:00
Chris Estreich
19c36068cb
Follow-up questions should trigger the "interactive" state (#8259) 2025-09-23 13:47:00 -04:00
Matt Rubens
8e9a266256
chore: add changeset for v3.28.6 (#8261) 2025-09-23 13:43:44 -04:00
Daniel
1a4fb7f91c
feat(types): add GPT-5-Codex model (#8260) 2025-09-23 13:35:44 -04:00
roomote[bot]
807cc999a5
feat: add package.nls.json checking to find-missing-translations script (#8255) 
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
 2025-09-23 11:10:23 -04:00
roomote[bot]
12f94fc727
fix: respect Ollama Modelfile num_ctx configuration (#7798) 
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Hannes Rudolph <hrudolph@gmail.com>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
 2025-09-22 23:08:09 -04:00
roomote[bot]
60ba5411b7
fix: prevent checkpoint text from wrapping in non-English languages (#8207) 
Co-authored-by: Roo Code <roomote@roocode.com>
 2025-09-22 23:02:43 -04:00
Daniel
9dabb85007
Fix: Improve reasoning block formatting for better readability (#7868) 2025-09-22 23:02:11 -04:00
Chris Estreich
0e1b23d09c
Bare metal evals fixes (#8224) 
Co-authored-by: Roo Code <roomote@roocode.com>
 2025-09-22 12:54:56 -07:00
daniel-lxs
e71ec43d0b
webview: never render base64; render backend-saved image URIs; allow globalStorage URIs; fix 401 2025-09-22 14:46:36 -05:00
Bruno Bergher
6c2aa63cfd
feat: Add keyboard shortcut for toggling auto-approve (Cmd/Ctrl+Alt+A) (#8214) 
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
Co-authored-by: Roo Code <roomote@roocode.com>
Co-authored-by: Matt Rubens <mrubens@users.noreply.github.com>
 2025-09-22 11:26:29 -04:00
Matt Rubens
6a4dab0dfa
Remove language selection and word wrap toggle from CodeBlock (#8208) 2025-09-21 23:05:08 -04:00
github-actions[bot]
ceb9d2b9f2
Changeset version bump (#8199) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-09-20 14:29:01 -07:00
Matt Rubens
95e42350d0
Release v3.28.5 (#8198) 
chore: add changeset for v3.28.5
 2025-09-20 16:33:28 -04:00
Matt Rubens
32d7e6f2ad
Add an announcement for Supernova (#8197) 
* Add an announcement for Supernova

* Remove duplicate keys
 2025-09-20 16:28:28 -04:00
Matt Rubens
1533efc1ea
Wrap code blocks by default (#8194) 2025-09-20 12:08:09 -04:00
Hannes Rudolph
d956cdb727
Fix duplicate rehydrate during reasoning; centralize rehydrate and preserve cancel metadata (#8171) 
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
 2025-09-20 00:34:21 -04:00