Merge branch 'main' into feat/172-opencode-go

Author: navedmerchant

.changeset/vertex-credentials-field-validation.md

@@ -0,0 +1,5 @@
+---
+"zoo-code": patch
+---
+
+Detect when the "Google Cloud Credentials" Vertex field has been given a filesystem path instead of the raw JSON contents of a service-account key file. The runtime now skips JSON.parse for path-shaped input, logs a single specific console warning naming the sibling "Google Cloud Key File Path" field and `GOOGLE_APPLICATION_CREDENTIALS` env var, and the settings UI shows an inline warning under the field while the input still looks like a path. Auth behavior is unchanged for correctly-configured users.

package.json

@@ -34,7 +34,7 @@
 		"@types/glob": "^9.0.0",
 		"@types/node": "^24.1.0",
 		"@vscode/vsce": "3.3.2",
-		"esbuild": "^0.25.0",
+		"esbuild": "0.28.0",
 		"eslint": "^9.27.0",
 		"glob": "^11.1.0",
 		"husky": "^9.1.7",
@@ -60,7 +60,9 @@
 		],
 		"overrides": {
 			"tar-fs": ">=3.1.1",
-			"esbuild": ">=0.25.0",
+			"esbuild": "0.28.0",
+			"rollup": "4.60.4",
+			"vite": "8.0.14",
 			"undici": ">=5.29.0",
 			"form-data": ">=4.0.4",
 			"bluebird": ">=3.7.2",

packages/core/src/message-utils/__tests__/safeJsonParse.spec.ts

@@ -0,0 +1,43 @@
+// npx vitest run packages/core/src/message-utils/__tests__/safeJsonParse.spec.ts
+
+import { safeJsonParse } from "../safeJsonParse.js"
+
+describe("safeJsonParse", () => {
+	let consoleErrorSpy: ReturnType<typeof vi.spyOn>
+
+	beforeEach(() => {
+		consoleErrorSpy = vi.spyOn(console, "error").mockImplementation(() => {})
+	})
+
+	afterEach(() => {
+		consoleErrorSpy.mockRestore()
+	})
+
+	it("returns the parsed value for valid JSON", () => {
+		expect(safeJsonParse<{ a: number }>('{"a":1}')).toEqual({ a: 1 })
+		expect(consoleErrorSpy).not.toHaveBeenCalled()
+	})
+
+	it("returns the default value for null, undefined, or empty input", () => {
+		expect(safeJsonParse<string>(null, "fallback")).toBe("fallback")
+		expect(safeJsonParse<string>(undefined, "fallback")).toBe("fallback")
+		expect(safeJsonParse<string>("", "fallback")).toBe("fallback")
+		expect(consoleErrorSpy).not.toHaveBeenCalled()
+	})
+
+	it("returns the default value and logs the generic message when no context is given (backward compatible)", () => {
+		const result = safeJsonParse<{ a: number }>("not json", undefined)
+		expect(result).toBeUndefined()
+		expect(consoleErrorSpy).toHaveBeenCalledTimes(1)
+		const message = consoleErrorSpy.mock.calls[0]?.[0]
+		expect(message).toBe("Error parsing JSON:")
+	})
+
+	it("includes the context label in the error log when provided", () => {
+		const result = safeJsonParse<{ a: number }>("not json", undefined, "foo")
+		expect(result).toBeUndefined()
+		expect(consoleErrorSpy).toHaveBeenCalledTimes(1)
+		const message = consoleErrorSpy.mock.calls[0]?.[0]
+		expect(message).toBe("Error parsing JSON (foo):")
+	})
+})

packages/core/src/message-utils/safeJsonParse.ts

@@ -3,9 +3,16 @@
  *
  * @param jsonString The string to parse
  * @param defaultValue Value to return if parsing fails
+ * @param context Optional label included in the error log so callers can be
+ *   identified when something other than valid JSON is supplied (e.g. a user
+ *   pasting a file path into a JSON field).
  * @returns Parsed JSON object or defaultValue if parsing fails
  */
-export function safeJsonParse<T>(jsonString: string | null | undefined, defaultValue?: T): T | undefined {
+export function safeJsonParse<T>(
+	jsonString: string | null | undefined,
+	defaultValue?: T,
+	context?: string,
+): T | undefined {
 	if (!jsonString) {
 		return defaultValue
 	}
@@ -14,7 +21,7 @@ export function safeJsonParse<T>(jsonString: string | null | undefined, defaultV
 		return JSON.parse(jsonString) as T
 	} catch (error) {
 		// Log the error to the console for debugging.
-		console.error("Error parsing JSON:", error)
+		console.error(`Error parsing JSON${context ? ` (${context})` : ""}:`, error)
 		return defaultValue
 	}
 }

packages/types/src/__tests__/looksLikeFilePath.spec.ts

@@ -0,0 +1,48 @@
+// npx vitest run src/__tests__/looksLikeFilePath.spec.ts
+
+import { looksLikeFilePath } from "../utils/looksLikeFilePath.js"
+
+describe("looksLikeFilePath", () => {
+	describe("nullish, empty, and whitespace-only input", () => {
+		it.each([
+			["undefined", undefined],
+			["null", null],
+			["empty string", ""],
+			["whitespace only", "   \t\n  "],
+		])("returns false for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(false)
+		})
+	})
+
+	describe("path-shaped input", () => {
+		it.each([
+			["Windows backslash path", "C:\\Users\\dev\\sa.json"],
+			["Windows forward-slash path", "C:/Users/dev/sa.json"],
+			["Windows drive lowercase", "d:\\creds.json"],
+			["POSIX absolute path", "/home/dev/sa.json"],
+			["POSIX absolute root /tmp", "/tmp/creds.json"],
+			["POSIX home path", "~/sa.json"],
+			["POSIX relative ./", "./sa.json"],
+			["POSIX relative ../", "../secrets/sa.json"],
+		])("returns true for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(true)
+		})
+
+		it("returns true after trimming surrounding whitespace", () => {
+			expect(looksLikeFilePath("  /tmp/creds.json  ")).toBe(true)
+			expect(looksLikeFilePath("\tC:\\sa.json\n")).toBe(true)
+		})
+	})
+
+	describe("JSON-shaped or bare-token input", () => {
+		it.each([
+			["JSON object", '{"type":"service_account","client_email":"x@y.z"}'],
+			["JSON array", "[1,2,3]"],
+			["JSON with leading whitespace", '   {"type":"service_account"}'],
+			["bare token", "not-json-and-not-a-path"],
+			["service-account-style email", "sa@project.iam.gserviceaccount.com"],
+		])("returns false for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(false)
+		})
+	})
+})

packages/types/src/index.ts

@@ -33,3 +33,5 @@ export * from "./vscode.js"
 export * from "./worktree.js"
 
 export * from "./providers/index.js"
+
+export * from "./utils/looksLikeFilePath.js"

packages/types/src/providers/fireworks.ts

@@ -5,6 +5,7 @@ export type FireworksModelId =
 	| "accounts/fireworks/models/kimi-k2-instruct-0905"
 	| "accounts/fireworks/models/kimi-k2-thinking"
 	| "accounts/fireworks/models/kimi-k2p5"
+	| "accounts/fireworks/models/kimi-k2p6"
 	| "accounts/fireworks/models/minimax-m2"
 	| "accounts/fireworks/models/minimax-m2p1"
 	| "accounts/fireworks/models/qwen3-235b-a22b-instruct-2507"
@@ -13,10 +14,12 @@ export type FireworksModelId =
 	| "accounts/fireworks/models/deepseek-v3"
 	| "accounts/fireworks/models/deepseek-v3p1"
 	| "accounts/fireworks/models/deepseek-v3p2"
+	| "accounts/fireworks/models/deepseek-v4-pro"
 	| "accounts/fireworks/models/glm-4p5"
 	| "accounts/fireworks/models/glm-4p5-air"
 	| "accounts/fireworks/models/glm-4p6"
 	| "accounts/fireworks/models/glm-4p7"
+	| "accounts/fireworks/models/glm-5p1"
 	| "accounts/fireworks/models/gpt-oss-20b"
 	| "accounts/fireworks/models/gpt-oss-120b"
 	| "accounts/fireworks/models/llama-v3p3-70b-instruct"
@@ -240,4 +243,37 @@ export const fireworksModels = {
 		description:
 			"Llama 4 Scout is a smaller, faster variant of Llama 4 with multimodal capabilities, ideal for quick iterations and cost-effective deployments.",
 	},
+	"accounts/fireworks/models/kimi-k2p6": {
+		maxTokens: 16384,
+		contextWindow: 262144,
+		supportsImages: true,
+		supportsPromptCache: true,
+		inputPrice: 0.95,
+		outputPrice: 4.0,
+		cacheReadsPrice: 0.16,
+		description:
+			"Kimi K2.6 is Moonshot AI's latest flagship agentic model, building on K2.5 with stronger long-horizon reasoning, multi-step tool use, and unified vision/text understanding.",
+	},
+	"accounts/fireworks/models/deepseek-v4-pro": {
+		maxTokens: 16384,
+		contextWindow: 1048576,
+		supportsImages: false,
+		supportsPromptCache: true,
+		inputPrice: 1.74,
+		outputPrice: 3.48,
+		cacheReadsPrice: 0.14,
+		description:
+			"DeepSeek V4 Pro is the latest iteration of the DeepSeek model family, with improved reasoning, code generation, and instruction following over the V3 series.",
+	},
+	"accounts/fireworks/models/glm-5p1": {
+		maxTokens: 25344,
+		contextWindow: 202752,
+		supportsImages: false,
+		supportsPromptCache: true,
+		inputPrice: 1.4,
+		outputPrice: 4.4,
+		cacheReadsPrice: 0.26,
+		description:
+			"Z.ai GLM-5.1 is the latest coding-focused model in the GLM family, with exceptional performance on complex programming tasks and enhanced reasoning and code generation quality.",
+	},
 } as const satisfies Record<string, ModelInfo>

packages/types/src/utils/looksLikeFilePath.ts

@@ -0,0 +1,24 @@
+// Returns true when a string is shaped like a filesystem path (Windows
+// drive-letter, POSIX absolute, POSIX home, POSIX relative). Pure and
+// dependency-free so it can be shared between the extension runtime (e.g.
+// parseVertexJsonCredentials) and the webview UI (e.g. the Vertex settings
+// warning), guaranteeing both surfaces agree on what "looks like a path"
+// means.
+//
+// Returns false for nullish, empty, and whitespace-only input — neither
+// call site should warn in those cases.
+export function looksLikeFilePath(value: string | null | undefined): boolean {
+	if (value == null) {
+		return false
+	}
+	const trimmed = value.trim()
+	if (!trimmed) {
+		return false
+	}
+	return (
+		/^[A-Za-z]:[\\/]/.test(trimmed) || // Windows: C:\... or C:/...
+		trimmed.startsWith("/") || // POSIX absolute: /home/...
+		trimmed.startsWith("~") || // POSIX home: ~/...
+		trimmed.startsWith(".") // POSIX relative: ./... or ../...
+	)
+}